add authentik-outpost helm chart

charts/authentik-outpost/.helmignore

@@ -0,0 +1,29 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+# Changelog
+CHANGELOG.md
+# additional files
+README.md
+tests/
+*.ignore.yaml

charts/authentik-outpost/CHANGELOG.md

@@ -0,0 +1 @@
+# Changelog

charts/authentik-outpost/Chart.yaml

@@ -0,0 +1,12 @@
+name: authentik-outpost
+version: 0.1.0
+appVersion: "2026.2.6"
+apiVersion: v2
+description: A Helm chart for deploying a manual Authentik Proxy Outpost
+type: application
+sources:
+  - https://github.com/code-tool/helm-charts/tree/main/charts/authentik-outpost
+dependencies:
+  - name: common
+    repository: https://code-tool.github.io/helm-charts
+    version: 0.x.x

charts/authentik-outpost/README.md

@@ -0,0 +1 @@
+# Authentik Outpost

charts/authentik-outpost/README.md.gotmpl

@@ -0,0 +1,25 @@
+# Authentik Outpost Helm Chart
+
+This chart deploys a [manual Authentik Proxy Outpost](https://docs.goauthentik.io/add-secure-apps/outposts/) to your Kubernetes cluster.
+
+## Prerequisites
+
+- A running [Authentik](https://goauthentik.io) instance
+- An Authentik Outpost token (generated from the Authentik UI under System → Outposts)
+
+## Installation
+
+```bash
+helm repo add code-tool https://code-tool.github.io/helm-charts
+helm repo update
+
+helm install authentik-outpost code-tool/authentik-outpost \
+  --set authentik.host=https://accounts.example.com \
+  --set authentik.token=your-outpost-token
+```
+
+## Configuration
+
+The following table lists the configurable parameters of the chart and their default values.
+
+{{ template "chart.valuesSection" . }}

charts/authentik-outpost/templates/deployment.yaml

@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+spec:
+  replicas: {{.Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "common.labels.matchLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "common.labels.matchLabels" . | nindent 8 }}
+    spec:
+      containers:
+        - name: proxy
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{.Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+            - name: https
+              containerPort: 9443
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: {{ .Values.authentik.existingSecretName | default (include "common.names.fullname" .) }}
+          livenessProbe:  
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with.Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with.Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with.Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/authentik-outpost/templates/ingress.yaml

@@ -0,0 +1,46 @@
+{{- if .Values.ingress.enabled }}
+{{- if empty .Values.ingress.whitelistSourceRange }}
+{{- fail "whitelistSourceRange cannot be empty"}}
+{{- end }}
+{{- if empty .Values.ingress.host }}
+{{- fail "ingress.host cannot be empty when ingress is enabled" }}
+{{- end }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  annotations:
+    nginx.ingress.kubernetes.io/whitelist-source-range: {{ join "," .Values.ingress.whitelistSourceRange | quote }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: nginx
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host }}
+      http:
+        paths:
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "common.names.fullname" . }}
+                port:
+                  name: http
+    {{- range .Values.ingress.extraHosts }}
+    - host: {{ . }}
+      http:
+        paths:
+          - path: /outpost.goauthentik.io
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "common.names.fullname" . }}
+                port:
+                  name: http
+    {{- end }}
+{{- end }}

charts/authentik-outpost/templates/secret.yaml

@@ -0,0 +1,13 @@
+{{- if not .Values.authentik.existingSecretName }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+type: Opaque
+data:
+  AUTHENTIK_HOST: {{ .Values.authentik.host | b64enc | quote }}
+  AUTHENTIK_TOKEN: {{ .Values.authentik.token | b64enc | quote }}
+  AUTHENTIK_INSECURE: {{.Values.authentik.insecure | toString | b64enc | quote }}
+{{- end }}

charts/authentik-outpost/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "common.names.fullname" . }}
+  labels:
+    {{- include "common.labels.standard" . | nindent 4 }}
+spec:
+  type: {{.Values.service.type }}
+  ports:
+    - port: {{.Values.service.portHttp }}
+      targetPort: http
+      protocol: TCP
+      name: http
+    - port: {{.Values.service.portHttps }}
+      targetPort: https
+      protocol: TCP
+      name: https
+  selector:
+    {{- include "common.labels.matchLabels" . | nindent 4 }}

charts/authentik-outpost/tests/go.mod

@@ -0,0 +1,69 @@
+module tests
+
+go 1.21
+
+require (
+	github.com/gruntwork-io/terratest v0.46.7
+	github.com/stretchr/testify v1.8.4
+)
+
+require (
+	github.com/aws/aws-sdk-go v1.44.122 // indirect
+	github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.9.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-errors/errors v1.0.2-0.20180813162953-d98b870cc4e0 // indirect
+	github.com/go-logr/logr v1.2.3 // indirect
+	github.com/go-openapi/jsonpointer v0.19.6 // indirect
+	github.com/go-openapi/jsonreference v0.20.1 // indirect
+	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-sql-driver/mysql v1.4.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/gnostic v0.5.7-v3refs // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/gruntwork-io/go-commons v0.8.0 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.0 // indirect
+	github.com/imdario/mergo v0.3.11 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattn/go-zglob v0.0.2-0.20190814121620-e3c945676326 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pquerna/otp v1.2.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/urfave/cli v1.22.2 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/oauth2 v0.7.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
+	golang.org/x/term v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
+	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/api v0.27.2 // indirect
+	k8s.io/apimachinery v0.27.2 // indirect
+	k8s.io/client-go v0.27.2 // indirect
+	k8s.io/klog/v2 v2.90.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect
+	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
+)