apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: authentik
  namespace: services
spec:
  chart: authentik
  repo: https://goauthentik.github.io/helm
  targetNamespace: services
  version: "2026.5.0"
  valuesContent: |
    authentik:
      existingSecret:
        secretName: authentik-env
    postgresql:
      enabled: true
      global:
        postgresql:
          auth:
            existingSecret: authentik-secrets
            secretKeys:
              adminPasswordKey: postgresql-password
              userPasswordKey: postgresql-password
      primary:
        persistence:
          size: 8Gi
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.researchstack.io/role
                    operator: In
                    values:
                      - core
        tolerations:
          - key: node-role.kubernetes.io/control-plane
            operator: Equal
            value: "true"
            effect: NoSchedule
    redis:
      enabled: true
      master:
        persistence:
          size: 2Gi
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.researchstack.io/role
                    operator: In
                    values:
                      - core
        tolerations:
          - key: node-role.kubernetes.io/control-plane
            operator: Equal
            value: "true"
            effect: NoSchedule
    server:
      nodeSelector:
        kubernetes.io/hostname: steamdeck
      resources:
        requests:
          memory: 256Mi
          cpu: 100m
        limits:
          memory: 512Mi
      service:
        # ClusterIP — Traefik reaches Authentik via cluster DNS through the
        # rs-auth Ingress (manifests/ingress/ingress.yaml). No NodePort needed.
        type: ClusterIP
    worker:
      nodeSelector:
        kubernetes.io/hostname: steamdeck
      resources:
        requests:
          memory: 256Mi
          cpu: 100m
        limits:
          memory: 512Mi
      service:
        type: ClusterIP