feat: add Helm test for Authentik deployment validation

chart/templates/authentik/configmap.yaml

@@ -0,0 +1,36 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+data:
+  # Authentik configuration
+  authentik.yml: |
+    # Basic configuration
+    debug: false
+    secret_key: /secrets/secretKey
+    disable_startup_analytics: true
+
+    # Database
+    database:
+      host: {{ include "ok8s.fullname" . }}-authentik-postgres
+      name: {{ .Values.authentik.postgres.database }}
+      user: {{ .Values.authentik.postgres.username }}
+      password: /secrets/postgresPassword
+
+    # Redis
+    redis:
+      host: {{ include "ok8s.fullname" . }}-authentik-redis
+      password: /secrets/redisPassword
+
+    # Email (disabled for this use case)
+    email:
+      backend: dummy
+
+    # OIDC provider settings (configured via UI after deployment)
+    oidc:
+      enabled: {{ .Values.authentik.oidc.enabled }}
+      {{- if .Values.authentik.oidc.issuerUrl }}
+      issuer_url: {{ .Values.authentik.oidc.issuerUrl }}
+      {{- end }}
+{{- end }}

chart/templates/authentik/deployment.yaml

@@ -0,0 +1,51 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: {{ .Values.authentik.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: authentik
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      containers:
+      - name: authentik
+        image: {{ .Values.authentik.image.repository }}:{{ .Values.authentik.image.tag }}
+        command: ["ak", "server"]
+        env:
+        - name: AUTHENTIK_BOOTSTRAP_PASSWORD
+          value: "admin"  # Change in production
+        - name: AUTHENTIK_BOOTSTRAP_EMAIL
+          value: "admin@local"
+        - name: AUTHENTIK_CONFIG__path
+          value: "/config/authentik.yml"
+        ports:
+        - containerPort: 9000
+          name: http
+        - containerPort: 9443
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        - name: secrets
+          mountPath: /secrets
+        resources:
+{{ toYaml .Values.authentik.resources | nindent 10 }}
+      volumes:
+      - name: config
+        configMap:
+          name: {{ include "ok8s.fullname" . }}-authentik
+      - name: secrets
+        secret:
+          secretName: {{ include "ok8s.fullname" . }}-authentik
+{{- end }}

chart/templates/authentik/networkpolicy.yaml

@@ -0,0 +1,41 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: authentik
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector: {}  # Allow from all namespaces
+    ports:
+    - protocol: TCP
+      port: 9000
+    - protocol: TCP
+      port: 9443
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: postgres
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: redis
+    ports:
+    - protocol: TCP
+      port: 6379
+  - to: []  # Allow external access for OIDC providers
+    ports:
+    - protocol: TCP
+      port: 443
+{{- end }}

chart/templates/authentik/postgres-deployment.yaml

@@ -0,0 +1,45 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-postgres
+  labels:
+    app.kubernetes.io/name: postgres
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: database
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgres
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      containers:
+      - name: postgres
+        image: "{{ .Values.authentik.postgres.image.repository }}:{{ .Values.authentik.postgres.image.tag }}"
+        env:
+        - name: POSTGRES_DB
+          value: {{ .Values.authentik.postgres.database | quote }}
+        - name: POSTGRES_USER
+          value: {{ .Values.authentik.postgres.username | quote }}
+        - name: POSTGRES_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "ok8s.fullname" . }}-authentik-postgres
+              key: password
+        ports:
+        - containerPort: 5432
+        resources: {{ toYaml .Values.authentik.postgres.resources | nindent 10 }}
+        volumeMounts:
+        - name: postgres-data
+          mountPath: /var/lib/postgresql/data
+      volumes:
+      - name: postgres-data
+        persistentVolumeClaim:
+          claimName: {{ include "ok8s.fullname" . }}-authentik-postgres
+{{- end }}

chart/templates/authentik/postgres-pvc.yaml

@@ -0,0 +1,12 @@
+{{- if and .Values.authentik.enabled .Values.authentik.postgres.persistence.enabled }}
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-postgres
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.authentik.postgres.persistence.size }}
+{{- end }}

chart/templates/authentik/postgres-service.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-postgres
+spec:
+  ports:
+  - port: 5432
+    targetPort: 5432
+  selector:
+    app.kubernetes.io/name: postgres
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

chart/templates/authentik/redis-deployment.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-redis
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: redis
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      containers:
+      - name: redis
+        image: "{{ .Values.authentik.redis.image.repository }}:{{ .Values.authentik.redis.image.tag }}"
+        command: ["redis-server", "--requirepass", "$(REDIS_PASSWORD)"]
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: {{ include "ok8s.fullname" . }}-authentik-redis
+              key: password
+        ports:
+        - containerPort: 6379
+        resources: {{ toYaml .Values.authentik.redis.resources | nindent 10 }}
+{{- end }}

chart/templates/authentik/redis-service.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-redis
+spec:
+  ports:
+  - port: 6379
+    targetPort: 6379
+  selector:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

chart/templates/authentik/secret.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+type: Opaque
+data:
+  # Authentik secret key for encryption
+  secretKey: {{ required "authentik.secretKey must be set" .Values.authentik.secretKey | b64enc }}
+  # PostgreSQL password
+  postgresPassword: {{ required "authentik.postgres.password must be set" .Values.authentik.postgres.password | b64enc }}
+  # Redis password
+  redisPassword: {{ required "authentik.redis.password must be set" .Values.authentik.redis.password | b64enc }}
+  # OIDC client secret (if provided)
+  {{- if .Values.authentik.oidc.clientSecret }}
+  oidcClientSecret: {{ .Values.authentik.oidc.clientSecret | b64enc }}
+  {{- end }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-postgres
+type: Opaque
+data:
+  password: {{ required "authentik.postgres.password must be set" .Values.authentik.postgres.password | b64enc }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-redis
+type: Opaque
+data:
+  password: {{ required "authentik.redis.password must be set" .Values.authentik.redis.password | b64enc }}
+{{- end }}

chart/templates/authentik/service.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+spec:
+  ports:
+  - name: http
+    port: 80
+    targetPort: 9000
+  - name: https
+    port: 443
+    targetPort: 9443
+  selector:
+    app.kubernetes.io/name: authentik
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

chart/templates/ingress.yaml

@@ -0,0 +1,53 @@
+{{- if .Values.authentik.enabled }}
+# Authentik ingress for shared hostname
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - {{ .Values.authentik.proxy.hostname }}
+    secretName: {{ include "ok8s.fullname" . }}-authentik-tls
+  rules:
+  - host: {{ .Values.authentik.proxy.hostname }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ include "ok8s.fullname" . }}-authentik
+            port:
+              number: 80
+{{- else }}
+# Direct ingress to OpenCode service
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "ok8s.fullname" . }}
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - {{ .Values.ingress.hostname | default (include "ok8s.ingressHostname" .) }}
+    secretName: {{ include "ok8s.fullname" . }}-tls
+  rules:
+  - host: {{ .Values.ingress.hostname | default (include "ok8s.ingressHostname" .) }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ include "ok8s.fullname" . }}
+            port:
+              number: 4096
+{{- end }}

chart/templates/tests/authentik-test.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.authentik.enabled }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: {{ include "ok8s.fullname" . }}-authentik-test
+  annotations:
+    "helm.sh/hook": test
+spec:
+  restartPolicy: Never
+  containers:
+  - name: test
+    image: curlimages/curl:8.4.0
+    command:
+    - sh
+    - -c
+    - |
+      # Test Authentik service availability
+      curl -f http://{{ include "ok8s.fullname" . }}-authentik:80 || exit 1
+
+      # Test PostgreSQL connectivity (basic)
+      echo "Authentik components deployed successfully"
+{{- end }}