kubernetes helm chart fails without additional undocumented steps about authentik HOT 9 CLOSED

Hey, I've just looked into this and noticed that I've had monitoring.enabled set to true by default, which requires the Prometheus CRDs. I'll change the default to false. (Edit: I've just pushed an update to the helm chart to change this to false)

I'm not quite sure what the other errors are coming from, authentik does create some PVCs for uploads but it shouldn't cause any issues.

from authentik.

I've made this configurable in helm using pvc.mode: ReadWriteOnce, it'll be included in the next minor update.

from authentik.

I've gone ahead and tried to make use of these changes with the following values.yaml:

postgresql:
  postgresqlPassword: "generated-key"
redis:
  password: "generated-key"
config:
  secretKey: "generated-key"
pvc.mode: ReadWriteOnce
ingress:
  annotations:
    kubernetes.io/ingress.class: "traefik"
  hosts:
    - authentik.internal.lazz.tech
  tls:
    - secretName: internal-acme-crt-secret
      hosts:
        - '*.internal.lazz.tech'

However I'm encountering the following errors with bot the static and web pods:

error while running "VolumeBinding" prebind plugin for pod "authentik-1618767851-web-b9cb96dc9-swnh6": Operation cannot be fulfilled on persistentvolumeclaims "authentik-1618767851-uploads": the object has been modified; please apply your changes to the latest version and try again

error while running "VolumeBinding" prebind plugin for pod "authentik-1618767851-static-6cfd6884dd-6wzf5": Failed to bind volumes: timed out waiting for the condition

I suspect this may be due to my repeated attempts to install this via helm?

from authentik.

pvc.mode: ReadWriteOnce
I think within a values file you have to format it as

pvc:
  mode: ReadWriteOnce

I'm not sure where the error could come from, seems to be related with the PVC Provisioner, but not 100% sure. Can you try a clean install in another namespace, and see if that works?

from authentik.

Hmm looks like the error while running "VolumeBinding" prebind plugin for pod "authentik-1618536529-static-7bbb74bcd7-fs754": Failed to bind volumes: timed out waiting for the condition was due to k3s not coming with a default storage class.

• k3s-io/k3s#85

I tried installing "local path provisioner" based on this link:

• k3s-io/k3s#85 (comment)

However I'm now getting error while running "VolumeBinding" prebind plugin for pod "authentik-1618545250-static-6fbf47664f-hjrr6": Failed to bind volumes: timed out waiting for the condition on the web and static pods.

edit:
Looks like k3s actually does come with "local path provisioner" these days.

from authentik.

Is your k3s cluster running on multiple nodes? I think you might be running into storage issues as the PVCs are declared as RWX which your cluster might not have.

from authentik.

Is your k3s cluster running on multiple nodes? I think you might be running into storage issues as the PVCs are declared as RWX which your cluster might not have.

That could be it. I have one physical machine running k3OS configured as a master node for my Homelab.

from authentik.

pvc.mode: ReadWriteOnce

I think within a values file you have to format it as

pvc:

  mode: ReadWriteOnce

I'm not sure where the error could come from, seems to be related with the PVC Provisioner, but not 100% sure. Can you try a clean install in another namespace, and see if that works?

Yup I'll try with the adjusted values format and a new namespace.

from authentik.

The following config from your suggestions has deployed successfully to my k3OS homelab, without having to change namespaces. Thank you very much for your help and thank you again for making an awesome selfhosted oriented sso solution!

postgresql:
  postgresqlPassword: "generated-key"
redis:
  password: "generated-key"
config:
  secretKey: "generated-key"
pvc:
  mode: ReadWriteOnce
ingress:
  annotations:
    kubernetes.io/ingress.class: "traefik"
  hosts:
    - authentik.internal.lazz.tech
  tls:
    - secretName: internal-acme-crt-secret
      hosts:
        - '*.internal.lazz.tech'

from authentik.