Skip to main content

Kubernetes installation

You can install authentik to run on Kubernetes using a Helm Chart.

info

You can also view a video walk-through of the installation process on Kubernetes (with bonus details about email configuration and other important options).

Requirements​

  • Kubernetes
  • Helm

Video​

View our video about installing authentik on Kubernetes.

Generate passwords​

Start by generating passwords for the database and cache. You can use either of the following commands:

pwgen -s 50 1
openssl rand 60 | base64 -w 0

Set values​

Create a values.yaml file with a minimum of these settings:

authentik:
    secret_key: "PleaseGenerateASecureKey"
    # This sends anonymous usage-data, stack traces on errors and
    # performance data to sentry.io, and is fully opt-in
    error_reporting:
        enabled: true
    postgresql:
        password: "ThisIsNotASecurePassword"

server:
    gateway:
        # Specify kubernetes gateway controller class name
        GatewayClassName: nginx | traefik | kong
        enabled: true
        hosts:
            - authentik.domain.tld

postgresql:
    enabled: true
    auth:
        password: "ThisIsNotASecurePassword"

See all configurable values on ArtifactHub.

PostgreSQL production setup​

The PostgreSQL database that is created by default during installation is only intended for demonstration and testing purposes. For production instances, you should use another installation method using one of the following operators:

It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by Email stages to send verification/recovery emails.

For more information, refer to our Email configuration documentation.

Install authentik Helm Chart​

Now, execute the following commands to install authentik:

helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik -f values.yaml

During the installation process, the database migrations will be applied automatically on startup.

Access authentik​

After the installation is complete, access authentik at https://<gateway-host-name>/if/flow/initial-setup/. Here, you can set a password for the default akadmin user.

Initial setup in browser

You will get a Not Found error if initial setup URL doesn't include the trailing forward slash /. Also verify that the authentik server, worker, and PostgreSQL database are running and healthy. Review additional tips in our troubleshooting docs.

First steps in authentik​

You are now ready to add your first application and its provider. Then you'll want to add users and define groups, roles, and RBAC guidelines.

To view a typical workflow for adding applications and users, with helpful context and explanations for each step, refer to the First Steps tutorial.

📄️ Potatoes

They're great!