from Starfighter@discuss.tchncs.de to selfhosted@lemmy.world on 01 Apr 17:59
https://discuss.tchncs.de/post/57661692
I’m currently in the long process of rebuilding my declarative homelab using k3s, ArgoCD and NixOS.
I had previously used Keycloak but that always seemed massively overqualified and way too complex for my purposes. With this rebuild I saw my chance to try out Authentik which appears to be in good standing with the homelab community.
They have tons of documentation for pretty much anything which was encouraging to me. Well except for the documentation for their Helm Charts maybe…
Started off with version 2025.12.x, am now onto 2026.02.x and have spent most weekends in between that on getting Authentik to even just deploy to the cluster.
It’s partially my fault for attempting to use Secrets initially but even now with hardcoded keys in my git repo the default example chart doesn’t work:
values.yaml
yaml authentik: existingSecret: secretName: authentik-secret postgresql: # None of this gets applied at all so I do it manually below… password: “somepasswd” server: replicas: 1 env: # Manually apply all the configuration values. Why am I using Helm charts again? - name: AUTHENTIK_POSTGRESQL__HOST value: authentik-postgresql - name: AUTHENTIK_POSTGRESQL__USER value: authentik - name: AUTHENTIK_POSTGRESQL__PASSWORD value: “somepasswd” - name: AUTHENTIK_POSTGRESQL__NAME value: authentik route: main: # … postgresql: enabled: true auth: # And set everything here once again username: authentik password: “somepasswd” postgresPassword: “somepasswd” usePasswordFiles: false database: authentik primary: persistence: size: 4Gi
I started off with the official example and after all these undocumented changes it still only deploys-ish:
With the defaults authentik-server would always try to reach the DB under localhost which doesn’t work in the context of this chart/k8s.
So after a while I figured out that the authentik: configuration block doesn’t actually do anything and I set all the values the chart should set by hand.
Now the DB connects but the liveliness probe on the authentik-server pod fails. It logs the incoming probe requests but apparently doesn’t answer them (correctly) leading to k8s killing the pod.
Sorry for the ramble but I’ve hit my motivational breaking point with Authentik.
Since the community seems to like it a bit I am left wondering what I’m doing wrong to have this many issues with it.
Did you people have this much trouble with Authentik and what have you switched to instead?
threaded - newest
When I did my authentik setup through helm chart a while back, the only real problems I had were with learning blueprints and not so much with getting Authentik to do its thing.
The main things you should be checking given a liveliness probe failure is
kubectl -n <namespace> describe pod <podname>to check the reason for failure. Additionally,kubectl logs -p -n <namespace> <podname> [container]. Will get you logs of the last run of the pod that has already failed, rather than the current run that may be soon to fail. Those two commands should point you pretty directly where your chart config has gone wrong. I can likely help as well if you are unsure what you are looking at.Additionally, once you get things working, please go back and usw secrets properly with the chart. Authentik lets you sub many values for env vars or files, which combined with mounting secrets is how you can use them.
Did you also have to set all these env vars by hand?
I am wondering if it might have something to do with rendering Helm Charts under ArgoCD.
I’ll give it another try with your recommendations.
And should I get it working finally, I will obviously switch back to using Secrets.
I only removed them to reduce possible points of failure.
As for blueprints, that’s a task for future me xD