authentik/website/docs/install-config/install/kubernetes.md

title

title
Kubernetes installation

You can install authentik to run on Kubernetes using Helm Chart.

:::info You can also view a video walk-through of the installation process on Kubernetes (with bonus details about email configuration and other important options). :::

Requirements

• Kubernetes
• Helm

Video

Generate Passwords

Start by generating passwords for the database and cache. You can use either of the following commands:

pwgen -s 50 1
openssl rand 60 | base64 -w 0

Set Values

Create a values.yaml file with a minimum of these settings:

authentik:
    secret_key: "PleaseGenerateASecureKey"
    # This sends anonymous usage-data, stack traces on errors and
    # performance data to sentry.io, and is fully opt-in
    error_reporting:
        enabled: true
    postgresql:
        password: "ThisIsNotASecurePassword"

server:
    ingress:
        # Specify kubernetes ingress controller class name
        ingressClassName: nginx | traefik | kong
        enabled: true
        hosts:
            - authentik.domain.tld

postgresql:
    enabled: true
    auth:
        password: "ThisIsNotASecurePassword"
redis:
    enabled: true

See all configurable values on ArtifactHub.

Install authentik Helm Chart

Now, execute the following commands to install authentik:

helm repo add authentik https://charts.goauthentik.io
helm repo update
helm upgrade --install authentik authentik/authentik -f values.yaml

During the installation process, the database migrations will be applied automatically on startup.

Accessing authentik

After the installation is complete, access authentik at https://<ingress-host-name>/if/flow/initial-setup/. Here, you can set a password for the default akadmin user.

Optional step: Configure global email credentials

It is recommended to configure global email credentials as well. These are used by authentik to notify you about alerts and configuration issues. Additionally, they can be utilized by Email stages to send verification and recovery emails.

To configure this, append this block to your values.yaml file:

# add this block under the `authentik:` block in your values.yaml file
# authentik:
email:
    # -- SMTP Server emails are sent from, fully optional
    host: ""
    port: 587
    # -- SMTP credentials. When left empty, no authentication will be done.
    username: ""
    # -- SMTP credentials. When left empty, no authentication will be done.
    password: ""
    # -- Enable either use_tls or use_ssl. They can't be enabled at the same time.
    use_tls: false
    # -- Enable either use_tls or use_ssl. They can't be enabled at the same time.
    use_ssl: false
    # -- Connection timeout in seconds
    timeout: 30
    # -- Email 'from' address can either be in the format "foo@bar.baz" or "authentik <foo@bar.baz>"
    from: ""

By following these steps, you will successfully install and set up authentik on Kubernetes using Helm.