0.9.0 Chart Feedback

[james-d-elliott]

This is where users should discuss the chart feedback for the upcoming 0.9.0 release.

[mwinters-stuff]

I have had a try at using the 0.9.0 chart, and have come across a couple of problems.

Errors installing the cart, which are created by the naming of the attributes,
deployment.yaml, lines 48, 51, 54

Error: INSTALLATION FAILED: 1 error occurred:
        * Deployment.apps "aaa-authelia" is invalid: [spec.template.annotations: Invalid value: "authelia.com/checksum/config": a qualified name must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName'), spec.template.annotations: Invalid value: "authelia.com/checksum/secret": a qualified name must consist of alphanumeric characters, '-', '_' or '.', and must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')]

for example

authelia.com/checksum/config: {{ include (print $.Template.BasePath "/configMap.yaml") . | sha256sum }}

Creates an error - that authelia.com/checksum/config doesnt match the regex for naming
changing the last / to a - resolves the error

A second issue, is that it seems that authelia can not load the configuration.yaml, from the configmap. I didnt have time to look a tthat last night

[autarchprinceps]

Not that there isn't a value to change this, but I'd think one would want to keep the default config as close to working as possible without input, so:
Configuration: access_control: 'default_policy' option 'deny' is invalid: when no rules are specified it must be 'two_factor' or 'one_factor'

[autarchprinceps]

Hmm, setting configMap.access_control.default_policy to two_factor doesn't seem to fix this. I'm starting from a working, fairly basic config in 0.8.58 to 0.9, to then try to switch to OIDC instead, but for now I'm really just using a yaml file with users in it, with nothing fancy around it.

[autarchprinceps]

Ok, I got it to work. One needs to also set configMap.access_control.secret.enabled: true. I think this is at the very least non-intuitive and/or should default to true, if there is already a handling of the default policy with or without rules

[james-d-elliott]

Ah, it's because it was included in the wrong if/else block, fixed locally. Thanks!

[autarchprinceps]

The dependencies of mariadb, postgres & redis are all missing the configMap segment in the conditions of the Chart.yaml compared to the place those settings are in the values.yaml.

[james-d-elliott]

What do you mean by configMap segment?

[SIMULATAN]

Hi, setting ingress.traefikCRD.sticky=true causes the installation to fail.
The reason is that the field of the IngressRoute is indented to be interpreted as a services list entry rather than a property of the created service.
See ingressRoute.yaml and the traefik IngressRoute reference

Shall I create a PR targeting the master or v0.9.0-beta3 branch? It seems to be a problem on both branches.

[james-d-elliott]

Make one targeting master and bump the version appropriately to beta3. Thanks for this, must have mangled the indentation in reworking some of these elements.

[pfaelzerchen]

Hi, i'm still not able to bring authelia up with the 0.9.0 chart. I started with a working 0.8.58 chart. But so far some feedback regarding the documentation.

There are some differences between the breaking change guide, values.yaml and values.yaml.local:

• issuer_private_keys from the guide is jwks in values.yaml
• Also the secrets handling changed, values.yaml.local still contains the old style. README.md also describes the old secrets style.
• probably some more I already forgot

The change from host/port to address for smtp, ldap and postgres (but not redis) is not mentioned in the guide, but also breaking.

[pfaelzerchen]

OK. Authelia is running now. The last error was the missing 's' in submissions for the smtp address. One of those typos...

Also it was not really straight-forward to upgrade, the general structure seems improved to me.

The secrets management could have some more documentation. The passwords and encryption keys use another "path" logic than the oidc configuration does. I think, I understand the reason. I had to use the additionalSecrets to mount the oidc-keys which I found out by trying as they are not automatically mounted as the rest of the password/key-secrets. The documentation could be more elaborative on that.

[james-d-elliott]

Quite a few elements of the values files have been resolved.

[tarioch]

I'm struggling even at the chart validation level of OIDC and I'm not understanding what I'm doing wrong. My config looks like this

      identity_providers:
        oidc:
          enabled: true
          clients:
            - id: "repo"
              secret: '$pbkdf2-sha512.......'
              public: false
              authorization_policy: two_factor
              redirect_uris:
                - https://somecallbackurl
              scopes:
                - openid
                - email
                - profile
              consent_mode: implicit

and validation/lint fails with

engine.go:189: [INFO] Fail: The 'configMap.identity_providers.oidc.clients' which have the Confidential Client Type must have a secret. The client with id '%!s(<nil>)' does not have a secret but is Confidential.

[pfaelzerchen]

Some things got renamed here with 0.9.0. You should look into the values.yaml. I think something like this might work:

      identity_providers:
        oidc:
          enabled: true
          clients:
            - client_id: "repo"
              client_secret:
                value: '$pbkdf2-sha512.......'
              public: false
              authorization_policy: two_factor
              redirect_uris:
                - https://somecallbackurl
              scopes:
                - openid
                - email
                - profile
              consent_mode: implicit

[tarioch]

Thanks, got it working, there were quite a bit more changes (moving all the config from secrets to the corresponding section, smtp, authorization_url change in the nginx ingress annotation).