Helm Chart custom Postgres with cert error | authentik | Page 1

sly ledge Sep 19, 2025, 5:03 PM

#

database.yaml

apiVersion: postgres-operator.crunchydata.com/v1beta1
kind: PostgresCluster
metadata:
  name: authentik
spec:
  postgresVersion: 17
  instances:
    - name: instance1
      replicas: 1
      dataVolumeClaimSpec:
        accessModes:
        - "ReadWriteOnce"
        resources:
          requests:
            storage: 1Gi

#

values.yaml

authentik:
  postgresql:
    enabled: false
  global:
    env:
      - name: AUTHENTIK_SECRET_KEY
        valueFrom:
          secretKeyRef:
            name: authentik-secret
            key: secret-key
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: host
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: user
      - name: AUTHENTIK_POSTGRESQL__PORT
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: port
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: password
      - name: AUTHENTIK_POSTGRESQL__SSLMODE
        value: verify-ca
      - name: AUTHENTIK_POSTGRESQL__SSLROOTCERT
        valueFrom:
          secretKeyRef:
            name: authentik-cluster-cert
            key: root.crt
      - name: AUTHENTIK_POSTGRESQL__SSLCERT
        valueFrom:
          secretKeyRef:
            name: authentik-replication-cert
            key: tls.crt
      - name: AUTHENTIK_POSTGRESQL__SSLKEY
        valueFrom:
          secretKeyRef:
            name: authentik-replication-cert
            key: tls.key
  authentik:
    secret_key: env://AUTHENTIK_SECRET_KEY
    postgresql:
      host: env://AUTHENTIK_POSTGRESQL__HOST
      name: env://AUTHENTIK_POSTGRESQL__NAME
      user: env://AUTHENTIK_POSTGRESQL__USER
      password: env://AUTHENTIK_POSTGRESQL__PASSWORD
      port: env://AUTHENTIK_POSTGRESQL__PORT

#

values.yaml part 2

  server:
    ingress:
      ingressClassName: traefik
      enabled: true
      hosts:
        - authentik.domain.tld
  worker:
    postgresql:
      host: env://AUTHENTIK_POSTGRESQL__HOST
      name: env://AUTHENTIK_POSTGRESQL__NAME
      user: env://AUTHENTIK_POSTGRESQL__USER
      password: env://AUTHENTIK_POSTGRESQL__PASSWORD
      port: env://AUTHENTIK_POSTGRESQL__PORT

#

Helm Chart custom Postgres with cert error

sly ledge Sep 19, 2025, 5:32 PM

#

Solved it, you have to mount the certs as files.

sinful elbow Nov 5, 2025, 11:26 PM

#

sly ledge Solved it, you have to mount the certs as files.

I stuck in the same problem. specially when I add config of read replicas.

sly ledge Nov 6, 2025, 12:35 AM

#

This is my values.yaml:

authentik:
  postgresql:
    enabled: false
  redis:
    enabled: false
  global:
    env:
      - name: AUTHENTIK_SECRET_KEY
        valueFrom:
          secretKeyRef:
            name: authentik-secret
            key: secret-key
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: host
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: user
      - name: AUTHENTIK_POSTGRESQL__PORT
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: port
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-pguser-authentik
            key: password
      - name: AUTHENTIK_POSTGRESQL__SSLMODE
        value: verify-ca
      - name: AUTHENTIK_POSTGRESQL__SSLROOTCERT
        value: /certs/ca.crt
      - name: AUTHENTIK_POSTGRESQL__SSLCERT
        value: /certs/tls.crt
      - name: AUTHENTIK_POSTGRESQL__SSLKEY
        value: /certs/tls.key
  authentik:
    secret_key: env://AUTHENTIK_SECRET_KEY
    postgresql:
      host: env://AUTHENTIK_POSTGRESQL__HOST
      name: env://AUTHENTIK_POSTGRESQL__NAME
      user: env://AUTHENTIK_POSTGRESQL__USER
      password: env://AUTHENTIK_POSTGRESQL__PASSWORD
      port: env://AUTHENTIK_POSTGRESQL__PORT
    redis:
      host: authentik-redis-ha

#

  server:
    volumes:
      - name: postgres-certs
        secret:
          secretName: authentik-replication-cert
          defaultMode: 0640
    volumeMounts:
      - name: postgres-certs
        mountPath: /certs
  worker:
    postgresql:
      host: env://AUTHENTIK_POSTGRESQL__HOST
      name: env://AUTHENTIK_POSTGRESQL__NAME
      user: env://AUTHENTIK_POSTGRESQL__USER
      password: env://AUTHENTIK_POSTGRESQL__PASSWORD
      port: env://AUTHENTIK_POSTGRESQL__PORT
    volumes:
      - name: postgres-certs
        secret:
          secretName: authentik-replication-cert
          defaultMode: 0640
    volumeMounts:
      - name: postgres-certs
        mountPath: /certs
        readOnly: true
    env:
      - name: AUTHENTIK_BOOTSTRAP_PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-secret
            key: akadmin-password
      - name: AUTHENTIK_BOOTSTRAP_TOKEN
        valueFrom:
          secretKeyRef:
            name: authentik-secret
            key: akadmin-token
      - name: AUTHENTIK_BOOTSTRAP_EMAIL
        valueFrom:
          secretKeyRef:
            name: authentik-secret
            key: akadmin-email

#Helm Chart custom Postgres with cert error