charts/authentik: add support for gateway api

[rissson]

No description provided.

[rissson]

Example usage:

server:
  route:
    main:
      enabled: true
      hostnames:
        - authentik.company
      parentRefs:
        - name: my-gw
          sectionName: https
    https-redirect:
      enabled: true
      hostnames:
        - authentik.company
      parentRefs:
        - name: my-gw
          sectionName: http
      httpsRedirect: true

[wrenix]

i believe we should force the apiVersion and support just one version.
Otherwise everybody could create his own manifest independent (if it is so configurable).

The idea of helm is to be like a facade pattern in software design pattern - way: https://en.wikipedia.org/wiki/Facade_pattern

[rissson]

I intend to follow whatever https://github.com/prometheus-community/helm-charts/ does, they probably know better than I

[coryschwartz]

this is what I looked at:

• When route.enabled is false, the httproute is not created
• When route.enabled is true, it is created.
• When a hostname is added, it templates correctly
• parentRefs templates correctly.

I think this is all you probably should need, but I'm testing on GKE and it fails health checks with an error. I don't think this is the fault of the chart, just an implementation detail of gateways on GKE. Authentik will return a redirect, and the gateway expects 200OK.

Another implementation detail for my test configuration, my Gateway has two sections, one named 'http' and the other named 'https'. I want to eventually see how well this works with your httpsRedirect feature.

I start with only one parentRef selected, so I set it up like this inthe values file:

parentRefs:
- kind: Gateway
  name: cluster-gateway
  namespace: cluster-gateway
  sectionName: http

This way, the gateway is configured to use http for this route, but not https. In my setup, I get route fault abort error on https. This is working as expected.

Next, I setup both http and https parentRefs, and observe that the gateway now has the route configured for HTTP and HTTPS.
Works as expected.

parentRefs:
- kind: Gateway
  name: cluster-gateway
  namespace: cluster-gateway
  sectionName: http
- kind: Gateway
  name: cluster-gateway
  namespace: cluster-gateway
  sectionName: https

Next, set httpsRedirect to true to see what happens. I see your comment saying I need to be careful to only enable this on the http listener, and comment leaves me wondering what I need to do to make sure this happens properly. After all, there is only one HTTPRoute is going to be defined. In my test,both http:// and https:// redirected. This is obviously not what we want.

I see the templated section adding a filter to redirect to https, and this is the result:

$ curl -ik http://<host>
HTTP/1.1 301 Moved Permanently
location: https://<host>/
date: Fri, 07 Mar 2025 23:33:41 GMT
via: 1.1 google
content-length: 0

$ curl -ik https://<host>
HTTP/2 301
location: https://<host>/
date: Fri, 07 Mar 2025 23:34:06 GMT
via: 1.1 google

I might be wrong, but I believe the https redirect feature doesn't work here. You would want to create two HTTPRoutes. One has the http parentRef, and has the redirect. The other has the https parentRef and doesn't have the redirect. Maybe you should create two HTTPRoutes when this is true. One has the requestRedirect filter and the other has the "additional filters". I don't know how you might do that and make it look pretty/simple in the values file, though.

[coryschwartz]

Should this be called route or httproute? style choice, really.

[coryschwartz]

On the Ingreess, the path references {{ .Values.authentik.web.path }} so here probably should also

[rissson]

Thank you for the thorough review. I'll get to this for our next release