From 69307c84bba2373d6e2b5dfed472173e32ddb061 Mon Sep 17 00:00:00 2001
From: Zoe Roux <zoe.roux@zoriya.dev>
Date: Sun, 3 Aug 2025 15:42:35 +0200
Subject: [PATCH] Use password generator for authentik secret key

---
 apps/authentik.yaml | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/apps/authentik.yaml b/apps/authentik.yaml
index a39eec2..779d1d3 100644
--- a/apps/authentik.yaml
+++ b/apps/authentik.yaml
@@ -21,12 +21,16 @@ spec:
     helm:
       valuesObject:
         authentik:
-          secret_key: "PleaseGenerateA50CharKey"
           postgresql:
             host: postgres-cluster-rw.postgres
 
         global:
           env:
+            - name: AUTHENTIK_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: secret-key
+                  key: password
             - name: AUTHENTIK_STORAGE__MEDIA__BACKEND
               value: s3
             # TODO: configure s3
@@ -93,3 +97,16 @@ spec:
                 name: postgres-ca
                 kind: ClusterIssuer
                 group: cert-manager.io
+
+          - apiVersion: external-secrets.io/v1
+            kind: ExternalSecret
+            metadata:
+              name: secret-key
+            spec:
+              refreshPolicy: CreatedOnce
+              dataFrom:
+              - sourceRef:
+                  generatorRef:
+                    apiVersion: generators.external-secrets.io/v1alpha1
+                    kind: ClusterGenerator
+                    name: password