Refactor authentik configuration to use mounted secrets for PostgreSQL credentials

applications/templates/authentik.yaml

@@ -21,29 +21,13 @@ spec:
       valuesObject:
         global:
           priorityClassName: homelab-critical
-          env:
-          - name: AUTHENTIK_DATABASE__HOST
-            valueFrom:
-              secretKeyRef:
-                name: pg-authentik-cluster-app
-                key: host
-          - name: AUTHENTIK_POSTGRESQL__NAME
-            valueFrom:
-              secretKeyRef:
-                name: pg-authentik-cluster-app
-                key: dbname
-          - name: AUTHENTIK_POSTGRESQL__PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: pg-authentik-cluster-app
-                key: password
-          - name: AUTHENTIK_POSTGRESQL__USER
-            valueFrom:
-              secretKeyRef:
-                name: pg-authentik-cluster-app
-                key: username
         authentik:
           secret_key: bGd7nChCpPQmypR64rgF
+          postgresql:
+            host: file:///postgres-creds/host
+            name: file:///postgres-creds/dbname
+            user: file:///postgres-creds/username
+            password: file:///postgres-creds/password
         server:
           metrics:
             enabled: true
@@ -56,6 +40,23 @@ spec:
               - authentik.noxxos.nl
             annotations:
               traefik.ingress.kubernetes.io/router.entrypoints: web
+          volumes:
+            - name: postgres-creds
+              secret:
+                secretName: pg-authentik-cluster-app
+          volumeMounts:
+            - name: postgres-creds
+              mountPath: /postgres-creds
+              readOnly: true
+        worker:
+          volumes:
+            - name: postgres-creds
+              secret:
+                secretName: pg-authentik-cluster-app
+          volumeMounts:
+            - name: postgres-creds
+              mountPath: /postgres-creds
+              readOnly: true
         postgresql:
           enabled: false
         redis: