Rauthy is an OpenID Connect (OIDC) Provider and Single Sign-On (SSO) solution written in Rust. It provides a secure, fast, and reliable authentication service for your applications.

This helm chart aims to make your deployment and maintenance of rauthy easier in a kubernetes environment.

• Kubernetes 1.19+
• Helm 3.2.0+
• Persistent volume provisioner support in the underlying infrastructure (if persistence is enabled)

• Automated starter secret generation based on the minimal production configuration for getting familiar with rauthy,
• Bring Your Own configuration via external secret,
• Highly available, clustered setup support,
• External access via Ingress / httpRoute,
• Metrics and serviceMonitor support.

helm repo add rauthy-helm https://reversing0148.github.io/rauthy-helm
helm repo update

# Install with default values
helm install rauthy rauthy-helm/rauthy

# Install with custom namespace
helm install rauthy rauthy-helm/rauthy --create-namespace --namespace rauthy

# Install with custom values file
helm install rauthy rauthy-helm/rauthy -f values.yaml

helm uninstall rauthy

This is for configuring a headless service for hiqlite.

This defines a port for metrics on the service and pod resources.

Setting limits is possible but not recommended. For more details read the comments in values.yaml.

Either externalSecret or config can be used but not both.

Either externalSecret or config can be used but not both.

The chart allows you to deploy rauthy by generating a configuration for you based on the minimal production configuration.

To use this feature keep the externalSecret empty.

⚠️ Important! The configuration is re-genreated and applied on each upgrade! Make sure to migrate to externalSecret after your first install and before an upgrade to avoid data loss!

Migration steps:

• Install the helm chart with config.generate true

• Modify your values.yaml as such:

  config:
    generate: false

  externalSecret: "rauthy-config"

  Make sure to use your secret's name!

• You can now safely upgrade

The chart supports configuring rauthy via your own secret.

You can do this by creating a secret in the same namespace as rauthy, then providing the secret name, in the externalSecret field. For example:

apiVersion: v1
kind: Secret
metadata:
  name: rauthy-config
  namespace: rauthy
type: Opaque
stringData:
  config.toml: |-
    # paste and adjust config from
    # https://sebadob.github.io/rauthy/config/config_minimal.html
    # or
    # https://sebadob.github.io/rauthy/config/config.html

Make sure to keep values.yaml updated:

externalSecret: "rauthy-config"

Rauthy is deployed as a statefulset, therefore the use of some form of persistent volume is inevitable.

The chart mounts a persistent volume at /app/data for storing Rauthy's internal hiqlite database and configuration.

By default, the chart uses an emptyDir volume when persistence is disabled.

Currently this helm chart only supports deploying rauthy with its internal hiqlite database.

External postgresql database support via the helm chart is planned but is not yet available.

• When existingSecret is not set, and HTTPRoute is enabled the templates assume you have tls configured on the gateway when generating the secret template.

Like rauthy this helm chart is licensed under the Apache License 2.0.