Deploy an identity provider

[mischavandenburg]

Set up Identity Provider (IdP) for ArgoCD Authentication

Description

We need to implement a centralized identity provider to handle authentication for ArgoCD and future services in our KubeCraft project. This will provide secure Single Sign-On (SSO) capabilities and centralized user management.

Requirements

• Deploy either Authentik or Keycloak as our identity provider
• Configure OIDC/OAuth2 integration with ArgoCD
• Set up initial user management structure
• Document the setup process for future reference

Technical Considerations

• Should be deployed within our k3s cluster
• Must be accessible through ingress
• Needs persistent storage for user data
• Should use our existing external secrets operator for sensitive data
• Must be deployed using GitOps principles with our existing tools
• If using a postgres backend, we must deploy a separate cluster, can be a separate issue

Tasks

1. Research and choose between Authentik and Keycloak

   • Compare resource requirements
   • Evaluate ease of maintenance
   • Check community support and documentation
   • Assess integration capabilities

2. Infrastructure Setup

   • Configure ingress rules
   • Set up TLS certificates
   • Implement backup solution

3. Identity Provider Deployment

   • Create Kubernetes manifests or Helm charts
   • Configure persistent storage
   • Set up initial admin account
   • Implement basic security policies

4. ArgoCD Integration

   • Configure OIDC/OAuth2 settings in ArgoCD
   • Set up role mappings
   • Test SSO functionality
   • Document login process

5. Documentation

   • Document deployment architecture
   • Create user management guide
   • Write troubleshooting guide
   • Document backup/restore procedures

Acceptance Criteria

• Identity provider is successfully deployed and accessible
• ArgoCD successfully authenticates users through the IdP
• User management documentation is complete
• Backup and restore procedures are tested and documented
• All configurations are managed through GitOps

Additional Notes

• Consider setting up monitoring and alerting for the IdP
• Plan for scalability as we add more services
• Consider implementing MFA if supported
• Document security best practices

Resources

• ArgoCD SSO Configuration
• Keycloak on Kubernetes Documentation
• Authentik Documentation