1"use strict";(self.webpackChunk_goauthentik_docs_topics=self.webpackChunk_goauthentik_docs_topics||[]).push([["16266"],{60427(e,t,n){n.d(t,{Ay:()=>r,RM:()=>a});var s=n(62540),o=n(43023);let a=[];function i(e){let t={code:"code",pre:"pre",...(0,o.R)(),...e.components};return(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"# Log level that the outpost will set\n# Allowed levels: trace, debug, info, warning, error\n# Applies to: non-embedded\nlog_level: debug\n# Interval at which the outpost will refresh the providers\n# from authentik. For caching outposts (such as LDAP), the\n# cache will also be invalidated at that interval.\n# (Format: hours=1;minutes=2;seconds=3).\nrefresh_interval: minutes=5\n########################################\n# The settings below are only relevant when using a managed outpost\n########################################\n# URL that the outpost uses to connect back to authentik\nauthentik_host: https://authentik.tld/\n# Disable SSL Validation for the authentik connection\nauthentik_host_insecure: false\n# Optionally specify a different URL used for user-facing interactions\n# Applies to: proxy outposts\nauthentik_host_browser:\n# Template used for objects created (deployments/containers, services, secrets, etc)\nobject_naming_template: ak-outpost-%(name)s\n# Use a specific docker image for this outpost rather than the default. This also applies to Kubernetes\n# outposts.\n# Applies to: non-embedded\ncontainer_image:\n########################################\n# Docker outpost specific settings\n########################################\n# Network the outpost container should be connected to\n# Applies to: non-embedded\ndocker_network: null\n# Optionally disable mapping of ports to outpost container, may be useful when using docker networks\n# (Available with 2021.9.4+)\n# Applies to: non-embedded\ndocker_map_ports: true\n# Optionally additional labels for docker containers\n# (Available with 2022.1.2)\n# Applies to: non-embedded\ndocker_labels: null\n########################################\n# Kubernetes outpost specific settings\n########################################\n# Replica count for the deployment of the outpost\n# Applies to: non-embedded\nkubernetes_replicas: 1\n# Namespace to deploy in, defaults to the same namespace authentik is deployed in (if available)\nkubernetes_namespace: authentik\n# Any additional annotations to add to the ingress object, for example cert-manager\nkubernetes_ingress_annotations: {}\n# Name of the secret that is used for TLS connections, leave empty to disable TLS\nkubernetes_ingress_secret_name: authentik-outpost-tls\n# pathType to use on routes. Defaults to `Prefix`. Some ingress-nginx deployments need this to be set to `ImplementationSpecific`.\n# Service kind created, can be set to LoadBalancer for LDAP outposts for example\nkubernetes_service_type: ClusterIP\n# Disable any components of the kubernetes integration, can be any of\n# - 'secret'\n# - 'deployment'\n# - 'service'\n# - 'prometheus servicemonitor'\n# - 'ingress'\n# - 'traefik middleware'\nkubernetes_disabled_components: []\n# If the above docker image is in a private repository, use these secrets to pull.\n# NOTE: The secret must be created manually in the namespace first.\n# Applies to: non-embedded\nkubernetes_image_pull_secrets: []\n# Optionally configure an ingress class name. If not set, the ingress will use the cluster's\n# default ingress class\n# (Available with 2022.11.0+)\n# Applies to: proxy outposts\nkubernetes_ingress_class_name: null\n# Optionally apply an RFC 6902 compliant patch to the Kubernetes objects.\n# For an understanding of how this works, refer to the link below:\n# https://github.com/kubernetes-sigs/kustomize/blob/master/examples/jsonpatch.md\n#\n# This value expects a mapping where the key represents\n# the Kubernetes component that shall be patched.\n# It can be any of the same values supported by `kubernetes_disabled_components`.\n#\n# For example use this patch to add custom resource requests and limits\n# to the outpost deployment:\n#\n# deployment:\n# - op: add\n# path: \"/spec/template/spec/containers/0/resources\"\n# value:\n# requests:\n# cpu: 2000m\n# memory: 2000Mi\n# limits:\n# cpu: 4000m\n# memory: 8000Mi\nkubernetes_json_patches: null\n# Disable strict x509 validation for Kubernetes API server.\n#\n# On some older Kubernetes clusters, the root certificate may have been\n# generated
1without certain x509 extensions. `urllib3`, which is used in\n# the official kubernetes client, introduced stricter validation for\n# certificates in version 2.4.0 which will cause `certificate verify failed`\n# errors to appear in outpost logs. This option disables the stricter\n# validation and allows the outpost to connect to the Kubernetes API server\n# even with older certificates.\n#\n# It is recommended to only enable this option if you are experiencing\n# certificate validation issues and understand the security implications\n# of disabling strict x509 validation.\nkubernetes_disable_x509_strict: false\n"})})}function r(e={}){let{wrapper:t}={...(0,o.R)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(i,{...e})}):i(e)}},86975(e,t,n){n.r(t),n.d(t,{metadata:()=>s,default:()=>p,frontMatter:()=>r,contentTitle:()=>d,toc:()=>u,assets:()=>l});var s=JSON.parse('{"id":"add-secure-apps/outposts/embedded/embedded","title":"Embedded Outpost","description":"authentik includes an embedded outpost to simplify deployments that use the Proxy provider.","source":"@site/add-secure-apps/outposts/embedded/embedded.mdx","sourceDirName":"add-secure-apps/outposts/embedded","slug":"/add-secure-apps/outposts/embedded/","permalink":"/add-secure-apps/outposts/embedded/","draft":false,"unlisted":false,"editUrl":"https://github.com/goauthentik/authentik/edit/main/website/docs/add-secure-apps/outposts/embedded/embedded.mdx","tags":[],"version":"current","frontMatter":{"title":"Embedded Outpost"},"sidebar":"docs","previous":{"title":"Kubernetes","permalink":"/add-secure-apps/outposts/integrations/kubernetes"},"next":{"title":"Manual Outpost deployment in Docker Compose","permalink":"/add-secure-apps/outposts/manual-deploy-docker-compose"}}'),o=n(62540),a=n(43023),i=n(60427);let r={title:"Embedded Outpost"},d,l={},u=[{value:"When to use the embedded outpost",id:"when-to-use-the-embedded-outpost",level:2},{value:"Configuration",id:"configuration",level:2},...i.RM,{value:"Routing",id:"routing",level:2},{value:"How the embedded outpost differs from managed outposts",id:"how-the-embedded-outpost-differs-from-managed-outposts",level:2}];function c(e){let t={a:"a",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",strong:"strong",...(0,a.R)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.p,{children:"authentik includes an embedded outpost to simplify deployments that use the Proxy provider."}),"\n",(0,o.jsx)(t.p,{children:"The embedded outpost runs as part of the main authentik server deployment and is managed by authentik itself. It authenticates to the authentik API by using the secret key."}),"\n",(0,o.jsxs)(t.p,{children:["You can access the embedded outpost on the same ports as authentik itself, ",(0,o.jsx)(t.code,{children:"9000"})," and ",(0,o.jsx)(t.code,{children:"9443"}),"."]}),"\n",(0,o.jsx)(t.h2,{id:"when-to-use-the-embedded-outpost",children:"When to use the embedded outpost"}),"\n",(0,o.jsx)(t.p,{children:"Use the embedded outpost when you are using the proxy provider and want the simplest deployment model. It is a good fit when authentik is already behind a reverse proxy and you want proxy provider traffic to be handled by the same authentik deployment, without a separate outpost deployment."}),"\n",(0,o.jsxs)(t.p,{children:["Use a ",(0,o.jsx)(t.a,{href:"/add-secure-apps/outposts/",children:"managed outpost"})," instead when you want authentik to deploy and update a separate outpost through the ",(0,o.jsx)(t.a,{href:"/add-secure-apps/outposts/integrations/docker",children:"Docker"})," or ",(0,o.jsx)(t.a,{href:"/add-secure-apps/outposts/integrations/kubernetes",children:"Kubernetes"})," integrations, or when you want the outpost lifecycle to be separate from the core server."]}),"\n",(0,o.jsxs)(t.p,{children:["If the embedded outpost does not fit your deployment, you can ignore it and use a ",(0,o.jsx)(t.a,{href:"/add-secure-apps/outposts/",children:"managed outpost"})," instead."]}),"\n",(0,o.jsx)(t.h2,{id:"configuration",children:"Configuration"}),"\n",(0,o.jsx)(t.p,{children:"Because authentik does not know its own primary URL, you might need to configure the embedded outpost after installation."}),"\n",(0,o.jsx)(t.p,{children:"By default, when you open the Admin interface on a fresh install, authentik automatically configures the outpost to use the same URL that was used to access authentik."}),"\n",(0,o.jsxs)(t.p,{children:["If this is not correct, navigate to ",(0,o.jsx)(t.strong,{children:"Applications"})," > ",(0,o.jsx)(t.strong,{children:"Outposts"}),", edit ",(0,o.jsx)(t.strong,{children:"authentik Embedded Outpost"}),", and set ",(0,o.jsx)(t.code,{children:"authentik_host"})," to the correct URL."]}),"\n",(0,o.jsx)(t.p,{children:"Make sure that you set a full URL. A hostname or FQDN by itself does not work."}),"\n",(0,o.jsxs)(t.p,{children:["Most other outpost configuration options also apply to the embedded outpost, except for items that are marked as ",(0,o.jsx)(t.code,{children:"non-embedded"}),"."]}),"\n","\n",(0,o.jsx)(i.Ay,{}),"\n",(0,o.jsx)(t.h2,{id:"routing",children:"Routing"}),"\n",(0,o.jsx)(t.p,{children:"Requests are routed as follows:"}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsxs)(t.li,{children:["Paths starting with ",(0,o.jsx)(t.code,{children:"/static"}),", ",(0,o.jsx)(t.code,{children:"/media"}),", and ",(0,o.jsx)(t.code,{children:"/help"})," return packaged CSS and JavaScript files, and user-uploaded media files."]}),"\n",(0,o.jsxs)(t.li,{children:["Paths starting with ",(0,o.jsx)(t.code,{children:"/outpost.goauthentik.io"})," are sent to the embedded outpost."]}),"\n",(0,o.jsx)(t.li,{children:"Any hosts configured in the providers assigned to the embedded outpost are sent to the outpost."}),"\n",(0,o.jsx)(t.li,{children:"Everything remaining is sent to the authentik backend server."}),"\n"]}),"\n",(0,o.jsx)(t.h2,{id:"how-the-embedded-outpost-differs-from-managed-outposts",children:"How the embedded outpost differs from managed outposts"}),"\n",(0,o.jsx)(t.p,{children:"There are a few differences between managed outposts and the embedded outpost because authentik cannot fully manage the main authentik server deployment in the same way that it manages a separate outpost deployment."}),"\n",(0,o.jsxs)(t.ol,{children:["\n",(0,o.jsxs)(t.li,{children:["\n",(0,o.jsx)(t.p,{children:"Docker only: no automatic Traefik labels are added to the server container."}),"\n",(0,o.jsx)(t.p,{children:"When you deploy a managed outpost on Docker, the container includes labels that can configure Traefik automatically. The embedded outpost does not add those labels to the server container."}),"\n"]}),"\n",(0,o.jsxs)(t.li,{children:["\n",(0,o.jsx)(t.p,{children:"Kubernetes only: an additional Service is created."}),"\n",(0,o.jsx)(t.p,{children:"Because authentik does not know the name of the primary authentik Service, it creates another Service with a common set of labels that is always present."}),"\n"]}),"\n"]})]})}function p(e={}){let{wrapper:t}={...(0,a.R)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},43023(e,t,n){n.d(t,{R:()=>i,x:()=>r});var s=n(63696);let o={},a=s.createContext(o);function i(e){let t=s.useContext(a);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:i(e.components),s.createElement(a.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.