goauthentik / goauthentik/authentik

Easier fetching of blueprints from OCI registries

Open
#4,262 14 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Is your feature request related to a problem? Please describe.**
From the [blueprint docs for OCI storages](https://goauthentik.io/developer-docs/blueprints/#storage---oci) I gather that the user can set the path of a blueprint to an URL instead of a local path to fetch a specific blueprint from an OCI registry.

I looked at this in the UI and I don't see a way to type in the path (the path field is a dropdown list with local paths of existing local blueprint yaml files). Maybe I am overlooking something, but even if this is possible, it seems very tedious to do because it needs to be done for every blueprint and there may be hundreds of them in a registry.

**Describe the solution you'd like**
As an alternative I want to propose the following:

Add new environment variable(s) that can be used to specify OCI registry URLs (with/without credentials) but for the root of the registry and not for an individual blueprint. Moreover, have the environment variables specify under what folder name to store the downloaded blueprints in the `/blueprints` directory.

Then periodically delete the folder with the blueprints entirely and fetch them again from the registry. Then (re)apply them.

**Describe alternatives you've considered**
1. Have an separate container to download the OCI registry and place it into a folder accessible to authentik.
2. Manually download the OCI registry and place the files in an accessible to authentik directory.

**Additional context**
Alternatively the UI can have a new dialog to specify this (instead of using environment variables). But I would personally prefer the environment variable approach, as this way authentik can be bootstrapped to apply a custom set of blueprints on the first startup. Basically do something like:
1. Define registry with blueprints to download in an environment variable
2. Map them to be placed under `/blueprints/default`
3. Start authentik
4. authentik starts up fully configured, no need to delete flows/stages/etc created by the default blueprints.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.