Add authentik database user and ExternalSecret

Add managed role for authentik user on blumeops-pg CNPG cluster,
with ExternalSecret pulling password from 1Password item
"Authentik (blumeops)".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

argocd/manifests/databases/blumeops-pg.yaml

@@ -55,6 +55,15 @@ spec:
         createdb: true
         passwordSecret:
           name: blumeops-pg-teslamate
+      # authentik user for Authentik identity provider (runs on ringtail)
+      - name: authentik
+        login: true
+        connectionLimit: -1
+        ensure: present
+        inherit: true
+        createdb: true
+        passwordSecret:
+          name: blumeops-pg-authentik
 
   # Resource limits for minikube environment
   resources:

argocd/manifests/databases/external-secret-authentik.yaml

@@ -0,0 +1,28 @@
+# ExternalSecret for Authentik database user password
+#
+# 1Password item: "Authentik (blumeops)" in blumeops vault
+# Field: "postgresql-password"
+#
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: blumeops-pg-authentik
+  namespace: databases
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: onepassword-blumeops
+  target:
+    name: blumeops-pg-authentik
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/basic-auth
+      data:
+        username: authentik
+        password: "{{ .password }}"
+  data:
+  - secretKey: password
+    remoteRef:
+      key: Authentik (blumeops)
+      property: postgresql-password

argocd/manifests/databases/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - external-secret-eblume.yaml
   - external-secret-borgmatic.yaml
   - external-secret-teslamate.yaml
+  - external-secret-authentik.yaml