Repository: goauthentik/authentik

Issue:
Cannot use kubernetes secret - read only filesystem
I am trying to pass secrets from Kubernetes into Authentik. For that I added the following lines to the Helm values:

```
    volumes:
    - name: cluster-domain-cert
      secret:
        secretName: ${CLUSTER_DOMAIN_CERT}
        defaultMode: 0666
        items:
        - key: tls.crt
          path: fullchain.pem
        - key: tls.key
          path: privkey.pem
    volumeMounts:
    - name: cluster-domain-cert
      mountPath: /certs/${CLUSTER_DOMAIN}
      readOnly: false
```

The secrets gets mounted sucessfuly and the task to search certs finds them but fails to read them:
```
{"event": "Task started", "level": "info", "logger": "authentik.root.celery", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "task_id": "00f728fc-22e1-4f63-9376-2706e7a85158", "task_name": "certificate_discovery", "timestamp": "2022-03-20T23:20:11.159295"}
{"event": "Failed to open file or invalid format", "exc": "OSError(30, 'Read-only file system')", "file": "PosixPath('/certs/angelnu.com/privkey.pem')", "level": "warning", "logger": "authentik.crypto.tasks", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "timestamp": "2022-03-20T23:20:11.160119"}
{"event": "Failed to open file or invalid format", "exc": "OSError(30, 'Read-only file system')", "file": "PosixPath('/certs/angelnu.com/fullchain.pem')", "level": "warning", "logger": "authentik.crypto.tasks", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "timestamp": "2022-03-20T23:20:11.160346"}
{"event": "Task finished", "level": "info", "logger": "authentik.root.celery", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "state": "SUCCESS", "task_id": "00f728fc-22e1-4f63-9376-2706e7a85158", "task_name": "certificate_discovery", "timestamp": "2022-03-20T23:20:11.172351"}

```

The problem is that since Kubernetes 1.9 the [secrets are mounted read-only](https://github.com/kubernetes/kubernetes/issues/62099) and the Authentik task tries to open the file in read and **write** mode: https://github.com/goauthentik/authentik/blob/457e17fec37664236224644f00a7b93a54f9e7fb/authentik/crypto/tasks.py#L64

```
authentik@authentik-worker-6c899bf47-djtgg:/$ mount|grep certs
tmpfs on /certs/angelnu.com type tmpfs (ro,relatime)
```

I think the fix is to change the task to open in read-only mode.
Cannot use kubernetes secret - read only filesystem
I am trying to pass secrets from Kubernetes into Authentik. For that I added the following lines to the Helm values:

```
    volumes:
    - name: cluster-domain-cert
      secret:
        secretName: ${CLUSTER_DOMAIN_CERT}
        defaultMode: 0666
        items:
        - key: tls.crt
          path: fullchain.pem
        - key: tls.key
          path: privkey.pem
    volumeMounts:
    - name: cluster-domain-cert
      mountPath: /certs/${CLUSTER_DOMAIN}
      readOnly: false
```

The secrets gets mounted sucessfuly and the task to search certs finds them but fails to read them:
```
{"event": "Task started", "level": "info", "logger": "authentik.root.celery", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "task_id": "00f728fc-22e1-4f63-9376-2706e7a85158", "task_name": "certificate_discovery", "timestamp": "2022-03-20T23:20:11.159295"}
{"event": "Failed to open file or invalid format", "exc": "OSError(30, 'Read-only file system')", "file": "PosixPath('/certs/angelnu.com/privkey.pem')", "level": "warning", "logger": "authentik.crypto.tasks", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "timestamp": "2022-03-20T23:20:11.160119"}
{"event": "Failed to open file or invalid format", "exc": "OSError(30, 'Read-only file system')", "file": "PosixPath('/certs/angelnu.com/fullchain.pem')", "level": "warning", "logger": "authentik.crypto.tasks", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "timestamp": "2022-03-20T23:20:11.160346"}
{"event": "Task finished", "level": "info", "logger": "authentik.root.celery", "pid": 134, "request_id": "task-00f728fc22e14f6393762706e7a85158", "state": "SUCCESS", "task_id": "00f728fc-22e1-4f63-9376-2706e7a85158", "task_name": "certificate_discovery", "timestamp": "2022-03-20T23:20:11.172351"}

```

The problem is that since Kubernetes 1.9 the [secrets are mounted read-only](https://github.com/kubernetes/kubernetes/issues/62099) and the Authentik task tries to open the file in read and **write** mode: https://github.com/goauthentik/authentik/blob/457e17fec37664236224644f00a7b93a54f9e7fb/authentik/crypto/tasks.py#L64

```
authentik@authentik-worker-6c899bf47-djtgg:/$ mount|grep certs
tmpfs on /certs/angelnu.com type tmpfs (ro,relatime)
```

I think the fix is to change the task to open in read-only mode.


Discussion:

Resolving patch:
diff --git a/authentik/crypto/tasks.py b/authentik/crypto/tasks.py
--- a/authentik/crypto/tasks.py
+++ b/authentik/crypto/tasks.py
@@ -61,7 +61,7 @@ def certificate_discovery(self: MonitoredTask):
         else:
             cert_name = path.name.replace(path.suffix, "")
         try:
-            with open(path, "r+", encoding="utf-8") as _file:
+            with open(path, "r", encoding="utf-8") as _file:
                 body = _file.read()
                 if "PRIVATE KEY" in body:
                     private_keys[cert_name] = ensure_private_key_valid(body)


Test patch: