mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
1f04831a97
ingress-nginx is gone and every app is served by the Envoy Gateway. The certificates were created by cert-manager's ingress-shim and are owned by the Ingresses, so each app now declares its Certificate itself, with the same name, secret and usages, so nothing gets reissued. gateway-shim can't take over because the certificates live in the app namespaces. immich drops mbg.hensen.io, which has no route, so that one certificate is reissued through the Gateway's HTTP-01 solver. Also removes the Longhorn test-port redirect URI and updates comments that still described nginx.
51 lines
2.1 KiB
YAML
51 lines
2.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: authentik-blueprint-longhorn
|
|
data:
|
|
longhorn-oidc.yaml: |
|
|
version: 1
|
|
metadata:
|
|
name: Longhorn OIDC
|
|
entries:
|
|
# Envoy Gateway does the login for Longhorn, which has no users of its
|
|
# own (see longhorn/httproute.yaml).
|
|
- model: authentik_providers_oauth2.oauth2provider
|
|
id: longhorn-provider
|
|
state: present
|
|
identifiers:
|
|
name: Longhorn
|
|
attrs:
|
|
name: Longhorn
|
|
authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
|
|
authentication_flow: !Find [authentik_flows.flow, [slug, default-authentication-flow]]
|
|
invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
|
|
client_type: confidential
|
|
client_id: longhorn
|
|
client_secret: !Env [LONGHORN_OIDC_CLIENT_SECRET, ""]
|
|
redirect_uris:
|
|
- matching_mode: strict
|
|
url: https://longhorn.rubenhensen.nl/oauth2/callback
|
|
signing_key: !Find [authentik_crypto.certificatekeypair, [name, "authentik Self-signed Certificate"]]
|
|
property_mappings:
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
|
|
- !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
|
|
- model: authentik_core.application
|
|
id: longhorn-app
|
|
state: present
|
|
identifiers:
|
|
slug: longhorn
|
|
attrs:
|
|
name: Longhorn
|
|
provider: !KeyOf longhorn-provider
|
|
meta_launch_url: https://longhorn.rubenhensen.nl
|
|
# Longhorn can delete volumes, so only admins get in.
|
|
- model: authentik_policies.policybinding
|
|
state: present
|
|
identifiers:
|
|
order: 0
|
|
target: !KeyOf longhorn-app
|
|
attrs:
|
|
group: !Find [authentik_core.group, [name, "authentik Admins"]]
|