mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
910b792452
Longhorn has no users of its own; nginx guarded it with basic auth using apr1 hashes, which Envoy Gateway does not support. An Envoy Gateway SecurityPolicy now sends visitors through an authentik OIDC application that only admins may use. The client secret lives in Vault at kv/longhorn-oidc and reaches both authentik and Envoy through External Secrets.
77 lines
1.8 KiB
YAML
77 lines
1.8 KiB
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: longhorn
|
|
spec:
|
|
parentRefs:
|
|
- name: homelab
|
|
namespace: envoy-gateway-system
|
|
sectionName: https-longhorn
|
|
hostnames:
|
|
- longhorn.rubenhensen.nl
|
|
rules:
|
|
- backendRefs:
|
|
- name: longhorn-frontend
|
|
port: 80
|
|
# No limit on the whole request, as with nginx. Envoy's default of 15s
|
|
# cuts off uploads and long-lived connections.
|
|
timeouts:
|
|
request: 0s
|
|
---
|
|
# Longhorn has no login of its own. Envoy sends visitors through authentik
|
|
# first; the authentik application only lets admins in.
|
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
|
kind: SecurityPolicy
|
|
metadata:
|
|
name: longhorn-oidc
|
|
spec:
|
|
targetRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
name: longhorn
|
|
oidc:
|
|
provider:
|
|
issuer: https://authentik.rubenhensen.nl/application/o/longhorn/
|
|
clientID: longhorn
|
|
clientSecret:
|
|
name: longhorn-oidc-client-secret
|
|
scopes:
|
|
- openid
|
|
- email
|
|
- profile
|
|
logoutPath: /logout
|
|
---
|
|
# Same client secret as authentik's, under the key Envoy Gateway expects.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: longhorn-oidc-client-secret
|
|
spec:
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
refreshInterval: 15m
|
|
target:
|
|
name: longhorn-oidc-client-secret
|
|
creationPolicy: Owner
|
|
data:
|
|
- secretKey: client-secret
|
|
remoteRef:
|
|
key: kv/longhorn-oidc
|
|
property: client_secret
|
|
---
|
|
# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: gateway-tls
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
namespace: envoy-gateway-system
|
|
to:
|
|
- group: ""
|
|
kind: Secret
|
|
name: letsencrypt-prod
|