unkin-agent
c98d88c197
The artifactapi web UI is open to anyone who can reach the host. Front it with Authentik SSO gated on akP-artifactapi-admin, while leaving the package-manager surfaces (/api/v1, /api/v2, /v2 docker registry, /terraform, /.well-known) untouched — dnf, containerd mirrors, buildah, terraform and CI publish steps cannot do a browser flow. - Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape. - Add the oauth-credentials VaultStaticSecret. - Point the api-route /ui rule at oauth2-proxy and add a /oauth2 rule; the catch-all / rule still goes straight to the api Service on both listeners. Requires terraform-authentik #34 applied and the Vault kv seed first. Reviewed-on: #456 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
69 lines
2.2 KiB
YAML
69 lines
2.2 KiB
YAML
---
|
|
# Path split between the authenticated UI and the unauthenticated machine API.
|
|
# Longest matching prefix wins, so the two UI rules take precedence over "/".
|
|
#
|
|
# AUTHENTICATED (oauth2 Service -> oauth2-proxy -> ui Service):
|
|
# /oauth2 oauth2-proxy sign_in / start / callback / sign_out
|
|
# /ui the human-facing SPA
|
|
#
|
|
# NOT AUTHENTICATED (artifactapi Service, unchanged):
|
|
# /api/v1/{remote,local,virtual}/* package proxy reads (yum/dnf, pip, ...)
|
|
# /api/v2/remotes|virtuals|locals/* management API + the UI's own XHR calls
|
|
# /api/v2/remotes/{name}/files/* CI publish uploads (PUT) and downloads
|
|
# /v2/* Docker Registry V2 (containerd, buildah)
|
|
# /terraform/v1/providers/* Terraform provider registry
|
|
# /.well-known/terraform.json Terraform service discovery
|
|
# /health, /version, / probes and the redirect to /ui/
|
|
# Those clients cannot complete a browser OIDC flow, so they must never be
|
|
# routed through oauth2-proxy.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: api-route
|
|
namespace: artifactapi
|
|
spec:
|
|
hostnames:
|
|
- artifactapi.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
# Early-boot clients (anaconda/kickstart, yum in %post, PXE) need plain HTTP
|
|
# for the rpm repos; serve the app directly on port 80 instead of redirecting.
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: http
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: oauth2
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /oauth2
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: oauth2
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /ui
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: artifactapi
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|