unkin-agent
c98d88c197
The artifactapi web UI is open to anyone who can reach the host. Front it with Authentik SSO gated on akP-artifactapi-admin, while leaving the package-manager surfaces (/api/v1, /api/v2, /v2 docker registry, /terraform, /.well-known) untouched — dnf, containerd mirrors, buildah, terraform and CI publish steps cannot do a browser flow. - Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape. - Add the oauth-credentials VaultStaticSecret. - Point the api-route /ui rule at oauth2-proxy and add a /oauth2 rule; the catch-all / rule still goes straight to the api Service on both listeners. Requires terraform-authentik #34 applied and the Vault kv seed first. Reviewed-on: #456 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
58 lines
1.5 KiB
YAML
58 lines
1.5 KiB
YAML
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: postgres-credentials
|
|
namespace: artifactapi
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: postgres-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/artifactapi/default/postgres-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: environment
|
|
namespace: artifactapi
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: environment
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/artifactapi/default/environment
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|
|
---
|
|
# Authentik OIDC client for the artifactapi UI front door (client_id,
|
|
# client_secret, cookie_secret). Seeded out of band at
|
|
# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
|
|
# k8s auth role already grants the artifactapi/default ServiceAccount read on
|
|
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
|
|
# terraform-vault change is needed. Consumed by the oauth2 Deployment.
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: oauth-credentials
|
|
namespace: artifactapi
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/artifactapi/default/oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|