unkin-agent
47f7cd9c51
Add a public front door for the WatchState admin UI on watchstate.unkin.net via the external (DMZ) Traefik, alongside the existing internal watchstate.k8s.syd1.au.unkin.net gateway. oauth2-proxy fronts both hostnames. - DNSRecord watchstate-dns-internal (bind-internal/authoritative, unkin.net zone) -> A 198.18.199.0, the traefik-external VIP (arrstack precedent). - watchstate-external Gateway (traefik-external) + HTTPRoutes: http->https redirect and https -> watchstate-oauth2:80. TLS terminated with the Let's Encrypt *.unkin.net wildcard (wildcard-unkin-net-tls), so no cert-manager/external-dns annotations. - oauth2-proxy: relative redirect-url (/oauth2/callback) so reverse-proxy mode derives scheme+host per request, making the callback work on BOTH hosts; cookie + whitelist domains cover both hostnames. - Drop the no-op sync-wave: "0" annotation on the vaultauth default VaultAuth. Dependencies: - wildcard-unkin-net-tls reflection into the watchstate namespace (reflector allow-list, argocd-apps PR #418). - Both callback URIs registered on the Authentik watchstate provider (terraform-authentik, separate PR).
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
---
|
|
# External (DMZ) front for the WatchState admin UI, served on watchstate.unkin.net
|
|
# via the external Traefik (LB VIP 198.18.199.0). TLS is terminated with the real
|
|
# Let's Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in the
|
|
# cert-manager namespace, reflected into this namespace as wildcard-unkin-net-tls
|
|
# by the emberstack reflector), so there is no cert-manager annotation here. The
|
|
# apex watchstate.unkin.net A record lives in the bind-operator unkin.net zone
|
|
# (bind-internal/authoritative), NOT external-dns, so no external-dns annotation
|
|
# either. The internal watchstate Gateway (watchstate.k8s.syd1.au.unkin.net) is
|
|
# untouched; oauth2-proxy fronts both hostnames.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: external
|
|
name: watchstate-external
|
|
namespace: watchstate
|
|
spec:
|
|
gatewayClassName: traefik-external
|
|
listeners:
|
|
- name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
hostname: watchstate.unkin.net
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
- name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
hostname: watchstate.unkin.net
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: wildcard-unkin-net-tls
|