unkin-agent
6515e7f637
The vlselect query UI is only reachable in-cluster, so every log search needs a port-forward. Publish it at vlogs.unkin.net behind oauth2-proxy on the external (DMZ) Traefik. - Add `apps/base/logging/vlogs`: external Gateway, http->https redirect and main HTTPRoute - Terminate TLS with the reflected Let's Encrypt `*.unkin.net` wildcard; reflect it into `logging` - Publish the `vlogs` A record at the DMZ gateway VIP from the bind-operator `unkin.net` zone - Route all traffic through the `vlogs-oauth2` Service, upstreaming to `vlselect-logs:9471` - Gate on the Authentik `vlogs` application, group `akP-vlogs-admin` - Read OIDC credentials from `kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials` Depends on unkin/terraform-authentik#40. Reviewed-on: #498 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
---
|
|
# External (DMZ) front for the VictoriaLogs UI on vlogs.unkin.net via the
|
|
# external Traefik (LB VIP 198.18.199.0). TLS terminates with the real Let's
|
|
# Encrypt *.unkin.net wildcard (Certificate wildcard-unkin-net in cert-manager,
|
|
# reflected into this namespace as wildcard-unkin-net-tls by the emberstack
|
|
# reflector), so there is no cert-manager annotation here. The apex
|
|
# vlogs.unkin.net A record lives in the bind-operator unkin.net zone, NOT
|
|
# external-dns, so no external-dns annotation either. oauth2-proxy fronts it.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
labels:
|
|
traefik.io/instance: external
|
|
name: vlogs-external
|
|
namespace: logging
|
|
spec:
|
|
gatewayClassName: traefik-external
|
|
listeners:
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: vlogs.unkin.net
|
|
name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
- allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
hostname: vlogs.unkin.net
|
|
name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: wildcard-unkin-net-tls
|
|
mode: Terminate
|