unkin-agent
8c929e44ee
The vlselect query UI is only reachable in-cluster, so log searches need a port-forward. Front it with the same oauth2-proxy pattern logviewer uses. - Add apps/base/logging/vlogs: vlogs Gateway (vault-issuer TLS, traefik-internal) plus http->https redirect and main HTTPRoute - Route all traffic through the vlogs-oauth2 Service into oauth2-proxy, which upstreams to vlselect-logs:9471 - Gate access on the Authentik vlogs application, group akP-vlogs-admin - Source OIDC credentials from kv/kubernetes/namespace/logging/default/vlogs-oauth-credentials
18 lines
386 B
YAML
18 lines
386 B
YAML
---
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
|
kind: VaultStaticSecret
|
|
metadata:
|
|
name: vlogs-oauth-credentials
|
|
namespace: logging
|
|
spec:
|
|
destination:
|
|
create: true
|
|
name: vlogs-oauth-credentials
|
|
overwrite: true
|
|
hmacSecretData: true
|
|
mount: kv
|
|
path: kubernetes/namespace/logging/default/vlogs-oauth-credentials
|
|
refreshAfter: 5m
|
|
type: kv-v2
|
|
vaultAuthRef: default
|