unkin-agent
8f7b9360ad
Front /ui with an Authentik-authenticated oauth2-proxy while leaving every package-manager surface unauthenticated. - Add the oauth2-proxy ConfigMap, Deployment, Service and VMPodScrape. - Add the oauth-credentials VaultStaticSecret. - Split httproute: /ui and /oauth2 to oauth2-proxy (HTTPS, plus an HTTP redirect); everything else to the api Service on both listeners.
106 lines
3.3 KiB
YAML
106 lines
3.3 KiB
YAML
---
|
|
# API SIDE -- NOT AUTHENTICATED. Everything that is not /ui or /oauth2 lands
|
|
# here and goes straight to the api Service, exactly as before:
|
|
# /api/v1/{remote,local,virtual}/* package proxy reads (yum/dnf, pip, ...)
|
|
# /api/v2/remotes|virtuals|locals/* management API + the UI's own XHR calls
|
|
# /api/v2/remotes/{name}/files/* CI publish uploads (PUT) and downloads
|
|
# /v2/* Docker Registry V2 (containerd, buildah)
|
|
# /terraform/v1/providers/* Terraform provider registry
|
|
# /.well-known/terraform.json Terraform service discovery
|
|
# /health, /version, / probes and the redirect to /ui/
|
|
# These clients cannot complete a browser OIDC flow, so they must never be
|
|
# routed through oauth2-proxy.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: api-route
|
|
namespace: artifactapi
|
|
spec:
|
|
hostnames:
|
|
- artifactapi.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
# Early-boot clients (anaconda/kickstart, yum in %post, PXE) need plain HTTP
|
|
# for the rpm repos; serve the app directly on port 80 instead of redirecting.
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: http
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: artifactapi
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
---
|
|
# UI SIDE -- AUTHENTICATED. Only the human-facing SPA and the oauth2-proxy
|
|
# endpoints (sign_in / start / callback / sign_out) go through the proxy, which
|
|
# requires an Authentik session in akP-artifactapi-admin and forwards to the ui
|
|
# Service. Longer path prefixes win over the api-route "/" rule above.
|
|
# HTTPS only: the session cookie is Secure, so a plain-HTTP session cannot work.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: ui-route
|
|
namespace: artifactapi
|
|
spec:
|
|
hostnames:
|
|
- artifactapi.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: https
|
|
rules:
|
|
- backendRefs:
|
|
- group: ""
|
|
kind: Service
|
|
name: oauth2
|
|
port: 80
|
|
weight: 1
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /ui
|
|
- path:
|
|
type: PathPrefix
|
|
value: /oauth2
|
|
---
|
|
# Send plain-HTTP browsers hitting the UI to HTTPS so they can obtain the Secure
|
|
# session cookie. Scoped to the UI paths only -- api-route keeps serving the
|
|
# package-manager surfaces over port 80 unredirected.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: ui-http-redirect
|
|
namespace: artifactapi
|
|
spec:
|
|
hostnames:
|
|
- artifactapi.k8s.syd1.au.unkin.net
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: artifactapi
|
|
sectionName: http
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|
|
matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /ui
|
|
- path:
|
|
type: PathPrefix
|
|
value: /oauth2
|