unkin-agent
b9f727bc97
## Why WatchState currently only has an internal front door (watchstate.k8s.syd1.au.unkin.net, PR #419, merged). This adds a public front door at **watchstate.unkin.net** via the external (DMZ) Traefik so the admin UI is reachable off-cluster, still fully gated by oauth2-proxy/Authentik. The internal gateway and routes are untouched; oauth2-proxy now fronts BOTH hostnames. Stacked base note: the intended base (benvin/watchstate-deploy, PR #419) merged into main before this PR opened, so this targets `main`. ## How - **DNS**: `watchstate-dns-internal` DNSRecord in `apps/base/bind-internal/authoritative/records.yaml` (unkin.net zone, bind-internal) -> `A 198.18.199.0`, the traefik-external VIP. Mirrors the `arrstack-dns-internal` precedent (external front door via bind, not external-dns). Kept in the central bind-internal location, so no AppProject destination widening is needed. - **Gateway**: new `watchstate-external` Gateway (`gatewayClassName: traefik-external`), http + https listeners on hostname `watchstate.unkin.net`. TLS terminated with the Let's Encrypt `*.unkin.net` wildcard secret `wildcard-unkin-net-tls` — so **no cert-manager and no external-dns annotations**. - **Routes**: `watchstate-external-http-redirect` (http->https 301) and `watchstate-external` (https -> `watchstate-oauth2:80`), mirroring the arrproxy/cheeztv external patterns. - **oauth2-proxy dual-host**: `OAUTH2_PROXY_REDIRECT_URL` changed from the pinned cluster callback to the **relative** `/oauth2/callback`. With `OAUTH2_PROXY_REVERSE_PROXY=true` (already set), oauth2-proxy derives scheme+host per request from `X-Forwarded-Proto/Host` (verified in oauth2-proxy v7.15.3 `getOAuthRedirectURI`: host-less redirectURL falls through to request-derived), so the callback works on both `watchstate.unkin.net` and `watchstate.k8s.syd1.au.unkin.net`. `COOKIE_DOMAINS` and `WHITELIST_DOMAINS` now list both hosts (one cookie per host; a single parent-domain cookie can't cleanly span unkin.net vs k8s.syd1.au.unkin.net). - Dropped the no-op `argocd.argoproj.io/sync-wave: "0"` annotation on the `default` VaultAuth. New resources intentionally carry no sync-wave annotations. ## Validation - `kustomize build --enable-helm` on `apps/overlays/au-syd1/watchstate` and `.../bind-internal`: OK. - kubeconform (repo CI config, k8s 1.33.7): watchstate overlay 15/15 valid (2 Gateways, 4 HTTPRoutes); bind-internal overlay 67/67 valid (incl. `watchstate-dns-internal`). ## Dependencies - **Reflector allow-list (argocd-apps PR #418)**: reflects `wildcard-unkin-net-tls` into the `watchstate` namespace. This PR references that secret as if present. - **Authentik (terraform-authentik, separate PR)**: register both `https://watchstate.unkin.net/oauth2/callback` and `https://watchstate.k8s.syd1.au.unkin.net/oauth2/callback` as redirect URIs on the watchstate provider. Reviewed-on: #420 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
41 lines
2.2 KiB
YAML
41 lines
2.2 KiB
YAML
---
|
|
# Non-secret oauth2-proxy configuration (client_id/secret/cookie_secret come
|
|
# from the watchstate-oauth-credentials Secret). Single auth front for the
|
|
# WatchState UI + API: every path requires a valid Authentik session. Access is
|
|
# authorized Authentik-side (the watchstate application binds akR-global-admin
|
|
# only), so no oauth2-proxy group allowlist is set here.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: watchstate-oauth2-env
|
|
namespace: watchstate
|
|
data:
|
|
OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:4180"
|
|
OAUTH2_PROXY_PROVIDER: "oidc"
|
|
OAUTH2_PROXY_OIDC_ISSUER_URL: "https://identity.k8s.syd1.au.unkin.net/application/o/watchstate/"
|
|
# Relative (host-less) redirect URL: with reverse-proxy mode on, oauth2-proxy
|
|
# derives scheme+host per request from X-Forwarded-Proto/Host, so the same
|
|
# deployment serves BOTH the external watchstate.unkin.net and internal
|
|
# watchstate.k8s.syd1.au.unkin.net callbacks. Both absolute callback URIs are
|
|
# registered on the Authentik provider (terraform-authentik, separate PR).
|
|
OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
|
|
OAUTH2_PROXY_UPSTREAMS: "http://watchstate.watchstate.svc.cluster.local:8080/"
|
|
OAUTH2_PROXY_SCOPE: "openid email profile ak_groups"
|
|
OAUTH2_PROXY_OIDC_GROUPS_CLAIM: "ak_groups"
|
|
OAUTH2_PROXY_PASS_USER_HEADERS: "true"
|
|
OAUTH2_PROXY_EMAIL_DOMAINS: "*"
|
|
# Authentik hardcodes email_verified=false in the id_token; authorization is
|
|
# enforced Authentik-side, so accepting the unverified email is safe.
|
|
OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
|
|
OAUTH2_PROXY_COOKIE_SECURE: "true"
|
|
# One cookie domain per host (a single parent-domain cookie can't span
|
|
# unkin.net and k8s.syd1.au.unkin.net cleanly); oauth2-proxy picks the domain
|
|
# matching the request host. Whitelist both so post-auth `rd` redirects to
|
|
# either front door are honoured.
|
|
OAUTH2_PROXY_COOKIE_DOMAINS: "watchstate.unkin.net,watchstate.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_WHITELIST_DOMAINS: "watchstate.unkin.net,watchstate.k8s.syd1.au.unkin.net"
|
|
OAUTH2_PROXY_REVERSE_PROXY: "true"
|
|
OAUTH2_PROXY_PROVIDER_CA_FILES: "/etc/ssl/combined/ca-certificates.crt"
|
|
OAUTH2_PROXY_CODE_CHALLENGE_METHOD: "S256"
|
|
OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
|