Initial commit

infrastructure/authentik/manifests/istio-virtualservice.yaml

@@ -0,0 +1,63 @@
+apiVersion: networking.istio.io/v1beta1
+kind: VirtualService
+metadata:
+  name: authentik
+  namespace: authentik
+spec:
+  hosts:
+    - auth.kube.huskypup.net
+  gateways:
+    - istio-system/edge
+  http:
+    # Allow NetBird silent auth in an iframe (prompt=none)
+    - match:
+        - uri:
+            prefix: /application/o/authorize/
+      headers:
+        response:
+          remove:
+            - x-frame-options
+          set:
+            content-security-policy: "frame-ancestors https://netbird.kube.huskypup.net"
+      route:
+        - destination:
+            host: authentik-server.authentik.svc.cluster.local
+            port:
+              number: 80
+
+    # Ensure CORS headers are present even on 401 responses
+    - match:
+        - uri:
+            prefix: /application/o/userinfo/
+        - uri:
+            prefix: /application/o/token/
+      headers:
+        response:
+          set:
+            access-control-allow-origin: "https://netbird.kube.huskypup.net"
+            access-control-allow-credentials: "true"
+            access-control-allow-methods: "GET, POST, OPTIONS"
+            access-control-allow-headers: "authorization, content-type"
+            vary: "Origin"
+      route:
+        - destination:
+            host: authentik-server.authentik.svc.cluster.local
+            port:
+              number: 80
+
+    # Forward auth endpoint for Istio ext_authz
+    - match:
+        - uri:
+            prefix: /outpost.goauthentik.io
+      route:
+        - destination:
+            host: authentik-server.authentik.svc.cluster.local
+            port:
+              number: 80
+
+    # All other traffic goes to Authentik
+    - route:
+        - destination:
+            host: authentik-server.authentik.svc.cluster.local
+            port:
+              number: 80