Initial commit

infrastructure/istio/istiod-values.yaml

@@ -0,0 +1,54 @@
+# Istio Ambient Mode - ztunnel handles L4 mTLS, waypoints handle L7
+profile: ambient
+
+pilot:
+  autoscaleEnabled: true
+  autoscaleMin: 1
+  autoscaleMax: 3
+  resources:
+    requests:
+      cpu: 10m
+      memory: 128Mi
+    limits:
+      memory: 512Mi
+  env:
+    PILOT_ENABLE_AMBIENT: "true"
+
+# Use Istio CNI for ambient mesh networking (ztunnel traffic redirection)
+cni:
+  enabled: true
+
+meshConfig:
+  # ext_authz provider for Authentik forward-auth (via waypoint proxies)
+  # In ambient mode, ext_authz is enforced by waypoint proxies, not sidecars.
+  # Authentik's forward-auth endpoint is exposed under /outpost.goauthentik.io.
+  extensionProviders:
+    - name: authentik-ext-authz
+      envoyExtAuthzHttp:
+        # Route through Host-rewriting proxy (see authentik/ext-authz-proxy.yaml)
+        # Authentik's embedded outpost only serves forward-auth on Host: auth.kube.huskypup.net
+        service: ext-authz-proxy.authentik.svc.cluster.local
+        port: 4180
+        pathPrefix: /outpost.goauthentik.io/auth/traefik
+        headersToDownstreamOnAllow:
+          - set-cookie
+        headersToUpstreamOnAllow:
+          - cookie
+          - set-cookie
+          - authorization
+          - x-authentik-username
+          - x-authentik-groups
+          - x-authentik-email
+          - x-authentik-name
+          - x-authentik-uid
+        headersToDownstreamOnDeny:
+          - set-cookie
+          - content-type
+          - location
+        includeRequestHeadersInCheck:
+          - cookie
+          - authorization
+        includeAdditionalHeadersInCheck:
+          X-Forwarded-Proto: "%REQ(:SCHEME)%"
+          X-Forwarded-Host: "%REQ(:AUTHORITY)%"
+          X-Forwarded-Uri: "%REQ(:PATH)%"