From fb0ed0071f4babfde26b9ffb83f008b135239264 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Sat, 14 Mar 2026 13:48:35 -0500 Subject: [PATCH] Set X-Forwarded-Proto header for Ceph dashboard SAML authentication Dashboard runs with ssl: false behind TLS-terminating proxy, so SAML library sees http:// URLs and rejects responses expecting https://. Explicitly set X-Forwarded-Proto: https on both Istio VirtualService and Envoy Gateway HTTPRoute so the SAML ACS URL matches. Co-Authored-By: Claude Opus 4.6 --- infrastructure/rook-ceph/manifests/envoy-route.yaml | 6 ++++++ .../rook-ceph/manifests/istio-virtualservice.yaml | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/infrastructure/rook-ceph/manifests/envoy-route.yaml b/infrastructure/rook-ceph/manifests/envoy-route.yaml index 5796c35..4698ec2 100644 --- a/infrastructure/rook-ceph/manifests/envoy-route.yaml +++ b/infrastructure/rook-ceph/manifests/envoy-route.yaml @@ -17,6 +17,12 @@ spec: - path: type: PathPrefix value: / + filters: + - type: RequestHeaderModifier + requestHeaderModifier: + set: + - name: X-Forwarded-Proto + value: https backendRefs: - group: gateway.envoyproxy.io kind: Backend diff --git a/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml b/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml index 44ef06e..2079b62 100644 --- a/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml +++ b/infrastructure/rook-ceph/manifests/istio-virtualservice.yaml @@ -9,7 +9,11 @@ spec: gateways: - istio-system/edge http: - - timeout: 3600s + - headers: + request: + set: + x-forwarded-proto: https + timeout: 3600s route: - destination: host: rook-ceph-mgr-dashboard.rook-ceph.svc.cluster.local