# ==========================================================================
# Global Authentik ext_authz Policy - Ingress Gateway
# ==========================================================================
#
# This CUSTOM AuthorizationPolicy runs on the Istio ingress gateway and
# requires Authentik forward-auth for ALL external traffic, EXCEPT:
#
#   1. auth.kube.huskypup.net         - Authentik itself (must be reachable)
#   2. Services with native OIDC      - They redirect to Authentik themselves
#   3. Machine-access services        - Docker registry, git agent, MQTT, etc.
#   4. Vault                          - Has its own auth system
#
# How it works:
#   - The ingress gateway is a regular Envoy proxy (not ztunnel), so CUSTOM
#     action works directly without waypoint proxies.
#   - Unauthenticated users get HTTP 302 redirect to Authentik login.
#   - After login, Authentik sets a session cookie and redirects back.
#   - Subsequent requests pass ext_authz automatically via cookie.
#
# Zero-trust: Any new *.kube.huskypup.net service is AUTOMATICALLY protected.
# To exclude a new native-OIDC service, add its hostname to notValues below.
#
# Per-namespace ext_authz policies in ext-authz-policies.yaml provide
# defense-in-depth at the waypoint proxy layer.
# ==========================================================================
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: global-authentik-authz
  namespace: istio-system
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: CUSTOM
  provider:
    name: "authentik-ext-authz"  # Must match meshConfig extensionProviders[].name
  rules:
    - to:
        - operation:
            hosts: ["*.kube.huskypup.net"]
      when:
        - key: request.headers[host]
          notValues:
            # --- Authentik itself (must be reachable to log in) ---
            - "auth.kube.huskypup.net"

            # --- Services with native Authentik OIDC (handle auth themselves) ---
            - "grafana.kube.huskypup.net"
            - "argocd.kube.huskypup.net"
            - "gitlab.kube.huskypup.net"
            - "n8n.kube.huskypup.net"
            - "nextcloud.kube.huskypup.net"
            - "homeassistant.kube.huskypup.net"
            - "guacamole.kube.huskypup.net"
            - "rancher.kube.huskypup.net"
            - "netbird.kube.huskypup.net"
            - "everest.kube.huskypup.net"

            # --- Machine-access services (ext_authz would break automation) ---
            - "registry.gitlab.kube.huskypup.net"   # Docker registry (docker push/pull)
            - "minio.gitlab.kube.huskypup.net"       # Object storage (CI artifacts)
            - "kas.kube.huskypup.net"                 # GitLab Agent Server (cluster agent)
            - "mqtt.kube.huskypup.net"                # MQTT protocol (IoT devices)

            # --- Vault (has its own auth system + API access by ESO/apps) ---
            - "vault.kube.huskypup.net"

---
# Register the wildcard hostname in Istio's service registry so that the
# AuthorizationPolicy host reference above passes Kiali KIA0104 validation.
# MESH_EXTERNAL + resolution NONE = no routing side-effects; this is purely
# a registry entry for the wildcard used in the CUSTOM policy above.
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: kube-huskypup-net-wildcard
  namespace: istio-system
spec:
  hosts:
    - "*.kube.huskypup.net"
  location: MESH_EXTERNAL
  resolution: NONE
  ports:
    - number: 443
      name: https
      protocol: HTTPS