apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: authentik
  namespace: authentik
spec:
  hosts:
    - auth.kube.huskypup.net
  gateways:
    - istio-system/edge
  http:
    # Allow NetBird silent auth in an iframe (prompt=none)
    - match:
        - uri:
            prefix: /application/o/authorize/
      headers:
        response:
          remove:
            - x-frame-options
          set:
            content-security-policy: "frame-ancestors https://netbird.kube.huskypup.net"
      route:
        - destination:
            host: authentik-server.authentik.svc.cluster.local
            port:
              number: 80

    # Ensure CORS headers are present even on 401 responses
    - match:
        - uri:
            prefix: /application/o/userinfo/
        - uri:
            prefix: /application/o/token/
      headers:
        response:
          set:
            access-control-allow-origin: "https://netbird.kube.huskypup.net"
            access-control-allow-credentials: "true"
            access-control-allow-methods: "GET, POST, OPTIONS"
            access-control-allow-headers: "authorization, content-type"
            vary: "Origin"
      route:
        - destination:
            host: authentik-server.authentik.svc.cluster.local
            port:
              number: 80

    # Forward auth endpoint for Istio ext_authz
    - match:
        - uri:
            prefix: /outpost.goauthentik.io
      route:
        - destination:
            host: authentik-server.authentik.svc.cluster.local
            port:
              number: 80

    # All other traffic goes to Authentik
    - route:
        - destination:
            host: authentik-server.authentik.svc.cluster.local
            port:
              number: 80