mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
64 lines
1.7 KiB
YAML
64 lines
1.7 KiB
YAML
apiVersion: networking.istio.io/v1beta1
|
|
kind: VirtualService
|
|
metadata:
|
|
name: authentik
|
|
namespace: authentik
|
|
spec:
|
|
hosts:
|
|
- auth.kube.huskypup.net
|
|
gateways:
|
|
- istio-system/edge
|
|
http:
|
|
# Allow NetBird silent auth in an iframe (prompt=none)
|
|
- match:
|
|
- uri:
|
|
prefix: /application/o/authorize/
|
|
headers:
|
|
response:
|
|
remove:
|
|
- x-frame-options
|
|
set:
|
|
content-security-policy: "frame-ancestors https://netbird.kube.huskypup.net"
|
|
route:
|
|
- destination:
|
|
host: authentik-server.authentik.svc.cluster.local
|
|
port:
|
|
number: 80
|
|
|
|
# Ensure CORS headers are present even on 401 responses
|
|
- match:
|
|
- uri:
|
|
prefix: /application/o/userinfo/
|
|
- uri:
|
|
prefix: /application/o/token/
|
|
headers:
|
|
response:
|
|
set:
|
|
access-control-allow-origin: "https://netbird.kube.huskypup.net"
|
|
access-control-allow-credentials: "true"
|
|
access-control-allow-methods: "GET, POST, OPTIONS"
|
|
access-control-allow-headers: "authorization, content-type"
|
|
vary: "Origin"
|
|
route:
|
|
- destination:
|
|
host: authentik-server.authentik.svc.cluster.local
|
|
port:
|
|
number: 80
|
|
|
|
# Forward auth endpoint for Istio ext_authz
|
|
- match:
|
|
- uri:
|
|
prefix: /outpost.goauthentik.io
|
|
route:
|
|
- destination:
|
|
host: authentik-server.authentik.svc.cluster.local
|
|
port:
|
|
number: 80
|
|
|
|
# All other traffic goes to Authentik
|
|
- route:
|
|
- destination:
|
|
host: authentik-server.authentik.svc.cluster.local
|
|
port:
|
|
number: 80
|