mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
f8eea2ed45
Remove all nessus references: ArgoCD project destination, Istio ambient enrollment, waypoint gateway, authorization policies, ext-authz policy, TLS certificate, ingress gateway host, Kyverno exclusion, and Authentik forward-auth blueprint. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
266 lines
5.2 KiB
YAML
266 lines
5.2 KiB
YAML
# Istio Ambient Waypoint Proxies
|
|
# In ambient mode, L7 AuthorizationPolicies (ALLOW/CUSTOM/ext_authz) are enforced
|
|
# by waypoint proxies, not sidecars. Each namespace with L7 policies needs a waypoint.
|
|
#
|
|
# Waypoints are deployed as Kubernetes Gateway resources using the istio-waypoint
|
|
# gateway class. They handle:
|
|
# - L7 AuthorizationPolicy evaluation
|
|
# - ext_authz calls to Authentik for forward-auth
|
|
# - HTTP header-based routing decisions
|
|
|
|
# --- Infrastructure namespaces ---
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: istio-system
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: authentik
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: grafana
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: prometheus
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: mqtt
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: external-dns
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: unpoller
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: netbird
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
|
|
# --- Application namespaces ---
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: argocd
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: gitlab
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: n8n
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: nextcloud
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: teslamate
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: home-assistant
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: frigate
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: guacamole
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: crowdsec
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: waypoint
|
|
namespace: scylla-manager
|
|
labels:
|
|
istio.io/waypoint-for: service
|
|
spec:
|
|
gatewayClassName: istio-waypoint
|
|
listeners:
|
|
- name: mesh
|
|
port: 15008
|
|
protocol: HBONE
|