mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
0d39bcddc9
The global-authentik-authz AuthorizationPolicy uses *.kube.huskypup.net as a host match, but Kiali flagged KIA0104 because the wildcard had no matching entry in Istio's service registry. Adding a MESH_EXTERNAL ServiceEntry with resolution NONE registers the hostname without affecting routing. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
88 lines
3.5 KiB
YAML
88 lines
3.5 KiB
YAML
# ==========================================================================
|
|
# Global Authentik ext_authz Policy - Ingress Gateway
|
|
# ==========================================================================
|
|
#
|
|
# This CUSTOM AuthorizationPolicy runs on the Istio ingress gateway and
|
|
# requires Authentik forward-auth for ALL external traffic, EXCEPT:
|
|
#
|
|
# 1. auth.kube.huskypup.net - Authentik itself (must be reachable)
|
|
# 2. Services with native OIDC - They redirect to Authentik themselves
|
|
# 3. Machine-access services - Docker registry, git agent, MQTT, etc.
|
|
# 4. Vault - Has its own auth system
|
|
#
|
|
# How it works:
|
|
# - The ingress gateway is a regular Envoy proxy (not ztunnel), so CUSTOM
|
|
# action works directly without waypoint proxies.
|
|
# - Unauthenticated users get HTTP 302 redirect to Authentik login.
|
|
# - After login, Authentik sets a session cookie and redirects back.
|
|
# - Subsequent requests pass ext_authz automatically via cookie.
|
|
#
|
|
# Zero-trust: Any new *.kube.huskypup.net service is AUTOMATICALLY protected.
|
|
# To exclude a new native-OIDC service, add its hostname to notValues below.
|
|
#
|
|
# Per-namespace ext_authz policies in ext-authz-policies.yaml provide
|
|
# defense-in-depth at the waypoint proxy layer.
|
|
# ==========================================================================
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: global-authentik-authz
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
istio: ingressgateway
|
|
action: CUSTOM
|
|
provider:
|
|
name: "authentik-ext-authz" # Must match meshConfig extensionProviders[].name
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts: ["*.kube.huskypup.net"]
|
|
when:
|
|
- key: request.headers[host]
|
|
notValues:
|
|
# --- Authentik itself (must be reachable to log in) ---
|
|
- "auth.kube.huskypup.net"
|
|
|
|
# --- Services with native Authentik OIDC (handle auth themselves) ---
|
|
- "grafana.kube.huskypup.net"
|
|
- "argocd.kube.huskypup.net"
|
|
- "gitlab.kube.huskypup.net"
|
|
- "n8n.kube.huskypup.net"
|
|
- "nextcloud.kube.huskypup.net"
|
|
- "homeassistant.kube.huskypup.net"
|
|
- "guacamole.kube.huskypup.net"
|
|
- "rancher.kube.huskypup.net"
|
|
- "netbird.kube.huskypup.net"
|
|
- "everest.kube.huskypup.net"
|
|
|
|
# --- Machine-access services (ext_authz would break automation) ---
|
|
- "registry.gitlab.kube.huskypup.net" # Docker registry (docker push/pull)
|
|
- "minio.gitlab.kube.huskypup.net" # Object storage (CI artifacts)
|
|
- "kas.kube.huskypup.net" # GitLab Agent Server (cluster agent)
|
|
- "mqtt.kube.huskypup.net" # MQTT protocol (IoT devices)
|
|
|
|
# --- Vault (has its own auth system + API access by ESO/apps) ---
|
|
- "vault.kube.huskypup.net"
|
|
|
|
---
|
|
# Register the wildcard hostname in Istio's service registry so that the
|
|
# AuthorizationPolicy host reference above passes Kiali KIA0104 validation.
|
|
# MESH_EXTERNAL + resolution NONE = no routing side-effects; this is purely
|
|
# a registry entry for the wildcard used in the CUSTOM policy above.
|
|
apiVersion: networking.istio.io/v1
|
|
kind: ServiceEntry
|
|
metadata:
|
|
name: kube-huskypup-net-wildcard
|
|
namespace: istio-system
|
|
spec:
|
|
hosts:
|
|
- "*.kube.huskypup.net"
|
|
location: MESH_EXTERNAL
|
|
resolution: NONE
|
|
ports:
|
|
- number: 443
|
|
name: https
|
|
protocol: HTTPS
|