mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
55 lines
1.7 KiB
YAML
55 lines
1.7 KiB
YAML
# Istio Ambient Mode - ztunnel handles L4 mTLS, waypoints handle L7
|
|
profile: ambient
|
|
|
|
pilot:
|
|
autoscaleEnabled: true
|
|
autoscaleMin: 1
|
|
autoscaleMax: 3
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 512Mi
|
|
env:
|
|
PILOT_ENABLE_AMBIENT: "true"
|
|
|
|
# Use Istio CNI for ambient mesh networking (ztunnel traffic redirection)
|
|
cni:
|
|
enabled: true
|
|
|
|
meshConfig:
|
|
# ext_authz provider for Authentik forward-auth (via waypoint proxies)
|
|
# In ambient mode, ext_authz is enforced by waypoint proxies, not sidecars.
|
|
# Authentik's forward-auth endpoint is exposed under /outpost.goauthentik.io.
|
|
extensionProviders:
|
|
- name: authentik-ext-authz
|
|
envoyExtAuthzHttp:
|
|
# Route through Host-rewriting proxy (see authentik/ext-authz-proxy.yaml)
|
|
# Authentik's embedded outpost only serves forward-auth on Host: auth.kube.huskypup.net
|
|
service: ext-authz-proxy.authentik.svc.cluster.local
|
|
port: 4180
|
|
pathPrefix: /outpost.goauthentik.io/auth/traefik
|
|
headersToDownstreamOnAllow:
|
|
- set-cookie
|
|
headersToUpstreamOnAllow:
|
|
- cookie
|
|
- set-cookie
|
|
- authorization
|
|
- x-authentik-username
|
|
- x-authentik-groups
|
|
- x-authentik-email
|
|
- x-authentik-name
|
|
- x-authentik-uid
|
|
headersToDownstreamOnDeny:
|
|
- set-cookie
|
|
- content-type
|
|
- location
|
|
includeRequestHeadersInCheck:
|
|
- cookie
|
|
- authorization
|
|
includeAdditionalHeadersInCheck:
|
|
X-Forwarded-Proto: "%REQ(:SCHEME)%"
|
|
X-Forwarded-Host: "%REQ(:AUTHORITY)%"
|
|
X-Forwarded-Uri: "%REQ(:PATH)%"
|