mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
68 lines
2.9 KiB
YAML
68 lines
2.9 KiB
YAML
# ==========================================================================
|
|
# Global Authentik ext_authz Policy - Ingress Gateway
|
|
# ==========================================================================
|
|
#
|
|
# This CUSTOM AuthorizationPolicy runs on the Istio ingress gateway and
|
|
# requires Authentik forward-auth for ALL external traffic, EXCEPT:
|
|
#
|
|
# 1. auth.kube.huskypup.net - Authentik itself (must be reachable)
|
|
# 2. Services with native OIDC - They redirect to Authentik themselves
|
|
# 3. Machine-access services - Docker registry, git agent, MQTT, etc.
|
|
# 4. Vault - Has its own auth system
|
|
#
|
|
# How it works:
|
|
# - The ingress gateway is a regular Envoy proxy (not ztunnel), so CUSTOM
|
|
# action works directly without waypoint proxies.
|
|
# - Unauthenticated users get HTTP 302 redirect to Authentik login.
|
|
# - After login, Authentik sets a session cookie and redirects back.
|
|
# - Subsequent requests pass ext_authz automatically via cookie.
|
|
#
|
|
# Zero-trust: Any new *.kube.huskypup.net service is AUTOMATICALLY protected.
|
|
# To exclude a new native-OIDC service, add its hostname to notValues below.
|
|
#
|
|
# Per-namespace ext_authz policies in ext-authz-policies.yaml provide
|
|
# defense-in-depth at the waypoint proxy layer.
|
|
# ==========================================================================
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: global-authentik-authz
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
istio: ingressgateway
|
|
action: CUSTOM
|
|
provider:
|
|
name: "authentik-ext-authz" # Must match meshConfig extensionProviders[].name
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts: ["*.kube.huskypup.net"]
|
|
when:
|
|
- key: request.headers[host]
|
|
notValues:
|
|
# --- Authentik itself (must be reachable to log in) ---
|
|
- "auth.kube.huskypup.net"
|
|
|
|
# --- Services with native Authentik OIDC (handle auth themselves) ---
|
|
- "grafana.kube.huskypup.net"
|
|
- "argocd.kube.huskypup.net"
|
|
- "gitlab.kube.huskypup.net"
|
|
- "n8n.kube.huskypup.net"
|
|
- "nextcloud.kube.huskypup.net"
|
|
- "homeassistant.kube.huskypup.net"
|
|
- "guacamole.kube.huskypup.net"
|
|
- "rancher.kube.huskypup.net"
|
|
- "netbird.kube.huskypup.net"
|
|
- "everest.kube.huskypup.net"
|
|
|
|
# --- Machine-access services (ext_authz would break automation) ---
|
|
- "registry.gitlab.kube.huskypup.net" # Docker registry (docker push/pull)
|
|
- "minio.gitlab.kube.huskypup.net" # Object storage (CI artifacts)
|
|
- "kas.kube.huskypup.net" # GitLab Agent Server (cluster agent)
|
|
- "mqtt.kube.huskypup.net" # MQTT protocol (IoT devices)
|
|
|
|
# --- Vault (has its own auth system + API access by ESO/apps) ---
|
|
- "vault.kube.huskypup.net"
|