mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
f8eea2ed45
Remove all nessus references: ArgoCD project destination, Istio ambient enrollment, waypoint gateway, authorization policies, ext-authz policy, TLS certificate, ingress gateway host, Kyverno exclusion, and Authentik forward-auth blueprint. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
122 lines
3.1 KiB
YAML
122 lines
3.1 KiB
YAML
# ==========================================================================
|
|
# Istio ext_authz Policies - Forward Auth via Authentik
|
|
# ==========================================================================
|
|
#
|
|
# These policies protect services that don't have native OIDC integration.
|
|
# Istio's ext_authz filter calls Authentik's forward-auth endpoint before
|
|
# allowing traffic through.
|
|
#
|
|
# Services with native OIDC (GitLab, ArgoCD, Grafana, n8n, Home Assistant,
|
|
# Rancher, Nextcloud) do NOT need ext_authz - they handle auth themselves.
|
|
#
|
|
# IMPORTANT: CUSTOM action does NOT support 'from' or source-based matching.
|
|
# We use 'to.operation.hosts' to restrict to external hostnames only.
|
|
# Internal service-to-service traffic uses k8s DNS names (*.svc.cluster.local)
|
|
# which won't match, so it bypasses ext_authz and hits ALLOW policies instead.
|
|
# ==========================================================================
|
|
|
|
# --- Prometheus: Require Authentik auth for browser access ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-prometheus
|
|
namespace: prometheus
|
|
spec:
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- prometheus.kube.huskypup.net
|
|
paths:
|
|
- /*
|
|
---
|
|
# --- TeslaMate: Require Authentik auth ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-teslamate
|
|
namespace: teslamate
|
|
spec:
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- teslamate.kube.huskypup.net
|
|
---
|
|
# --- ESPHome: Require Authentik auth ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-esphome
|
|
namespace: home-assistant
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: esphome
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- esphome.kube.huskypup.net
|
|
---
|
|
# --- Kiali: Require Authentik auth ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-kiali
|
|
namespace: istio-system
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: kiali
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- kiali.kube.huskypup.net
|
|
---
|
|
# --- Frigate: Require Authentik auth ---
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-frigate
|
|
namespace: frigate
|
|
spec:
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- frigate.kube.huskypup.net
|
|
---
|
|
# --- Scylla Manager: Require Authentik auth ---
|
|
# NOTE: Namespace 'scylla-manager' must exist before applying this policy.
|
|
apiVersion: security.istio.io/v1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: ext-authz-scylla-manager
|
|
namespace: scylla-manager
|
|
spec:
|
|
action: CUSTOM
|
|
provider:
|
|
name: authentik-ext-authz
|
|
rules:
|
|
- to:
|
|
- operation:
|
|
hosts:
|
|
- scylla-manager.kube.huskypup.net
|