ignis: add basic auth via envoy SecurityPolicy

Ignis has no built-in auth; required now that ignis.fireflylab.cc is a public hostname. Plain k8s Secret (no Vault yet) holding an htpasswd hash, enforced at gateway via SecurityPolicy.
2026-08-04 00:14:33 +07:00
parent 3d829d0ded
commit a06159c8e8
3 changed files with 31 additions and 2 deletions
@@ -0,0 +1,22 @@
+{{- if .Values.auth.enabled }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+type: Opaque
+stringData:
+  .htpasswd: {{ .Values.auth.htpasswd | quote }}
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: {{ .Release.Name }}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: {{ .Release.Name }}
+  basicAuth:
+    users:
+      name: {{ .Release.Name }}-basic-auth
+{{- end }}