ignis: add basic auth via envoy SecurityPolicy

Ignis has no built-in auth; required now that ignis.fireflylab.cc is a public hostname. Plain k8s Secret (no Vault yet) holding an htpasswd hash, enforced at gateway via SecurityPolicy.
2026-08-04 00:14:33 +07:00
parent 3d829d0ded
commit a06159c8e8
3 changed files with 31 additions and 2 deletions
@@ -3,8 +3,9 @@ apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: {{ .Release.Name }}
-  # No built-in auth in Ignis itself — LAN-only exposure, same tradeoff
-  # already accepted for Vault in cluster-platform.
+  # Ignis has no built-in auth — basic-auth enforced at the gateway via
+  # SecurityPolicy (see basic-auth.yaml), required since one hostname is
+  # public-facing (ignis.fireflylab.cc).
 spec:
  parentRefs:
    - name: envoy-gateway