ignis: add basic auth via envoy SecurityPolicy

Ignis has no built-in auth; required now that ignis.fireflylab.cc is a public hostname. Plain k8s Secret (no Vault yet) holding an htpasswd hash, enforced at gateway via SecurityPolicy.
2026-08-04 00:14:33 +07:00
parent 3d829d0ded
commit a06159c8e8
3 changed files with 31 additions and 2 deletions
@@ -40,3 +40,9 @@ httpRoute:
  hostnames:
    - ignis.fireflylab.local
    - ignis.fireflylab.cc
+
+auth:
+  enabled: true
+  # bcrypt htpasswd line, e.g. output of: htpasswd -nB <user>
+  # Generate this yourself — do not put the plaintext password here.
+  htpasswd: "duynguyen:$2y$05$0hgFpQXdm1arjoEG5Gqs5.Q0Bl8YGOgXVLzBXdQjCnBTRgR1sYb9O"