duynguyen
a06159c8e8
Ignis has no built-in auth; required now that ignis.fireflylab.cc is a public hostname. Plain k8s Secret (no Vault yet) holding an htpasswd hash, enforced at gateway via SecurityPolicy.
26 lines
697 B
YAML
26 lines
697 B
YAML
{{- if .Values.httpRoute.enabled }}
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
# Ignis has no built-in auth — basic-auth enforced at the gateway via
|
|
# SecurityPolicy (see basic-auth.yaml), required since one hostname is
|
|
# public-facing (ignis.fireflylab.cc).
|
|
spec:
|
|
parentRefs:
|
|
- name: envoy-gateway
|
|
namespace: envoy-gateway-system
|
|
hostnames:
|
|
{{- range .Values.httpRoute.hostnames }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: {{ .Release.Name }}
|
|
port: {{ .Values.service.port }}
|
|
{{- end }}
|