duynguyen
a06159c8e8
Ignis has no built-in auth; required now that ignis.fireflylab.cc is a public hostname. Plain k8s Secret (no Vault yet) holding an htpasswd hash, enforced at gateway via SecurityPolicy.
23 lines
490 B
YAML
23 lines
490 B
YAML
{{- if .Values.auth.enabled }}
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: {{ .Release.Name }}-basic-auth
|
|
type: Opaque
|
|
stringData:
|
|
.htpasswd: {{ .Values.auth.htpasswd | quote }}
|
|
---
|
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
|
kind: SecurityPolicy
|
|
metadata:
|
|
name: {{ .Release.Name }}-basic-auth
|
|
spec:
|
|
targetRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
name: {{ .Release.Name }}
|
|
basicAuth:
|
|
users:
|
|
name: {{ .Release.Name }}-basic-auth
|
|
{{- end }}
|