alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 1 Actions Activity

feat: add proxy auth
All checks were successful
lint-test-helm / lint-helm (push) Successful in 1m21s
Details
render-manifests-push / render-manifests-push (push) Successful in 4m17s
Details
renovate / renovate (push) Successful in 5m3s
Details

Browse Source
This commit is contained in:
Alex Lebens
2026-02-25 17:42:52 -06:00
parent 536e164b03
commit 7411f391e8
15 changed files with 315 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
clusters/cl01tl/helm/authentik/templates/reference-grant.yaml
View File

@@ -9,9 +9,30 @@ metadata:
app.kubernetes.io/part-of: {{ .Release.Name }} app.kubernetes.io/part-of: {{ .Release.Name }}
spec: spec:
from: from:
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: lidarr
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: radarr
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: radarr-4k
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: radarr-anime
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: radarr-standup
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: sonarr
- group: gateway.networking.k8s.io - group: gateway.networking.k8s.io
kind: HTTPRoute kind: HTTPRoute
namespace: sonarr-4k namespace: sonarr-4k
- group: gateway.networking.k8s.io
kind: HTTPRoute
namespace: sonarr-anime
to: to:
- group: "" - group: ""
kind: Service kind: Service

26
clusters/cl01tl/helm/lidarr/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/lidarr/values.yaml
View File

@@ -84,12 +84,28 @@ lidarr:
hostnames: hostnames:
- lidarr.alexlebens.net - lidarr.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: lidarr name: lidarr
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/radarr-4k/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/radarr-4k/values.yaml
View File

@@ -84,12 +84,28 @@ radarr-4k:
hostnames: hostnames:
- radarr-4k.alexlebens.net - radarr-4k.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: radarr-4k name: radarr-4k
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/radarr-anime/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/radarr-anime/values.yaml
View File

@@ -82,12 +82,28 @@ radarr-anime:
hostnames: hostnames:
- radarr-anime.alexlebens.net - radarr-anime.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: radarr-anime name: radarr-anime
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/radarr-standup/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/radarr-standup/values.yaml
View File

@@ -82,12 +82,28 @@ radarr-standup:
hostnames: hostnames:
- radarr-standup.alexlebens.net - radarr-standup.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: radarr-standup name: radarr-standup
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/radarr/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/radarr/values.yaml
View File

@@ -84,12 +84,28 @@ radarr:
hostnames: hostnames:
- radarr.alexlebens.net - radarr.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: radarr name: radarr
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/sonarr-anime/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/sonarr-anime/values.yaml
View File

@@ -82,12 +82,28 @@ sonarr-anime:
hostnames: hostnames:
- sonarr-anime.alexlebens.net - sonarr-anime.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: sonarr-anime name: sonarr-anime
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix

26
clusters/cl01tl/helm/sonarr/templates/middleware.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
name: oidc-forward-auth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: oidc-forward-auth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
forwardAuth:
address: http://ak-outpost-traefik-proxy-auth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
trustForwardHeader: true
authResponseHeaders:
- X-authentik-username
- X-authentik-groups
- X-authentik-entitlements
- X-authentik-email
- X-authentik-name
- X-authentik-uid
- X-authentik-jwt
- X-authentik-meta-jwks
- X-authentik-meta-outpost
- X-authentik-meta-provider
- X-authentik-meta-app
- X-authentik-meta-version

16
clusters/cl01tl/helm/sonarr/values.yaml
View File

@@ -82,12 +82,28 @@ sonarr:
hostnames: hostnames:
- sonarr.alexlebens.net - sonarr.alexlebens.net
rules: rules:
- backendRefs:
- name: ak-outpost-traefik-proxy-auth
namespace: authentik
port: 9000
weight: 100
filters: []
matches:
- path:
type: PathPrefix
value: /outpost.goauthentik.io
- backendRefs: - backendRefs:
- group: '' - group: ''
kind: Service kind: Service
name: sonarr name: sonarr
port: 80 port: 80
weight: 100 weight: 100
filters:
- type: ExtensionRef
extensionRef:
group: traefik.io
kind: Middleware
name: oidc-forward-auth
matches: matches:
- path: - path:
type: PathPrefix type: PathPrefix