adding new git-ops structure

2026-09-02 19:53:17 -03:00
parent 39bda3c129
commit 7a560f6f97
50 changed files with 4693 additions and 0 deletions
@@ -0,0 +1,39 @@
+# ClusterPolicy: expands the single `use-sso-auth: "true"` Ingress annotation
+# into the ingress-nginx forward-auth annotations pointed at the Authentik
+# embedded outpost.
+#
+# Test before applying to real ingresses:
+#   kubectl apply -f auth/sso-auth-policy.yaml
+#   kubectl annotate ingress -n default homepage use-sso-auth=true --dry-run=server -o yaml   # check annotations get injected
+#   # remove the test annotation afterwards
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: inject-sso-auth
+spec:
+  validationFailureAction: Audit
+  background: false
+  rules:
+    - name: authentik-forward-auth
+      match:
+        any:
+          - resources:
+              kinds: [Ingress]
+      preconditions:
+        all:
+          - key: "{{ request.object.metadata.annotations.\"use-sso-auth\" || '' }}"
+            operator: Equals
+            value: "true"
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              nginx.ingress.kubernetes.io/auth-url: https://auth.haven/outpost.goauthentik.io/auth/nginx
+              nginx.ingress.kubernetes.io/auth-signin: https://auth.haven/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
+              # NOTE: no auth-snippet used — ingress-nginx 1.15 rejects snippet
+              # annotations by default (allow-snippet-annotations=false, your
+              # controller ConfigMap is empty so it uses the default).
+              # ingress-nginx already forwards X-Original-URL to the auth
+              # backend automatically, which is all Authentik needs.
+              nginx.ingress.kubernetes.io/auth-response-headers: X-Authentik-Username,X-Authentik-Email,X-Authentik-Groups,X-Authentik-Name,X-Authentik-Metadata