# ClusterPolicy: expands the single `use-sso-auth: "true"` Ingress annotation
# into the ingress-nginx forward-auth annotations pointed at the Authentik
# embedded outpost.
#
# Test before applying to real ingresses:
#   kubectl apply -f auth/sso-auth-policy.yaml
#   kubectl annotate ingress -n default homepage use-sso-auth=true --dry-run=server -o yaml   # check annotations get injected
#   # remove the test annotation afterwards
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: inject-sso-auth
spec:
  validationFailureAction: Audit
  background: false
  rules:
    - name: authentik-forward-auth
      match:
        any:
          - resources:
              kinds: [Ingress]
      preconditions:
        all:
          - key: "{{ request.object.metadata.annotations.\"use-sso-auth\" || '' }}"
            operator: Equals
            value: "true"
      mutate:
        patchStrategicMerge:
          metadata:
            annotations:
              nginx.ingress.kubernetes.io/auth-url: https://auth.haven/outpost.goauthentik.io/auth/nginx
              nginx.ingress.kubernetes.io/auth-signin: https://auth.haven/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
              # NOTE: no auth-snippet used — ingress-nginx 1.15 rejects snippet
              # annotations by default (allow-snippet-annotations=false, your
              # controller ConfigMap is empty so it uses the default).
              # ingress-nginx already forwards X-Original-URL to the auth
              # backend automatically, which is all Authentik needs.
              nginx.ingress.kubernetes.io/auth-response-headers: X-Authentik-Username,X-Authentik-Email,X-Authentik-Groups,X-Authentik-Name,X-Authentik-Metadata