40 lines
1.7 KiB
YAML
40 lines
1.7 KiB
YAML
# ClusterPolicy: expands the single `use-sso-auth: "true"` Ingress annotation
|
|
# into the ingress-nginx forward-auth annotations pointed at the Authentik
|
|
# embedded outpost.
|
|
#
|
|
# Test before applying to real ingresses:
|
|
# kubectl apply -f auth/sso-auth-policy.yaml
|
|
# kubectl annotate ingress -n default homepage use-sso-auth=true --dry-run=server -o yaml # check annotations get injected
|
|
# # remove the test annotation afterwards
|
|
---
|
|
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: inject-sso-auth
|
|
spec:
|
|
validationFailureAction: Audit
|
|
background: false
|
|
rules:
|
|
- name: authentik-forward-auth
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds: [Ingress]
|
|
preconditions:
|
|
all:
|
|
- key: "{{ request.object.metadata.annotations.\"use-sso-auth\" || '' }}"
|
|
operator: Equals
|
|
value: "true"
|
|
mutate:
|
|
patchStrategicMerge:
|
|
metadata:
|
|
annotations:
|
|
nginx.ingress.kubernetes.io/auth-url: https://auth.haven/outpost.goauthentik.io/auth/nginx
|
|
nginx.ingress.kubernetes.io/auth-signin: https://auth.haven/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
|
|
# NOTE: no auth-snippet used — ingress-nginx 1.15 rejects snippet
|
|
# annotations by default (allow-snippet-annotations=false, your
|
|
# controller ConfigMap is empty so it uses the default).
|
|
# ingress-nginx already forwards X-Original-URL to the auth
|
|
# backend automatically, which is all Authentik needs.
|
|
nginx.ingress.kubernetes.io/auth-response-headers: X-Authentik-Username,X-Authentik-Email,X-Authentik-Groups,X-Authentik-Name,X-Authentik-Metadata
|