kjeld Schouten-Lebbing
6ab34757aa
Important notes: - Uses 80 and 443 for primary ingress, but warns about such when installing - Currently entrypoints are hardcoded, PR's are welcome to change this. (thanks to co-author for fixing the icon url) Co-authored-by: Stavros Kois <stavros-k@users.noreply.github.com> Signed-off-by: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
70 lines
2.1 KiB
YAML
70 lines
2.1 KiB
YAML
{{- if .Values.appIngress.webui.enabled -}}
|
|
{{- if .Values.appIngress.webui.host -}}
|
|
{{- if or (eq .Values.appIngress.webui.certType "letsencrypt-prod") (eq .Values.appIngress.webui.certType "letsencrypt-staging") }}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
annotations:
|
|
# hooks are defined here
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-weight": "10"
|
|
"helm.sh/hook-delete-policy": before-hook-creation
|
|
spec:
|
|
commonName: {{ .Values.appIngress.webui.host }}
|
|
secretName: {{ .Release.Name }}
|
|
dnsNames:
|
|
- {{ .Values.appIngress.webui.host }}
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
---
|
|
{{- end }}
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
spec:
|
|
entryPoints:
|
|
- {{ .Values.appIngress.webui.entrypoint }}
|
|
routes:
|
|
- kind: Rule
|
|
match: Host(`{{ .Values.appIngress.webui.host }}`)
|
|
services:
|
|
- name: api@internal # The internal name of the Dashboard for Traefik
|
|
kind: TraefikService
|
|
middlewares:
|
|
- name: traefik-middlewares-chain-public@kubernetescrd
|
|
{{- if .Values.appIngress.webui.authForwardUrl -}}
|
|
- name: {{ .Release.Name }}-auth-forward
|
|
{{- end }}
|
|
{{- if .Values.appIngress.webui.certType }}
|
|
tls: {{- if eq .Values.appIngress.webui.certType "selfsigned" -}}[]{{ else if eq .Values.appIngress.webui.certType "existingcert" }}
|
|
secretName: {{ .Values.appIngress.webui.existingCert }}
|
|
{{- else if eq .Values.appIngress.webui.certType "wildcard" -}}
|
|
secretName: wildcardcert
|
|
{{ else }}
|
|
secretName: {{ .Release.Name }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.appIngress.webui.authForwardUrl -}}
|
|
---
|
|
# Forward authentication
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: {{ .Release.Name }}-auth-forward
|
|
spec:
|
|
forwardAuth:
|
|
address: '{{ .Values.appIngress.webui.authForwardUrl }}'
|
|
trustForwardHeader: true
|
|
authResponseHeaders:
|
|
- Remote-User
|
|
- Remote-Groups
|
|
- Remote-Name
|
|
- Remote-Email
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|