panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
69 lines
2.9 KiB
YAML
69 lines
2.9 KiB
YAML
# Authelia forward-auth in front of NetBox, enforced at the gateway.
|
|
#
|
|
# This is what makes AD-group -> NetBox-role mapping possible at all: NetBox has no
|
|
# SSO group mapping, but it does have header-based group sync, and this supplies the
|
|
# headers from a source the app can trust (see netbox/values.yaml remoteAuth).
|
|
#
|
|
# Flow: browser -> Envoy -> (extAuth) Authelia -> 200 + Remote-* headers -> NetBox.
|
|
# On 401/403 Authelia redirects to https://auth.ddupan.top and back.
|
|
---
|
|
apiVersion: gateway.envoyproxy.io/v1alpha1
|
|
kind: SecurityPolicy
|
|
metadata:
|
|
name: netbox-authelia
|
|
namespace: netbox
|
|
spec:
|
|
# Targets the HTTPRoute the chart generates, so the policy applies to exactly the
|
|
# traffic that reaches NetBox and nothing else on the shared gateway.
|
|
targetRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
name: netbox
|
|
extAuth:
|
|
# HTTP, not gRPC. This is the whole reason the gateway is Envoy Gateway and not
|
|
# Contour: Contour supports only the gRPC ext_authz protocol, and Authelia
|
|
# implements the HTTP ExtAuthz filter.
|
|
http:
|
|
backendRefs:
|
|
- name: authelia
|
|
namespace: authelia # allowed by ../authelia/referencegrant-extauth.yaml
|
|
# The SERVICE port, not the container port. The Authelia chart publishes
|
|
# port 80 -> targetPort http (9091); referencing 9091 here is rejected with
|
|
# "TCP Port 9091 not found on service authelia/authelia".
|
|
port: 80
|
|
# Authelia's ExtAuthz endpoint. The ORIGINAL request path is appended to this
|
|
# prefix, which is how Authelia learns what was being requested.
|
|
path: /api/authz/ext-authz/
|
|
|
|
# Headers Envoy copies from Authelia's response ONTO the upstream request.
|
|
# NOTE this belongs to the `http` service block, not to `extAuth` — the API
|
|
# rejects it one level up (headersToBackend is a field of HTTPExtAuthService).
|
|
#
|
|
# SECURITY: "coexisting headers will be overridden" (Envoy Gateway API docs) —
|
|
# a client-supplied Remote-User is replaced by Authelia's verdict, not merged.
|
|
# This list is the entire trust boundary; do not add anything NetBox reads for
|
|
# authorization that Authelia does not itself vouch for.
|
|
headersToBackend:
|
|
- Remote-User
|
|
- Remote-Groups
|
|
- Remote-Email
|
|
- Remote-Name
|
|
|
|
# Headers Envoy forwards TO Authelia. Without cookie there is no session and every
|
|
# request bounces to the portal; without the X-Forwarded-* trio Authelia cannot
|
|
# reconstruct the original URL and answers 400.
|
|
headersToExtAuth:
|
|
- cookie
|
|
- authorization
|
|
- proxy-authorization
|
|
- accept
|
|
- x-forwarded-proto
|
|
- x-forwarded-host
|
|
- x-forwarded-uri
|
|
- x-forwarded-for
|
|
- x-original-method
|
|
|
|
# Fail CLOSED. If Authelia is down, refuse traffic rather than admit unauthenticated
|
|
# requests to a service whose entire auth model is "trust the header".
|
|
failOpen: false
|