jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
40 lines
1.8 KiB
YAML
40 lines
1.8 KiB
YAML
---
|
|
# North-south ingress for Homepage at the APEX home.keithjackson.dev. Attaches to the shared Gateway
|
|
# via the dedicated `https-apex` listener (sectionName) — the wildcard `https` listener's hostname
|
|
# `*.home.keithjackson.dev` does NOT match the bare apex, so this route MUST bind the apex listener
|
|
# added in platform/gateway/gateway.yaml. TLS is terminated at the Gateway by the wildcard cert (the
|
|
# apex is a SAN on it). Same-namespace backend, so no ReferenceGrant; the parentRef is permitted
|
|
# because the homepage namespace carries gateway-access=shared.
|
|
#
|
|
# auth-mode=forward-auth records the INTENDED posture: Homepage is a bare UI with no native OIDC, so
|
|
# it should sit behind oauth2-proxy forward-auth at the Gateway (R-IDP-02). NOTE: the Gateway
|
|
# ext-authz ATTACHMENT that actually enforces forward-auth is a Phase-6 WS-NET TODO that is NOT yet
|
|
# built anywhere in the repo (platform/oauth2-proxy is the authenticator only; no CiliumEnvoyConfig /
|
|
# ext-authz exists). Until that mechanism lands, this route — like every other forward-auth app
|
|
# (jackett, qbittorrent, pihole, radarr, …) — is reachable without auth. See README.md "Forward-auth".
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: homepage
|
|
namespace: homepage
|
|
labels:
|
|
app.kubernetes.io/name: homepage
|
|
annotations:
|
|
homelab.keithjackson.dev/auth-mode: forward-auth
|
|
homelab.keithjackson.dev/auth-groups: platform-admins
|
|
spec:
|
|
parentRefs:
|
|
- name: shared
|
|
namespace: gateway
|
|
sectionName: https-apex # the apex listener (wildcard `https` won't match the bare apex)
|
|
hostnames:
|
|
- home.keithjackson.dev
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: homepage
|
|
port: 80
|