Thom Seddon
@ -0,0 +1,39 @@
|
||||
# Kubernetes - Advanced Separate Pod Example
|
||||
|
||||
This is an advanced example of how to deploy traefik-forward-auth in it's own pod. This example is a good starting point for those who already have traefik deployed (e.g. using helm).
|
||||
|
||||
This example uses [Individual Authentication](https://github.com/thomseddon/traefik-forward-auth/blob/master/README.md#individual-ingress-authentication-in-kubernetes) to selectively apply forward authentication to each individual ingresses, for example:
|
||||
|
||||
```
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
tls:
|
||||
certresolver: default
|
||||
```
|
||||
|
||||
This example also includes SSL via traefik acme/lesencrypt, auth host mode, and leverages kustomise. A simple example "whoami" application (deployment, service and ingress) is included for completeness.
|
||||
|
||||
Example deployment:
|
||||
|
||||
```
|
||||
# Deploy traefik-forward-auth
|
||||
kubectl apply -k traefik-forward-auth
|
||||
|
||||
# Deploy example whoami app
|
||||
kubectl apply -k whoami
|
||||
```
|
||||
@ -0,0 +1,3 @@
|
||||
bases:
|
||||
- traefik-forward-auth
|
||||
- whoami
|
||||
@ -0,0 +1,8 @@
|
||||
rule.example_public.action=allow
|
||||
rule.example_public.rule=Host("stats.example.com") && PathPrefix("/api/public")
|
||||
|
||||
rule.example_api.action=allow
|
||||
rule.example_api.rule=Host("api.example.com") && Headers("X-API-Authorization", "a-long-api-key")
|
||||
|
||||
rule.example_api_query.action=allow
|
||||
rule.example_api_query.rule=Host("api.example.com") && && Query("api_key=a-long-api-key")
|
||||
@ -0,0 +1,71 @@
|
||||
#
|
||||
# Traefik Forward Auth Deployment
|
||||
#
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: traefik-forward-auth
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: traefik-forward-auth
|
||||
spec:
|
||||
serviceAccountName: traefik-ingress-controller
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- image: thomseddon/traefik-forward-auth:2
|
||||
name: traefik-forward-auth
|
||||
ports:
|
||||
- containerPort: 4181
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: CONFIG
|
||||
value: "/config"
|
||||
- name: DOMAIN
|
||||
value: "example.com"
|
||||
# INSECURE_COOKIE is required if not using a https entrypoint
|
||||
# - name: INSECURE_COOKIE
|
||||
# value: "true"
|
||||
# Remove COOKIE_DOMAIN if not using auth host mode
|
||||
- name: COOKIE_DOMAIN
|
||||
value: "example.com"
|
||||
- name: AUTH_HOST
|
||||
value: "auth.example.com"
|
||||
- name: LOG_LEVEL
|
||||
value: "info"
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: secrets
|
||||
key: google-client-id
|
||||
- name: PROVIDERS_GOOGLE_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: secrets
|
||||
key: google-client-secret
|
||||
- name: SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: secrets
|
||||
key: secret
|
||||
volumeMounts:
|
||||
- name: configs
|
||||
mountPath: /config
|
||||
subPath: traefik-forward-auth.ini
|
||||
|
||||
volumes:
|
||||
- name: configs
|
||||
configMap:
|
||||
name: configs
|
||||
- name: secrets
|
||||
secret:
|
||||
secretName: secrets
|
||||
@ -0,0 +1,20 @@
|
||||
#
|
||||
# Auth Ingress
|
||||
#
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`auth.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: traefik-forward-auth
|
||||
port: 4181
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,26 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: default
|
||||
commonLabels:
|
||||
app: traefik-forward-auth
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- middleware.yaml
|
||||
|
||||
#
|
||||
# Configs
|
||||
#
|
||||
configMapGenerator:
|
||||
- name: configs
|
||||
files:
|
||||
- configs/traefik-forward-auth.ini
|
||||
|
||||
#
|
||||
# Secrets
|
||||
#
|
||||
secretGenerator:
|
||||
- name: secrets
|
||||
env: secrets/traefik-forward-auth.env
|
||||
@ -0,0 +1,9 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://traefik-forward-auth:4181
|
||||
authResponseHeaders:
|
||||
- X-Forwarded-User
|
||||
@ -0,0 +1,3 @@
|
||||
google-client-id=client-id
|
||||
google-client-secret=client-secret
|
||||
secret=something-random
|
||||
@ -0,0 +1,17 @@
|
||||
#
|
||||
# Auth Service
|
||||
#
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: traefik-forward-auth
|
||||
labels:
|
||||
app: traefik
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: traefik
|
||||
ports:
|
||||
- name: auth-http
|
||||
port: 4181
|
||||
targetPort: 4181
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
containers:
|
||||
- image: containous/whoami
|
||||
name: whoami
|
||||
@ -0,0 +1,19 @@
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- https
|
||||
routes:
|
||||
- match: Host(`whoami.example.com`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: traefik-forward-auth
|
||||
tls:
|
||||
certresolver: default
|
||||
@ -0,0 +1,7 @@
|
||||
commonLabels:
|
||||
app: whoami
|
||||
|
||||
resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app: whoami
|
||||
|
||||
Reference in New Issue
Block a user