126 lines
3.9 KiB
YAML
126 lines
3.9 KiB
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: otel-debug-ingress-public
|
|
namespace: monitoring
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
|
|
nginx.ingress.kubernetes.io/websocket-services: "otel-debug-service"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: "50m"
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- otel.k6n.net
|
|
secretName: otel-k6n-tls
|
|
rules:
|
|
- host: otel.k6n.net
|
|
http:
|
|
paths:
|
|
- path: /api
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /v1
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /health
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
# The handler has its own static token authentication. This route
|
|
# lets an in-cluster ingress synchronizer fetch promoted IPs without
|
|
# requiring a browser OIDC session.
|
|
- path: /internal/honeypot
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /ws
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /agents_example.md
|
|
pathType: ImplementationSpecific
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /instrumentation.md
|
|
pathType: ImplementationSpecific
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
- path: /static
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: otel-debug-ingress
|
|
namespace: monitoring
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# OIDC protection via the platform auth service (users.k6n.net):
|
|
# /oauth2/auth resolves the session cookie / bearer token and answers
|
|
# 200 (allow), 401 (challenge -> browser_redirect to /login) or 403.
|
|
# otel.k6n.net is registered as a realm host in the auth service's
|
|
# realms.json. Public API and agent endpoints are routed via otel-debug-ingress-public.
|
|
nginx.ingress.kubernetes.io/auth-url: https://users.k6n.net/oauth2/auth
|
|
nginx.ingress.kubernetes.io/auth-signin: https://users.k6n.net/login?rd=$scheme://$host$escaped_request_uri
|
|
nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-User
|
|
nginx.ingress.kubernetes.io/auth-cache-duration: 200 60s, 401 5s, 403 5s
|
|
nginx.ingress.kubernetes.io/auth-proxy-set-headers: monitoring/auth-subrequest-headers
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- otel.k6n.net
|
|
secretName: otel-k6n-tls
|
|
rules:
|
|
- host: otel.k6n.net
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: otel-debug-service
|
|
port:
|
|
number: 80
|
|
---
|
|
# Header map for the auth subrequest (same pattern as home/auth-subrequest-headers).
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: auth-subrequest-headers
|
|
namespace: monitoring
|
|
data:
|
|
X-Original-Method: $request_method
|
|
X-Original-URL: $scheme://$host$request_uri
|