feat(apps): Put garage-ui behind authentik forward-auth

apps/garage-ui/httproute.yaml

@@ -15,8 +15,22 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: garage-ui
+        - name: authentik-server
+          namespace: authentik
           port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - middleware.yaml
   - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

argocd-apps/services/garage-ui.yaml

@@ -27,9 +27,7 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: true
-                existingSecret:
-                  name: garage-ui-secrets
+                enabled: false
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:

infra/authentik/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
+  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server