feat(apps): Enable network policies for redoost

apps/garage-ui/httproute.yaml

@@ -15,8 +15,22 @@ spec:
       sectionName: websecure
   rules:
     - backendRefs:
-        - name: garage-ui
+        - name: authentik-server
+          namespace: authentik
           port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /outpost.goauthentik.io
+    - backendRefs:
+        - name: garage-ui
+          port: 80
+      filters:
+        - extensionRef:
+            group: traefik.io
+            kind: Middleware
+            name: authentik
+          type: ExtensionRef
       matches:
         - path:
             type: PathPrefix

apps/garage-ui/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - sealed-secret.yaml
+  - middleware.yaml
   - httproute.yaml

apps/garage-ui/middleware.yaml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: authentik
+  namespace: garage
+spec:
+  forwardAuth:
+    address: http://authentik-server.authentik.svc.cluster.local/outpost.goauthentik.io/auth/traefik
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+    trustForwardHeader: true

argocd-apps/services/garage-ui.yaml

@@ -27,9 +27,7 @@ spec:
                 name: garage-ui-secrets
             auth:
               admin:
-                enabled: true
+                enabled: false
-                existingSecret:
-                  name: garage-ui-secrets
               jwt_private_key_secret:
                 name: garage-ui-secrets
             cors:

argocd-apps/services/redoost.yaml

@@ -39,6 +39,19 @@ spec:
             websiteUpstream: garage.garage.svc.cluster.local:3902
             bucket: redoost-sites
             existingSecret: redoost-s3
+          networkPolicy:
+            enabled: true
+            gateway:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: traefik
+            s3:
+              - namespaceSelector:
+                  matchLabels:
+                    kubernetes.io/metadata.name: garage
+                podSelector:
+                  matchLabels:
+                    app.kubernetes.io/name: garage
     - path: apps/redoost
       repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
       targetRevision: main

bootstrap/argocd-cm-oidc-patch.yaml

@@ -8,6 +8,7 @@ data:
     issuer: https://auth.whyredfire.dev/application/o/argocd/
     clientID: argocd
     clientSecret: $argocd-oidc:clientSecret
+    enablePKCEAuthentication: true
     requestedScopes:
       - openid
       - profile

infra/authentik/blueprints.yaml

@@ -4,18 +4,11 @@ metadata:
   name: authentik-blueprints
   namespace: authentik
 data:
-  # Google is the only way in: its source has no enrollment flow, so a Google
-  # account can only log in when a user with the same email already exists.
   google-login.yaml: |
     version: 1
     metadata:
       name: Google login
     entries:
-      - model: authentik_blueprints.metaapplyblueprint
-        attrs:
-          identifiers:
-            path: default/flow-default-authentication-flow.yaml
-          required: true
       - model: authentik_blueprints.metaapplyblueprint
         attrs:
           identifiers:
@@ -48,8 +41,29 @@ data:
           provider_type: google
           user_matching_mode: email_link
       - model: authentik_stages_identification.identificationstage
+        id: google-identification
         identifiers:
-          name: default-authentication-identification
+          name: google-identification
         attrs:
           sources:
             - !KeyOf google
+          user_fields: []
+      - model: authentik_flows.flow
+        id: google-flow
+        identifiers:
+          slug: google-login
+        attrs:
+          authentication: require_unauthenticated
+          designation: authentication
+          name: Google login
+          title: Welcome!
+      - model: authentik_flows.flowstagebinding
+        identifiers:
+          order: 10
+          stage: !KeyOf google-identification
+          target: !KeyOf google-flow
+      - model: authentik_brands.brand
+        identifiers:
+          domain: authentik-default
+        attrs:
+          flow_authentication: !KeyOf google-flow

infra/authentik/httproute.yaml

@@ -14,6 +14,20 @@ spec:
       namespace: traefik
       sectionName: websecure
   rules:
+    # The ArgoCD Android app posts to the token endpoint without its trailing slash
+    - backendRefs:
+        - name: authentik-server
+          port: 80
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              replaceFullPath: /application/o/token/
+              type: ReplaceFullPath
+      matches:
+        - path:
+            type: Exact
+            value: /application/o/token
     - backendRefs:
         - name: authentik-server
           port: 80

infra/authentik/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - sealed-secret.yaml
   - blueprints.yaml
   - httproute.yaml
+  - referencegrant.yaml

infra/authentik/referencegrant.yaml

@@ -0,0 +1,17 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: outpost
+  namespace: authentik
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: garage
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: qbit
+  to:
+    - group: ""
+      kind: Service
+      name: authentik-server