ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/longhorn-ui/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - oauth2-proxy.yaml
+  - route.yaml
+  - vso.yaml
+  - network-policies.yaml

vendor/infrastructure/longhorn-ui/network-policies.yaml

@@ -0,0 +1,139 @@
+---
+# Longhorn UI only accepts browser traffic through oauth2-proxy.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: longhorn-ui-auth-proxy-ingress
+  namespace: longhorn
+spec:
+  endpointSelector:
+    matchLabels:
+      app: longhorn-ui
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: longhorn
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+---
+# longhorn-oauth2-proxy: Gateway ingress, upstream Longhorn UI, Zitadel OIDC.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: longhorn
+  ingress:
+    # Kubelet probes, local port-forwarding, and same-node Gateway backend flows.
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+    # Gateway I Envoy proxy: outbound connections use reserved:ingress identity.
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            gateway.networking.k8s.io/gateway-name: gateway-internal
+            k8s:io.kubernetes.pod.namespace: kube-system
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app: longhorn-ui
+      toPorts:
+        - ports:
+            - port: "8000"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: zitadel
+            app.kubernetes.io/name: zitadel-oidc-internal
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: gateway-internal-egress-longhorn-oauth2-proxy
+spec:
+  endpointSelector:
+    matchLabels:
+      "reserved:ingress": ""
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: longhorn
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-longhorn-oauth2-proxy
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: longhorn
+      toPorts:
+        - ports:
+            - port: "4180"
+              protocol: TCP
+---
+# Same-node Gateway backend selections can return to node-local ephemeral
+# source ports via the host path.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-longhorn-oauth2-proxy-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: longhorn
+            app.kubernetes.io/name: oauth2-proxy
+            app.kubernetes.io/instance: longhorn
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/infrastructure/longhorn-ui/oauth2-proxy.yaml

@@ -0,0 +1,97 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: longhorn-vso
+  namespace: longhorn
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: longhorn
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oauth2-proxy
+        app.kubernetes.io/instance: longhorn
+        gateway.quorate.internal/allow-gateway-client: "true"
+        quorate.dev/zitadel-relay: "true"
+    spec:
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+          imagePullPolicy: IfNotPresent
+          args:
+            - --http-address=0.0.0.0:4180
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.quorate.dev
+            - --redirect-url=https://longhorn.quorate.internal/oauth2/callback
+            - --upstream=http://longhorn-frontend.longhorn.svc.cluster.local:80
+            - --email-domain=*
+            - --scope=openid profile email groups
+            - --allowed-group=longhorn_admin
+            - --reverse-proxy=true
+            - --skip-provider-button=true
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --cookie-refresh=1h
+            - --cookie-expire=8h
+          envFrom:
+            - secretRef:
+                name: longhorn-oauth2-proxy
+          ports:
+            - name: http
+              containerPort: 4180
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          startupProbe:
+            httpGet:
+              path: /ping
+              port: http
+            failureThreshold: 12
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+  ports:
+    - name: http
+      port: 4180
+      targetPort: http
+      protocol: TCP

vendor/infrastructure/longhorn-ui/route.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: longhorn
+  namespace: longhorn
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - longhorn.quorate.internal
+  rules:
+    - backendRefs:
+        - name: longhorn-oauth2-proxy
+          port: 4180

vendor/infrastructure/longhorn-ui/vso.yaml

@@ -0,0 +1,27 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: longhorn
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: longhorn
+    serviceAccount: longhorn-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+spec:
+  type: kv-v2
+  mount: secret
+  path: longhorn/oauth2-proxy
+  destination:
+    name: longhorn-oauth2-proxy
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default