105 lines
3.0 KiB
YAML
105 lines
3.0 KiB
YAML
# Three Ingresses on one host because middlewares and router priority are
|
|
# per-Ingress. Traefik matches pathType Prefix character-wise (not per path
|
|
# segment), so public prefixes carry a trailing slash and priorities are
|
|
# explicit - by default Traefik orders routers by rule length, which would
|
|
# not reliably put /api/admin above /api/.
|
|
# 300 dev-admin /api/admin -> Authelia -> api (prefix /api stripped)
|
|
# 200 dev-public /api/ /m /m/ -> api / m, public (prefixes stripped)
|
|
# 100 dev / -> Authelia -> ui (also bare /api)
|
|
# All carry the tls section (otherwise the router is http-only), but only
|
|
# "dev" has the cert-manager annotation so a single Certificate owns dev-tls.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dev
|
|
namespace: dev
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
traefik.ingress.kubernetes.io/router.priority: "100"
|
|
traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: dev.aggtaa.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: ui
|
|
tls:
|
|
- secretName: dev-tls
|
|
hosts:
|
|
- dev.aggtaa.com
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dev-admin
|
|
namespace: dev
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.priority: "300"
|
|
traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd,dev-strip-prefix@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: dev.aggtaa.com
|
|
http:
|
|
paths:
|
|
# no trailing slash on purpose: also catches bare /api/admin
|
|
# (and /api/administrator...), all of which stay behind Authelia
|
|
- path: /api/admin
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: api
|
|
tls:
|
|
- secretName: dev-tls
|
|
hosts:
|
|
- dev.aggtaa.com
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: dev-public
|
|
namespace: dev
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.priority: "200"
|
|
traefik.ingress.kubernetes.io/router.middlewares: dev-strip-prefix@kubernetescrd
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: dev.aggtaa.com
|
|
http:
|
|
paths:
|
|
- path: /api/
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: api
|
|
- path: /m
|
|
pathType: Exact
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: m
|
|
- path: /m/
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: dev
|
|
port:
|
|
name: m
|
|
tls:
|
|
- secretName: dev-tls
|
|
hosts:
|
|
- dev.aggtaa.com
|