From 34de8a5f34eec3910aa3dd564e8c6d693fd188c3 Mon Sep 17 00:00:00 2001 From: chrisfu Date: Wed, 22 Apr 2026 06:30:29 -0700 Subject: [PATCH] **fix(supabase): update cookie domain handling and enhance manifest-generation with new paths** --- conf/gke.cfg | 15 +++----- prole-auth/target/classes/application.yml | 2 +- ...PasswordService$FixedCallbackHandler.class | Bin 1673 -> 2842 bytes supabase/helm/generated/manifest-summary.json | 4 ++- .../helm/generated/supabase-helm.app.yaml | 32 ++++++++---------- 5 files changed, 23 insertions(+), 30 deletions(-) diff --git a/conf/gke.cfg b/conf/gke.cfg index 9caa8fd..6d05107 100644 --- a/conf/gke.cfg +++ b/conf/gke.cfg @@ -1,5 +1,5 @@ ; Prole Master Configuration File -; Generated by install.py on 2026-04-20 22:44:30 +; Generated by install.py on 2026-04-21 20:06:41 ; This file is used as input for Ansible deployment and k8s cluster creation. [User] @@ -79,8 +79,8 @@ init_password.cluster_name = ${CLUSTER_NAME} init_password.db_cluster_name = knoe-dev-cnpg-0 init_password.db_host_port = 5432 init_password.db_namespace = ${DATABASE_NAMESPACE} -init_password.db_password = ${PROLE_SECRET:v1:rNg0cdK0dMk1kxsb:0Eu8yWnNpdwTDLnAaUItgMV6VjMZPDTQRMrU09mKQzozWE05U-7LLQ==} -init_password.db_password_confirm = ${PROLE_SECRET:v1:rNg0cdK0dMk1kxsb:0Eu8yWnNpdwTDLnAaUItgMV6VjMZPDTQRMrU09mKQzozWE05U-7LLQ==} +init_password.db_password = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh} +init_password.db_password_confirm = ${PROLE_SECRET:v1:ZFFldOYIZkB0YP4L:hPhu1R9jyKh5lYPsbrtLdd8F0leQ_yBODT6f4cYL9lU9GrBh} init_password.db_username = chrisfu init_password.generate_ssh_key = true init_scripts.run_scripts = true @@ -114,7 +114,7 @@ CNPG_SIZE_PROFILE = small DATABASE_NAMESPACE = knoe-db-0 DB_CLUSTER_KUBECONTEXT = gke_plenary-truck-485623-p7_us-west3_knoe-dev-cnpg-0 DB_HOST_PORT = 5432 -DB_PASSWORD = ${PROLE_SECRET:v1:AX1bdMcT41sPTZbS:wvvf8AVN-hvKOcJWg1EIBtly78nrTL7rBrjfLXboqqMUD_qw-lSoSQ==} +DB_PASSWORD = ${PROLE_SECRET:v1:MnnRuv9H3uhhWQp2:-oCq5ybT1tVEOjAiH5DjrTDrPa8hYituYyK1gdxlcuLFfmXa} DEPLOYMENT_MODE = k8s DEPLOYMENT_TARGET = prole-prod-cluster DOCKER_IMPORT_DIR = @@ -128,12 +128,7 @@ GITLAB_OIDC_CLIENT_ID = secretref://google-oidc-client-id GITLAB_OIDC_CLIENT_SECRET = secretref://google-oidc-client-secret GITLAB_OIDC_ISSUER = https://accounts.google.com GITLAB_PUBLIC_HOSTS = git.knoe.dev -; AUTOCLEAN was turned OFF on 2026-04-20 after it destructively deleted the -; gitaly PVC on every init_gitlab.sh run (has_legacy false-positive via -; bare PVC-exists check — fixed in setup_gitlab_storage). With the fix in -; place the flag is safe to re-enable, but 0 is the conservative default: -; a repair_blocked message is preferable to a silent data wipe. -GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 0 +GITLAB_REPAIR_BLOCKED_AUTOCLEAN = 1 GITLAB_SHELL_LOADBALANCER_IP = 34.106.243.154 GITLAB_SSH_HOST = git-ssh.knoe.dev GITLAB_WEBSERVICE_LIMITS_MEMORY = 3Gi diff --git a/prole-auth/target/classes/application.yml b/prole-auth/target/classes/application.yml index 4c7b28a..fd55b04 100644 --- a/prole-auth/target/classes/application.yml +++ b/prole-auth/target/classes/application.yml @@ -11,7 +11,7 @@ prole: auth: enabled: false cookieName: prole_session - cookieDomain: .prole.org + cookieDomain: ${PROLE_AUTH_COOKIE_DOMAIN:.prole.org} sessionTtl: 8h # REQUIRED in production when enabled. Provide via env: PROLE_AUTH_SESSION_SECRET sessionSecret: "" diff --git a/prole-auth/target/classes/org/prole/auth/kerberos/KerberosPasswordService$FixedCallbackHandler.class b/prole-auth/target/classes/org/prole/auth/kerberos/KerberosPasswordService$FixedCallbackHandler.class index b6fb745987d9299e8616df4966f3250a086e27c2..a37187fc344e47f2976bc8dc430edead1b55ac90 100644 GIT binary patch literal 2842 zcmb_e+fy4=82_D+%_elyK+45nX=|ZvF3^=)t0h=#Ly^d}g`y?iHp`K03E6dbL+QK! zgs;Bv;zOCS?F`OTef1CVZ*Ux^`kmcPNCh%D!^7^`^PThEe&20>f3^1#z(-i`L#Aj&Rjz7v zx1w%vyUcCVQD=gWMa^*@lb9uLZy7oto-(%iT0yH;%bLD1t<~15+-8Vbwo%g!ORF*@ zXZKB5a*4j47fMenNT7=$Y6TJ*LZyO?Btu3pY^x5}>$c%O@h#B<9qPQc$r}ng(TyGj zz35|*9qx)VhTil+m6;V8Z!nCu72R-dUwl6X6ugPE45vtZn~;5En$8-eSo5HXrGA!=!v>B}suEQZS55gq~~qm@=%UXHOz{ z`OHD^gvKih(#Vj;isn=b<{IH#JSmMup&+MV1f!Im{M))#br?z~B)-L;h4Le=yZOwj z43%M|ZR8q=H5}LEaq^1%sCo61YtPbJfO)D~>oJ4co~2PZ z4NL`_US_z`o~`A2jBxaN40(5KpBUmxF7>53&GN99aa+bD!=+;do}sf@s*a408O{hk z)iBlKLi2>7Cw)lCc-^)5pI+2VKL%#L-Wh`t zGQLpoCB9-f?_uN(9J^j~jZLolz6By_IFuV&7Qh_p}w#^om#pX82i8hI%iT$Qd(uANpvHGG1|@1 z+Cgg~`vNSRdj>f>@(l4^B86~`-VqW5jN%=7U+}NuI^LxnF?piJdBPJO!VUV4g@`Oj zAlCQrJ~0VRf6yAGwUnD1d3mejMz}XT_yZP3dc)VorIhp=y1z$XO8OPu<8n&Q{sj3s z&g>v9j{1Y6{_#jELPzoENbMm0GX@`~q!&2<%XeY6^UtoZy2G>jqNi#MJ+vDl+f}mp z7FqoX8MI91tYX~r=sH0$MDX0Cy-YV0>e%xPwDd@*ouE8 zP~J^*wRi~oW#GqSv5%1Ne#j?i4G~W?o7+S7DE>bGPSf`&W-vB}CC;UU754iE4t WKEu~UOVYh4?m@!<%2>lUNc{_8NYn5D delta 459 zcmX|7O-lk%6g_X$c{7t{SQH3RsADx+noZ?bWkrkHxM@?aOk60EK@!o%b<3Dt|3X57 z7A;x^(O+p95z?6nWZ>L)&wb~f^X75(K4iR)US0w0%<&%Y+w>L zmdGsr%dm_Uc3j}u2=}z$IVrH%=n8pv3dTtxO_k}~X`Q~iJI0tm9y2H)jv_KBVHahb z5KqaU^JlqUHUr1`h*hjXau(#xEL7?$OqSymsEw1T>#X2Ye diff --git a/supabase/helm/generated/manifest-summary.json b/supabase/helm/generated/manifest-summary.json index 86148d3..eee0823 100644 --- a/supabase/helm/generated/manifest-summary.json +++ b/supabase/helm/generated/manifest-summary.json @@ -3,6 +3,8 @@ "manifests": "/Users/chrisfu/dev/prole/supabase/k8s/supabase-helm.yaml", "manifests_app": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.app.yaml", "manifests_frontdoor_db": "/Users/chrisfu/dev/prole/supabase/helm/generated/supabase-helm.frontdoor-db.yaml", - "db_host": "knoe-db-rw.knoe-db-0.svc.cluster.local", + "manifests_public_ingress_tls": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-tls.yaml", + "manifests_public_ingress_kong": "/Users/chrisfu/dev/prole/supabase/k8s/public-ingress-kong.yaml", + "db_host": "10.180.15.236", "supabase_namespace": "supabase" } \ No newline at end of file diff --git a/supabase/helm/generated/supabase-helm.app.yaml b/supabase/helm/generated/supabase-helm.app.yaml index 1615b10..d352d24 100644 --- a/supabase/helm/generated/supabase-helm.app.yaml +++ b/supabase/helm/generated/supabase-helm.app.yaml @@ -28,7 +28,7 @@ --- {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-db", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"database": "cG9zdGdyZXM=", "password": "dnp4LndDNEFrZDR4LURqNldndWg=", "password_encoded": "dnp4LndDNEFrZDR4LURqNldndWg="}} --- -{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-jwt", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"anonKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaVlXNXZiaUlzSW1semN5STZJbXR1YjJVdGMzVndZV0poYzJVaUxDSnBZWFFpT2pFM056WXpNakUwTURVc0ltVjRjQ0k2TWpBNU1UWTRNVFF3TlgwLjQxNG5JcmVYWnFsVjhOemkzdnZWNVNuSmdiRTNGd181T0pIZVI3ek5qRFk=", "secret": "NGU1M2UxZWNiOThlYjMyZWU4M2I4OTBiZWE3OWU2NzhlOTUyYzZhZTIzN2VkZjNmNjVmMzdiZjZkZDIyNjJlYg==", "serviceKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaWMyVnlkbWxqWlY5eWIyeGxJaXdpYVhOeklqb2lhMjV2WlMxemRYQmhZbUZ6WlNJc0ltbGhkQ0k2TVRjM05qTXlNVFF3TlN3aVpYaHdJam95TURreE5qZ3hOREExZlEud3U0SVlQWEkwNjZtUHhUUHFnV3ZFRjRpaWRHZS1aalJaZDJLdm9tZTZaUQ=="}} +{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-jwt", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"anonKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaVlXNXZiaUlzSW1semN5STZJbXR1YjJVdGMzVndZV0poYzJVaUxDSnBZWFFpT2pFM056WTRNamN3T0Rjc0ltVjRjQ0k2TWpBNU1qRTROekE0TjMwLkJFbHZWemJkZ05tbHRZV3VtcnhwaWg3RU9LeU5NeXdveWtPLVo2UUZUdHc=", "secret": "NGU1M2UxZWNiOThlYjMyZWU4M2I4OTBiZWE3OWU2NzhlOTUyYzZhZTIzN2VkZjNmNjVmMzdiZjZkZDIyNjJlYg==", "serviceKey": "ZXlKaGJHY2lPaUpJVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SnliMnhsSWpvaWMyVnlkbWxqWlY5eWIyeGxJaXdpYVhOeklqb2lhMjV2WlMxemRYQmhZbUZ6WlNJc0ltbGhkQ0k2TVRjM05qZ3lOekE0Tnl3aVpYaHdJam95TURreU1UZzNNRGczZlEuakVzTUZQdDFnYjhxQWkzb1VPTnNoNVROY2dYeV8zZW8wMC1TVzVjU2dLWQ=="}} --- {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-meta", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"cryptoKey": "eW91ci1lbmNyeXB0aW9uLWtleS0zMi1jaGFycy1taW4="}} --- @@ -36,13 +36,13 @@ --- {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-realtime", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"secretKeyBase": "VXBOVm50bjNjRHhISnBxOTlZTWMxVDFBUWdRcGM4a2ZZVHVSZ0JpWWExNUJMcng4ZXRRb1h6M2dadjEvdTJvcQ=="}} --- -{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-s3", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": null} +{"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-s3", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"accessKey": "OWQzNmQ0MzRkMjZkZGRiOTcyZGNmZjJkOTI2NjYxMmI4ZTYxOGQ2YTYzYmIwOGM2ZTEyZTdlOTYzOGQ4MDQyMQ==", "keyId": "R0s5NmQ1ZmZlOGIxMWYzYTNkYzdhMDlhNzY="}} --- {"apiVersion": "v1", "kind": "Secret", "metadata": {"name": "supabase-smtp", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "type": "Opaque", "data": {"password": "ZmFrZV9tYWlsX3Bhc3N3b3Jk", "username": "ZmFrZV9tYWlsX3VzZXI="}} --- {"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-functions-main", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"index.ts": "import * as jose from 'https://deno.land/x/jose@v4.14.4/index.ts'\n\nconsole.log('main function started')\n\nconst JWT_SECRET = Deno.env.get('JWT_SECRET')\nconst VERIFY_JWT = Deno.env.get('VERIFY_JWT') === 'true'\n\nfunction getAuthToken(req: Request) {\nconst authHeader = req.headers.get('authorization')\nif (!authHeader) {\n throw new Error('Missing authorization header')\n}\nconst [bearer, token] = authHeader.split(' ')\nif (bearer !== 'Bearer') {\n throw new Error(`Auth header is not 'Bearer {token}'`)\n}\nreturn token\n}\n\nasync function verifyJWT(jwt: string): Promise {\nconst encoder = new TextEncoder()\nconst secretKey = encoder.encode(JWT_SECRET)\ntry {\n await jose.jwtVerify(jwt, secretKey)\n} catch (err) {\n console.error(err)\n return false\n}\nreturn true\n}\n\nDeno.serve(async (req: Request) => {\nif (req.method !== 'OPTIONS' && VERIFY_JWT) {\n try {\n const token = getAuthToken(req)\n const isValidJWT = await verifyJWT(token)\n\n if (!isValidJWT) {\n return new Response(JSON.stringify({ msg: 'Invalid JWT' }), {\n status: 401,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n } catch (e) {\n console.error(e)\n return new Response(JSON.stringify({ msg: e.toString() }), {\n status: 401,\n headers: { 'Content-Type': 'application/json' },\n })\n }\n}\n\nconst url = new URL(req.url)\nconst { pathname } = url\nconst path_parts = pathname.split('/')\nconst service_name = path_parts[1]\n\nif (!service_name || service_name === '') {\n const error = { msg: 'missing function name in request' }\n return new Response(JSON.stringify(error), {\n status: 400,\n headers: { 'Content-Type': 'application/json' },\n })\n}\n\nconst servicePath = `/home/deno/functions/${service_name}`\nconsole.error(`serving the request with ${servicePath}`)\n\nconst memoryLimitMb = 150\nconst workerTimeoutMs = 1 * 60 * 1000\nconst noModuleCache = false\nconst importMapPath = null\nconst envVarsObj = Deno.env.toObject()\nconst envVars = Object.keys(envVarsObj).map((k) => [k, envVarsObj[k]])\n\ntry {\n const worker = await EdgeRuntime.userWorkers.create({\n servicePath,\n memoryLimitMb,\n workerTimeoutMs,\n noModuleCache,\n importMapPath,\n envVars,\n })\n return await worker.fetch(req)\n} catch (e) {\n const error = { msg: e.toString() }\n return new Response(JSON.stringify(error), {\n status: 500,\n headers: { 'Content-Type': 'application/json' },\n })\n}\n})\n"}} --- -{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"wrapper.sh": "#!/bin/bash\n\nset -euo pipefail\n\necho \"Replacing env placeholders of /usr/local/kong/kong.yml\"\n\nsed \\\n-e \"s|\\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|\" \\\n-e \"s|\\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|\" \\\n-e \"s|\\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|\" \\\n-e \"s|\\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|\" \\\n/usr/local/kong/template.yml \\\n> /usr/local/kong/kong.yml\n\nexec /docker-entrypoint.sh kong docker-start\n", "template.yml": "_format_version: '2.1'\n_transform: true\n\nconsumers:\n - username: DASHBOARD\n - username: anon\n keyauth_credentials:\n - key: ${SUPABASE_ANON_KEY}\n - username: service_role\n keyauth_credentials:\n - key: ${SUPABASE_SERVICE_KEY}\nacls:\n - consumer: anon\n group: anon\n - consumer: service_role\n group: admin\nbasicauth_credentials:\n - consumer: DASHBOARD\n username: ${DASHBOARD_USERNAME}\n password: ${DASHBOARD_PASSWORD}\nservices:\n - name: auth-v1-open\n url: http://supabase-auth:9999/verify\n routes:\n - name: auth-v1-open\n strip_path: true\n paths:\n - /auth/v1/verify\n plugins:\n - name: cors\n - name: auth-v1-open-callback\n url: http://supabase-auth:9999/callback\n routes:\n - name: auth-v1-open-callback\n strip_path: true\n paths:\n - /auth/v1/callback\n plugins:\n - name: cors\n - name: auth-v1-open-authorize\n url: http://supabase-auth:9999/authorize\n routes:\n - name: auth-v1-open-authorize\n strip_path: true\n paths:\n - /auth/v1/authorize\n plugins:\n - name: cors\n - name: auth-v1\n _comment: \"GoTrue: /auth/v1/* -> http://supabase-auth:9999/*\"\n url: http://supabase-auth:9999\n routes:\n - name: auth-v1-all\n strip_path: true\n paths:\n - /auth/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: rest-v1\n _comment: \"PostgREST: /rest/v1/* -> http://supabase-rest:3000/*\"\n url: http://supabase-rest:3000/\n routes:\n - name: rest-v1-all\n strip_path: true\n paths:\n - /rest/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: graphql-v1\n _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'\n url: http://supabase-rest:3000/rpc/graphql\n routes:\n - name: graphql-v1-all\n strip_path: true\n paths:\n - /graphql/v1\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: request-transformer\n config:\n add:\n headers:\n - Content-Profile:graphql_public\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: realtime-v1-ws\n _comment: \"Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*\"\n url: http://supabase-realtime:4000/socket\n protocol: ws\n routes:\n - name: realtime-v1-ws\n strip_path: true\n paths:\n - /realtime/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: realtime-v1-rest\n _comment: 'Realtime: /realtime/v1/* -> http://supabase-realtime:4000/api/*'\n url: http://supabase-realtime:4000/api\n protocol: http\n routes:\n - name: realtime-v1-rest\n strip_path: true\n paths:\n - /realtime/v1/api\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: storage-v1\n _comment: \"Storage: /storage/v1/* -> http://supabase-storage:5000/*\"\n url: http://supabase-storage:5000/\n routes:\n - name: storage-v1-all\n strip_path: true\n paths:\n - /storage/v1/\n plugins:\n - name: cors\n - name: functions-v1\n _comment: 'Edge Functions: /functions/v1/* -> http://supabase-functions:9000/*'\n url: http://supabase-functions:9000/\n routes:\n - name: functions-v1-all\n strip_path: true\n paths:\n - /functions/v1/\n plugins:\n - name: cors\n\n\n\n\n - name: meta\n _comment: \"pg-meta: /pg/* -> http://supabase-meta:8080/*\"\n url: http://supabase-meta:8080/\n routes:\n - name: meta-all\n strip_path: true\n paths:\n - /pg/\n plugins:\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - name: dashboard\n _comment: 'Studio: /* -> http://supabase-studio:3000/*'\n url: http://supabase-studio:3000/\n routes:\n - name: dashboard-all\n strip_path: true\n paths:\n - /\n plugins:\n - name: cors\n - name: basic-auth\n config:\n hide_credentials: true\n"}} +{"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-kong", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"wrapper.sh": "#!/bin/bash\n\nset -euo pipefail\n\necho \"Replacing env placeholders of /usr/local/kong/kong.yml\"\n\nsed \\\n-e \"s|\\${SUPABASE_ANON_KEY}|${SUPABASE_ANON_KEY}|\" \\\n-e \"s|\\${SUPABASE_SERVICE_KEY}|${SUPABASE_SERVICE_KEY}|\" \\\n-e \"s|\\${DASHBOARD_USERNAME}|${DASHBOARD_USERNAME}|\" \\\n-e \"s|\\${DASHBOARD_PASSWORD}|${DASHBOARD_PASSWORD}|\" \\\n/usr/local/kong/template.yml \\\n> /usr/local/kong/kong.yml\n\nexec /docker-entrypoint.sh kong docker-start\n", "template.yml": "_format_version: '2.1'\n_transform: true\n\nconsumers:\n - username: DASHBOARD\n - username: anon\n keyauth_credentials:\n - key: ${SUPABASE_ANON_KEY}\n - username: service_role\n keyauth_credentials:\n - key: ${SUPABASE_SERVICE_KEY}\nacls:\n - consumer: anon\n group: anon\n - consumer: service_role\n group: admin\nbasicauth_credentials:\n - consumer: DASHBOARD\n username: ${DASHBOARD_USERNAME}\n password: ${DASHBOARD_PASSWORD}\nservices:\n # Dedicated health endpoint used by the GCE LB BackendConfig.\n # request-termination returns 200 synchronously without hitting any\n # upstream, so the probe passes as long as the Kong proxy itself is\n # accepting requests -- same liveness semantics as the TCP check we\n # originally wanted, but using the HTTP protocol that GCE's L7\n # BackendConfig CRD actually accepts (TCP is rejected with\n # `Protocol \"TCP\" is not valid, must be one of [HTTP,HTTPS,HTTP2]`).\n #\n # URL is a RFC-2606 reserved `.invalid` hostname that never resolves.\n # We originally tried `http://127.0.0.1:8000/` here, which is Kong's\n # own proxy port -- this crashlooped the pod on startup (rollout timed\n # out waiting for new pod to become Ready). Suspected cause: Kong's\n # declarative-config parser rejects the self-reference. Since the\n # request-termination plugin short-circuits before any DNS lookup or\n # upstream connection, using a non-resolvable placeholder URL is\n # equivalent in behavior but avoids the loop detection.\n - name: healthz\n url: http://knoe.healthz.invalid/\n routes:\n - name: healthz\n strip_path: true\n paths:\n - /healthz\n plugins:\n - name: request-termination\n config:\n status_code: 200\n message: ok\n - name: auth-v1-open\n url: http://supabase-auth:9999/verify\n routes:\n - name: auth-v1-open\n strip_path: true\n paths:\n - /auth/v1/verify\n plugins:\n - name: cors\n - name: auth-v1-open-callback\n url: http://supabase-auth:9999/callback\n routes:\n - name: auth-v1-open-callback\n strip_path: true\n paths:\n - /auth/v1/callback\n plugins:\n - name: cors\n - name: auth-v1-open-authorize\n url: http://supabase-auth:9999/authorize\n routes:\n - name: auth-v1-open-authorize\n strip_path: true\n paths:\n - /auth/v1/authorize\n plugins:\n - name: cors\n - name: auth-v1\n _comment: \"GoTrue: /auth/v1/* -> http://supabase-auth:9999/*\"\n url: http://supabase-auth:9999\n routes:\n - name: auth-v1-all\n strip_path: true\n paths:\n - /auth/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: rest-v1\n _comment: \"PostgREST: /rest/v1/* -> http://supabase-rest:3000/*\"\n url: http://supabase-rest:3000/\n routes:\n - name: rest-v1-all\n strip_path: true\n paths:\n - /rest/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: graphql-v1\n _comment: 'PostgREST: /graphql/v1/* -> http://supabase-rest:3000/rpc/graphql'\n url: http://supabase-rest:3000/rpc/graphql\n routes:\n - name: graphql-v1-all\n strip_path: true\n paths:\n - /graphql/v1\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: true\n - name: request-transformer\n config:\n add:\n headers:\n - Content-Profile:graphql_public\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: realtime-v1-ws\n _comment: \"Realtime: /realtime/v1/* -> ws://supabase-realtime:4000/socket/*\"\n url: http://supabase-realtime:4000/socket\n protocol: ws\n routes:\n - name: realtime-v1-ws\n strip_path: true\n paths:\n - /realtime/v1/\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: realtime-v1-rest\n _comment: 'Realtime: /realtime/v1/* -> http://supabase-realtime:4000/api/*'\n url: http://supabase-realtime:4000/api\n protocol: http\n routes:\n - name: realtime-v1-rest\n strip_path: true\n paths:\n - /realtime/v1/api\n plugins:\n - name: cors\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - anon\n - name: storage-v1\n _comment: \"Storage: /storage/v1/* -> http://supabase-storage:5000/*\"\n url: http://supabase-storage:5000/\n routes:\n - name: storage-v1-all\n strip_path: true\n paths:\n - /storage/v1/\n plugins:\n - name: cors\n - name: functions-v1\n _comment: 'Edge Functions: /functions/v1/* -> http://supabase-functions:9000/*'\n url: http://supabase-functions:9000/\n routes:\n - name: functions-v1-all\n strip_path: true\n paths:\n - /functions/v1/\n plugins:\n - name: cors\n\n\n\n\n - name: meta\n _comment: \"pg-meta: /pg/* -> http://supabase-meta:8080/*\"\n url: http://supabase-meta:8080/\n routes:\n - name: meta-all\n strip_path: true\n paths:\n - /pg/\n plugins:\n - name: key-auth\n config:\n hide_credentials: false\n - name: acl\n config:\n hide_groups_header: true\n allow:\n - admin\n - name: dashboard\n _comment: 'Studio: /* -> http://supabase-studio:3000/*'\n url: http://supabase-studio:3000/\n routes:\n - name: dashboard-all\n strip_path: true\n paths:\n - /\n plugins:\n - name: cors\n - name: basic-auth\n config:\n hide_credentials: true\n"}} --- {"apiVersion": "v1", "kind": "ConfigMap", "metadata": {"name": "supabase-vector-config", "labels": {"helm.sh/chart": "knoe-supabase-0.5.0-knoe.1", "app.kubernetes.io/name": "supabase", "app.kubernetes.io/instance": "supabase", "app.kubernetes.io/managed-by": "Helm"}}, "data": {"vector.yml": "api:\n enabled: true\n address: 0.0.0.0:9001\n\nsources:\n kubernetes_host:\n type: kubernetes_logs\n extra_label_selector: app.kubernetes.io/instance=supabase,app.kubernetes.io/name!=knoe-supabase-vector\n\ntransforms:\n project_logs:\n type: remap\n inputs:\n - kubernetes_host\n source: |-\n .project = \"default\"\n .event_message = del(.message)\n .appname = del(.kubernetes.container_name)\n del(.file)\n del(.kubernetes)\n del(.source_type)\n del(.stream)\n router:\n type: route\n inputs:\n - project_logs\n route:\n kong: '.appname == \"knoe-supabase-kong\"'\n auth: '.appname == \"knoe-supabase-auth\"'\n rest: '.appname == \"knoe-supabase-rest\"'\n realtime: '.appname == \"knoe-supabase-realtime\"'\n storage: '.appname == \"knoe-supabase-storage\"'\n functions: '.appname == \"knoe-supabase-functions\"'\n db: '.appname == \"knoe-supabase-db\"'\n # Ignores non nginx errors since they are related with kong booting up\n kong_logs:\n type: remap\n inputs:\n - router.kong\n source: |-\n req, err = parse_nginx_log(.event_message, \"combined\")\n if err == null {\n .timestamp = req.timestamp\n .metadata.request.headers.referer = req.referer\n .metadata.request.headers.user_agent = req.agent\n .metadata.request.headers.cf_connecting_ip = req.client\n .metadata.response.status_code = req.status\n url, split_err = split(req.request, \" \")\n if split_err == null {\n .metadata.request.method = url[0]\n .metadata.request.path = url[1]\n .metadata.request.protocol = url[2]\n }\n }\n if err != null {\n abort\n }\n # Ignores non nginx errors since they are related with kong booting up\n kong_err:\n type: remap\n inputs:\n - router.kong\n source: |-\n .metadata.request.method = \"GET\"\n .metadata.response.status_code = 200\n parsed, err = parse_nginx_log(.event_message, \"error\")\n if err == null {\n .timestamp = parsed.timestamp\n .severity = parsed.severity\n .metadata.request.host = parsed.host\n .metadata.request.headers.cf_connecting_ip = parsed.client\n url, err = split(parsed.request, \" \")\n if err == null {\n .metadata.request.method = url[0]\n .metadata.request.path = url[1]\n .metadata.request.protocol = url[2]\n }\n }\n if err != null {\n abort\n }\n # Gotrue logs are structured json strings which frontend parses directly. But we keep metadata for consistency.\n auth_logs:\n type: remap\n inputs:\n - router.auth\n source: |-\n parsed, err = parse_json(.event_message)\n if err == null {\n .metadata.timestamp = parsed.time\n .metadata = merge!(.metadata, parsed)\n }\n # PostgREST logs are structured so we separate timestamp from message using regex\n rest_logs:\n type: remap\n inputs:\n - router.rest\n source: |-\n parsed, err = parse_regex(.event_message, r'^(?P