mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 14:04:31 +00:00
416318dada
Without this, kubectl apply without -n flag lands in default namespace instead of monitoring, leaving the live configmap with the old knoe-auth hostname.
83 lines
2.9 KiB
YAML
83 lines
2.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: knoe-grafana-proxy-nginx
|
|
namespace: monitoring
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
events { worker_connections 1024; }
|
|
http {
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Never trust inbound auth headers from clients.
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
|
|
location = /_auth_verify {
|
|
internal;
|
|
proxy_pass http://authority-prole-auth.knoe-system.svc.cluster.local:8080/auth/verify;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# Pass Google OAuth and Grafana login paths through without auth_request
|
|
# so auth.google sign-in can complete. Kerberos users still reach Grafana
|
|
# via the auth_request path below and get X-WEBAUTH-USER injected.
|
|
location = /grafana/login/google {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location ~ ^/grafana/login(/.*)?$ {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location / {
|
|
auth_request /_auth_verify;
|
|
auth_request_set $knoe_user $upstream_http_x_knoe_user;
|
|
auth_request_set $knoe_groups $upstream_http_x_knoe_groups;
|
|
|
|
error_page 401 = @login;
|
|
error_page 403 = @login;
|
|
|
|
proxy_set_header X-WEBAUTH-USER $knoe_user;
|
|
proxy_set_header X-Knoe-Groups $knoe_groups;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location @login {
|
|
return 302 https://api.prole.org/auth/login?next=$scheme://$host$request_uri;
|
|
}
|
|
}
|
|
}
|