mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 17:34:31 +00:00
73bfbc3a98
- kong-configmap: sync to live content; fix grafana upstream to route through
knoe-grafana-proxy (nginx auth proxy) instead of kps-grafana (stale service
name from old helm release); add db.prole.org → oauth2-proxy route; fix
knoe-auth FQDN to authority-prole-auth
- grafana-proxy-configmap: fix upstream to prometheus-grafana (helm release
name is 'prometheus', not 'kps'); fix auth_request FQDN to
authority-prole-auth.knoe-system; fix login redirect to api.prole.org
- grafana-proxy-{deployment,service}: add namespace: monitoring
82 lines
2.8 KiB
YAML
82 lines
2.8 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: knoe-grafana-proxy-nginx
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 1;
|
|
events { worker_connections 1024; }
|
|
http {
|
|
map $http_upgrade $connection_upgrade {
|
|
default upgrade;
|
|
'' close;
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name _;
|
|
|
|
# Never trust inbound auth headers from clients.
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
|
|
location = /_auth_verify {
|
|
internal;
|
|
proxy_pass http://authority-prole-auth.knoe-system.svc.cluster.local:8080/auth/verify;
|
|
proxy_pass_request_body off;
|
|
proxy_set_header Content-Length "";
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_set_header X-Forwarded-Host $host;
|
|
}
|
|
|
|
# Pass Google OAuth and Grafana login paths through without auth_request
|
|
# so auth.google sign-in can complete. Kerberos users still reach Grafana
|
|
# via the auth_request path below and get X-WEBAUTH-USER injected.
|
|
location = /grafana/login/google {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location ~ ^/grafana/login(/.*)?$ {
|
|
proxy_set_header X-WEBAUTH-USER "";
|
|
proxy_set_header X-Knoe-Groups "";
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_http_version 1.1;
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location / {
|
|
auth_request /_auth_verify;
|
|
auth_request_set $knoe_user $upstream_http_x_knoe_user;
|
|
auth_request_set $knoe_groups $upstream_http_x_knoe_groups;
|
|
|
|
error_page 401 = @login;
|
|
error_page 403 = @login;
|
|
|
|
proxy_set_header X-WEBAUTH-USER $knoe_user;
|
|
proxy_set_header X-Knoe-Groups $knoe_groups;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|
|
|
|
proxy_pass http://prometheus-grafana.monitoring.svc.cluster.local:80;
|
|
}
|
|
|
|
location @login {
|
|
return 302 https://api.prole.org/auth/login?next=$scheme://$host$request_uri;
|
|
}
|
|
}
|
|
}
|