prole/deploy/opentofu/k3s/manifests/knoe/kong-configmap.yaml

100 lines
2.6 KiB
YAML

apiVersion: v1
kind: ConfigMap
metadata:
name: knoe-svc-kong-config
namespace: knoe-system
data:
kong.yml: |
_format_version: "3.0"
_transform: true
services:
- name: healthz
url: http://knoe.healthz.invalid/
routes:
- name: healthz
paths:
- /healthz
strip_path: true
plugins:
- name: request-termination
config:
status_code: 200
message: ok
- name: knoe-service
url: http://knoe-svc.knoe-system.svc.cluster.local:8080
routes:
- name: knoe-k3s-kubeconfig
hosts:
- svc.prole.org
paths:
- /k3s/kube_config.sh
strip_path: false
- name: db-manager
url: http://knoe-db-manager.knoe-db.svc.cluster.local:80
routes:
- name: backup-route
hosts:
- svc.prole.org
paths:
- /backup
strip_path: false
# Grafana: routed through knoe-grafana-proxy (nginx) which handles
# Kerberos auth_request (X-WEBAUTH-USER injection) and passes
# /grafana/login paths through for auth.google sign-in.
- name: grafana
url: http://knoe-grafana-proxy.monitoring.svc.cluster.local:80
routes:
- name: grafana-root
hosts:
- svc.prole.org
paths:
- /
strip_path: false
- name: knoe-auth
url: http://knoe-auth.knoe-system.svc.cluster.local:8080
routes:
- name: knoe-auth-root
hosts:
- api.prole.org
paths:
- /
strip_path: false
# Supabase Studio: gated by oauth2-proxy (Google Workspace prole.org).
# oauth2-proxy forwards authenticated requests upstream to supabase-kong.
- name: studio
url: http://oauth2-proxy.supabase.svc.cluster.local:4180
routes:
- name: studio-root
hosts:
- db.prole.org
paths:
- /
strip_path: false
- name: gitea-http
url: http://gitea-http.gitea.svc.cluster.local:3000
routes:
- name: gitea-root
hosts:
- git-internal.prole.org
paths:
- /
strip_path: false
- name: gitea-ssh
host: gitea-ssh.gitea.svc.cluster.local
port: 22
protocol: tcp
routes:
- name: gitea-ssh-tcp
protocols:
- tcp
destinations:
- port: 3022