mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3f46279b39
Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in front of the dsh-gateway, wired through the Traefik Gateway API. The gateway inherits the authenticated GitHub username via X-Forwarded-User (SSO). - gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap (auto-provision claim + mint/rotate token + session cookie), patch_token() - 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true - gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example, HTTPRoute backend -> oauth2-proxy:4180 - tests: 10 new SSO cases (106 passing) Placeholders (dsh-demo.example.com, your-github-org) are substituted at apply time. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
22 lines
595 B
YAML
22 lines
595 B
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: dsh-gateway
|
|
namespace: dsh-demo
|
|
labels:
|
|
app.kubernetes.io/part-of: dsh-demo
|
|
spec:
|
|
parentRefs:
|
|
- name: dsh-gateway
|
|
namespace: dsh-demo
|
|
sectionName: https
|
|
hostnames:
|
|
# TODO: replace with the actual public FQDN before applying.
|
|
- dsh-demo.example.com
|
|
rules:
|
|
- backendRefs:
|
|
# Route through oauth2-proxy (GitHub OAuth) first; it authenticates the
|
|
# browser and forwards to dsh-gateway:8080 with X-Forwarded-User set.
|
|
- name: oauth2-proxy
|
|
port: 4180
|