feat(dex): add Traefik IngressRoute support for Dex ingress routing#385
feat(dex): add Traefik IngressRoute support for Dex ingress routing#385mgrzybek wants to merge 8 commits into
Conversation
Add an ingress_routing_type config field ('ingress' by default, backward
compatible) that switches Dex from Kubernetes Ingress resources to Traefik
IngressRoute + Middleware CRDs when set to 'ingressroute'.
The Traefik path creates three Middlewares per Realm (strip X-Remote-User,
inject X-Auth-Tenancy-Id, ForwardAuth to the session verify endpoint) and
two IngressRoutes (catchall Dex path, authenticated callback), replacing
the two nginx-annotated Ingress resources.
The ClusterRole is extended with traefik.io/ingressroutes and
traefik.io/middlewares permissions to allow the operator to manage these
resources.
|
This looks good code-wise, thanks. I'm thinking about how we deal with leftover ingress resources when a version of this is deployed with Should we handle cleaning up |
Co-authored-by: Matt Anson <matta@stackhpc.com>
This is an operator. We could add some logic into the reconcile loop. This makes sense. |
When ingress_routing_type changes between ingress and ingressroute, the reconciliation loop now deletes resources of the other type, making it fully convergent. 404s are ignored for fresh deployments.
2 participants
Add an ingress_routing_type config field ('ingress' by default, backward compatible) that switches Dex from Kubernetes Ingress resources to Traefik IngressRoute + Middleware CRDs when set to 'ingressroute'.
The Traefik path creates three Middlewares per Realm (strip
X-Remote-User, injectX-Auth-Tenancy-Id,ForwardAuthto the session verify endpoint) and two IngressRoutes (catchall Dex path, authenticated callback), replacing the two nginx-annotated Ingress resources.The ClusterRole is extended with
traefik.io/ingressroutesandtraefik.io/middlewarespermissions to allow the operator to manage these resources.