feat: add ForwardAuth middleware, protect Longhorn and Hubble with Authentik

manifests/middleware.yaml

@@ -0,0 +1,21 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authentik-forwardauth
+  namespace: traefik
+spec:
+  forwardAuth:
+    address: http://ak-outpost-traefik-forwardauth.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-authentik-username
+      - X-authentik-groups
+      - X-authentik-email
+      - X-authentik-name
+      - X-authentik-uid
+      - X-authentik-jwt
+      - X-authentik-meta-jwks
+      - X-authentik-meta-outpost
+      - X-authentik-meta-provider
+      - X-authentik-meta-app
+      - X-authentik-meta-version

manifests/protected-routes.yaml

@@ -0,0 +1,39 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: longhorn-ui
+  namespace: longhorn-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`longhorn.solidish.dev`)
+      kind: Rule
+      middlewares:
+        - name: authentik-forwardauth
+          namespace: traefik
+      services:
+        - name: longhorn-frontend
+          port: 80
+  tls:
+    secretName: longhorn-solidish-dev-tls
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: hubble-ui
+  namespace: kube-system
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`hubble.solidish.dev`)
+      kind: Rule
+      middlewares:
+        - name: authentik-forwardauth
+          namespace: traefik
+      services:
+        - name: hubble-ui
+          port: 80
+  tls:
+    secretName: hubble-solidish-dev-tls

manifests/routes.yaml

@@ -1,39 +1,5 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
-metadata:
-  name: longhorn-ui
-  namespace: longhorn-system
-spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure-longhorn
-  hostnames:
-    - longhorn.solidish.dev
-  rules:
-    - backendRefs:
-        - name: longhorn-frontend
-          port: 80
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: hubble-ui
-  namespace: kube-system
-spec:
-  parentRefs:
-    - name: traefik-gateway
-      namespace: traefik
-      sectionName: websecure-hubble
-  hostnames:
-    - hubble.solidish.dev
-  rules:
-    - backendRefs:
-        - name: hubble-ui
-          port: 80
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
 metadata:
   name: authentik
   namespace: authentik