platform/manifests
1
0
Fork 0
Code Issues 7 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix: use expose annotation rather than explicit whitelist

Browse Source
This commit is contained in:
Jonas Juselius
2025-06-22 08:48:35 +02:00
parent 383477822a
commit 7607373146
7 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
values/headscale/values.yaml
+1
View File
@@ -223,6 +223,7 @@ configMaps:
{ "name": "argocd.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" }, { "name": "argocd.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
{ "name": "hubble.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" }, { "name": "hubble.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
{ "name": "plausible.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" }, { "name": "plausible.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
{ "name": "dapr.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
{ "name": "rabbitmq.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" }, { "name": "rabbitmq.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
{ "name": "rabbitmq.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" }, { "name": "rabbitmq.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
values/keycloak/values/values-prod.yaml
+1 -1
View File
@@ -54,7 +54,7 @@ adminIngress:
nginx.ingress.kubernetes.io/backend-protocol: HTTP nginx.ingress.kubernetes.io/backend-protocol: HTTP
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 oceanbox.io/expose: internal
hostname: keycloak.adm.oceanbox.io hostname: keycloak.adm.oceanbox.io
ingressClassName: nginx ingressClassName: nginx
path: / path: /
values/keycloak/values/values.yaml
+1 -1
View File
@@ -49,7 +49,7 @@ adminIngress:
nginx.ingress.kubernetes.io/backend-protocol: HTTP nginx.ingress.kubernetes.io/backend-protocol: HTTP
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 oceanbox.io/expose: internal
hostname: auth.adm.oceanbox.io hostname: auth.adm.oceanbox.io
ingressClassName: nginx ingressClassName: nginx
path: / path: /
values/openfga/values/openfga-prod.yaml.gotmpl
+1 -1
View File
@@ -29,7 +29,7 @@ ingress:
annotations: annotations:
cert-manager.io/cluster-issuer: letsencrypt-production cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 oceanbox.io/expose: internal
hosts: hosts:
- host: openfga.srv.oceanbox.io - host: openfga.srv.oceanbox.io
paths: paths:
values/openfga/values/openfga-staging.yaml.gotmpl
+1 -1
View File
@@ -29,7 +29,7 @@ ingress:
annotations: annotations:
cert-manager.io/cluster-issuer: letsencrypt-production cert-manager.io/cluster-issuer: letsencrypt-production
nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 oceanbox.io/expose: internal
hosts: hosts:
- host: openfga.dev.oceanbox.io - host: openfga.dev.oceanbox.io
paths: paths:
values/plume/values/plume-staging.yaml.gotmpl
+1 -1
View File
@@ -5,7 +5,7 @@ ingress:
cert-manager.io/cluster-issuer: letsencrypt-staging cert-manager.io/cluster-issuer: letsencrypt-staging
nginx.ingress.kubernetes.io/backend-protocol: HTTP nginx.ingress.kubernetes.io/backend-protocol: HTTP
nginx.ingress.kubernetes.io/ssl-redirect: "true" nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 oceanbox.io/expose: internal
hosts: hosts:
- host: plume.ekman.oceanbox.io - host: plume.ekman.oceanbox.io
paths: paths:
values/system/oceanbox/hubble-ui-ingress.yaml
+2 -2
View File
@@ -12,7 +12,7 @@ metadata:
# nginx.ingress.kubernetes.io/server-snippet: | # nginx.ingress.kubernetes.io/server-snippet: |
# client_header_buffer_size 100k; # client_header_buffer_size 100k;
# large_client_header_buffers 4 100k; # large_client_header_buffers 4 100k;
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,128.39.100.131/32,158.36.88.98/32,158.36.21.21/32,192.30.252.0/22,140.82.112.0/20 oceanbox.io/expose: internal
name: hubble-ui name: hubble-ui
namespace: kube-system namespace: kube-system
spec: spec:
@@ -42,7 +42,7 @@ metadata:
# nginx.ingress.kubernetes.io/server-snippet: | # nginx.ingress.kubernetes.io/server-snippet: |
# client_header_buffer_size 100k; # client_header_buffer_size 100k;
# large_client_header_buffers 4 100k; # large_client_header_buffers 4 100k;
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,128.39.100.131/32,158.36.88.98/32,158.36.21.21/32,192.30.252.0/22,140.82.112.0/20 oceanbox.io/expose: internal
name: hubble-ui-oauth2-proxy name: hubble-ui-oauth2-proxy
namespace: kube-system namespace: kube-system
spec: spec: