1139 lines
43 KiB
YAML
1139 lines
43 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: istio-config
|
|
namespace: default
|
|
spec:
|
|
interval: 5m
|
|
timeout: 10m
|
|
values:
|
|
global:
|
|
env: contour
|
|
environments:
|
|
contour:
|
|
namespaces:
|
|
- name: attachments
|
|
certManager:
|
|
certificates:
|
|
platform-tls:
|
|
dnsNames:
|
|
- sarex.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
minio-tls:
|
|
dnsNames:
|
|
- minio.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
zitadel-tls:
|
|
dnsNames:
|
|
- zitadel.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
dashboard-tls:
|
|
dnsNames:
|
|
- dashboard.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
rabbitmq-tls:
|
|
dnsNames:
|
|
- rabbitmq.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
keycloak-tls:
|
|
dnsNames:
|
|
- keycloak.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
glitchtip-tls:
|
|
dnsNames:
|
|
- glitchtip.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
openobserve-tls:
|
|
dnsNames:
|
|
- openobserve.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
camunda-keycloak-tls:
|
|
dnsNames:
|
|
- camunda-keycloak.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
camunda-identity-tls:
|
|
dnsNames:
|
|
- camunda-identity.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
camunda-operate-tls:
|
|
dnsNames:
|
|
- camunda-operate.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
camunda-tasklist-tls:
|
|
dnsNames:
|
|
- camunda-tasklist.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
camunda-optimize-tls:
|
|
dnsNames:
|
|
- camunda-optimize.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
vault-tls:
|
|
dnsNames:
|
|
- vault.contour.infra.sarex.tech
|
|
issuerRef:
|
|
name: letsencrypt-issuer-istio
|
|
kind: ClusterIssuer
|
|
istio:
|
|
requestAuthentications:
|
|
api-jwt:
|
|
namespace: istio-system
|
|
selector:
|
|
matchLabels:
|
|
istio: ingressgateway
|
|
jwtRules:
|
|
- issuer: django
|
|
jwks: |
|
|
{
|
|
"keys": [{
|
|
"kty": "RSA",
|
|
"kid": "tiSFtZhCeHtAmHjjY3cG55ZYRgpTnIbAdmX1DsD8GOk=",
|
|
"use": "sig",
|
|
"alg": "RS512",
|
|
"n": "iJxequyGx7cS2MKqYBlyFXsrN5mhvKKyMeYFYW2XbvCiVRXVs0OK7gwvmhMRR-spCTxJLrG2rxzvs0CBXEFIrvmVRpXSLAau_aRAoTxmfCTqsZWb9ZT7u2i3_itUgFZmQg9UsuKoSodLJ16mf29XLE6VRqlu9oIxTB61FN5WtJ8ML7-lS00UBNYbemD8iVVFTHdn_v-uJ9blhg-2l-SPaJmwFlYlr8Zll99NXhw0-SNRzYTKJ04B1SIlebkuyTpvKbeGwnA6sPainH26MQ88DJIueRpJy_zgDWYoQBO7JAxbxJnF5A5RWeWDqodZU0FPkuNyQM8RI20j83GPI-X4FvTJNXKoBVgWNpq0yvxbwcFo0GdXDkXu8FPxBjCmh0yQnz-C_3SWcQ6gM1e9ryypoi4IJzR9KIlo7c39VTK4K70lx6piEtR_Cl3LldnHVhztAPEQr58e9cIrStax3EzwMijS6eFPf21vZNIpgs96XoZGBXvbtRJJx8uqbYSjO4uofgJWkIrjleO-ygD1MpTe7Opr_5h7-DfywrgBNbstskCecSbEgCv0Hblx55JCZcb_lL6hT5cJRXOybFEmIGRpGZTR-eUELrI1cqP62Tf3qvUyNeOPi9WE2lDCJtsF1gya64xWTi1nxSXdCJEZGjKyGFHg_Majf2RzyzsYuX90P5c",
|
|
"e": "AQAB"
|
|
}]
|
|
}
|
|
forwardOriginalToken: true
|
|
outputClaims:
|
|
user_id: x-user-id
|
|
company_ids: x-company-ids
|
|
zitadel-jwks:
|
|
namespace: istio-system
|
|
selector:
|
|
matchLabels:
|
|
istio: ingressgateway
|
|
jwtRules:
|
|
- issuer: https://zitadel.contour.infra.sarex.tech
|
|
jwksUri: https://zitadel.contour.infra.sarex.tech/oauth/v2/keys
|
|
forwardOriginalToken: true
|
|
fromHeaders:
|
|
- name: Identity
|
|
prefix: "Bearer "
|
|
- name: Authorization
|
|
prefix: "Bearer "
|
|
outputClaims:
|
|
company_ids: x-company-ids
|
|
sub: x-user-id
|
|
add-traceparent-filter:
|
|
- attachments
|
|
- bim
|
|
- cde
|
|
- checklists
|
|
- comparisons
|
|
- contracts
|
|
- control-interface
|
|
- cross-section
|
|
- django
|
|
- documentations
|
|
- drawings
|
|
- eav
|
|
- faas
|
|
- flows
|
|
- gateway
|
|
- inspections
|
|
- issues
|
|
- mapper
|
|
- measurements
|
|
- message-hub
|
|
- notes
|
|
- pm
|
|
- prescriptions
|
|
- processing
|
|
- projects
|
|
- remarks
|
|
- resources
|
|
- reviews
|
|
- rfi
|
|
- stamp-verification
|
|
- subscriptions
|
|
- system-log
|
|
- transmittal
|
|
- workspaces
|
|
envoyFilters:
|
|
http-header-count-size-control:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: NETWORK_FILTER
|
|
match:
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
typed_config:
|
|
'@type': >-
|
|
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
common_http_protocol_options:
|
|
max_headers_count: 200
|
|
max_request_headers_kb: 96
|
|
header-size-sidecar:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: NETWORK_FILTER
|
|
match:
|
|
context: SIDECAR_INBOUND
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
typed_config:
|
|
'@type': >-
|
|
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
common_http_protocol_options:
|
|
max_headers_kb: 96
|
|
max_request_headers_kb: 96
|
|
- applyTo: NETWORK_FILTER
|
|
match:
|
|
context: SIDECAR_OUTBOUND
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
typed_config:
|
|
'@type': >-
|
|
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
common_http_protocol_options:
|
|
max_headers_kb: 96
|
|
max_request_headers_kb: 96
|
|
sarex-agents-upload-body-50mb:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
sni: sarex.contour.infra.sarex.tech
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
subFilter:
|
|
name: envoy.filters.http.router
|
|
patch:
|
|
operation: INSERT_BEFORE
|
|
value:
|
|
name: envoy.filters.http.buffer
|
|
typed_config:
|
|
"@type": type.googleapis.com/envoy.extensions.filters.http.buffer.v3.Buffer
|
|
max_request_bytes: 2147483648
|
|
x-robots-tag-noindex:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: VIRTUAL_HOST
|
|
match:
|
|
context: GATEWAY
|
|
routeConfiguration:
|
|
vhost:
|
|
name: sarex.contour.infra.sarex.tech:443
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
response_headers_to_add:
|
|
- append: false
|
|
header:
|
|
key: X-Robots-Tag
|
|
value: noindex, nofollow
|
|
- applyTo: VIRTUAL_HOST
|
|
match:
|
|
context: GATEWAY
|
|
routeConfiguration:
|
|
vhost:
|
|
name: dashboard.contour.infra.sarex.tech:443
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
response_headers_to_add:
|
|
- append: false
|
|
header:
|
|
key: X-Robots-Tag
|
|
value: noindex, nofollow
|
|
- applyTo: VIRTUAL_HOST
|
|
match:
|
|
context: GATEWAY
|
|
routeConfiguration:
|
|
vhost:
|
|
name: sarex.contour.infra.sarex.tech:80
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
response_headers_to_add:
|
|
- append: false
|
|
header:
|
|
key: X-Robots-Tag
|
|
value: noindex, nofollow
|
|
- applyTo: VIRTUAL_HOST
|
|
match:
|
|
context: GATEWAY
|
|
routeConfiguration:
|
|
vhost:
|
|
name: dashboard.contour.infra.sarex.tech:80
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
response_headers_to_add:
|
|
- append: false
|
|
header:
|
|
key: X-Robots-Tag
|
|
value: noindex, nofollow
|
|
strip-jwt-on-public-hosts:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
subFilter:
|
|
name: envoy.filters.http.jwt_authn
|
|
patch:
|
|
operation: INSERT_BEFORE
|
|
value:
|
|
name: envoy.filters.http.lua
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inlineCode: |
|
|
local public_hosts = {
|
|
["camunda-keycloak.contour.infra.sarex.tech"] = true,
|
|
["keycloak.contour.infra.sarex.tech"] = true,
|
|
["zitadel.contour.infra.sarex.tech"] = true,
|
|
["dashboard.contour.infra.sarex.tech"] = true,
|
|
["openobserve.contour.infra.sarex.tech"] = true,
|
|
}
|
|
|
|
local public_paths = {
|
|
"^/documentations/api/v1/public/qr",
|
|
"^/documentations/api/v1/public/documents/public_link",
|
|
}
|
|
|
|
local function is_public(host, path)
|
|
if not host then return false end
|
|
host = string.gsub(host, ":%d+$", "")
|
|
if public_hosts[host] then
|
|
return true
|
|
end
|
|
if path then
|
|
for _,pref in ipairs(public_paths) do
|
|
if string.find(path, pref) == 1 then
|
|
return true
|
|
end
|
|
end
|
|
end
|
|
return false
|
|
end
|
|
|
|
function envoy_on_request(handle)
|
|
local h = handle:headers()
|
|
local host = h:get(":authority")
|
|
local path = h:get(":path")
|
|
if is_public(host, path) then
|
|
local auth = h:get("authorization")
|
|
if auth then
|
|
h:replace("x-orig-authorization", auth)
|
|
h:remove("authorization")
|
|
end
|
|
end
|
|
end
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
subFilter:
|
|
name: envoy.filters.http.jwt_authn
|
|
patch:
|
|
operation: INSERT_AFTER
|
|
value:
|
|
name: envoy.filters.http.lua
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inlineCode: |
|
|
function envoy_on_request(handle)
|
|
local h = handle:headers()
|
|
local xauth = h:get("x-orig-authorization")
|
|
if xauth and not h:get("authorization") then
|
|
h:replace("authorization", xauth)
|
|
h:remove("x-orig-authorization")
|
|
end
|
|
end
|
|
strip-jwt-on-public-paths:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
subFilter:
|
|
name: envoy.filters.http.jwt_authn
|
|
patch:
|
|
operation: INSERT_BEFORE
|
|
value:
|
|
name: envoy.filters.http.lua
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inlineCode: |
|
|
local public_prefixes = {
|
|
"^/documentations/api/v1/public/qr",
|
|
"^/documentations/api/v1/public/documents/public_link"
|
|
}
|
|
|
|
local download_prefixes = {
|
|
"^/files/api/v1/documents/folders",
|
|
"^/files/api/v1/documents",
|
|
"^/files/api/v1/bundles"
|
|
}
|
|
|
|
local function starts_with_any(path, prefixes)
|
|
for _, pref in ipairs(prefixes) do
|
|
if string.find(path, pref) == 1 then
|
|
return true
|
|
end
|
|
end
|
|
return false
|
|
end
|
|
|
|
local function has_download_type(path)
|
|
if not path or path == "" then
|
|
return false
|
|
end
|
|
return string.match(path, "[%?&]download_type=") ~= nil
|
|
end
|
|
|
|
local function should_strip(path)
|
|
if not path then
|
|
return false
|
|
end
|
|
|
|
if starts_with_any(path, public_prefixes) then
|
|
return true
|
|
end
|
|
|
|
if starts_with_any(path, download_prefixes) and has_download_type(path) then
|
|
return true
|
|
end
|
|
|
|
return false
|
|
end
|
|
|
|
function envoy_on_request(handle)
|
|
local h = handle:headers()
|
|
local p = h:get(":path") or ""
|
|
|
|
if should_strip(p) then
|
|
local auth = h:get("authorization")
|
|
if auth then
|
|
h:replace("x-orig-authorization-public-paths", auth)
|
|
h:remove("authorization")
|
|
end
|
|
|
|
local identity = h:get("identity")
|
|
if identity then
|
|
h:replace("x-orig-identity-public-paths", identity)
|
|
h:remove("identity")
|
|
end
|
|
|
|
h:replace("x-jwt-stripped-public-paths", "1")
|
|
end
|
|
end
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
subFilter:
|
|
name: envoy.filters.http.jwt_authn
|
|
patch:
|
|
operation: INSERT_AFTER
|
|
value:
|
|
name: envoy.filters.http.lua
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
|
|
inlineCode: |
|
|
function envoy_on_request(handle)
|
|
local h = handle:headers()
|
|
local stripped = h:get("x-jwt-stripped-public-paths")
|
|
|
|
if stripped == "1" then
|
|
local xauth = h:get("x-orig-authorization-public-paths")
|
|
if xauth and not h:get("authorization") then
|
|
h:replace("authorization", xauth)
|
|
end
|
|
h:remove("x-orig-authorization-public-paths")
|
|
|
|
local xidentity = h:get("x-orig-identity-public-paths")
|
|
if xidentity and not h:get("identity") then
|
|
h:replace("identity", xidentity)
|
|
end
|
|
h:remove("x-orig-identity-public-paths")
|
|
|
|
h:remove("x-jwt-stripped-public-paths")
|
|
end
|
|
end
|
|
cors-json-401:
|
|
namespace: istio-system
|
|
workloadSelector:
|
|
labels:
|
|
istio: ingressgateway
|
|
configPatches:
|
|
- applyTo: HTTP_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.http.jwt_authn
|
|
patch:
|
|
operation: INSERT_BEFORE
|
|
value:
|
|
name: envoy.filters.http.cors
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
|
|
cors:
|
|
allow_credentials: true
|
|
allow_headers: "Authorization,Content-Type"
|
|
allow_methods: "GET,POST,PUT,PATCH,DELETE,OPTIONS"
|
|
allow_origin_string_match:
|
|
- safe_regex:
|
|
regex: https://.*\.sarex\.io
|
|
- safe_regex:
|
|
regex: https://.*\.contour\.infra\.sarex\.tech
|
|
- safe_regex:
|
|
regex: https://localhost:.*
|
|
max_age: "86400"
|
|
- applyTo: NETWORK_FILTER
|
|
match:
|
|
context: GATEWAY
|
|
listener:
|
|
filterChain:
|
|
filter:
|
|
name: envoy.filters.network.http_connection_manager
|
|
patch:
|
|
operation: MERGE
|
|
value:
|
|
typed_config:
|
|
'@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
|
|
local_reply_config:
|
|
mappers:
|
|
- body:
|
|
inline_string: |
|
|
{"error":"unauthorized","detail":"Invalid or expired token"}
|
|
filter:
|
|
status_code_filter:
|
|
comparison:
|
|
op: EQ
|
|
value:
|
|
default_value: 401
|
|
runtime_key: default
|
|
headers_to_add:
|
|
- append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
header:
|
|
key: Content-Type
|
|
value: application/json
|
|
- append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
header:
|
|
key: Access-Control-Allow-Origin
|
|
value: '%REQ(Origin)%'
|
|
- append_action: OVERWRITE_IF_EXISTS_OR_ADD
|
|
header:
|
|
key: Access-Control-Allow-Credentials
|
|
value: 'true'
|
|
gateways:
|
|
platform:
|
|
name: platform-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: platform-tls
|
|
minio:
|
|
name: minio-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- minio.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: minio-tls
|
|
zitadel:
|
|
name: zitadel-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- zitadel.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: zitadel-tls
|
|
dashboard:
|
|
name: dashboard-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- dashboard.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: dashboard-tls
|
|
rabbitmq:
|
|
name: rabbitmq-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- rabbitmq.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: rabbitmq-tls
|
|
keycloak:
|
|
name: keycloak-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- keycloak.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: keycloak-tls
|
|
glitchtip:
|
|
name: glitchtip-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- glitchtip.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: glitchtip-tls
|
|
openobserve:
|
|
name: openobserve-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- openobserve.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: openobserve-tls
|
|
vault:
|
|
name: vault-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- vault.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: vault-tls
|
|
camunda:
|
|
name: camunda-gateway
|
|
namespace: gateway
|
|
servers:
|
|
- hosts:
|
|
- camunda-keycloak.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: camunda-keycloak-tls
|
|
- hosts:
|
|
- camunda-identity.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: camunda-identity-tls
|
|
- hosts:
|
|
- camunda-operate.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: camunda-operate-tls
|
|
- hosts:
|
|
- camunda-tasklist.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: camunda-tasklist-tls
|
|
- hosts:
|
|
- camunda-optimize.contour.infra.sarex.tech
|
|
tls:
|
|
credentialName: camunda-optimize-tls
|
|
virtualServices:
|
|
platform:
|
|
name: sarex-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /admin/
|
|
service: backend-svc.django.svc.cluster.local
|
|
port: 80
|
|
|
|
- path:
|
|
prefix: /api/
|
|
service: backend-svc.django.svc.cluster.local
|
|
port: 80
|
|
|
|
- path:
|
|
prefix: /
|
|
service: frontend-svc.django.svc.cluster.local
|
|
port: 80
|
|
gateway-platform:
|
|
name: pdm-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /gateway/
|
|
rewrite: /
|
|
service: pdm-svc.documentations.svc.cluster.local
|
|
port: 80
|
|
resources-admin:
|
|
name: resources-admin-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /resource-management
|
|
rewrite: /resource-management
|
|
service: backend-svc.resources.svc.cluster.local
|
|
port: 80
|
|
srx-admin-frontend:
|
|
name: srx-admin-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /control-interface/
|
|
rewrite: /
|
|
service: frontend-svc.control-interface.svc.cluster.local
|
|
port: 80
|
|
workflows-frontend:
|
|
name: workflows-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /workflows/api/
|
|
rewrite: /api/
|
|
service: backend-svc.processing.svc.cluster.local
|
|
port: 80
|
|
- path:
|
|
prefix: /workflows/
|
|
rewrite: /
|
|
service: frontend-svc.processing.svc.cluster.local
|
|
port: 80
|
|
eav-api:
|
|
name: eav-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /eav/api/
|
|
rewrite: /api/
|
|
service: backend-svc.eav.svc.cluster.local
|
|
port: 80
|
|
issues-api:
|
|
name: issues-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /issues/api/
|
|
rewrite: /api/
|
|
service: backend-svc.issues.svc.cluster.local
|
|
port: 80
|
|
flows-api:
|
|
name: flows-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /flows/api/
|
|
rewrite: /api/
|
|
service: backend-svc.flows.svc.cluster.local
|
|
port: 80
|
|
rfi-api:
|
|
name: rfi-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /rfi/api/
|
|
rewrite: /api/
|
|
service: backend-svc.rfi.svc.cluster.local
|
|
port: 80
|
|
transmittals-api:
|
|
name: flows-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /transmittals/api/
|
|
rewrite: /api/
|
|
service: backend-svc.transmittal.svc.cluster.local
|
|
port: 80
|
|
workspaces-api:
|
|
name: workspaces-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /workspaces/api/
|
|
rewrite: /api/
|
|
service: backend-svc.workspaces.svc.cluster.local
|
|
port: 80
|
|
documentations-frontend:
|
|
name: documentations-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /documentations/static/
|
|
rewrite: /
|
|
service: frontend-svc.documentations.svc.cluster.local
|
|
port: 80
|
|
transmittal-frontend:
|
|
name: transmittal-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /transmittal/static/
|
|
rewrite: /
|
|
service: frontend-svc.transmittal.svc.cluster.local
|
|
port: 80
|
|
documentations-api:
|
|
name: documentations-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /documentations/api/
|
|
rewrite: /api/
|
|
service: backend-api-svc.documentations.svc.cluster.local
|
|
port: 80
|
|
mapper-api:
|
|
name: mapper-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /mapper/api/
|
|
rewrite: /api/
|
|
service: backend-svc.mapper.svc.cluster.local
|
|
port: 80
|
|
filestream-api:
|
|
name: documentations-filestream-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /files/api/
|
|
rewrite: /api/
|
|
service: backend-filestream-svc.documentations.svc.cluster.local
|
|
port: 80
|
|
issues-frontend:
|
|
name: issues-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /issues/static/
|
|
rewrite: /
|
|
service: frontend-svc.issues.svc.cluster.local
|
|
port: 80
|
|
flows-frontend:
|
|
name: flows-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /flows/static/
|
|
rewrite: /
|
|
service: frontend-svc.flows.svc.cluster.local
|
|
port: 80
|
|
reviews-frontend:
|
|
name: reviews-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /reviews/static/
|
|
rewrite: /
|
|
service: frontend-svc.reviews.svc.cluster.local
|
|
port: 80
|
|
rfi-frontend:
|
|
name: rfi-frontend-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- sarex.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/platform-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /rfi/static/
|
|
rewrite: /
|
|
service: frontend-svc.rfi.svc.cluster.local
|
|
port: 80
|
|
vault:
|
|
name: vault-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- vault.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/vault-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: vault-vault-contour.vault.svc.cluster.local
|
|
port: 8200
|
|
minio:
|
|
name: minio-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- minio.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/minio-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /console/
|
|
service: minio-console.minio.svc.cluster.local
|
|
port: 9001
|
|
minio-api:
|
|
name: minio-api-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- minio.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/minio-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: minio.minio.svc.cluster.local
|
|
port: 9000
|
|
zitadel:
|
|
name: zitadel-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- zitadel.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/zitadel-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: zitadel-idp-contour.zitadel.svc.cluster.local
|
|
port: 8080
|
|
dashboard:
|
|
name: dashboard-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- dashboard.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/dashboard-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: dashboard-kong-proxy.kubernetes-dashboard.svc.cluster.local
|
|
port: 80
|
|
rabbitmq:
|
|
name: rabbitmq-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- rabbitmq.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/rabbitmq-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: rabbitmq.rabbitmq.svc.cluster.local
|
|
port: 15672
|
|
keycloak:
|
|
name: keycloak-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- keycloak.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/keycloak-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: keycloak-keycloak-contour.keycloak.svc.cluster.local
|
|
port: 80
|
|
glitchtip:
|
|
name: glitchtip-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- glitchtip.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/glitchtip-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: glitchtip-web.glitchtip.svc.cluster.local
|
|
port: 8000
|
|
openobserve:
|
|
name: openobserve-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- openobserve.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/openobserve-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: openobserve-web.openobserve.svc.cluster.local
|
|
port: 5080
|
|
camunda-keycloak:
|
|
name: camunda-keycloak-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-keycloak.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-keycloak.camunda.svc.cluster.local
|
|
port: 80
|
|
camunda-identity:
|
|
name: camunda-identity-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-identity.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-identity.camunda.svc.cluster.local
|
|
port: 80
|
|
camunda-operate:
|
|
name: camunda-operate-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-operate.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-operate.camunda.svc.cluster.local
|
|
port: 80
|
|
camunda-tasklist:
|
|
name: camunda-tasklist-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-tasklist.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-tasklist.camunda.svc.cluster.local
|
|
port: 80
|
|
camunda-optimize:
|
|
name: camunda-optimize-virt-service
|
|
namespace: gateway
|
|
hosts:
|
|
- camunda-optimize.contour.infra.sarex.tech
|
|
gateways:
|
|
- gateway/camunda-gateway
|
|
routes:
|
|
- path:
|
|
prefix: /
|
|
service: camunda-optimize.camunda.svc.cluster.local
|
|
port: 80
|