k.rennerandClaude Opus 4.7
8be94b1896
ingress-nginx auth-type/auth-secret/auth-realm trio becomes a Traefik BasicAuth Middleware. Re-encrypts the SOPS Secret with both `auth` (nginx convention, kept for safety during transition) and `users` (Traefik convention) pointing at the same htpasswd content; SOPS file now uses encrypted_regex so only stringData is encrypted (the rest of the manifest is plaintext, matching the convention used elsewhere). This is the last hostname on ingress-nginx. After this lands and verifies, the controller can be decommissioned. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
15 lines
509 B
YAML
15 lines
509 B
YAML
# BasicAuth Middleware referencing the same htpasswd content the
|
|
# ingress-nginx auth-secret annotation pointed at. The Secret
|
|
# (kubernetes/apps/monitoring/loki-basic-auth.sops.yaml) has both
|
|
# `auth` (nginx convention) and `users` (Traefik convention) keyed to
|
|
# the same htpasswd value — Traefik's BasicAuth Middleware reads `users`.
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: loki-basic-auth
|
|
namespace: monitoring
|
|
spec:
|
|
basicAuth:
|
|
secret: loki-basic-auth
|
|
realm: Loki
|