k.rennerandClaude Opus 4.8
760e187ba1
code-server (the HA /config editor sidecar) runs with --auth=none, as root, mounting the entire /config incl. plaintext secrets.yaml, .storage, and the git PAT in the PVC remote URL. Until now the only control on it was network reachability of vscode.home.renner.uno — any LAN client could read every HA secret and edit config. Put it behind Authentik using the existing paperless-gate proxy-outpost pattern: - New Authentik proxy provider + application + dedicated outpost (ak-outpost-vscode-gate) in mode: proxy. authorization_flow is the passkey-stepup-authorization flow (same one Homeassistant/Immich/ Audiobookshelf/Netbird use), so every authorize requires a passkey. - New "Home Assistant Config Editors" group (git-owned membership, k.renner only) bound to the app — explicit allowlist for who can read HA secrets via the editor. - vscode Ingress now backends the gate outpost (ExternalName mirror) instead of code-server directly. - home-assistant CNP tightened: traefik no longer allowed to :8080; only the vscode-gate outpost pod may reach code-server. Matching scoped egress CNP added in the authentik namespace. - code-server is a service-worker app; skip_path_regex carves out its static/manifest/SW tree to avoid the credentials:'omit' redirect loop that forced retirement of the music-assistant gate. Exact skip set to be confirmed post-deploy (see PR checklist). Verified: kubectl kustomize builds clean for home-assistant, authentik, and network-policies. The Authentik proxy flow + code-server PWA behaviour require a browser passkey login test after apply. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
27 lines
948 B
YAML
27 lines
948 B
YAML
---
|
|
# Allow the dedicated vscode-gate outpost to egress into the
|
|
# home-assistant namespace and reach the code-server sidecar (:8080) on
|
|
# the HA pod. Without this, the authentik-namespace baseline CNP
|
|
# (kubernetes/infrastructure/network-policies/authentik-ns.yaml) has no
|
|
# egress rule to home-assistant, so the gate outpost's forwarded requests
|
|
# are dropped. Scoped to the gate outpost's pod label so no other
|
|
# authentik component can reach code-server. Mirrors paperless-gate-egress.yaml.
|
|
apiVersion: cilium.io/v2
|
|
kind: CiliumNetworkPolicy
|
|
metadata:
|
|
name: vscode-gate-egress
|
|
namespace: authentik
|
|
spec:
|
|
endpointSelector:
|
|
matchLabels:
|
|
goauthentik.io/outpost-name: vscode-gate
|
|
egress:
|
|
- toEndpoints:
|
|
- matchLabels:
|
|
"k8s:io.kubernetes.pod.namespace": home-assistant
|
|
app.kubernetes.io/name: home-assistant
|
|
toPorts:
|
|
- ports:
|
|
- port: "8080"
|
|
protocol: TCP
|