Jeffrey
30f9c63c9b
The API server defaults group on allowedRoutes.kinds and certificateRefs, and group, kind and weight on the TCPRoute backendRefs. Omitting them left both ArgoCD apps permanently OutOfSync against the live objects. Matches what authentik-httproute.yaml already does.
41 lines
1.0 KiB
YAML
41 lines
1.0 KiB
YAML
# TCP listeners for the authentik LDAP outpost. kinds must be set explicitly:
|
|
# TCP allows nothing by default and TLS defaults to TLSRoute.
|
|
- op: add
|
|
path: /spec/listeners/-
|
|
value:
|
|
name: authentik-ldap
|
|
protocol: TCP
|
|
port: 389
|
|
allowedRoutes:
|
|
kinds:
|
|
- group: gateway.networking.k8s.io
|
|
kind: TCPRoute
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: authentik
|
|
- op: add
|
|
path: /spec/listeners/-
|
|
value:
|
|
name: authentik-ldaps
|
|
protocol: TLS
|
|
port: 636
|
|
# No hostname: LDAP clients cannot be relied on to send SNI
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- group: ""
|
|
kind: Secret
|
|
name: authentik-ldap-tls
|
|
namespace: envoy-gateway
|
|
allowedRoutes:
|
|
kinds:
|
|
- group: gateway.networking.k8s.io
|
|
kind: TCPRoute
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: authentik
|