JeffreyandClaude Opus 5
964ace4986
Adds the LDAP outpost deployment and routes ports 389 and 636 on gateway-internal to it. 636 is a TLS listener in Terminate mode so cert-manager renews the LDAPS certificate automatically, and both listeners forward to the outpost's plaintext 3389. allowedRoutes.kinds is set explicitly on both listeners: a TCP listener permits no route kinds by default and a TLS listener defaults to TLSRoute, so the TCPRoute would not attach otherwise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
23 lines
607 B
YAML
23 lines
607 B
YAML
apiVersion: gateway.networking.k8s.io/v1alpha2
|
|
kind: TCPRoute
|
|
metadata:
|
|
name: authentik-ldap
|
|
namespace: authentik
|
|
spec:
|
|
parentRefs:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
namespace: envoy-gateway
|
|
sectionName: authentik-ldap
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
namespace: envoy-gateway
|
|
sectionName: authentik-ldaps
|
|
rules:
|
|
# The gateway terminates TLS on 636, so both listeners hit the plaintext port
|
|
- backendRefs:
|
|
- name: authentik-ldap
|
|
port: 3389
|