JeffreyandClaude Opus 5
964ace4986
Adds the LDAP outpost deployment and routes ports 389 and 636 on gateway-internal to it. 636 is a TLS listener in Terminate mode so cert-manager renews the LDAPS certificate automatically, and both listeners forward to the outpost's plaintext 3389. allowedRoutes.kinds is set explicitly on both listeners: a TCP listener permits no route kinds by default and a TLS listener defaults to TLSRoute, so the TCPRoute would not attach otherwise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
936 B
YAML
38 lines
936 B
YAML
# TCP listeners for the authentik LDAP outpost. kinds must be set explicitly:
|
|
# TCP allows nothing by default and TLS defaults to TLSRoute.
|
|
- op: add
|
|
path: /spec/listeners/-
|
|
value:
|
|
name: authentik-ldap
|
|
protocol: TCP
|
|
port: 389
|
|
allowedRoutes:
|
|
kinds:
|
|
- kind: TCPRoute
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: authentik
|
|
- op: add
|
|
path: /spec/listeners/-
|
|
value:
|
|
name: authentik-ldaps
|
|
protocol: TLS
|
|
port: 636
|
|
# No hostname: LDAP clients cannot be relied on to send SNI
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: authentik-ldap-tls
|
|
namespace: envoy-gateway
|
|
allowedRoutes:
|
|
kinds:
|
|
- kind: TCPRoute
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: authentik
|