diff --git a/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cloudflared-tunnel-exits/http-exits.yaml b/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cloudflared-tunnel-exits/http-exits.yaml index 4b518b7ae..4e8e9674a 100644 --- a/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cloudflared-tunnel-exits/http-exits.yaml +++ b/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cloudflared-tunnel-exits/http-exits.yaml @@ -100,6 +100,11 @@ spec: external-hostname: wiki.onp-k8s.admin.seichi.click internal-authority: "growi.growi-system:3000" + # Argo Workflows に対する POST リクエストのみを受け付けるためのリバースプロキシ。 + - name: argo-workflows-reverse-proxy + external-hostname: argo-workflows-webhook.onp-k8s.admin.seichi.click + internal-authority: "argo-workflows-reverse-proxy.argocd:80" + template: metadata: name: "cloudflared-tunnel-http-exit--{{name}}" diff --git a/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cluster-wide-apps/app-of-other-apps/argo-events-reverse-proxy.yaml b/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cluster-wide-apps/app-of-other-apps/argo-events-reverse-proxy.yaml new file mode 100644 index 000000000..7d520134e --- /dev/null +++ b/seichi-onp-k8s/manifests/seichi-kubernetes/apps/cluster-wide-apps/app-of-other-apps/argo-events-reverse-proxy.yaml @@ -0,0 +1,39 @@ +# 外部から Argo Workflows を発火するためには Cloudflared を使えば機能的には問題がないが、 +# 任意のクライアントから GET を受け付けると面倒なので、POST だけに限定するためのリバースプロキシを挟む。 +apiVersion: v1 +kind: Deployment +metadata: + name: argo-workflows-reverse-proxy + namespace: argocd +spec: + containers: + - name: nginx + image: nginx:1.26.0 + volumeMounts: + - name: conf + mountPath: /etc/nginx/nginx.conf + subPath: nginx.conf + volumes: + - name: conf + configMap: + name: argo-workflows-reverse-proxy-config-map +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: argo-workflows-reverse-proxy-config-map + namespace: argocd +data: + nginx.conf: | + http { + server { + listen 80; + server_name argo-workflows-webhook.onp-k8s.admin.seichi.click; + location / { + if ($request_method !~ ^(POST)$ ) { + return 405; + } + proxy_pass http://argo-workflows-server.argo:2746; + } + } + }