Refactor/istio ory

k8s/eventrunner-api/base/ingress.yaml

@@ -5,8 +5,6 @@ metadata:
   namespace: eventrunner
   annotations:
     cert-manager.io/cluster-issuer: threadr-issuer
-    nginx.ingress.kubernetes.io/service-upstream: "true"
-    nginx.ingress.kubernetes.io/upstream-vhost: oathkeeper-proxy.auth.svc.cluster.local
 spec:
   ingressClassName: nginx
   tls:
@@ -21,7 +19,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: oathkeeper-proxy  # Just the service name
+                name: oathkeeper-proxy
                 port:
                   number: 4455
----

k8s/eventrunner-api/base/istio-auth-policy.yaml

@@ -9,6 +9,6 @@ spec:
       app: eventrunner-api
   action: CUSTOM
   provider:
-    name: oathkeeper-ext-authz
+    name: ext-authz
   rules:
     - {}

k8s/eventrunner-api/base/istio-mesh-config.yaml

@@ -8,12 +8,10 @@ data:
     extensionProviders:
     - name: "ext-authz"
       envoyExtAuthzHttp:
-        service: "oathkeeper-proxy.auth.svc.cluster.local"
-        port: 4455
-        timeout: "10s"
-        includeRequestHeadersInCheck: ["authorization", "cookie"]
-        headersToUpstreamOnAllow: ["authorization", "cookie"]
-        headersToDownstreamOnDeny: ["content-type", "set-cookie"]
-        includeRequestBodyInCheck: true
-        maxRequestBytes: 8192
-        allowPartialMessage: true
+        service: "oathkeeper-api.auth.svc.cluster.local"
+        port: 4456
+        timeout: 10s
+        failOpen: false
+        statusOnError: "500"
+        pathPrefix: /decisions
+        includeRequestHeadersInCheck: ["authorization"]

k8s/eventrunner-api/base/service.yaml

@@ -8,7 +8,7 @@ metadata:
     sidecar.istio.io/inject: "true"
 spec:
   ports:
-    - port: 8200
+    - port: 80
       targetPort: 8200
       protocol: TCP
       name: http

k8s/hydra/values.yaml

@@ -148,6 +148,6 @@ ingress:
     tls:
       - secretName: auth-services-tls
         hosts:
-          - hydra.tunnel.threadr.ai
+          - "*.tunnel.threadr.ai"
   admin:
     enabled: false

k8s/kratos/kratos-values.yaml

@@ -135,7 +135,7 @@ ingress:
     tls:
       - secretName: auth-services-tls
         hosts:
-          - kratos.tunnel.threadr.ai
+          - "*.tunnel.threadr.ai"
 
 log:
   level: debug
@@ -294,7 +294,7 @@ kratos:
               - id: github
                 provider: github
                 client_id: "{{ .Values.client_id }}"
-                lient_secret: "{{ .Values.client_secret }}"
+                client_secret: "{{ .Values.client_secret }}"
                 issuer_url: https://api.github.com
                 mapper_url: "base64://ewogICJpZGVudGl0eSI6IHsKICAgICJ0cmFpdHMiOiB7CiAgICAgICJlbWFpbCI6ICJ7eyAuY2xhaW1zLmVtYWlsIH19IiwKICAgICAgIm5hbWUiOiAie3sgLmNsYWltcy5uYW1lIH19IiwKICAgICAgInRlbmFudF9pZHMiOiBbImRlZmF1bHQiXSwKICAgICAgInByb2plY3RfaWQiOiAiMDAwMDAwMDAtMDAwMC0wMDAwLTAwMDAtMDAwMDAwMDAwMDAwIiwKICAgICAgInJvbGVzIjogWyJ1c2VyIl0KICAgIH0KICB9Cn0="
                 scope:

k8s/oathkeeper/values.yaml

@@ -167,10 +167,10 @@ oathkeeper:
       {
         "id": "eventrunner-rule",
         "upstream": {
-          "url": "http://eventrunner-api.eventrunner.svc.cluster.local:8200"
+          "url": "http://eventrunner-api.eventrunner",
         },
         "match": {
-          "url": "http://api.tunnel.threadr.ai/<.*>",
+          "url": "https://api.tunnel.threadr.ai/api/<.*>",
           "methods": [
             "GET",
             "POST",

k8s/tls/auth.yaml

@@ -3,6 +3,8 @@ kind: Certificate
 metadata:
   name: auth-services-tls
   namespace: auth
+  labels:
+    app.kubernetes.io/name: auth-services
 spec:
   secretName: auth-services-tls
   duration: 2160h # 90 days
@@ -12,4 +14,8 @@ spec:
     name: threadr-issuer
   commonName: "*.tunnel.threadr.ai"
   dnsNames:
-    - "*.tunnel.threadr.ai"
+    - "*.tunnel.threadr.ai"
+  usages:
+    - digital signature
+    - key encipherment
+    - server auth