feat(longhorn): enable auth via authelia

[martinohmann]

No description provided.

[github-actions]

--- HelmRelease: longhorn-system/longhorn Ingress: longhorn-system/longhorn-ingress

+++ HelmRelease: longhorn-system/longhorn Ingress: longhorn-system/longhorn-ingress

@@ -10,12 +10,18 @@

     app.kubernetes.io/instance: longhorn
     app: longhorn-ingress
   annotations:
     hajimari.io/appName: Longhorn
     hajimari.io/group: storage
     hajimari.io/icon: mdi:harddisk-plus
+    nginx.ingress.kubernetes.io/auth-method: GET
+    nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
+    nginx.ingress.kubernetes.io/auth-signin: https://auth.18b.haus?rm=$request_method
+    nginx.ingress.kubernetes.io/auth-snippet: |
+      proxy_set_header X-Forwarded-Method $request_method;
+    nginx.ingress.kubernetes.io/auth-url: http://authelia.default.svc.cluster.local/api/verify
 spec:
   ingressClassName: internal
   rules:
   - host: longhorn.18b.haus
     http:
       paths:

[github-actions]

--- kubernetes/apps/default/authelia/app Kustomization: flux-system/authelia ConfigMap: default/authelia

+++ kubernetes/apps/default/authelia/app Kustomization: flux-system/authelia ConfigMap: default/authelia

@@ -67,13 +67,19 @@

 
     access_control:
       default_policy: one_factor
       networks:
         - name: internal
           networks: ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
-      rules: []
+      rules:
+        - domain: longhorn.18b.haus
+          policy: one_factor
+          subject:
+            - ['group:admins']
+        - domain: longhorn.18b.haus
+          policy: deny
 
     identity_providers:
       oidc:
         cors:
           endpoints: ["authorization", "token", "revocation", "introspection"]
           allowed_origins_from_client_redirect_uris: true
--- kubernetes/apps/longhorn-system/longhorn/app Kustomization: flux-system/longhorn HelmRelease: longhorn-system/longhorn

+++ kubernetes/apps/longhorn-system/longhorn/app Kustomization: flux-system/longhorn HelmRelease: longhorn-system/longhorn

@@ -31,12 +31,18 @@

       systemManagedComponentsNodeSelector: node.longhorn.io/create-default-disk:true
     ingress:
       annotations:
         hajimari.io/appName: Longhorn
         hajimari.io/group: storage
         hajimari.io/icon: mdi:harddisk-plus
+        nginx.ingress.kubernetes.io/auth-method: GET
+        nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
+        nginx.ingress.kubernetes.io/auth-signin: https://auth.18b.haus?rm=$request_method
+        nginx.ingress.kubernetes.io/auth-snippet: |
+          proxy_set_header X-Forwarded-Method $request_method;
+        nginx.ingress.kubernetes.io/auth-url: http://authelia.default.svc.cluster.local/api/verify
       enabled: true
       host: longhorn.18b.haus
       ingressClassName: internal
       tls: true
     longhornDriver:
       nodeSelector: