TazLab K8s Ingress and Auth

This page defines the traffic entry points and identity protection for the cluster.

External Traffic Flow

  1. MetalLB: Assigns IP 192.168.1.240 to the Traefik Service in infrastructure/instances/traefik/.
  2. Traefik: Intercepts all traffic on ports 80 and 443.
  3. TLS Termination is split by certificate source:
    • Blog + Wiki (public DNS): Use Let’s Encrypt cert-manager Certificates — blog-tazlab.net-tls (covers tazlab.net, blog.tazlab.net, www.tazlab.net, lab.tazlab.net) and wiki-tazlab.net-tls (wiki.tazlab.net). The ClusterIssuer letsencrypt-issuer handles issuance with HTTP01 validation via Traefik. Renewal is automatic.
    • Internal ingress (*.tazlab.net): Uses Vault PKI delivered via VSO (VaultPKISecret vault-pki-tls). The wildcard TLS ExternalSecret and its associated Vault KV path have been deleted. Renewal is handled automatically by VSO.
    • The old wildcard cert (*.tazlab.net) originally obtained via lego + Cloudflare DNS-01 is no longer in use. All TLS auto-renewal is now covered: Let’s Encrypt cert-manager Certificates renew automatically, and Vault PKI certificates renew automatically via VSO.

Middlewares Inventory

Definitions live in apps/base/hugo-blog/middlewares.yaml and infrastructure/auth/oauth2-proxy/middleware.yaml.

  • auth@kubernetescrd: The global ForwardAuth middleware for Dex integration.
  • hugo-blog-redirect-to-blog: Normalizes traffic to blog.tazlab.net.

Auth Stack Stability (Fixed 2026-05-09)

To ensure reliable cluster bootstrap, the oauth2-proxy deployment in the auth namespace includes an initContainer (wait-for-dex). This container polls the Dex OIDC discovery endpoint (https://dex.tazlab.net/.well-known/openid-configuration) using curl before the main proxy starts. This resolves the startup race (TD-026) where the proxy would crash repeatedly if Dex wasn’t ready.

See Also