TazLab K8s Ingress and Auth

This page defines the traffic entry points and identity protection for the cluster.

External Traffic Flow

  1. MetalLB: Assigns IP 192.168.1.240 to the Traefik Service in infrastructure/instances/traefik/.
  2. Traefik: Intercepts all traffic on ports 80 and 443.
  3. cert-manager: Provides the wildcard-tls certificate (*.tazlab.net) from Let’s Encrypt.

Protected Dashboards (IAM)

Critical UIs are behind a ForwardAuth gate managed by Dex + OAuth2 Proxy.

ServiceHostnameAuthentication
Grafanagrafana.tazlab.netDex (Google OAuth)
PGAdminpgadmin.tazlab.netDex (Google OAuth)
Longhornlonghorn.tazlab.netInternal (VPN) / Auth (Planned)
Traefik UItraefik.tazlab.netAuth (Planned)

Middlewares Inventory

Definitions live in apps/base/hugo-blog/middlewares.yaml and infrastructure/auth/oauth2-proxy/middleware.yaml.

  • auth@kubernetescrd: The global ForwardAuth middleware for Dex integration.
  • hugo-blog-redirect-to-blog: Normalizes traffic to blog.tazlab.net.

See Also