104 lines
2.3 KiB
YAML
104 lines
2.3 KiB
YAML
---
|
|
# Certificate for the dashboard
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: kubernetes-dashboard-tls
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
secretName: kubernetes-dashboard-tls
|
|
issuerRef:
|
|
name: letsencrypt-prod
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- "dashboard.internal.${DOMAIN}"
|
|
duration: 2160h # 90 days
|
|
renewBefore: 360h # 15 days
|
|
privateKey:
|
|
algorithm: RSA
|
|
size: 2048
|
|
|
|
---
|
|
# Internal-only middleware
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: internal-only
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
ipWhiteList:
|
|
# Restrict to local private network ranges
|
|
sourceRange:
|
|
- 127.0.0.1/32 # localhost
|
|
- 10.0.0.0/8 # Private network
|
|
- 172.16.0.0/12 # Private network
|
|
- 192.168.0.0/16 # Private network
|
|
|
|
---
|
|
# HTTPS redirect middleware
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: Middleware
|
|
metadata:
|
|
name: dashboard-redirect-scheme
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
|
|
---
|
|
# IngressRoute for Dashboard
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: kubernetes-dashboard-https
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`dashboard.internal.${DOMAIN}`)
|
|
kind: Rule
|
|
middlewares:
|
|
- name: internal-only
|
|
namespace: kubernetes-dashboard
|
|
services:
|
|
- name: kubernetes-dashboard
|
|
port: 443
|
|
serversTransport: dashboard-transport
|
|
tls:
|
|
secretName: kubernetes-dashboard-tls
|
|
|
|
---
|
|
# HTTP to HTTPS redirect
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: kubernetes-dashboard-http
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
routes:
|
|
- match: Host(`dashboard.internal.${DOMAIN}`)
|
|
kind: Rule
|
|
middlewares:
|
|
- name: dashboard-redirect-scheme
|
|
namespace: kubernetes-dashboard
|
|
services:
|
|
- name: kubernetes-dashboard
|
|
port: 443
|
|
serversTransport: dashboard-transport
|
|
|
|
---
|
|
# ServersTransport for HTTPS backend with skip verify
|
|
apiVersion: traefik.containo.us/v1alpha1
|
|
kind: ServersTransport
|
|
metadata:
|
|
name: dashboard-transport
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
insecureSkipVerify: true
|
|
serverName: dashboard.internal.${DOMAIN}
|
|
|