1 changed files with 21 additions and 0 deletions
@@ -53,4 +53,25 @@ data:
      # even though the DNS CNAME points at the tunnel.
      - hostname: zitadel.riotpiao.com
        service: https://zitadel.riotpiao.com
      # KUBERNETES API, for kubectl from outside the LAN.
      #
      # Origin is the in-cluster Service, not the node IP: that survives a
      # control-plane address change and lets the connectors reach whichever
      # apiserver is local-healthy.
      #
      # noTLSVerify is required. The apiserver serves a certificate for the
      # cluster CA plus its node/LB addresses, so its SANs cannot match this
      # public hostname. Cloudflare terminates the public TLS with the
      # *.riotpiao.com edge certificate, and the connector hop is already
      # inside the cluster, so skipping verification on that short hop is the
      # least-bad option. Do not widen this to other rules.
      #
      # SECURITY: this exposes the API to the internet. Authentication is still
      # ZITADEL OIDC plus client certificates, but put a Cloudflare Access
      # application in front of this hostname as well -- see the note in the
      # PR. Without Access, every scanner on the internet reaches the apiserver.
      - hostname: k8s.riotpiao.com
        service: https://kubernetes.default.svc.cluster.local:443
        originRequest:
          noTLSVerify: true
      - service: http_status:404