remove: strip all oauth2-proxy deployments

- Delete oauth2-proxy helm releases from helmfile (temporal, kmsvc, longhorn, portainer) - Remove oauth2-proxy manifests and ingress redirects - Add direct ingress for kmsvc management service - Update temporal/portainer/longhorn ingress comments to reflect direct service exposure Services now accessible without oauth2-proxy layer.
2026-07-11 19:36:31 -07:00
parent e1d0cfd70b
commit e6d7626fb6
11 changed files with 23 additions and 648 deletions
@@ -1,25 +0,0 @@
-# Ingress for Longhorn storage UI — routes to OAuth2-Proxy
-# TLS terminated here; oauth2-proxy handles OIDC auth
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  ingressClassName: nginx
-  tls:
-  - secretName: longhorn-tls
-    hosts:
-    - longhorn.riotpiao.homelab.com
-  rules:
-  - host: longhorn.riotpiao.homelab.com
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: oauth2-proxy
-            port:
-              number: 4180
@@ -1,106 +0,0 @@
-# OAuth2-Proxy for Longhorn storage UI
-# Protects persistent volume management interface with Authentik OIDC
-
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: oauth2-proxy
-      annotations:
-        secret.reloader.stakater.com/reload: "longhorn-oidc"
-    spec:
-      serviceAccountName: oauth2-proxy
-      containers:
-      - name: oauth2-proxy
-        image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 4180
-          protocol: TCP
-        env:
-        - name: OAUTH2_PROXY_PROVIDER
-          value: "oidc"
-        - name: OAUTH2_PROXY_OIDC_ISSUER_URL
-          value: "https://authentik.riotpiao.homelab.com/application/o/longhorn/"
-        - name: OAUTH2_PROXY_CLIENT_ID
-          value: "longhorn"
-        - name: OAUTH2_PROXY_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: longhorn-oidc
-              key: clientSecret
-        - name: OAUTH2_PROXY_COOKIE_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: longhorn-oidc
-              key: cookieSecret
-        - name: OAUTH2_PROXY_REDIRECT_URL
-          value: "https://longhorn.riotpiao.homelab.com/oauth2/callback"
-        - name: OAUTH2_PROXY_UPSTREAM
-          value: "http://longhorn-frontend:80"
-        - name: OAUTH2_PROXY_COOKIE_SECURE
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_HTTPONLY
-          value: "true"
-        - name: OAUTH2_PROXY_COOKIE_SAMESITE
-          value: "Lax"
-        - name: OAUTH2_PROXY_EMAIL_DOMAIN
-          value: "*"
-        - name: OAUTH2_PROXY_SKIP_AUTH_REGEX
-          value: "^/health"
-        - name: OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER
-          value: "true"
-        - name: OAUTH2_PROXY_REVERSE_PROXY
-          value: "true"
-        resources:
-          requests:
-            cpu: 50m
-            memory: 64Mi
-          limits:
-            cpu: 100m
-            memory: 128Mi
-        livenessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 10
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /ping
-            port: http
-          initialDelaySeconds: 5
-          periodSeconds: 5
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: oauth2-proxy
-  namespace: longhorn-system
-spec:
-  type: ClusterIP
-  ports:
-  - port: 4180
-    targetPort: http
-    protocol: TCP
-    name: http
-  selector:
-    app: oauth2-proxy