release.yaml

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: nginx
spec:
  interval: 5m
  chart:
    spec:
      # renovate: registryUrl=https://kubernetes.github.io/ingress-nginx
      chart: ingress-nginx
      version: 4.11.3
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
        namespace: flux-system
      interval: 5m
  install:
    remediation:
      retries: 3
  # Default values
  # https://github.com/kubernetes/ingress-nginx/blob/master/charts/ingress-nginx/values.yaml
  values:
    controller:
      allowSnippetAnnotations: true # Required but risky - see https://github.com/kubernetes/ingress-nginx/issues/7837 - ok as only one user in the cluster
      watchIngressWithoutClass: true
      replicaCount: 3
      config:
        custom-http-errors: 404,401,403,500,503
        hsts-max-age: "31449600"
        # See instructions at https://goauthentik.io/docs/providers/proxy/forward_auth
        global-auth-url: "http://ak-outpost-ingress.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx"
        global-auth-signin: "https://authentik.pub.${CLUSTER_DOMAIN}/outpost.goauthentik.io/start?rd=$scheme://$host$request_uri"
        #global-auth-signin: "https://authentik.pub.${CLUSTER_DOMAIN}/outpost.goauthentik.io/start?rd=$escaped_request_uri"
        #global-auth-response-headers: X-Auth-Username,X-Forwarded-Email,X-Forwarded-Preferred-Username,X-Forwarded-User,X-Auth-Groups
        global-auth-response-headers: Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid
        global-auth-snippet: |
          proxy_set_header X-Forwarded-Host $http_host;        
        location-snippet: |
          auth_request_set $authentik_username $upstream_http_X_authentik_username;
          auth_request_set $authentik_groups $upstream_http_X_authentik_groups;
        server-snippet: |
          access_by_lua_block {
            local username = ngx.var.authentik_username
            local groups    = ngx.var.authentik_groups
            local required_usernames = ngx.var['required_usernames']
            local required_groups    = ngx.var['required_groups']
              local sep = '|'
            if (required_usernames ~= nil) then
              for required_username in string.gmatch(required_usernames, "([^"..sep.."]+)") do
                if string.match(username, required_username) then
                  return;
                end
              end
            end
            if (required_groups ~= nil) then
              for group in string.gmatch(groups, "([^"..sep.."]+)") do
                for required_group in string.gmatch(required_groups, "([^"..sep.."]+)") do
                  if string.match(group, required_group) then
                    return;
                  end
                end
              end
            end
            if (required_usernames ~= nil) or (required_groups ~= nil)  then
              ngx.exit(ngx.HTTP_FORBIDDEN);
            end
          }
        proxy-buffer-size: "16k" # Needed for authentik proxy
        proxy-body-size: "4000m"
      extraArgs:
        default-ssl-certificate: "cert-manager/${CLUSTER_DOMAIN_CERT}"
      use-forwarded-headers: "true"
      service:
        type: LoadBalancer
        externalTrafficPolicy: Local #Required to keep source IP
        annotations:
          metallb.universe.tf/loadBalancerIPs: "${CLUSTER_EXTERNAL_SUBNET_PREFIX}.${CLUSTER_LB_INGRESS}"
      #metrics:
      #  enabled: true
      #  serviceMonitor:
      #    enabled: true
      #    namespace: kube-system
      #  prometheusRule:
      #    enabled: false
      resources:
        requests:
          memory: 500Mi
          cpu: 25m
        limits:
          memory: 600Mi
      affinity:
        # An example of required pod anti-affinity
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app.kubernetes.io/name
                operator: In
                values:
                - ingress-nginx
              - key: app.kubernetes.io/instance
                operator: In
                values:
                - ingress-nginx
              - key: app.kubernetes.io/component
                operator: In
                values:
                - controller
            topologyKey: "kubernetes.io/hostname"
    defaultBackend:
      enabled: true
      image:
        repository: billimek/custom-error-pages
        tag: 0.4.4
      resources:
        requests:
          memory: 250Mi
          cpu: 25m
        limits:
          memory: 350Mi