Moved authelia ACL rules to seperate ConfigMaps

apps/grafana/config-map-authelia-acl.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia-acl
+  annotations:
+    config.huizinga.dev/fragment: authelia-acl
+data:
+  rules: |
+    - domain: grafana.${domain}
+      policy: one_factor

apps/grafana/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - ./repository.yaml
   - ./release.yaml
   - ./lldap.yaml
+  - ./config-map-authelia-acl.yaml
   - ../../common/postgres
   - ../../common/dragonflydb
 

infra/authelia/secret-authelia-acl.yaml

@@ -4,11 +4,6 @@ metadata:
   name: authelia-acl
 stringData:
   rules: |
-    - domain: traefik.${domain}
-      policy: one_factor
-      subject: "group:lldap_admin"
-    - domain: ceph.${domain}
-      policy: one_factor
-      subject: "group:lldap_admin"
-    - domain: grafana.${domain}
-      policy: one_factor
+    # Deny by default, mainly a placeholder to allow patching in other rules
+    - domain: "*"
+      policy: deny

infra/kyverno-policies/generate-authelia-acl.yaml

@@ -45,7 +45,7 @@ spec:
               kinds:
                 - ConfigMap
               annotations:
-                config.huizinga.dev/generate: authelia-acl
+                config.huizinga.dev/fragment: authelia-acl
       context:
         - name: rules
           apiCall:

infra/rook-ceph/config-map-authelia-acl.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia-acl
+  annotations:
+    config.huizinga.dev/fragment: authelia-acl
+data:
+  rules: |
+    - domain: ceph.${domain}
+      policy: one_factor
+      subject: "group:lldap_admin"

infra/rook-ceph/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - ./namespace.yaml
   - ./helm-repository.yaml
   - ./helm-release.yaml
+  - ./config-map-authelia-acl.yaml

infra/traefik/config-map-authelia-acl.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: authelia-acl
+  annotations:
+    config.huizinga.dev/fragment: authelia-acl
+data:
+  rules: |
+    - domain: traefik.${domain}
+      policy: one_factor
+      subject: "group:lldap_admin"

infra/traefik/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - ./namespace.yaml
   - ./helm-repository.yaml
   - ./helm-release.yaml
+  - ./config-map-authelia-acl.yaml