Files
Valeriy Petrov b0e527e970 Enable ingress basic auth for remote test contour.
Protect all public URLs via nginx basic auth; exempt Gitea API/registry/git paths for CI.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-06-10 03:25:26 +03:00

113 lines
3.2 KiB
YAML

apiVersion: v1
kind: ConfigMap
metadata:
name: adminpanel-env-js
namespace: {{ .Values.namespace }}
data:
env.js: |
window.__ENV__ = {
API_BASE_URL: {{ .Values.runtimeEnv.API_BASE_URL | quote }}{{- if .Values.runtimeEnv.SENTRY_DSN }},
SENTRY_DSN: {{ .Values.runtimeEnv.SENTRY_DSN | quote }}{{- end }}
};
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: adminpanel
namespace: {{ .Values.namespace }}
labels:
app: adminpanel
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
app: adminpanel
template:
metadata:
labels:
app: adminpanel
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: adminpanel
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- containerPort: 80
volumeMounts:
- name: env-js
mountPath: /config/env.js
subPath: env.js
lifecycle:
postStart:
exec:
command:
- sh
- -c
- |
API_URL=$(grep -o 'API_BASE_URL: "[^"]*"' /config/env.js | sed 's/.*"\([^"]*\)".*/\1/')
if [ -n "$API_URL" ]; then
find /usr/share/nginx/html/assets -name '*.js' -exec sed -i "s|https://api.sovamed.ru|${API_URL}|g" {} +
fi
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumes:
- name: env-js
configMap:
name: adminpanel-env-js
---
apiVersion: v1
kind: Service
metadata:
name: adminpanel
namespace: {{ .Values.namespace }}
spec:
selector:
app: adminpanel
ports:
- port: 80
targetPort: 80
---
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: adminpanel
namespace: {{ .Values.namespace }}
{{- if or .Values.ingress.tls.enabled .Values.ingress.basicAuth.enabled }}
annotations:
{{- if .Values.ingress.tls.enabled }}
cert-manager.io/cluster-issuer: {{ .Values.ingress.tls.clusterIssuer | quote }}
nginx.ingress.kubernetes.io/ssl-redirect: "true"
{{- end }}
{{- if .Values.ingress.basicAuth.enabled }}
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: {{ .Values.ingress.basicAuth.secretName | quote }}
nginx.ingress.kubernetes.io/auth-realm: {{ .Values.ingress.basicAuth.realm | quote }}
nginx.ingress.kubernetes.io/auth-skip-locations: {{ .Values.ingress.basicAuth.skipLocations | quote }}
{{- end }}
{{- end }}
spec:
ingressClassName: {{ .Values.ingress.className }}
{{- if .Values.ingress.tls.enabled }}
tls:
- hosts:
- {{ .Values.ingress.host }}
secretName: {{ .Values.ingress.tls.secretName }}
{{- end }}
rules:
- host: {{ .Values.ingress.host }}
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: adminpanel
port:
number: 80
{{- end }}