Adde prom auth ingress

k8s/apps/gitea/deployment.yaml

@@ -52,7 +52,7 @@ spec:
               value: "*"
           envFrom:
           - secretRef:
-              name: gitea-recapcha-creds
+              name: gitea-runner-act-runner-secrets
           ports:
             - name: http
               containerPort: 3000

k8s/core/prom-stack/ingress.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-proxy
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: prometheus
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`prom.hexor.cy`)
+      kind: Rule
+      middlewares:
+        - name: auth-proxy
+      services:
+        - name: prometheus-kube-prometheus-prometheus
+          port: 9090
+  tls:
+    secretName: prometheus-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: prometheus-tls
+spec:
+  secretName: prometheus-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - prom.hexor.cy

k8s/core/prom-stack/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - persistentVolume.yaml
   - external-secrets.yaml
+  - ingress.yaml
   - grafana-alerting-configmap.yaml
   - alertmanager-config.yaml
   - dashboards/telemt-dashboard-cm.yaml

k8s/core/prom-stack/prom-values.yaml

@@ -1,4 +1,3 @@
-
 alertmanager:
   config:
     global:
@@ -25,7 +24,7 @@ alertmanager:
               {{ end }}
 
   ingress:
-    enabled: true
+    enabled: false
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt
@@ -46,7 +45,7 @@ alertmanager:
 
 prometheus:
   ingress:
-    enabled: true
+    enabled: false
     ingressClassName: traefik
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt

terraform/keycloak/terraform.tfvars

@@ -16,6 +16,10 @@ proxy_applications = {
     domain         = "pass.hexor.cy"
     allowed_groups = ["hexor-admin", "app-pass"]
   }
+  Prometheus = {
+    domain         = "prom.hexor.cy"
+    allowed_groups = ["hexor-admin"]
+  }
 }
 
 oauth2_applications = {