Пређи на главни садржај

Ingress, ForwardAuth & Cert-Manager

To secure edge access, route external traffic, and automate TLS encryption, I built a zero-trust ingress architecture powered by Traefik Ingress Controller.

My Edge Components​

1. Traefik Ingress Controller​

  • Role: Standard ingress entry point for all incoming HTTP and HTTPS traffic into the k3s cluster. Routes domain requests to internal ClusterIP services based on hostname and path rules.

2. Cert-Manager (Automated TLS via Let's Encrypt)​

  • Role: Automatically provisions and renews SSL/TLS certificates using Let's Encrypt ACME HTTP-01 and DNS-01 challenges.
  • Why: Zero-maintenance HTTPS security. Cert-Manager continuously monitors certificate expiration and renews keys automatically without manual intervention.

3. ForwardAuth with OAuth2 Proxy (Keycloak)​

  • Role: Zero-trust authentication filter placed in front of administrative web dashboards (such as ArgoCD, MinIO Console, Grafana, or internal monitoring tools).
  • Why: Instead of relying on individual application passwords or risking unauthenticated admin endpoints, ForwardAuth intercepts incoming requests at the Traefik Ingress level and verifies active Keycloak sessions (via the dslan realm) through OAuth2 Proxy. Unauthenticated users are redirected to Keycloak before reaching internal cluster services.
Eliminate Per-App Configuration

By handling authentication at the ingress layer via ForwardAuth, I don't need to configure SAML or OAuth inside every single application (like ArgoCD or MinIO). The applications simply trust the headers provided by Traefik, stripping away a massive amount of configuration overhead. Services that need richer OIDC integration — like Grafana, Kaneo, and Penpot — authenticate directly against the dslan Keycloak realm instead.