From e53e4fb1cf6f49237e3eeb79014d3bddd8598bfd Mon Sep 17 00:00:00 2001 From: Nick Szaunig Date: Mon, 12 Oct 2026 11:23:46 +0200 Subject: [PATCH] fix(k8s): Traefik-Middleware cloudflare-only an Ingress-Manifesten Die live gesetzte Annotation traefik.ingress.kubernetes.io/router.middlewares fehlte in den Manifesten (Backend und Frontend). Sie schuetzt vor Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen. Co-Authored-By: Claude Opus 5.5 (1M context) --- deploy/k8s/backend/ingress.yaml | 4 ++++ deploy/k8s/frontend/ingress.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/deploy/k8s/backend/ingress.yaml b/deploy/k8s/backend/ingress.yaml index ca1e39d..4687776 100644 --- a/deploy/k8s/backend/ingress.yaml +++ b/deploy/k8s/backend/ingress.yaml @@ -6,6 +6,10 @@ metadata: # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod" # (or swap for whatever issuer/cert mechanism the cluster already uses). cert-manager.io/cluster-issuer: letsencrypt-prod + # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo + # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor + # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen. + traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd spec: ingressClassName: nginx tls: diff --git a/deploy/k8s/frontend/ingress.yaml b/deploy/k8s/frontend/ingress.yaml index 08a91b9..a5e5755 100644 --- a/deploy/k8s/frontend/ingress.yaml +++ b/deploy/k8s/frontend/ingress.yaml @@ -6,6 +6,10 @@ metadata: # Requires cert-manager with a ClusterIssuer named "letsencrypt-prod" # (or swap for whatever issuer/cert mechanism the cluster already uses). cert-manager.io/cluster-issuer: letsencrypt-prod + # Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo + # rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor + # Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen. + traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd spec: ingressClassName: nginx tls: