Nick SzaunigandClaude Opus 5.5
e53e4fb1cf
Die live gesetzte Annotation traefik.ingress.kubernetes.io/router.middlewares fehlte in den Manifesten (Backend und Frontend). Sie schuetzt vor Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
30 lines
999 B
YAML
30 lines
999 B
YAML
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: apicore-backend
|
|
annotations:
|
|
# Requires cert-manager with a ClusterIssuer named "letsencrypt-prod"
|
|
# (or swap for whatever issuer/cert mechanism the cluster already uses).
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
# Nur Traffic ueber Cloudflare zulassen. Die Middleware liegt im Repo
|
|
# rke2-cluster (security/cloudflare-only-middlewares.yaml). Sie schuetzt vor
|
|
# Direktzugriff am Origin vorbei, nicht vor fremden Cloudflare-Zonen.
|
|
traefik.ingress.kubernetes.io/router.middlewares: apicore-cloudflare-only@kubernetescrd
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- hosts:
|
|
- api.apicore.example.com
|
|
secretName: apicore-backend-tls
|
|
rules:
|
|
- host: api.apicore.example.com
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: apicore-backend
|
|
port:
|
|
number: 80
|