67a20f249e
We make use of nginx subrequests to block media file downloads while we check for access rights. The request is then proxied to the object storage engine and authorization is added via the "Authorization" header. This way the media urls are static and can be stored in the document's json content without compromising on security: access control is done on all requests based on the user cookie session.
84 lines
3.0 KiB
YAML
84 lines
3.0 KiB
YAML
{{- if .Values.ingressMedia.enabled -}}
|
|
{{- $fullName := include "impress.fullname" . -}}
|
|
{{- if and .Values.ingressMedia.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
|
|
{{- if not (hasKey .Values.ingressMedia.annotations "kubernetes.io/ingress.class") }}
|
|
{{- $_ := set .Values.ingressMedia.annotations "kubernetes.io/ingress.class" .Values.ingressMedia.className}}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
|
|
apiVersion: networking.k8s.io/v1
|
|
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
|
|
apiVersion: networking.k8s.io/v1beta1
|
|
{{- else -}}
|
|
apiVersion: extensions/v1beta1
|
|
{{- end }}
|
|
kind: Ingress
|
|
metadata:
|
|
name: {{ $fullName }}-media
|
|
namespace: {{ .Release.Namespace | quote }}
|
|
labels:
|
|
{{- include "impress.labels" . | nindent 4 }}
|
|
{{- with .Values.ingressMedia.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- if and .Values.ingressMedia.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
|
|
ingressClassName: {{ .Values.ingressMedia.className }}
|
|
{{- end }}
|
|
{{- if .Values.ingressMedia.tls.enabled }}
|
|
tls:
|
|
{{- if .Values.ingressMedia.host }}
|
|
- secretName: {{ $fullName }}-tls
|
|
hosts:
|
|
- {{ .Values.ingressMedia.host | quote }}
|
|
{{- end }}
|
|
{{- range .Values.ingressMedia.tls.additional }}
|
|
- hosts:
|
|
{{- range .hosts }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
secretName: {{ .secretName }}
|
|
{{- end }}
|
|
{{- end }}
|
|
rules:
|
|
{{- if .Values.ingressMedia.host }}
|
|
- host: {{ .Values.ingressMedia.host | quote }}
|
|
http:
|
|
paths:
|
|
- path: {{ .Values.ingressMedia.path | quote }}
|
|
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
|
|
pathType: Prefix
|
|
{{- end }}
|
|
backend:
|
|
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
|
service:
|
|
name: {{ $fullName }}-media
|
|
port:
|
|
number: {{ .Values.serviceMedia.port }}
|
|
{{- else }}
|
|
serviceName: {{ $fullName }}-media
|
|
servicePort: {{ .Values.serviceMedia.port }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- range .Values.ingressMedia.hosts }}
|
|
- host: {{ . | quote }}
|
|
http:
|
|
paths:
|
|
- path: {{ $.Values.ingressMedia.path | quote }}
|
|
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
|
|
pathType: Prefix
|
|
{{- end }}
|
|
backend:
|
|
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
|
|
service:
|
|
name: {{ $fullName }}-media
|
|
port:
|
|
number: {{ .Values.serviceMedia.port }}
|
|
{{- else }}
|
|
serviceName: {{ $fullName }}-media
|
|
servicePort: {{ .Values.serviceMedia.port }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|