search

kestra-io / helm-charts

Apache License 2.0
37 stars 26 forks source link

Provide support for 2 ingress: public webhook endpoint & private UI #18

Open aballiet opened 1 year ago

aballiet commented 1 year ago

Feature description

As Kestra has these two types of entities accessing the Webserver:

They carry distinct purposes, so makes sense to divide their access.

When going to a production environment, we might want to allow public access of the webhook endpoint /api/v1/executions/webhook but restrict all the other paths to the UI.

Currently a single ingress is provided allowing us to define a specific annotation for the webhook endpoint within Helm chart

ingress:
  enabled: true
  className: ""
  annotations:
    kubernetes.io/ingress.class: nginx
  hosts:
    - host: kestra.webhook.${load-balancer-ip}.nip.io
      paths:
        - path: /api/v1/executions/webhook
          pathType: Prefix

Could be interesting to support another ingress for general UI access in order to restrict access using IAP or to a VPN.

This would facilitate deployment process.