component-traefik-ingress

A standard Traefik Ingress for the project's web service, plus TLS via cert-manager.

Enable it

component-traefik-ingress:
  enabled: true
  labels:
    monitoring.onyourmarks.tech/probe: "true"
  hosts:
    - host: my-project.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: traefik-ingress-tls
      hosts: [my-project.example.com]

Every host listed under tls[].hosts gets a Let's Encrypt certificate through the letsencrypt-production cluster issuer. Issuance only succeeds once the name resolves to the cluster's load balancer (57.129.55.146), so add custom domains after DNS is in place. Hosts under *.k8s.instance.onyourmarks.tech resolve already.

Uptime monitoring label

labels."monitoring.onyourmarks.tech/probe" opts the ingress into the blackbox exporter:

Value	Probe
"true"	GET / over TLS must return 2xx
"allow-404"	2xx or 404 — for APIs that have nothing on /
absent	not monitored

Annotations

Defaults, always present:

annotations:
  cert-manager.io/cluster-issuer: letsencrypt-production
  traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
  traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-https@kubernetescrd

User annotations are merged on top. Only the router.middlewares key replaces its default, so when you set it, re-list traefik-redirect-https@kubernetescrd yourself:

component-traefik-ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-https@kubernetescrd,traefik-block-robots@kubernetescrd

Middlewares available cluster-wide (all in the traefik namespace, referenced as <name>@kubernetescrd):

Middleware	Use
traefik-redirect-https	http → https. Keep it.
traefik-block-robots	Adds X-Robots-Tag: noindex, nofollow, nosnippet, noarchive to every response. Put it on every *.k8s.instance.onyourmarks.tech host, never on a public domain.
traefik-redirect-to-www / traefik-redirect-to-non-www	Apex ↔ www canonicalisation.
traefik-security-headers	HSTS and friends.
traefik-oauth2-proxy-errors	Turns a 401 or 403 into a redirect to the cluster sign-in. Always listed before one of the two below.
traefik-oauth2-proxy-auth	Lets a request through only with a cluster sign-in (Auth0, onyourmarks.agency accounts). Passes the X-Auth-Request-* headers to the app.
traefik-oauth2-proxy-auth-id-token	The same, and also passes the Auth0 ID token as Authorization: Bearer, for an app that needs to know who is signed in.

Behind the cluster sign-in

Only hosts under *.k8s.instance.onyourmarks.tech can use it; the sign-in cookie is set for that domain.

component-traefik-ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-https@kubernetescrd,traefik-oauth2-proxy-errors@kubernetescrd,traefik-oauth2-proxy-auth@kubernetescrd
  cacheStaticAssets:
    enabled: false

cacheStaticAssets goes off because its route outranks the Ingress and carries no sign-in: with it on, every path ending in .js, .png and the like reaches the app without one.

The annotation covers the whole host. Paths that need different treatment go in an IngressRoute of their own, shipped through overlaysDir; k8s/app/platform/oym-ai-zendesk-agent/base/ingress-routes.yaml has both kinds:

• Paths machines call (webhooks, health checks, / for the uptime probe) get a rule without middlewares.
• An API the page calls with fetch gets the auth middleware without oauth2-proxy-errors, so an expired sign-in answers 401 instead of a redirect the browser cannot follow.

An app that uses the signed-in user takes it from the ID token and verifies the signature against the Auth0 tenant's keys. The X-Auth-Request-* headers are only trustworthy on requests that came through the middleware, and a request from inside the cluster does not.

Multiple hosts

hosts:
  - host: example.com
    paths: [{ path: /, pathType: Prefix }]
  - host: www.example.com
    paths: [{ path: /, pathType: Prefix }]
tls:
  - secretName: traefik-ingress-tls
    hosts: [example.com, www.example.com]

Routing a path to another service

By default every path goes to the app's Service (app-service, port 80). A path can target another Service in the namespace:

hosts:
  - host: example.com
    paths:
      - path: /
        pathType: Prefix
      - path: /metrics
        pathType: Prefix
        service:
          name: exporter-service
          port: 9100