xinfra/authserver/k8s/nginx.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: authserver-nginx-conf
  namespace: authserver
data:
  default.conf.template: |
    server {
        listen 80;
        server_name _;

        client_max_body_size 10m;

        location = /healthz {
            proxy_pass ${AUTHSERVER_BACKEND_UPSTREAM};
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location = /readyz {
            proxy_pass ${AUTHSERVER_BACKEND_UPSTREAM};
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /auth/api/ {
            proxy_pass ${AUTHSERVER_BACKEND_UPSTREAM};
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

        location /auth/oauth/ {
            proxy_pass ${AUTHSERVER_BACKEND_UPSTREAM};
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

        location /auth/.well-known/ {
            proxy_pass ${AUTHSERVER_BACKEND_UPSTREAM};
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

        location /internal/clouddm/ {
            proxy_pass ${CLOUDDM_UPSTREAM}/;
            proxy_http_version 1.1;
            proxy_set_header Host ${CLOUDDM_PUBLIC_HOST};
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Host ${CLOUDDM_PUBLIC_HOST};
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto http;
            proxy_connect_timeout 5s;
            proxy_send_timeout 60s;
            proxy_read_timeout 60s;
        }

        location / {
            return 404;
        }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: authserver-nginx
  namespace: authserver
spec:
  replicas: 1
  selector:
    matchLabels:
      app: authserver-nginx
  template:
    metadata:
      labels:
        app: authserver-nginx
    spec:
      containers:
        - name: nginx
          image: nginx:1.29-alpine
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 80
          env:
            - name: NGINX_ENVSUBST_FILTER
              value: "^(AUTHSERVER_BACKEND_UPSTREAM|CLOUDDM_UPSTREAM|CLOUDDM_PUBLIC_HOST)$"
            - name: AUTHSERVER_BACKEND_UPSTREAM
              value: http://authserver-backend:8083
            - name: CLOUDDM_UPSTREAM
              value: http://open-cdm.db.svc.cluster.local:8222
            - name: CLOUDDM_PUBLIC_HOST
              value: 218.11.5.223:30009
          volumeMounts:
            - name: nginx-conf
              mountPath: /etc/nginx/templates/default.conf.template
              subPath: default.conf.template
          readinessProbe:
            httpGet:
              path: /readyz
              port: 80
            initialDelaySeconds: 5
            periodSeconds: 10
          livenessProbe:
            httpGet:
              path: /healthz
              port: 80
            initialDelaySeconds: 10
            periodSeconds: 20
      volumes:
        - name: nginx-conf
          configMap:
            name: authserver-nginx-conf
---
apiVersion: v1
kind: Service
metadata:
  name: authserver-nginx
  namespace: authserver
spec:
  type: NodePort
  selector:
    app: authserver-nginx
  ports:
    - name: http
      port: 80
      targetPort: 80
      nodePort: 30080