traefik-pomerium-kubernetes-forwardauth

forward-auth.yaml

---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: forward-auth
  namespace: pomerium
spec:
  forwardAuth:
    address: https://pomerium-proxy.pomerium.svc.cluster.local
    trustForwardHeader: true
    tls:
      insecureSkipVerify: true
    authResponseHeaders:
      - Authorization
      - Impersonate-User
      - Impersonate-Group

kube-api-ingress-route-forwardauth.yaml

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: kube-api
  namespace: pomerium
spec:
  routes:
    - kind: Rule
      match: Host(`<kube api external domain>`) && PathPrefix(`/.pomerium`)
      services:
        - name: pomerium-proxy
          namespace: pomerium
          port: 443
    - kind: Rule
      match: Host(`<kube api external domain>`)
      services:
        - name: kubernetes
          namespace: default
          port: 443
      middlewares:
        - name: forward-auth
          namespace: pomerium

kube-api-ingressroute.yaml

---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: kube-api
  namespace: pomerium
spec:
  routes:
    - kind: Rule
      match: Host(`<kube api external domain>`)
      services:
        - name: pomerium-proxy
          namespace: pomerium
          port: 443

pomerium-policy.yaml

policy:
  - from: https://<kube api external domain>
    to: https://kubernetes.default.svc
    tls_custom_ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    allow_spdy: true
    allowed_domains:
      - <your domain>
    kubernetes_service_account_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token