Repository navigation
Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797) #8
Description
🤖 Generated by the Agentic Engineer
https://github.com/devantler-tech/platform-template/blob/39ac525df46e24ca7ba1ba2a9d27c144aa6a7e10/k8s/bases/infrastructure/controllers/auth-proxy/config-map.yaml#L1
# TODO: Remove auth-proxy when Cilium supports native forward auth (https://github.com/cilium/cilium/issues/23797)
---
apiVersion: v1
kind: ConfigMap
metadata:
name: auth-proxy-config
namespace: oauth2-proxy
data:
traefik.yaml: |
entryPoints:
web:
address: ":8080"
providers:
file:
filename: /etc/traefik/dynamic.yaml
log:
level: INFO
dynamic.yaml: |
http:
routers:
homepage:
rule: "Host(`${domain}`)"
entryPoints: ["web"]
service: homepage
hubble:
rule: "Host(`hubble.${domain}`)"
entryPoints: ["web"]
service: hubble-ui
prometheus:
rule: "Host(`prometheus.${domain}`)"
entryPoints: ["web"]
service: prometheus
alertmanager:
rule: "Host(`alertmanager.${domain}`)"
entryPoints: ["web"]
service: alertmanager
opencost:
rule: "Host(`opencost.${domain}`)"
entryPoints: ["web"]
service: opencost
services:
homepage:
loadBalancer:
servers:
- url: "http://homepage.homepage.svc.cluster.local:80"
hubble-ui:
loadBalancer:
servers:
- url: "http://keda-add-ons-http-interceptor-proxy.keda.svc.cluster.local:8080"
prometheus:
loadBalancer:
servers:
- url: "http://kube-prometheus-stack-prometheus.monitoring.svc.cluster.local:9090"
alertmanager:
loadBalancer:
servers:
- url: "http://kube-prometheus-stack-alertmanager.monitoring.svc.cluster.local:9093"
opencost:
loadBalancer:
servers:
- url: "http://opencost.opencost.svc.cluster.local:9090"
Blocker: cilium/cilium#23797 (native forward auth) | upstream | last-verified 2026-11-01: still OPEN; latest stable Cilium is v1.20.4. The native dependency platform#1881 is also open and held by open platform#2284, so no accepted replacement of the auth-proxy exists yet.
Generated by Claude Code
Activity
chore: dedupe auth-proxy removal TODO to a single component tracker (#16
[-]Remove auth-proxy when Cilium supports native forward auth (https://github.com/cilium/cilium/issues/23797)[/-][+]Remove the auth-proxy component when Cilium supports native forward auth (cilium/cilium#23797)[/+]devantler commentedon Jun 3, 2026
Promoting this to the single canonical tracker for removing the entire
auth-proxycomponent once cilium/cilium#23797 ships native forward auth. The auth-proxy TODO had been auto-filed once per file ink8s/bases/infrastructure/controllers/auth-proxy/(config-map, deployment, kustomization, networkpolicy, service), producing five identical issues (#8–#12). PR #16 already deduped the in-code TODO to a single component tracker; this consolidates the issue side to match. Closing #9–#12 as duplicates of this one.Labelled
blocked(gated on the upstream Cilium feature).devantler commentedon Sep 30, 2026
Re-verified 2026-09-30: the blocker has moved. This issue now waits on devantler-tech/platform#1881, not on Cilium.
auth-proxycomponent (6 manifests underk8s/bases/infrastructure/controllers/auth-proxy/). Removing it before the platform has proven the replacement would hand the gap on to every new platform built from the template.I've recorded devantler-tech/platform#1881 as a native "blocked by" dependency. Once it merges, port the same change here: remove
auth-proxyand switch the protected routes to the ExternalAuth filter. Theblockedlabel stays until then.chore: agent-claim #8 nonce=e3693b577b27c6d310f559e09291d3d6