coulomb/net-kingdom
2
0
Fork 0
generated from coulomb/repo-seed
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(sso-mfa): use ipWhiteList for Traefik v2 in LLDAP and privacyIDEA middleware

Browse Source 
Traefik 2.10 (K3s 1.30 bundle) requires ipWhiteList, not ipAllowList.
Updated both middleware files and clarified comments to match cluster version.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Bernd Worsch
2026-03-20 07:28:06 +00:00
parent 6d25d088d7
commit a375b3814d
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
sso-mfa/k8s/lldap/middleware.yaml
View File

@@ -17,7 +17,7 @@ metadata:
app.kubernetes.io/part-of: net-kingdom-sso-mfa app.kubernetes.io/part-of: net-kingdom-sso-mfa
net-kingdom/component: sso net-kingdom/component: sso
spec: spec:
ipAllowList: ipWhiteList:
# EDIT: replace with your VPN/office CIDRs. # EDIT: replace with your VPN/office CIDRs.
sourceRange: sourceRange:
- "10.0.0.0/8" - "10.0.0.0/8"

6
sso-mfa/k8s/privacyidea/middleware.yaml
View File

@@ -36,8 +36,8 @@ spec:
# ADJUST sourceRange to your actual VPN / office CIDR(s) before going live. # ADJUST sourceRange to your actual VPN / office CIDR(s) before going live.
# Leaving RFC-1918 ranges here is only a dev/staging default. # Leaving RFC-1918 ranges here is only a dev/staging default.
# #
# Traefik v3 uses ipAllowList; Traefik v2 uses ipWhiteList. # Traefik v2 uses ipWhiteList; Traefik v3 uses ipAllowList.
# Check your Traefik version and update accordingly. # This cluster runs Traefik 2.10 (K3s 1.30 bundle) — ipWhiteList required.
apiVersion: traefik.io/v1alpha1 apiVersion: traefik.io/v1alpha1
kind: Middleware kind: Middleware
metadata: metadata:
@@ -47,7 +47,7 @@ metadata:
app.kubernetes.io/part-of: net-kingdom-sso-mfa app.kubernetes.io/part-of: net-kingdom-sso-mfa
net-kingdom/component: mfa net-kingdom/component: mfa
spec: spec:
ipAllowList: ipWhiteList:
# EDIT: replace with your VPN/office CIDRs (see CONFIG.md for the pattern). # EDIT: replace with your VPN/office CIDRs (see CONFIG.md for the pattern).
# Example VPN: "10.8.0.0/24" # Example VPN: "10.8.0.0/24"
sourceRange: sourceRange: