Secure Kubernetes Dashboard with Authelia forward_auth #29

New issue

Open

opened 2026-07-25 19:37:16 +00:00 by lab · 0 comments

lab commented

2026-07-25 19:37:16 +00:00

Owner

The Kubernetes Dashboard is exposed via LoadBalancer (192.168.0.209) but has no authentication layer in Caddy. The bearer token is the only barrier.

Solution

Add a Caddy route with forward_auth pointing to Authelia, so users must authenticate before accessing the dashboard.

Steps

Add to caddy/configmap.yaml:

k8s.yukselcloud.com {
    log
    crowdsec
    forward_auth authelia.auth.svc.cluster.local:9091 {
        uri /api/authz/forward-auth
        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
    }
    reverse_proxy kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local:443 {
        header_up Host {host}
        header_up X-Forwarded-Proto https
    }
}

Apply configmap and restart Caddy
Add DNS record in DDNS config
Optionally change dashboard service to ClusterIP (no need for direct LB access)

The Kubernetes Dashboard is exposed via LoadBalancer (192.168.0.209) but has no authentication layer in Caddy. The bearer token is the only barrier. ## Solution Add a Caddy route with `forward_auth` pointing to Authelia, so users must authenticate before accessing the dashboard. ## Steps 1. Add to `caddy/configmap.yaml`: ```caddyfile k8s.yukselcloud.com { log crowdsec forward_auth authelia.auth.svc.cluster.local:9091 { uri /api/authz/forward-auth copy_headers Remote-User Remote-Groups Remote-Name Remote-Email } reverse_proxy kubernetes-dashboard.kubernetes-dashboard.svc.cluster.local:443 { header_up Host {host} header_up X-Forwarded-Proto https } } ``` 2. Apply configmap and restart Caddy 3. Add DNS record in DDNS config 4. Optionally change dashboard service to ClusterIP (no need for direct LB access)