From 9efbdb92ff933808b8835b00c07e6b8259fbbd51 Mon Sep 17 00:00:00 2001 From: Stefan Date: Thu, 30 Jul 2026 15:01:09 +0200 Subject: [PATCH] devnet-7: lock the agent faucet ingress behind the proxy's basic auth The agent faucet has no captcha (agents mine via REST), so open ingress meant anyone could claim via the web UI. The htpasswd secret powfaucet-agents-basic-auth (srv credential the panda proxy forwards) is created in the namespace; unauthenticated requests now get 401. Matches what generate_kubernetes_config emits once ingressAuthSecret is set in the collection defaults. --- kubernetes/devnet-7/faucet-agents/values.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kubernetes/devnet-7/faucet-agents/values.yaml b/kubernetes/devnet-7/faucet-agents/values.yaml index 0f49c83..5f48a22 100644 --- a/kubernetes/devnet-7/faucet-agents/values.yaml +++ b/kubernetes/devnet-7/faucet-agents/values.yaml @@ -20,6 +20,12 @@ powfaucet: enabled: true className: ingress-nginx-public + annotations: + # Lock the faucet behind basic auth that only the panda proxy holds, so it + # is reachable solely via the proxy (which authenticates the caller first). + nginx.ingress.kubernetes.io/auth-type: basic + nginx.ingress.kubernetes.io/auth-secret: powfaucet-agents-basic-auth + nginx.ingress.kubernetes.io/auth-realm: "panda proxy only" hosts: - host: faucet-agents.glamsterdam-devnet-7.ethpandaops.io