fix: set proxy url internal svc.cluster.local endpoint

[allanice001]

PR Type

Bug fix

---

Description

• Replace external domain URLs with internal cluster service endpoints

• Update OAuth2 proxy authentication URLs to use svc.cluster.local

• Fix ingress annotations across cluster-info, Grafana, and Vault applications

---

Diagram Walkthrough

flowchart LR
  A["External Domain URLs"] -- "Replace with" --> B["Internal Cluster Service"]
  B --> C["oauth2-proxy.glueops-core-oauth2-proxy.svc.cluster.local"]
  C --> D["Updated Ingress Annotations"]

Loading

File Walkthrough

Relevant files

Bug fix

application-cluster-info-page.yaml Update cluster-info OAuth2 proxy URLs                                        templates/application-cluster-info-page.yaml Replace OAuth2 proxy URLs with internal cluster service endpoints Update auth-signin and auth-url annotations to use svc.cluster.local +2/-2      application-kube-prometheus-stack.yaml Update Grafana OAuth2 proxy URLs                                                  templates/application-kube-prometheus-stack.yaml Replace OAuth2 proxy URLs with internal cluster service endpoints Update Grafana ingress annotations to use svc.cluster.local +2/-2      application-vault.yaml Update Vault OAuth2 proxy URLs                                                      templates/application-vault.yaml Replace OAuth2 proxy URLs with internal cluster service endpoints Update Vault ingress annotations to use svc.cluster.local +2/-2

---

[codiumai-pr-agent-free]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

[codiumai-pr-agent-free]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Use public URL for browser redirects Replace the internal service DNS in the auth-signin annotation with a publicly accessible URL to ensure browser redirects for authentication work correctly. templates/application-cluster-info-page.yaml [60-61] -nginx.ingress.kubernetes.io/auth-signin: "http://oauth2-proxy.glueops-core-oauth2-proxy.svc.cluster.local/oauth2/start?rd=https://$host$request_uri" +nginx.ingress.kubernetes.io/auth-signin: "http://oauth2.{{ .Values.captain_domain }}/oauth2/start?rd=https://$host$request_uri" nginx.ingress.kubernetes.io/auth-url: "http://oauth2-proxy.glueops-core-oauth2-proxy.svc.cluster.local/oauth2/auth" Apply / Chat Suggestion importance[1-10]: 10 __ Why: The suggestion correctly identifies a critical bug where using an internal service DNS for auth-signin would break the authentication flow, as this URL must be publicly accessible to the user's browser.	High
More

[venkatamutyala]

@allanice001 were you able to successfully test this locally? If not, this was the issue i was expecting to have if we changed the urls. I don't think there is an easy way around it.

E.g. visit: grafana.captain and it redirects to the local cluster url