apisix-dashboard-embed.yaml

# Grafana-embeddable front for the APISIX dashboard.
#
# WHY THIS EXISTS
# The apisix-dashboard app (3.0.0) hard-codes restrictive security headers:
#     X-Frame-Options: deny
#     Content-Security-Policy: default-src 'self'
# These block its own "embed Grafana URL" feature from loading
# https://monitor.wisefood.gr in an iframe. The headers cannot be changed in the
# app, and we are deliberately NOT enabling ingress-nginx configuration-snippets
# (cluster-wide raw-config injection) nor editing the live cluster ingress.
#
# Instead this adds a small nginx reverse-proxy in front of the dashboard that
# rewrites those two headers, and a replacement ingress for apisix.wisefood.gr
# that routes to the proxy. Everything here is scoped to the `apisix` namespace.
#
# APPLY (your call — nothing here is applied automatically):
#   kubectl apply -f apisix-dashboard-embed.yaml
# This REPLACES the existing apisix-dashboard ingress object (same name/host).
# Grafana must already allow embedding (allow_embedding=true, cookie_samesite=none
# — see grafana-config.yaml).
#
# ROLLBACK:
#   kubectl delete -f apisix-dashboard-embed.yaml
#   then re-apply your original apisix-dashboard ingress.
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: apisix-dashboard-proxy
  namespace: apisix
data:
  default.conf: |
    server {
      listen 8080;
      server_name _;

      location / {
        proxy_pass http://apisix-dashboard.apisix.svc.cluster.local:80;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Drop the dashboard app's restrictive headers...
        proxy_hide_header X-Frame-Options;
        proxy_hide_header Content-Security-Policy;

        # ...and replace with a policy that permits framing Grafana only.
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-src 'self' https://monitor.wisefood.gr; frame-ancestors 'self'" always;
      }
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: apisix-dashboard-proxy
  namespace: apisix
  labels:
    app.kubernetes.io/name: apisix-dashboard-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: apisix-dashboard-proxy
  template:
    metadata:
      labels:
        app.kubernetes.io/name: apisix-dashboard-proxy
    spec:
      containers:
        - name: nginx
          image: nginx:1.27-alpine
          ports:
            - name: http
              containerPort: 8080
          volumeMounts:
            - name: conf
              mountPath: /etc/nginx/conf.d/default.conf
              subPath: default.conf
              readOnly: true
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 10
      volumes:
        - name: conf
          configMap:
            name: apisix-dashboard-proxy
---
apiVersion: v1
kind: Service
metadata:
  name: apisix-dashboard-proxy
  namespace: apisix
spec:
  selector:
    app.kubernetes.io/name: apisix-dashboard-proxy
  ports:
    - name: http
      port: 80
      targetPort: 8080
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: apisix-dashboard
  namespace: apisix
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-production
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: 50m
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - apisix.wisefood.gr
      secretName: apisix-dashboard-tls
  rules:
    - host: apisix.wisefood.gr
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: apisix-dashboard-proxy
                port:
                  number: 80