auth: add 401 redirect middleware to oauth2-proxy

infrastructure/longhorn/ui-ingress/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: longhorn-system-longhorn-forward-auth@kubernetescrd,longhorn-system-longhorn-headers@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: longhorn-system-longhorn-forward-auth@kubernetescrd,sso-oauth2-proxy-errors@kubernetescrd,longhorn-system-longhorn-headers@kubernetescrd
 spec:
   ingressClassName: traefik
   tls:

services/oauth2-proxy/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - service.yaml
   - ingress.yaml
   - middleware.yaml
+  - middleware-errors.yaml

services/oauth2-proxy/middleware-errors.yaml

@@ -0,0 +1,14 @@
+# services/oauth2-proxy/middleware-errors.yaml
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: oauth2-proxy-errors
+  namespace: sso
+spec:
+  errors:
+    status:
+      - "401"
+    service:
+      name: oauth2-proxy
+      port: 80
+    query: /oauth2/start?rd={url}

services/vault/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     kubernetes.io/ingress.class: traefik
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.middlewares: vault-vault-forward-auth@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: vault-vault-forward-auth@kubernetescrd,sso-oauth2-proxy-errors@kubernetescrd
     traefik.ingress.kubernetes.io/service.serversscheme: https
     traefik.ingress.kubernetes.io/service.serversTransport: vault-vault-to-https@kubernetescrd
 spec:

services/zot/ingress.yaml

@@ -8,7 +8,7 @@ metadata:
     cert-manager.io/cluster-issuer: letsencrypt-prod
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: zot-zot-forward-auth@kubernetescrd,zot-zot-resp-headers@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: zot-zot-forward-auth@kubernetescrd,sso-oauth2-proxy-errors@kubernetescrd,zot-zot-resp-headers@kubernetescrd
 spec:
   ingressClassName: traefik
   tls: