Add single-use identity password setup

sso-mfa/k8s/identity-provisioner/deployment.yaml

@@ -34,6 +34,8 @@ spec:
             - name: PROVISIONER_SERVICE_TOKEN
               valueFrom:
                 secretKeyRef: {name: identity-provisioner-token, key: token}
+            - {name: PASSWORD_SETUP_PUBLIC_URL, value: "https://kc.coulomb.social/setup/password"}
+            - {name: PASSWORD_SETUP_TTL_SECONDS, value: "900"}
           securityContext:
             allowPrivilegeEscalation: false
             capabilities: {drop: ["ALL"]}
@@ -73,11 +75,43 @@ spec:
           podSelector:
             matchLabels: {app.kubernetes.io/name: user-engine}
       ports: [{protocol: TCP, port: 8080}]
+    - from:
+        - namespaceSelector:
+            matchLabels: {kubernetes.io/metadata.name: kube-system}
+          podSelector:
+            matchLabels: {app.kubernetes.io/name: traefik}
+      ports: [{protocol: TCP, port: 8080}]
   egress:
     - to:
         - podSelector:
             matchLabels: {app.kubernetes.io/name: lldap}
       ports: [{protocol: TCP, port: 17170}]
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: identity-password-setup
+  namespace: sso
+  labels:
+    app.kubernetes.io/name: identity-provisioner
+    app.kubernetes.io/part-of: net-kingdom-sso-mfa
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: "sso-keycape-rate-limit@kubernetescrd, sso-keycape-hsts@kubernetescrd"
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: kc.coulomb.social
+      http:
+        paths:
+          - path: /setup/password
+            pathType: Exact
+            backend:
+              service:
+                name: identity-provisioner
+                port: {number: 8080}
+  tls:
+    - hosts: [kc.coulomb.social]
+      secretName: kc-tls
     - to:
         - namespaceSelector:
             matchLabels: {kubernetes.io/metadata.name: kube-system}