Swagger 403, ArgoCD 대시보드, CORS 이슈 해결

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: swagger-403-redirect
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
              subFilter:
                name: envoy.filters.http.router
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
            inlineCode: |
              function envoy_on_response(response_handle)
                local host = response_handle:headers():get(":authority") or ""
                local status = response_handle:headers():get(":status")

                -- swagger 도메인의 403 응답만 처리
                if string.find(host, "swagger") and status == "403" then
                  local path = response_handle:headers():get("x-original-uri") or "/"
                  local redirect_url = "/oauth2/start?rd=" .. path

                  -- 302 리다이렉트로 변경
                  response_handle:headers():replace(":status", "302")
                  response_handle:headers():add("location", redirect_url)
                  response_handle:headers():add("cache-control", "no-cache, no-store")
                end
              end

// Spring Boot - 에러 응답에도 CORS 헤더 포함
@Configuration
public class CorsConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/**")
            .allowedOrigins("https://dev.goormgb.space")
            .allowedMethods("*")
            .allowCredentials(true);
    }
}

// 또는 @ControllerAdvice에서 모든 예외 응답에 헤더 추가

routes:
  - id: auth-guard
    uri: ${AUTH_GUARD_URL}
    predicates:
      - Path=/auth/**
    filters:
      - StripPrefix=1  # /auth/token/refresh → /token/refresh

@RestController
@RequestMapping("/auth")  // 추가
public class AuthController {

# 1. Helm repo 추가 (최초 1회)
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo add calico https://docs.tigera.io/calico/charts
helm repo add grafana https://grafana.github.io/helm-charts
helm repo update

# 2. Dependency 빌드
helm dependency build common-charts/infra/istio/base
helm dependency build common-charts/infra/calico
helm dependency build common-charts/infra/monitoring/loki

# 3. charts/ 폴더 커밋
git add common-charts/**/charts/
git commit -m "chore(helm): update chart dependencies"
git push

-- 요청 단계: 메타데이터에 저장
function envoy_on_request(request_handle)
  local host = request_handle:headers():get(":authority") or ""
  local path = request_handle:headers():get(":path") or "/"

  if string.find(host, "swagger") then
    request_handle:streamInfo():dynamicMetadata():set("swagger_filter", "is_swagger", "true")
    request_handle:streamInfo():dynamicMetadata():set("swagger_filter", "original_path", path)
  end
end

-- 응답 단계: 메타데이터에서 읽기
function envoy_on_response(response_handle)
  local metadata = response_handle:streamInfo():dynamicMetadata():get("swagger_filter")

  if metadata and metadata["is_swagger"] == "true" then
    -- 처리 로직
  end
end

# IngressGateway 재시작 (가장 확실)
kubectl rollout restart deployment istio-ingressgateway -n istio-system

# 또는 Istiod 재시작 (모든 프록시에 config 재전송)
kubectl rollout restart deployment istiod -n istio-system