[SCHEMATIC-215] Enable ingress for SigNoz UI

[BryanFauble]

https://sagebionetworks.jira.com/browse/SCHEMATIC-215

Problem:

1. SigNoz (Non-Enterprise) uses their own login mechanism that doesn't support SSO/SAML; We are reluctant to add JumpCloud SSO in-front of SigNoz as it will then require a 2-step login.
2. The Sage VPN is a viable option that requires users to be on the Sage VPN. As such we need to create a route to access the UI and restrict it to the public IP address.

Solution:

1. Creating a route in the Envoy Gateway to access the SigNoz UI.
2. Enable proxy protocol on the AWS load balancer to support forwarding the real client IP address via the X-Forwarded-For header.
3. Use an authorization SecurityPolicy to restrict access to the SigNoz HTTP route

Testing:

• To deploy and test on k8s sandbox cluster
• I verified that the URL is accessible via the dev url:

[BryanFauble]

SigNoz only supports working at the root URL of the domain it's running on. In favor of getting a solution I am going to use the ${environment}.sagedpe.org URLs. If we want to swap to using a different sub-domain later we'll be able to do that, for example Sage-Bionetworks-IT/organizations-infra#1302 shows what we might do on the Sage IT infra stack.

On this side it's going to be a larger shift (And why I didn't want to worry about doing it now). It's because we'll need to make sure that we request SSL certs from Let's Encrypt and make sure it all works with the Listeners in the Envoy Gateway.

[zaro0508]

alpha version?

[BryanFauble]

It's the latest at the moment (https://gateway.envoyproxy.io/latest/api/extension_types/#gatewayenvoyproxyiov1alpha1)

The gateway itself is past the v1.x.x mark, but the APIs (aka definition of this YAML) are subject to updates. I've been impressed with the changes this project has been publishing out and they have smoothed out a bunch of rough edges for shaping traffic into the K8s cluster. I've worked with other tools like Istio, and Traefik Proxy before & were a huge pain to manage at the time.

[zaro0508]

i do't know about the rest but this looks like what we want.

[BWMac]

LGTM!