Exposing the Longhorn UI on the Private Tier: Ingress, Basic Auth, and One Wildcard Certificate

Overview

Longhorn runs the cluster's storage but its dashboard answers anyone who can reach it: the UI ships with no authentication of its own[^3]. This appendix puts it on the private tier from Private Tier HTTPS, served by the same default wildcard certificate, with basic auth at the Ingress as the per-service guardrail. Admin devices already reach the tier through the existing bastion rule, so not one firewall rule changes.