From 114be3b2aad906be3f76e4b666527c38de6ce97c Mon Sep 17 00:00:00 2001 From: Jeff Billimek Date: Thu, 8 Aug 2019 22:23:39 -0400 Subject: [PATCH] adding auth0 chart (#62) * adding auth0 chart Signed-off-by: Jeff Billimek * renaming auth0 chart to forwardauth Signed-off-by: Jeff Billimek * adding home stanza to charts.yaml * adding dniel as maintainer * fixing linting error with Chart.yaml --- forwardauth/.helmignore | 25 +++++++++++ forwardauth/Chart.yaml | 9 ++++ forwardauth/templates/NOTES.txt | 19 ++++++++ forwardauth/templates/_helpers.tpl | 32 ++++++++++++++ forwardauth/templates/configmap.yaml | 12 +++++ forwardauth/templates/deployment.yaml | 64 +++++++++++++++++++++++++++ forwardauth/templates/ingress.yaml | 36 +++++++++++++++ forwardauth/templates/service.yaml | 19 ++++++++ forwardauth/values.yaml | 62 ++++++++++++++++++++++++++ 9 files changed, 278 insertions(+) create mode 100644 forwardauth/.helmignore create mode 100644 forwardauth/Chart.yaml create mode 100644 forwardauth/templates/NOTES.txt create mode 100644 forwardauth/templates/_helpers.tpl create mode 100644 forwardauth/templates/configmap.yaml create mode 100644 forwardauth/templates/deployment.yaml create mode 100644 forwardauth/templates/ingress.yaml create mode 100644 forwardauth/templates/service.yaml create mode 100644 forwardauth/values.yaml diff --git a/forwardauth/.helmignore b/forwardauth/.helmignore new file mode 100644 index 00000000..b56010b0 --- /dev/null +++ b/forwardauth/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +config/ +target/ +.mvn +src/ diff --git a/forwardauth/Chart.yaml b/forwardauth/Chart.yaml new file mode 100644 index 00000000..1c2e14b5 --- /dev/null +++ b/forwardauth/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +appVersion: "1.0" +description: A Helm chart for Kubernetes to install Auth0 Authorization application for Traefik forward authentication. +name: forwardauth +version: 0.1.0 +home: https://github.com/billimek/billimek-charts/tree/master/forwardauth +maintainers: + - name: dniel + email: dniel@engfeldt.net diff --git a/forwardauth/templates/NOTES.txt b/forwardauth/templates/NOTES.txt new file mode 100644 index 00000000..1351c608 --- /dev/null +++ b/forwardauth/templates/NOTES.txt @@ -0,0 +1,19 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ . }}{{ $.Values.ingress.path }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "helm.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get svc -w {{ template "helm.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "helm.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}') + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "helm.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl port-forward $POD_NAME 8080:80 +{{- end }} diff --git a/forwardauth/templates/_helpers.tpl b/forwardauth/templates/_helpers.tpl new file mode 100644 index 00000000..466bf927 --- /dev/null +++ b/forwardauth/templates/_helpers.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "helm.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "helm.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "helm.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/forwardauth/templates/configmap.yaml b/forwardauth/templates/configmap.yaml new file mode 100644 index 00000000..0e38a23d --- /dev/null +++ b/forwardauth/templates/configmap.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "helm.fullname" . }}-config + labels: + app: {{ template "helm.name" . }} + chart: {{ template "helm.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + application.yaml: | +{{ toYaml .Values.applicationYaml | indent 4 }} diff --git a/forwardauth/templates/deployment.yaml b/forwardauth/templates/deployment.yaml new file mode 100644 index 00000000..0e602791 --- /dev/null +++ b/forwardauth/templates/deployment.yaml @@ -0,0 +1,64 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "helm.fullname" . }} + labels: + app: {{ template "helm.name" . }} + chart: {{ template "helm.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "helm.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ template "helm.name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + volumeMounts: + - name: config-volume + mountPath: /config + env: + - name: JVM_OPTS + value: -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:MaxRAMFraction=1 + - name: ENV + value: "{{ .Values.logLevel }}" + livenessProbe: + httpGet: + path: /actuator/health + port: http + readinessProbe: + httpGet: + path: /actuator/health + port: http + resources: +{{ toYaml .Values.resources | indent 12 }} + volumes: + - name: config-volume + configMap: + name: {{ template "helm.fullname" . }}-config + + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/forwardauth/templates/ingress.yaml b/forwardauth/templates/ingress.yaml new file mode 100644 index 00000000..0a2e30be --- /dev/null +++ b/forwardauth/templates/ingress.yaml @@ -0,0 +1,36 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "helm.fullname" . -}} +{{- $servicePort := .Values.service.port -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + app: {{ template "helm.name" . }} + chart: {{ template "helm.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- with .Values.ingress.annotations }} + annotations: +{{ toYaml . | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + - http: + paths: + - backend: + serviceName: {{ $fullName }} + servicePort: http + path: /oauth2 +{{- end }} diff --git a/forwardauth/templates/service.yaml b/forwardauth/templates/service.yaml new file mode 100644 index 00000000..c03c7b14 --- /dev/null +++ b/forwardauth/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ template "helm.fullname" . }} + labels: + app: {{ template "helm.name" . }} + chart: {{ template "helm.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: 8080 + protocol: TCP + name: http + selector: + app: {{ template "helm.name" . }} + release: {{ .Release.Name }} diff --git a/forwardauth/values.yaml b/forwardauth/values.yaml new file mode 100644 index 00000000..5c0f8bf7 --- /dev/null +++ b/forwardauth/values.yaml @@ -0,0 +1,62 @@ +replicaCount: 1 + +image: + repository: index.docker.io/dniel/forwardauth + tag: latest + pullPolicy: Always + +# set logLevel to DEBUG, TEST, or PRODUCTION to control the verbosity of logs +logLevel: DEBUG + +service: + type: ClusterIP + port: 80 + +ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: traefik + traefik.frontend.rule.type: PathPrefixStrip + traefik.ingress.kubernetes.io/priority: "99999" + path: /oauth2 + +## Uncomment and complete the following section to set the configuration +# applicationYaml: +# domain: https://xxxxx.xx.auth0.com/ +# token-endpoint: https://xxx.xx.auth0.com/oauth/token +# authorize-url: https://xxxx.xx.auth0.com/authorize +# default: +# name: www.example.test +# client-id: +# client-secret: +# audience: or blank +# scope: "profile openid email" +# redirect-uri: http://www.example.test/oauth2/signin +# token-cookie-domain: example.test +# apps: +# - name: www.example.test +# client-id: +# client-secret: +# audience: or blank +# scope: "profile openid email" +# redirect-uri: http://www.example.test/oauth2/signin +# token-cookie-domain: example.test +# - name: traefik.example.test +# client-id: +# client-secret: +# audience: or blank +# scope: "profile openid email" +# redirect-uri: http://traefik.example.test/oauth2/signin +# token-cookie-domain: traefik.example.test + +resources: + limits: + memory: 512Mi + requests: + memory: 512Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {}