mirror of
https://github.com/k8s-at-home/charts.git
synced 2025-01-24 07:59:02 +00:00
feat: remoe oauth2-proxy helm chart
This commit is contained in:
Devin Buhl
parent
18d106d278
commit
4e258501c8
@ -1,23 +0,0 @@
|
|||||||
# Patterns to ignore when building packages.
|
|
||||||
# This supports shell glob matching, relative path matching, and
|
|
||||||
# negation (prefixed with !). Only one pattern per line.
|
|
||||||
.DS_Store
|
|
||||||
# Common VCS dirs
|
|
||||||
.git/
|
|
||||||
.gitignore
|
|
||||||
.bzr/
|
|
||||||
.bzrignore
|
|
||||||
.hg/
|
|
||||||
.hgignore
|
|
||||||
.svn/
|
|
||||||
# Common backup files
|
|
||||||
*.swp
|
|
||||||
*.bak
|
|
||||||
*.tmp
|
|
||||||
*~
|
|
||||||
# Various IDEs
|
|
||||||
.project
|
|
||||||
.idea/
|
|
||||||
*.tmproj
|
|
||||||
|
|
||||||
OWNERS
|
|
||||||
@ -1,19 +0,0 @@
|
|||||||
name: oauth2-proxy
|
|
||||||
version: 5.0.7
|
|
||||||
apiVersion: v1
|
|
||||||
appVersion: 7.1.3
|
|
||||||
home: https://github.com/k8s-at-home/charts/tree/master/charts/stable/oauth2-proxy
|
|
||||||
description: A reverse proxy that provides authentication with Google, Github or other providers
|
|
||||||
icon: https://avatars.githubusercontent.com/u/62798169?s=200&v=4
|
|
||||||
keywords:
|
|
||||||
- kubernetes
|
|
||||||
- oauth
|
|
||||||
- oauth2
|
|
||||||
- authentication
|
|
||||||
- google
|
|
||||||
- github
|
|
||||||
sources:
|
|
||||||
- https://github.com/oauth2-proxy/oauth2-proxy
|
|
||||||
engine: gotpl
|
|
||||||
kubeVersion: ">=1.9.0-0"
|
|
||||||
deprecated: true
|
|
||||||
@ -1,256 +0,0 @@
|
|||||||
# oauth2-proxy
|
|
||||||
|
|
||||||
 
|
|
||||||
|
|
||||||
A reverse proxy that provides authentication with Google, Github or other providers
|
|
||||||
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/k8s-at-home/charts/issues/new/choose)**
|
|
||||||
|
|
||||||
## Source Code
|
|
||||||
|
|
||||||
* <https://github.com/oauth2-proxy/oauth2-proxy>
|
|
||||||
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
Kubernetes: `>=1.9.0-0`
|
|
||||||
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
| Repository | Name | Version |
|
|
||||||
|------------|------|---------|
|
|
||||||
|
|
||||||
## TL;DR
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm repo add k8s-at-home https://k8s-at-home.com/charts/
|
|
||||||
helm repo update
|
|
||||||
helm install oauth2-proxy k8s-at-home/oauth2-proxy
|
|
||||||
```
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install the chart with the release name `oauth2-proxy`
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install oauth2-proxy k8s-at-home/oauth2-proxy
|
|
||||||
```
|
|
||||||
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To uninstall the `oauth2-proxy` deployment
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm uninstall oauth2-proxy
|
|
||||||
```
|
|
||||||
|
|
||||||
The command removes all the Kubernetes components associated with the chart **including persistent volumes** and deletes the release.
|
|
||||||
|
|
||||||
## Configuration
|
|
||||||
|
|
||||||
Read through the [values.yaml](./values.yaml) file. It has several commented out suggested values.
|
|
||||||
Other values may be used from the [values.yaml](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common).
|
|
||||||
|
|
||||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install oauth2-proxy \
|
|
||||||
--set env.TZ="America/New York" \
|
|
||||||
k8s-at-home/oauth2-proxy
|
|
||||||
```
|
|
||||||
|
|
||||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install oauth2-proxy k8s-at-home/oauth2-proxy -f values.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Custom configuration
|
|
||||||
|
|
||||||
### SSL Configuration
|
|
||||||
|
|
||||||
See: [SSL Configuration](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls).
|
|
||||||
Use ```values.yaml``` like:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
...
|
|
||||||
extraArgs:
|
|
||||||
tls-cert: /path/to/cert.pem
|
|
||||||
tls-key: /path/to/cert.key
|
|
||||||
|
|
||||||
extraVolumes:
|
|
||||||
- name: ssl-cert
|
|
||||||
secret:
|
|
||||||
secretName: my-ssl-secret
|
|
||||||
|
|
||||||
extraVolumeMounts:
|
|
||||||
- mountPath: /path/to/
|
|
||||||
name: ssl-cert
|
|
||||||
...
|
|
||||||
```
|
|
||||||
|
|
||||||
With a secret called `my-ssl-secret`:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
...
|
|
||||||
data:
|
|
||||||
cert.pem: AB..==
|
|
||||||
cert.key: CD..==
|
|
||||||
```
|
|
||||||
|
|
||||||
## Values
|
|
||||||
|
|
||||||
**Important**: When deploying an application Helm chart you can add more values from our common library chart [here](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common)
|
|
||||||
|
|
||||||
| Key | Type | Default | Description |
|
|
||||||
|-----|------|---------|-------------|
|
|
||||||
| affinity | object | `{}` | node/pod affinities Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
|
|
||||||
| authenticatedEmailsFile.enabled | bool | `false` | Enables authorize individual email addresses |
|
|
||||||
| authenticatedEmailsFile.restricted_access | string | `""` | [email addresses](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider#email-authentication) list config |
|
|
||||||
| authenticatedEmailsFile.template | string | `""` | Name of the configmap that is handled outside of that chart It's a simpler way to maintain only one configmap (user list) instead changing it for each oauth2-proxy service. Be aware the value name in the extern config map in data needs to be named to "restricted_user_access". One email per line example: restricted_access: |- name1@domain name2@domain If you override the config with restricted_access it will configure a user list within this chart what takes care of the config map resource. |
|
|
||||||
| config.clientID | string | `"XXXXXXX"` | OAuth client ID |
|
|
||||||
| config.clientSecret | string | `"XXXXXXXX"` | OAuth client secret |
|
|
||||||
| config.configFile | string | `"email_domains = [ \"*\" ]\nupstreams = [ \"file:///dev/null\" ]"` | google service account json contents serviceAccountJson: xxxx -- Alternatively, use an existing secret (see google-secret.yaml for required fields) existingSecret: google-secret -- custom [oauth2_proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) contents for settings not overridable via environment nor command line |
|
|
||||||
| config.cookieSecret | string | `"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"` | server specific cookie for the secret; create a new one with `openssl rand -base64 32 | head -c 32 | base64` |
|
|
||||||
| config.existingConfig | string | `nil` | xisting Kubernetes configmap to use for the configuration file. See [config template](https://github.com/helm/charts/blob/master/stable/oauth2-proxy/templates/configmap.yaml) for the required values |
|
|
||||||
| config.google | object | `{}` | |
|
|
||||||
| extraArgs | object | `{}` | key:value list of extra arguments to give the binary |
|
|
||||||
| extraEnv | list | `[]` | key:value list of extra environment variables to give the binary |
|
|
||||||
| extraVolumeMounts | list | `[]` | list of extra volumeMounts |
|
|
||||||
| extraVolumes | list | `[]` | list of extra volumes |
|
|
||||||
| htpasswdFile.enabled | bool | `false` | enable htpasswd-file option |
|
|
||||||
| htpasswdFile.entries | object | `{}` | list of [SHA encrypted user:passwords](https://oauth2-proxy.github.io/oauth2-proxy/configuration#command-line-options) |
|
|
||||||
| htpasswdFile.existingSecret | string | `""` | existing Kubernetes secret to use for OAuth2 htpasswd file |
|
|
||||||
| httpScheme | string | `"http"` | `http` or `https`. `name` used for port on the deployment. `httpGet` port `name` and `scheme` used for `liveness`- and `readinessProbes`. `name` and `targetPort` used for the service. |
|
|
||||||
| image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
|
|
||||||
| image.repository | string | `"quay.io/oauth2-proxy/oauth2-proxy"` | Image repository |
|
|
||||||
| image.tag | string | `"v7.1.3"` | Image tag |
|
|
||||||
| imagePullSecrets | list | `nil` | Optionally specify an array of imagePullSecrets. Secrets must be manually created in the namespace. ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod |
|
|
||||||
| ingress.annotations | object | `{}` | Ingress annotations |
|
|
||||||
| ingress.enabled | bool | `false` | Enable Ingress |
|
|
||||||
| ingress.extraPaths | list | `[]` | Ingress extra paths to prepend to every host configuration. Useful when configuring [custom actions with AWS ALB Ingress Controller](https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#actions). |
|
|
||||||
| ingress.hosts | list | `[]` | Ingress accepted hostnames |
|
|
||||||
| ingress.ingressClassName | string | `nil` | Set ingressClassName |
|
|
||||||
| ingress.path | string | `"/"` | Ingress accepted path |
|
|
||||||
| ingress.tls | list | `nil` | Ingress TLS configuration |
|
|
||||||
| initContainers | list | `[]` | Configure init containers for pod Ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ |
|
|
||||||
| livenessProbe | object | `{"enabled":true,"initialDelaySeconds":0,"timeoutSeconds":1}` | Configure Kubernetes liveness probes. Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ Disable both when deploying with Istio 1.0 mTLS. https://istio.io/help/faq/security/#k8s-health-checks |
|
|
||||||
| nodeSelector | object | `{}` | Node labels for pod assignment Ref: https://kubernetes.io/docs/user-guide/node-selection/ |
|
|
||||||
| podAnnotations | object | `{}` | annotations to add to each pod |
|
|
||||||
| podDisruptionBudget | object | `{"enabled":true,"minAvailable":1}` | PodDisruptionBudget settings Ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
|
|
||||||
| podLabels | object | `{}` | labels to add to each pod |
|
|
||||||
| podSecurityContext | object | `{}` | |
|
|
||||||
| priorityClassName | string | `""` | |
|
|
||||||
| proxyVarsAsSecrets | bool | `true` | |
|
|
||||||
| readinessProbe | object | `{"enabled":true,"initialDelaySeconds":0,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1}` | Configure Kubernetes readiness probes. |
|
|
||||||
| replicaCount | int | `1` | |
|
|
||||||
| resources | object | `{}` | |
|
|
||||||
| securityContext | object | `{"enabled":false,"runAsNonRoot":true}` | Configure Kubernetes security context for container Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
|
|
||||||
| service.annotations | object | `{}` | Service annotations for the GUI |
|
|
||||||
| service.loadBalancerIP | string | `nil` | Loadbalance IP for the GUI |
|
|
||||||
| service.loadBalancerSourceRanges | list | `nil` | List of IP CIDRs allowed access to load balancer (if supported) |
|
|
||||||
| service.port | int | `80` | Kubernetes port where the GUI is exposed |
|
|
||||||
| service.type | string | `"ClusterIP"` | Kubernetes service type for the GUI |
|
|
||||||
| serviceAccount.annotations | object | `{}` | |
|
|
||||||
| serviceAccount.enabled | bool | `true` | |
|
|
||||||
| serviceAccount.name | string | `nil` | |
|
|
||||||
| tolerations | list | `[]` | Tolerations for pod assignment Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ |
|
|
||||||
| topologySpreadConstraints | object | `{"enabled":false,"maxSkew":1,"topologyKey":"topology.kubernetes.io/zone","whenUnsatisfiable":"DoNotSchedule"}` | Configure Pod Topology Spread Constraints See https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ Requires Kubernetes >= v1.16 |
|
|
||||||
|
|
||||||
## Changelog
|
|
||||||
|
|
||||||
All notable changes to this application Helm chart will be documented in this file but does not include changes from our common library. To read those click [here](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common#changelog).
|
|
||||||
|
|
||||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
||||||
|
|
||||||
### [1.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This version upgrade oauth2-proxy to v4.0.0. Please see the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/blob/v4.0.0/CHANGELOG.md#v400) in order to upgrade.
|
|
||||||
|
|
||||||
### [2.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- support for Kubernetes v1.16.x by way of addressing the deprecation of the Deployment object apiVersion `apps/v1beta2`. See [the v1.16 API deprecations page](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for more information.
|
|
||||||
|
|
||||||
Due to [this issue](https://github.com/helm/helm/issues/6583) there may be errors performing a `helm upgrade`of this chart from versions earlier than 2.0.0.
|
|
||||||
|
|
||||||
### [3.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- support for [EKS IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) by adding a managed service account to the chart. This is a breaking change since the service account is enabled by default. To disable this behaviour set `serviceAccount.enabled` to `false`
|
|
||||||
|
|
||||||
### [4.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This is a breaking change as the chart was moved to k8s-at-home. No other change on top of the 3.x.x branch.
|
|
||||||
|
|
||||||
### [5.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- Not many breaking changes. See the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0) for oauth2-proxy, specifically the section "Breaking Changes" for a few configuration changes, particularly to do with the Azure provider.
|
|
||||||
|
|
||||||
### [5.0.1]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- Use helm-docs
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
### [5.0.4]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- Added icon url.
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
### [5.0.5]
|
|
||||||
|
|
||||||
#### Fixed
|
|
||||||
|
|
||||||
- Update oauth2-proxy website URLs.
|
|
||||||
|
|
||||||
### [5.0.6]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This version upgrade oauth2-proxy to 7.1.3. Please see the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.1.3/CHANGELOG.md) in order to upgrade.
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
[5.0.4]: #5.0.4
|
|
||||||
[5.0.1]: #5.0.1
|
|
||||||
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- See the [Docs](https://docs.k8s-at-home.com/our-helm-charts/getting-started/)
|
|
||||||
- Open an [issue](https://github.com/k8s-at-home/charts/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/k8s-at-home/organization/discussions)
|
|
||||||
- Join our [Discord](https://discord.gg/sTMX7Vh) community
|
|
||||||
|
|
||||||
----------------------------------------------
|
|
||||||
Autogenerated from chart metadata using [helm-docs v1.5.0](https://github.com/norwoodj/helm-docs/releases/v1.5.0)
|
|
||||||
@ -1,146 +0,0 @@
|
|||||||
{{- define "custom.repository.organization" -}}
|
|
||||||
k8s-at-home
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.repository.url" -}}
|
|
||||||
https://github.com/k8s-at-home/charts
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.helm.url" -}}
|
|
||||||
https://k8s-at-home.com/charts/
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.helm.path" -}}
|
|
||||||
{{ template "custom.repository.organization" . }}/{{ template "chart.name" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.notes" -}}
|
|
||||||
**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/k8s-at-home/charts/issues/new/choose)**
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.requirements" -}}
|
|
||||||
## Requirements
|
|
||||||
|
|
||||||
{{ template "chart.kubeVersionLine" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.dependencies" -}}
|
|
||||||
## Dependencies
|
|
||||||
|
|
||||||
{{ template "chart.requirementsTable" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.install.tldr" -}}
|
|
||||||
## TL;DR
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm repo add {{ template "custom.repository.organization" . }} {{ template "custom.helm.url" . }}
|
|
||||||
helm repo update
|
|
||||||
helm install {{ template "chart.name" . }} {{ template "custom.helm.path" . }}
|
|
||||||
```
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.install" -}}
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install the chart with the release name `{{ template "chart.name" . }}`
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install {{ template "chart.name" . }} {{ template "custom.helm.path" . }}
|
|
||||||
```
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.uninstall" -}}
|
|
||||||
## Uninstalling the Chart
|
|
||||||
|
|
||||||
To uninstall the `{{ template "chart.name" . }}` deployment
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm uninstall {{ template "chart.name" . }}
|
|
||||||
```
|
|
||||||
|
|
||||||
The command removes all the Kubernetes components associated with the chart **including persistent volumes** and deletes the release.
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.configuration.header" -}}
|
|
||||||
## Configuration
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.configuration.readValues" -}}
|
|
||||||
Read through the [values.yaml](./values.yaml) file. It has several commented out suggested values.
|
|
||||||
Other values may be used from the [values.yaml](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml) from the [common library](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common).
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.configuration.example.set" -}}
|
|
||||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install {{ template "chart.name" . }} \
|
|
||||||
--set env.TZ="America/New York" \
|
|
||||||
{{ template "custom.helm.path" . }}
|
|
||||||
```
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.configuration.example.file" -}}
|
|
||||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart.
|
|
||||||
|
|
||||||
```console
|
|
||||||
helm install {{ template "chart.name" . }} {{ template "custom.helm.path" . }} -f values.yaml
|
|
||||||
```
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.valuesSection" -}}
|
|
||||||
## Values
|
|
||||||
|
|
||||||
**Important**: When deploying an application Helm chart you can add more values from our common library chart [here](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common)
|
|
||||||
|
|
||||||
{{ template "chart.valuesTable" . }}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.support" -}}
|
|
||||||
## Support
|
|
||||||
|
|
||||||
- See the [Docs](https://docs.k8s-at-home.com/our-helm-charts/getting-started/)
|
|
||||||
- Open an [issue](https://github.com/k8s-at-home/charts/issues/new/choose)
|
|
||||||
- Ask a [question](https://github.com/k8s-at-home/organization/discussions)
|
|
||||||
- Join our [Discord](https://discord.gg/sTMX7Vh) community
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{ template "chart.header" . }}
|
|
||||||
|
|
||||||
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
|
|
||||||
|
|
||||||
{{ template "chart.description" . }}
|
|
||||||
|
|
||||||
{{ template "custom.notes" . }}
|
|
||||||
|
|
||||||
{{ template "chart.sourcesSection" . }}
|
|
||||||
|
|
||||||
{{ template "custom.requirements" . }}
|
|
||||||
|
|
||||||
{{ template "custom.dependencies" . }}
|
|
||||||
|
|
||||||
{{ template "custom.install.tldr" . }}
|
|
||||||
|
|
||||||
{{ template "custom.install" . }}
|
|
||||||
|
|
||||||
{{ template "custom.uninstall" . }}
|
|
||||||
|
|
||||||
{{ template "custom.configuration.header" . }}
|
|
||||||
|
|
||||||
{{ template "custom.configuration.readValues" . }}
|
|
||||||
|
|
||||||
{{ template "custom.configuration.example.set" . }}
|
|
||||||
|
|
||||||
{{ template "custom.configuration.example.file" . }}
|
|
||||||
|
|
||||||
{{ template "custom.custom.configuration" . }}
|
|
||||||
|
|
||||||
{{ template "custom.valuesSection" . }}
|
|
||||||
|
|
||||||
{{ template "custom.changelog" . }}
|
|
||||||
|
|
||||||
{{ template "custom.support" . }}
|
|
||||||
|
|
||||||
{{ template "helm-docs.versionFooter" . }}
|
|
||||||
{{ "" }}
|
|
||||||
@ -1,94 +0,0 @@
|
|||||||
{{- define "custom.changelog.header" -}}
|
|
||||||
## Changelog
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.changelog" -}}
|
|
||||||
{{ template "custom.changelog.header" . }}
|
|
||||||
|
|
||||||
All notable changes to this application Helm chart will be documented in this file but does not include changes from our common library. To read those click [here](https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common#changelog).
|
|
||||||
|
|
||||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
||||||
|
|
||||||
### [1.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This version upgrade oauth2-proxy to v4.0.0. Please see the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/blob/v4.0.0/CHANGELOG.md#v400) in order to upgrade.
|
|
||||||
|
|
||||||
### [2.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- support for Kubernetes v1.16.x by way of addressing the deprecation of the Deployment object apiVersion `apps/v1beta2`. See [the v1.16 API deprecations page](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for more information.
|
|
||||||
|
|
||||||
Due to [this issue](https://github.com/helm/helm/issues/6583) there may be errors performing a `helm upgrade`of this chart from versions earlier than 2.0.0.
|
|
||||||
|
|
||||||
### [3.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- support for [EKS IAM roles for service accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) by adding a managed service account to the chart. This is a breaking change since the service account is enabled by default. To disable this behaviour set `serviceAccount.enabled` to `false`
|
|
||||||
|
|
||||||
### [4.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This is a breaking change as the chart was moved to k8s-at-home. No other change on top of the 3.x.x branch.
|
|
||||||
|
|
||||||
### [5.0.0]
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- Not many breaking changes. See the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.0.0) for oauth2-proxy, specifically the section "Breaking Changes" for a few configuration changes, particularly to do with the Azure provider.
|
|
||||||
|
|
||||||
### [5.0.1]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- Use helm-docs
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
### [5.0.4]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- Added icon url.
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
### [5.0.5]
|
|
||||||
|
|
||||||
#### Fixed
|
|
||||||
|
|
||||||
- Update oauth2-proxy website URLs.
|
|
||||||
|
|
||||||
### [5.0.6]
|
|
||||||
|
|
||||||
#### Added
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
#### Changed
|
|
||||||
|
|
||||||
- This version upgrade oauth2-proxy to 7.1.3. Please see the [changelog](https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.1.3/CHANGELOG.md) in order to upgrade.
|
|
||||||
|
|
||||||
#### Removed
|
|
||||||
|
|
||||||
- N/A
|
|
||||||
|
|
||||||
[5.0.4]: #5.0.4
|
|
||||||
[5.0.1]: #5.0.1
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,38 +0,0 @@
|
|||||||
{{- define "custom.custom.configuration.header" -}}
|
|
||||||
## Custom configuration
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "custom.custom.configuration" -}}
|
|
||||||
{{ template "custom.custom.configuration.header" . }}
|
|
||||||
|
|
||||||
### SSL Configuration
|
|
||||||
|
|
||||||
See: [SSL Configuration](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/tls).
|
|
||||||
Use ```values.yaml``` like:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
...
|
|
||||||
extraArgs:
|
|
||||||
tls-cert: /path/to/cert.pem
|
|
||||||
tls-key: /path/to/cert.key
|
|
||||||
|
|
||||||
extraVolumes:
|
|
||||||
- name: ssl-cert
|
|
||||||
secret:
|
|
||||||
secretName: my-ssl-secret
|
|
||||||
|
|
||||||
extraVolumeMounts:
|
|
||||||
- mountPath: /path/to/
|
|
||||||
name: ssl-cert
|
|
||||||
...
|
|
||||||
```
|
|
||||||
|
|
||||||
With a secret called `my-ssl-secret`:
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
...
|
|
||||||
data:
|
|
||||||
cert.pem: AB..==
|
|
||||||
cert.key: CD..==
|
|
||||||
```
|
|
||||||
{{- end -}}
|
|
||||||
@ -1 +0,0 @@
|
|||||||
# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml.
|
|
||||||
@ -1,6 +0,0 @@
|
|||||||
ingress:
|
|
||||||
extraPaths:
|
|
||||||
- path: /*
|
|
||||||
backend:
|
|
||||||
serviceName: ssl-redirect
|
|
||||||
servicePort: use-annotation
|
|
||||||
@ -1 +0,0 @@
|
|||||||
replicaCount: 2 # Enables PodDisruptionBudget which is disabled when replicaCount is 1
|
|
||||||
@ -1,4 +0,0 @@
|
|||||||
# Allocate a FSGroup that owns the pod’s volumes via podSecurityContext
|
|
||||||
---
|
|
||||||
podSecurityContext:
|
|
||||||
fsGroup: 2000
|
|
||||||
@ -1 +0,0 @@
|
|||||||
# Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml.
|
|
||||||
@ -1,2 +0,0 @@
|
|||||||
# Will trigger creation of pdb
|
|
||||||
replicaCount: 2
|
|
||||||
@ -1,3 +0,0 @@
|
|||||||
To verify that oauth2-proxy has started, run:
|
|
||||||
|
|
||||||
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth2-proxy.fullname" . }}"
|
|
||||||
@ -1,54 +0,0 @@
|
|||||||
{{/* vim: set filetype=mustache: */}}
|
|
||||||
{{/*
|
|
||||||
Expand the name of the chart.
|
|
||||||
*/}}
|
|
||||||
{{- define "oauth2-proxy.name" -}}
|
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified app name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
If release name contains chart name it will be used as a full name.
|
|
||||||
*/}}
|
|
||||||
{{- define "oauth2-proxy.fullname" -}}
|
|
||||||
{{- if .Values.fullnameOverride -}}
|
|
||||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
|
||||||
{{- if contains $name .Release.Name -}}
|
|
||||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create chart name and version as used by the chart label.
|
|
||||||
*/}}
|
|
||||||
{{- define "oauth2-proxy.chart" -}}
|
|
||||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Get the secret name.
|
|
||||||
*/}}
|
|
||||||
{{- define "oauth2-proxy.secretName" -}}
|
|
||||||
{{- if .Values.config.existingSecret -}}
|
|
||||||
{{- printf "%s" .Values.config.existingSecret -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- printf "%s" (include "oauth2-proxy.fullname" .) -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create the name of the service account to use
|
|
||||||
*/}}
|
|
||||||
{{- define "oauth2-proxy.serviceAccountName" -}}
|
|
||||||
{{- if .Values.serviceAccount.enabled -}}
|
|
||||||
{{ default (include "oauth2-proxy.fullname" .) .Values.serviceAccount.name }}
|
|
||||||
{{- else -}}
|
|
||||||
{{ default "default" .Values.serviceAccount.name }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
{{- if .Values.authenticatedEmailsFile.enabled }}
|
|
||||||
{{- if .Values.authenticatedEmailsFile.restricted_access }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}-accesslist
|
|
||||||
data:
|
|
||||||
restricted_user_access: {{ .Values.authenticatedEmailsFile.restricted_access | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
{{- if and .Values.htpasswdFile.enabled (not .Values.htpasswdFile.existingSecret) }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file
|
|
||||||
type: Opaque
|
|
||||||
stringData:
|
|
||||||
users.txt: |-
|
|
||||||
{{- range $entries := .Values.htpasswdFile.entries }}
|
|
||||||
{{ $entries }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
{{- if not .Values.config.existingConfig }}
|
|
||||||
{{- if .Values.config.configFile }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
data:
|
|
||||||
oauth2_proxy.cfg: {{ .Values.config.configFile | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,222 +0,0 @@
|
|||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
spec:
|
|
||||||
replicas: {{ .Values.replicaCount }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
||||||
checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }}
|
|
||||||
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
|
|
||||||
checksum/google-secret: {{ include (print $.Template.BasePath "/google-secret.yaml") . | sha256sum }}
|
|
||||||
{{- if .Values.htpasswdFile.enabled }}
|
|
||||||
checksum/htpasswd: {{ include (print $.Template.BasePath "/configmap-htpasswd-file.yaml") . | sha256sum }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.podAnnotations }}
|
|
||||||
{{ toYaml .Values.podAnnotations | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
release: "{{ .Release.Name }}"
|
|
||||||
{{- if .Values.podLabels }}
|
|
||||||
{{ toYaml .Values.podLabels | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- if .Values.priorityClassName }}
|
|
||||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.podSecurityContext }}
|
|
||||||
securityContext:
|
|
||||||
{{- toYaml . | nindent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
serviceAccountName: {{ template "oauth2-proxy.serviceAccountName" . }}
|
|
||||||
{{- if ne (len .Values.initContainers) 0 }}
|
|
||||||
initContainers:
|
|
||||||
{{ toYaml .Values.initContainers | indent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
containers:
|
|
||||||
- name: {{ .Chart.Name }}
|
|
||||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
|
||||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
||||||
args:
|
|
||||||
- --http-address=0.0.0.0:4180
|
|
||||||
{{- range $key, $value := .Values.extraArgs }}
|
|
||||||
{{- if $value }}
|
|
||||||
- --{{ $key }}={{ $value }}
|
|
||||||
{{- else }}
|
|
||||||
- --{{ $key }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if or .Values.config.existingConfig .Values.config.configFile }}
|
|
||||||
- --config=/etc/oauth2_proxy/oauth2_proxy.cfg
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authenticatedEmailsFile.enabled }}
|
|
||||||
{{- if .Values.authenticatedEmailsFile.template }}
|
|
||||||
- --authenticated-emails-file=/etc/oauth2-proxy/{{ .Values.authenticatedEmailsFile.template }}
|
|
||||||
{{- else }}
|
|
||||||
- --authenticated-emails-file=/etc/oauth2-proxy/authenticated-emails-list
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- with .Values.config.google }}
|
|
||||||
{{- if and .adminEmail (or .serviceAccountJson .existingSecret) }}
|
|
||||||
- --google-admin-email={{ .adminEmail }}
|
|
||||||
- --google-service-account-json=/google/service-account.json
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.htpasswdFile.enabled }}
|
|
||||||
- --htpasswd-file=/etc/oauth2_proxy/htpasswd/users.txt
|
|
||||||
{{- end }}
|
|
||||||
env:
|
|
||||||
{{- if .Values.proxyVarsAsSecrets }}
|
|
||||||
- name: OAUTH2_PROXY_CLIENT_ID
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: {{ template "oauth2-proxy.secretName" . }}
|
|
||||||
key: client-id
|
|
||||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: {{ template "oauth2-proxy.secretName" . }}
|
|
||||||
key: client-secret
|
|
||||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: {{ template "oauth2-proxy.secretName" . }}
|
|
||||||
key: cookie-secret
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.extraEnv }}
|
|
||||||
{{ toYaml .Values.extraEnv | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
ports:
|
|
||||||
- containerPort: 4180
|
|
||||||
name: {{ .Values.httpScheme }}
|
|
||||||
protocol: TCP
|
|
||||||
{{- if .Values.livenessProbe.enabled }}
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /ping
|
|
||||||
port: {{ .Values.httpScheme }}
|
|
||||||
scheme: {{ .Values.httpScheme | upper }}
|
|
||||||
initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
|
|
||||||
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.readinessProbe.enabled }}
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /ping
|
|
||||||
port: {{ .Values.httpScheme }}
|
|
||||||
scheme: {{ .Values.httpScheme | upper }}
|
|
||||||
initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }}
|
|
||||||
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
|
||||||
successThreshold: {{ .Values.readinessProbe.successThreshold }}
|
|
||||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
|
||||||
{{- end }}
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 10 }}
|
|
||||||
volumeMounts:
|
|
||||||
{{- with .Values.config.google }}
|
|
||||||
{{- if and .adminEmail (or .serviceAccountJson .existingSecret) }}
|
|
||||||
- name: google-secret
|
|
||||||
mountPath: /google
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if or .Values.config.existingConfig .Values.config.configFile }}
|
|
||||||
- mountPath: /etc/oauth2_proxy
|
|
||||||
name: configmain
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authenticatedEmailsFile.enabled }}
|
|
||||||
- mountPath: /etc/oauth2-proxy
|
|
||||||
name: configaccesslist
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.htpasswdFile.enabled }}
|
|
||||||
- mountPath: /etc/oauth2_proxy/htpasswd
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- if ne (len .Values.extraVolumeMounts) 0 }}
|
|
||||||
{{ toYaml .Values.extraVolumeMounts | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.securityContext.enabled }}
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: {{ .Values.securityContext.runAsNonRoot }}
|
|
||||||
{{- end}}
|
|
||||||
volumes:
|
|
||||||
{{- with .Values.config.google }}
|
|
||||||
{{- if and .adminEmail (or .serviceAccountJson .existingSecret) }}
|
|
||||||
- name: google-secret
|
|
||||||
secret:
|
|
||||||
secretName: {{ if .existingSecret }}{{ .existingSecret }}{{ else }} {{ template "oauth2-proxy.secretName" $ }}{{ end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{- if .Values.htpasswdFile.enabled }}
|
|
||||||
- name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file
|
|
||||||
secret:
|
|
||||||
secretName: {{ if .Values.htpasswdFile.existingSecret }}{{ .Values.htpasswdFile.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-htpasswd-file {{ end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{- if or .Values.config.existingConfig .Values.config.configFile }}
|
|
||||||
- configMap:
|
|
||||||
defaultMode: 420
|
|
||||||
name: {{ if .Values.config.existingConfig }}{{ .Values.config.existingConfig }}{{ else }}{{ template "oauth2-proxy.fullname" . }}{{ end }}
|
|
||||||
name: configmain
|
|
||||||
{{- end }}
|
|
||||||
{{- if ne (len .Values.extraVolumes) 0 }}
|
|
||||||
{{ toYaml .Values.extraVolumes | indent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.authenticatedEmailsFile.enabled }}
|
|
||||||
- configMap:
|
|
||||||
{{- if .Values.authenticatedEmailsFile.template }}
|
|
||||||
name: {{ .Values.authenticatedEmailsFile.template }}
|
|
||||||
{{- else }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}-accesslist
|
|
||||||
{{- end }}
|
|
||||||
items:
|
|
||||||
- key: restricted_user_access
|
|
||||||
{{- if .Values.authenticatedEmailsFile.template }}
|
|
||||||
path: {{ .Values.authenticatedEmailsFile.template }}
|
|
||||||
{{- else }}
|
|
||||||
path: authenticated-emails-list
|
|
||||||
{{- end }}
|
|
||||||
name: configaccesslist
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{- if .Values.imagePullSecrets }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{ toYaml .Values.imagePullSecrets | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.affinity }}
|
|
||||||
affinity:
|
|
||||||
{{ toYaml .Values.affinity | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.nodeSelector }}
|
|
||||||
nodeSelector:
|
|
||||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
tolerations:
|
|
||||||
{{ toYaml .Values.tolerations | indent 8 }}
|
|
||||||
{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion -}}
|
|
||||||
{{- if .Values.topologySpreadConstraints.enabled }}
|
|
||||||
topologySpreadConstraints:
|
|
||||||
- labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
release: "{{ .Release.Name }}"
|
|
||||||
maxSkew: {{ .Values.topologySpreadConstraints.maxSkew }}
|
|
||||||
topologyKey: {{ .Values.topologySpreadConstraints.topologyKey }}
|
|
||||||
whenUnsatisfiable: {{ .Values.topologySpreadConstraints.whenUnsatisfiable }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,14 +0,0 @@
|
|||||||
{{- if and .Values.config.google (not .Values.config.google.existingSecret) }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}-google
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
service-account.json: {{ .serviceAccountJson }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,46 +0,0 @@
|
|||||||
{{- if .Values.ingress.enabled -}}
|
|
||||||
{{- $serviceName := include "oauth2-proxy.fullname" . -}}
|
|
||||||
{{- $servicePort := .Values.service.port -}}
|
|
||||||
{{- $ingressPath := .Values.ingress.path -}}
|
|
||||||
{{- $extraPaths := .Values.ingress.extraPaths -}}
|
|
||||||
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" -}}
|
|
||||||
apiVersion: networking.k8s.io/v1beta1
|
|
||||||
{{- else -}}
|
|
||||||
apiVersion: extensions/v1beta1
|
|
||||||
{{- end }}
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
{{- with .Values.ingress.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{ toYaml . | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" -}}
|
|
||||||
{{- if .Values.ingress.ingressClassName }}
|
|
||||||
ingressClassName: {{ .Values.ingress.ingressClassName }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
rules:
|
|
||||||
{{- range $host := .Values.ingress.hosts }}
|
|
||||||
- host: {{ $host | quote }}
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
{{ if $extraPaths }}
|
|
||||||
{{ toYaml $extraPaths | indent 10 }}
|
|
||||||
{{- end }}
|
|
||||||
- path: {{ $ingressPath }}
|
|
||||||
backend:
|
|
||||||
serviceName: {{ $serviceName }}
|
|
||||||
servicePort: {{ $servicePort }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- if .Values.ingress.tls }}
|
|
||||||
tls:
|
|
||||||
{{ toYaml .Values.ingress.tls | indent 4 }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
{{- if and .Values.podDisruptionBudget.enabled (gt (.Values.replicaCount | int) 1) }}
|
|
||||||
apiVersion: policy/v1beta1
|
|
||||||
kind: PodDisruptionBudget
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
|
||||||
{{- end }}
|
|
||||||
@ -1,16 +0,0 @@
|
|||||||
{{- if and (not .Values.config.existingSecret) (.Values.proxyVarsAsSecrets) }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
cookie-secret: {{ .Values.config.cookieSecret | b64enc | quote }}
|
|
||||||
client-secret: {{ .Values.config.clientSecret | b64enc | quote }}
|
|
||||||
client-id: {{ .Values.config.clientID | b64enc | quote }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,39 +0,0 @@
|
|||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
{{- if .Values.service.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{ toYaml .Values.service.annotations | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- if (or (eq .Values.service.type "ClusterIP") (empty .Values.service.type)) }}
|
|
||||||
type: ClusterIP
|
|
||||||
{{- if .Values.service.clusterIP }}
|
|
||||||
clusterIP: {{ .Values.service.clusterIP }}
|
|
||||||
{{end}}
|
|
||||||
{{- else if eq .Values.service.type "LoadBalancer" }}
|
|
||||||
type: {{ .Values.service.type }}
|
|
||||||
{{- if .Values.service.loadBalancerIP }}
|
|
||||||
loadBalancerIP: {{ .Values.service.loadBalancerIP }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.service.loadBalancerSourceRanges }}
|
|
||||||
loadBalancerSourceRanges:
|
|
||||||
{{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- else }}
|
|
||||||
type: {{ .Values.service.type }}
|
|
||||||
{{- end }}
|
|
||||||
ports:
|
|
||||||
- port: {{ .Values.service.port }}
|
|
||||||
targetPort: {{ .Values.httpScheme }}
|
|
||||||
protocol: TCP
|
|
||||||
name: {{ .Values.httpScheme }}
|
|
||||||
selector:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
@ -1,15 +0,0 @@
|
|||||||
{{- if or .Values.serviceAccount.enabled -}}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
{{- with .Values.serviceAccount.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{- toYaml . | nindent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
app: {{ template "oauth2-proxy.name" . }}
|
|
||||||
chart: {{ template "oauth2-proxy.chart" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
name: {{ template "oauth2-proxy.fullname" . }}
|
|
||||||
{{- end -}}
|
|
||||||
@ -1,223 +0,0 @@
|
|||||||
# Oauth client configuration specifics
|
|
||||||
config:
|
|
||||||
# -- OAuth client ID
|
|
||||||
clientID: "XXXXXXX"
|
|
||||||
# -- OAuth client secret
|
|
||||||
clientSecret: "XXXXXXXX"
|
|
||||||
# -- server specific cookie for the secret; create a new one with `openssl rand -base64 32 | head -c 32 | base64`
|
|
||||||
cookieSecret: "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
|
|
||||||
google: {}
|
|
||||||
# -- user impersonated by the google service account
|
|
||||||
# adminEmail: xxxx
|
|
||||||
|
|
||||||
# -- google service account json contents
|
|
||||||
# serviceAccountJson: xxxx
|
|
||||||
|
|
||||||
# -- Alternatively, use an existing secret (see google-secret.yaml for required fields)
|
|
||||||
# existingSecret: google-secret
|
|
||||||
|
|
||||||
# -- custom [oauth2_proxy.cfg](https://github.com/oauth2-proxy/oauth2-proxy/blob/master/contrib/oauth2-proxy.cfg.example) contents for settings not overridable via environment nor command line
|
|
||||||
configFile: |-
|
|
||||||
email_domains = [ "*" ]
|
|
||||||
upstreams = [ "file:///dev/null" ]
|
|
||||||
# Custom configuration file: oauth2_proxy.cfg
|
|
||||||
# configFile: |-
|
|
||||||
# pass_basic_auth = false
|
|
||||||
# pass_access_token = true
|
|
||||||
|
|
||||||
# -- (string)existing Kubernetes configmap to use for the configuration file. See [config template](https://github.com/helm/charts/blob/master/stable/oauth2-proxy/templates/configmap.yaml) for the required values
|
|
||||||
existingConfig:
|
|
||||||
|
|
||||||
image:
|
|
||||||
# -- Image repository
|
|
||||||
repository: "quay.io/oauth2-proxy/oauth2-proxy"
|
|
||||||
# -- Image tag
|
|
||||||
tag: "v7.1.3"
|
|
||||||
# -- Image pull policy
|
|
||||||
pullPolicy: "IfNotPresent"
|
|
||||||
|
|
||||||
# -- (list) Optionally specify an array of imagePullSecrets.
|
|
||||||
# Secrets must be manually created in the namespace.
|
|
||||||
# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
|
|
||||||
imagePullSecrets:
|
|
||||||
# - name: myRegistryKeySecretName
|
|
||||||
|
|
||||||
# -- key:value list of extra arguments to give the binary
|
|
||||||
extraArgs: {}
|
|
||||||
# -- key:value list of extra environment variables to give the binary
|
|
||||||
extraEnv: []
|
|
||||||
|
|
||||||
# To authorize individual email addresses
|
|
||||||
# That is part of extraArgs but since this needs special treatment we need to do a separate section
|
|
||||||
authenticatedEmailsFile:
|
|
||||||
# -- Enables authorize individual email addresses
|
|
||||||
enabled: false
|
|
||||||
# -- Name of the configmap that is handled outside of that chart
|
|
||||||
# It's a simpler way to maintain only one configmap (user list) instead changing it for each oauth2-proxy service.
|
|
||||||
# Be aware the value name in the extern config map in data needs to be named to "restricted_user_access".
|
|
||||||
# One email per line
|
|
||||||
# example:
|
|
||||||
# restricted_access: |-
|
|
||||||
# name1@domain
|
|
||||||
# name2@domain
|
|
||||||
# If you override the config with restricted_access it will configure a user list within this chart what takes care of the
|
|
||||||
# config map resource.
|
|
||||||
template: ""
|
|
||||||
|
|
||||||
# -- [email addresses](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider#email-authentication) list config
|
|
||||||
restricted_access: ""
|
|
||||||
|
|
||||||
service:
|
|
||||||
# -- Kubernetes service type for the GUI
|
|
||||||
type: ClusterIP
|
|
||||||
# -- Kubernetes port where the GUI is exposed
|
|
||||||
port: 80
|
|
||||||
# -- Service annotations for the GUI
|
|
||||||
annotations: {}
|
|
||||||
# -- (string) Loadbalance IP for the GUI
|
|
||||||
loadBalancerIP:
|
|
||||||
# -- (list) List of IP CIDRs allowed access to load balancer (if supported)
|
|
||||||
loadBalancerSourceRanges:
|
|
||||||
|
|
||||||
## Create or use ServiceAccount
|
|
||||||
serviceAccount:
|
|
||||||
## Specifies whether a ServiceAccount should be created
|
|
||||||
enabled: true
|
|
||||||
## The name of the ServiceAccount to use.
|
|
||||||
## If not set and create is true, a name is generated using the fullname template
|
|
||||||
name:
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
ingress:
|
|
||||||
# -- Enable Ingress
|
|
||||||
enabled: false
|
|
||||||
# -- Ingress accepted path
|
|
||||||
path: /
|
|
||||||
# -- Ingress accepted hostnames
|
|
||||||
hosts: []
|
|
||||||
# -- Ingress extra paths to prepend to every host configuration. Useful when configuring [custom actions with AWS ALB Ingress Controller](https://kubernetes-sigs.github.io/aws-alb-ingress-controller/guide/ingress/annotation/#actions).
|
|
||||||
extraPaths: []
|
|
||||||
# - path: /*
|
|
||||||
# backend:
|
|
||||||
# serviceName: ssl-redirect
|
|
||||||
# servicePort: use-annotation
|
|
||||||
|
|
||||||
# -- Ingress annotations
|
|
||||||
annotations: {}
|
|
||||||
# kubernetes.io/ingress.class: nginx
|
|
||||||
# kubernetes.io/tls-acme: "true"
|
|
||||||
|
|
||||||
# -- (list) Ingress TLS configuration
|
|
||||||
tls:
|
|
||||||
# Secrets must be manually created in the namespace.
|
|
||||||
# - secretName: chart-example-tls
|
|
||||||
# hosts:
|
|
||||||
# - chart-example.local
|
|
||||||
|
|
||||||
# -- (string) Set ingressClassName
|
|
||||||
ingressClassName:
|
|
||||||
|
|
||||||
resources: {}
|
|
||||||
# limits:
|
|
||||||
# cpu: 100m
|
|
||||||
# memory: 300Mi
|
|
||||||
# requests:
|
|
||||||
# cpu: 100m
|
|
||||||
# memory: 300Mi
|
|
||||||
|
|
||||||
# -- list of extra volumes
|
|
||||||
extraVolumes: []
|
|
||||||
# - name: ca-bundle-cert
|
|
||||||
# secret:
|
|
||||||
# secretName: <secret-name>
|
|
||||||
|
|
||||||
# -- list of extra volumeMounts
|
|
||||||
extraVolumeMounts: []
|
|
||||||
# - mountPath: /etc/ssl/certs/
|
|
||||||
# name: ca-bundle-cert
|
|
||||||
|
|
||||||
priorityClassName: ""
|
|
||||||
|
|
||||||
# -- node/pod affinities
|
|
||||||
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
|
||||||
affinity: {}
|
|
||||||
|
|
||||||
# -- Tolerations for pod assignment
|
|
||||||
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
|
||||||
tolerations: []
|
|
||||||
|
|
||||||
# -- Node labels for pod assignment
|
|
||||||
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
|
||||||
nodeSelector: {}
|
|
||||||
|
|
||||||
# Whether to use secrets instead of environment values for setting up OAUTH2_PROXY variables
|
|
||||||
proxyVarsAsSecrets: true
|
|
||||||
|
|
||||||
# -- Configure Kubernetes liveness probes.
|
|
||||||
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
|
|
||||||
# Disable both when deploying with Istio 1.0 mTLS. https://istio.io/help/faq/security/#k8s-health-checks
|
|
||||||
livenessProbe:
|
|
||||||
enabled: true
|
|
||||||
initialDelaySeconds: 0
|
|
||||||
timeoutSeconds: 1
|
|
||||||
|
|
||||||
# -- Configure Kubernetes readiness probes.
|
|
||||||
readinessProbe:
|
|
||||||
enabled: true
|
|
||||||
initialDelaySeconds: 0
|
|
||||||
timeoutSeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
|
|
||||||
# -- Configure Kubernetes security context for container
|
|
||||||
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
|
||||||
securityContext:
|
|
||||||
enabled: false
|
|
||||||
runAsNonRoot: true
|
|
||||||
|
|
||||||
# -- annotations to add to each pod
|
|
||||||
podAnnotations: {}
|
|
||||||
# -- labels to add to each pod
|
|
||||||
podLabels: {}
|
|
||||||
replicaCount: 1
|
|
||||||
|
|
||||||
# -- PodDisruptionBudget settings
|
|
||||||
# Ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
|
|
||||||
podDisruptionBudget:
|
|
||||||
enabled: true
|
|
||||||
minAvailable: 1
|
|
||||||
|
|
||||||
# Configure Kubernetes security context for pod
|
|
||||||
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
|
||||||
podSecurityContext: {}
|
|
||||||
|
|
||||||
# -- Configure init containers for pod
|
|
||||||
# Ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
|
|
||||||
initContainers: []
|
|
||||||
|
|
||||||
# -- `http` or `https`. `name` used for port on the deployment. `httpGet` port `name` and `scheme` used for `liveness`- and `readinessProbes`. `name` and `targetPort` used for the service.
|
|
||||||
httpScheme: http
|
|
||||||
|
|
||||||
# Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption.
|
|
||||||
# Alternatively supply an existing secret which contains the required information.
|
|
||||||
htpasswdFile:
|
|
||||||
# -- enable htpasswd-file option
|
|
||||||
enabled: false
|
|
||||||
# -- existing Kubernetes secret to use for OAuth2 htpasswd file
|
|
||||||
existingSecret: ""
|
|
||||||
# -- list of [SHA encrypted user:passwords](https://oauth2-proxy.github.io/oauth2-proxy/configuration#command-line-options)
|
|
||||||
entries: {}
|
|
||||||
# One row for each user
|
|
||||||
# example:
|
|
||||||
# entries:
|
|
||||||
# - testuser:{SHA}EWhzdhgoYJWy0z2gyzhRYlN9DSiv
|
|
||||||
|
|
||||||
# -- Configure Pod Topology Spread Constraints
|
|
||||||
# See https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
|
|
||||||
# Requires Kubernetes >= v1.16
|
|
||||||
topologySpreadConstraints:
|
|
||||||
enabled: false
|
|
||||||
maxSkew: 1
|
|
||||||
# See https://kubernetes.io/docs/reference/kubernetes-api/labels-annotations-taints/
|
|
||||||
topologyKey: topology.kubernetes.io/zone
|
|
||||||
whenUnsatisfiable: DoNotSchedule
|
|
||||||
Loading…
Reference in New Issue
Block a user