From 0238e09deae814ea128e2ff75729d6f6704a8fb3 Mon Sep 17 00:00:00 2001 From: Gerald Barker Date: Tue, 9 Apr 2019 17:47:59 +0100 Subject: [PATCH] [stable][chartmuseum] Allow use of Bearer Auth (#12725) Signed-off-by: Gerald Barker --- stable/chartmuseum/Chart.yaml | 2 +- stable/chartmuseum/README.md | 108 +++++++++++++++---- stable/chartmuseum/templates/deployment.yaml | 18 +++- stable/chartmuseum/values.yaml | 10 ++ 4 files changed, 111 insertions(+), 27 deletions(-) diff --git a/stable/chartmuseum/Chart.yaml b/stable/chartmuseum/Chart.yaml index 5a470a69df..3bb1a68c7f 100644 --- a/stable/chartmuseum/Chart.yaml +++ b/stable/chartmuseum/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Host your own Helm Chart Repository name: chartmuseum -version: 2.1.0 +version: 2.2.0 appVersion: 0.8.2 home: https://github.com/helm/chartmuseum icon: https://raw.githubusercontent.com/helm/chartmuseum/master/logo2.png diff --git a/stable/chartmuseum/README.md b/stable/chartmuseum/README.md index 60f4ed3e7b..4e87f616a7 100644 --- a/stable/chartmuseum/README.md +++ b/stable/chartmuseum/README.md @@ -10,29 +10,30 @@ Please also see https://github.com/kubernetes-helm/chartmuseum -- [ChartMuseum Helm Chart](#chartmuseum-helm-chart) - - [Table of Content](#table-of-content) - - [Prerequisites](#prerequisites) - - [Configuration](#configuration) - - [Installation](#installation) - - [Using with Amazon S3](#using-with-amazon-s3) - - [permissions grant with access keys](#permissions-grant-with-access-keys) - - [permissions grant with IAM instance profile](#permissions-grant-with-iam-instance-profile) - - [permissions grant with IAM assumed role](#permissions-grant-with-iam-assumed-role) - - [Using with Google Cloud Storage](#using-with-google-cloud-storage) - - [Using with Google Cloud Storage and a Google Service Account](#using-with-google-cloud-storage-and-a-google-service-account) - - [Using with Microsoft Azure Blob Storage](#using-with-microsoft-azure-blob-storage) - - [Using with Alibaba Cloud OSS Storage](#using-with-alibaba-cloud-oss-storage) - - [Using with Openstack Object Storage](#using-with-openstack-object-storage) - - [Using with Oracle Object Storage](#using-with-oracle-object-storage) - - [Using an existing secret](#using-an-existing-secret) - - [Using with local filesystem storage](#using-with-local-filesystem-storage) - - [Example storage class](#example-storage-class) - - [Ingress](#ingress) - - [Hosts](#hosts) - - [Annotations](#annotations) - - [Example Ingress configuration](#example-ingress-configuration) - - [Uninstall](#uninstall) +- [Prerequisites](#prerequisites) +- [Configuration](#configuration) +- [Installation](#installation) + - [Using with Amazon S3](#using-with-amazon-s3) + - [permissions grant with access keys](#permissions-grant-with-access-keys) + - [permissions grant with IAM instance profile](#permissions-grant-with-iam-instance-profile) + - [permissions grant with IAM assumed role](#permissions-grant-with-iam-assumed-role) + - [Using with Google Cloud Storage](#using-with-google-cloud-storage) + - [Using with Google Cloud Storage and a Google Service Account](#using-with-google-cloud-storage-and-a-google-service-account) + - [Using with Microsoft Azure Blob Storage](#using-with-microsoft-azure-blob-storage) + - [Using with Alibaba Cloud OSS Storage](#using-with-alibaba-cloud-oss-storage) + - [Using with Openstack Object Storage](#using-with-openstack-object-storage) + - [Using with Oracle Object Storage](#using-with-oracle-object-storage) + - [Using an existing secret](#using-an-existing-secret) + - [Using with local filesystem storage](#using-with-local-filesystem-storage) + - [Example storage class](#example-storage-class) + - [Authentication](#authentication) + - [Basic Authentication](#basic-authentication) + - [Bearer/Token auth](#bearertoken-auth) + - [Ingress](#ingress) + - [Hosts](#hosts) + - [Annotations](#annotations) + - [Example Ingress configuration](#example-ingress-configuration) +- [Uninstall](#uninstall) @@ -129,6 +130,9 @@ their default values. See values.yaml for all available options. | `env.open.CACHE` | Cache store, can be one of: redis | `` | | `env.open.CACHE_REDIS_ADDR` | Address of Redis service (host:port) | `` | | `env.open.CACHE_REDIS_DB` | Redis database to be selected after connect | `0` | +| `env.open.BEARER_AUTH` | Enable bearer auth | `false` | +| `env.open.AUTH_REALM` | Realm used for bearer authentication | `` | +| `env.open.AUTH_SERVICE` | Service used for bearer authentication | `` | | `env.field` | Expose pod information to containers through environment variables | `` | | `env.existingSecret` | Name of the existing secret use values | `` | | `env.existingSecret.BASIC_AUTH_USER` | Key name in the secret for the Username | `` | @@ -143,6 +147,8 @@ their default values. See values.yaml for all available options. | `oracle.secret.name` | Secret name for OCI config and key | `` | | `oracle.secret.config` | Secret key that holds the OCI config | `config` | | `oracle.secret.key_file` | Secret key that holds the OCI private key | `key_file` | +| `bearerAuth.secret.enabled` | Flag for bearer auth public key secret | `` | +| `bearerAuth.secret.publicKey` | The name of the secret with the public key | `` | | `service.type` | Kubernetes Service type | `ClusterIP` | | `service.clusterIP` | Static clusterIP or None for headless services| `nil` | | `service.externalTrafficPolicy` | Source IP preservation (only for Service type NodePort) | `Local` | @@ -565,6 +571,62 @@ parameters: userSecretName: thesecret ``` +### Authentication + +By default this chart does not have any authentication configured and allows anyone to fetch or upload (assuming the API is enabled) charts there are two supported methods of authentication + +#### Basic Authentication + +This allows all API routes to be protected by HTTP basic auth, this is configured either as plain text in the values that gets stored as a secret in the kubernetes cluster by setting: + +```yaml +env: + secret: + BASIC_AUTH_USERNAME: curator + BASIC_AUTH_PASSWORD: mypassword +``` + +Or by using values from an existing secret in the cluster that can be created using: + +'''shell +kubectl create secret generic chartmuseum-secret --from-literal="basic-auth-user=curator" --from-literal="basic-auth-pass=mypassword" +''' + +This secret can be used in the values file as follows: + +```yaml +env: + existingSecret: chartmuseum-secret + existingSecretMappings: + BASIC_AUTH_USER: basic-auth-user + BASIC_AUTH_PASS: basic-auth-pass +``` + +#### Bearer/Token auth + +When using this ChartMuseum is configured with a public key, and will accept RS256 JWT tokens signed by the associated private key, passed in the Authorization header. You can use the [chartmuseum/auth](https://github.com/chartmuseum/auth) Go library to generate valid JWT tokens. For more information about how this works, please see [chartmuseum/auth-server-example](https://github.com/chartmuseum/auth-server-example) + +To use this the public key should be stored in a secret this can be done with + +```shell +kubectl create secret generic chartmuseum-public-key --from-file=public-key.pem +``` + +And Bearer/Token auth can be configured using the following values + +```yaml +env: + open: + BEARER_AUTH: true + AUTH_REALM: + AUTH_SERVICE: + +bearerAuth: + secret: + enabled: true + publicKeySecret: chartmuseum-public-key +``` + ### Ingress This chart provides support for ingress resources. If you have an ingress controller installed on your cluster, such as [nginx-ingress](https://hub.kubeapps.com/charts/stable/nginx-ingress) or [traefik](https://hub.kubeapps.com/charts/stable/traefik) you can utilize the ingress controller to expose Kubeapps. diff --git a/stable/chartmuseum/templates/deployment.yaml b/stable/chartmuseum/templates/deployment.yaml index bed2e53512..683faee0d4 100644 --- a/stable/chartmuseum/templates/deployment.yaml +++ b/stable/chartmuseum/templates/deployment.yaml @@ -77,6 +77,10 @@ spec: {{- end }} {{- end }} {{- end }} +{{- if .Values.bearerAuth.secret.enabled }} + - name: AUTH_CERT_PATH + value: /var/keys/public-key.pem +{{ end }} args: - --port=8080 {{- if eq .Values.env.open.STORAGE "local" }} @@ -95,20 +99,23 @@ spec: path: {{ .Values.env.open.CONTEXT_PATH }}/health port: http {{ toYaml .Values.probes.readiness | indent 10 }} -{{- if eq .Values.env.open.STORAGE "local" }} volumeMounts: +{{- if eq .Values.env.open.STORAGE "local" }} - mountPath: /storage name: storage-volume {{- end }} {{- if .Values.gcp.secret.enabled }} - volumeMounts: - mountPath: /etc/secrets/google name: {{ include "chartmuseum.fullname" . }}-gcp {{- end }} {{- if .Values.oracle.secret.enabled }} - volumeMounts: - mountPath: /home/chartmuseum/.oci name: {{ include "chartmuseum.fullname" . }}-oracle +{{- end }} +{{- if .Values.bearerAuth.secret.enabled }} + - name: public-key + mountPath: /var/keys + readOnly: true {{- end }} {{- with .Values.resources }} resources: @@ -168,3 +175,8 @@ spec: - key: {{ .Values.oracle.secret.key_file }} path: oci.key {{ end }} +{{- if .Values.bearerAuth.secret.enabled }} + - name: public-key + secret: + secretName: {{ .Values.bearerAuth.secret.publicKeySecret }} +{{- end }} diff --git a/stable/chartmuseum/values.yaml b/stable/chartmuseum/values.yaml index 2b1dcd8d80..96d29928bf 100644 --- a/stable/chartmuseum/values.yaml +++ b/stable/chartmuseum/values.yaml @@ -84,6 +84,12 @@ env: CACHE_REDIS_ADDR: # Redis database to be selected after connect CACHE_REDIS_DB: 0 + # enable bearer auth + BEARER_AUTH: false + # auth realm used for bearer auth + AUTH_REALM: + # auth service used for bearer auth + AUTH_SERVICE: field: # POD_IP: status.podIP secret: @@ -249,3 +255,7 @@ oracle: config: config # Secret key that holds the oci private key key_file: key_file +bearerAuth: + secret: + enabled: false + publicKeySecret: chartmuseum-public-key