stable/pomerium: update v0.0.5 (#14542)

https://github.com/pomerium/pomerium/releases/tag/v0.0.5

Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>

stable/pomerium/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: pomerium
-version: 1.0.1
-appVersion: 0.0.3
+version: 1.1.0
+appVersion: 0.0.5
 home: http://www.pomerium.io/
 icon: https://www.pomerium.io/logo.svg
 description: Pomerium is an identity-aware access proxy.

stable/pomerium/README.md

@@ -8,22 +8,29 @@
 helm install --name my-release stable/pomerium
 ```
 
-> Note: Pomerium depends on being configured with a third party identity providers to function properly. If you run pomerium without specifiying default values, you will need to change those configuration variables following setup.
+> Note: Pomerium depends on being configured with a third party identity providers to function properly. If you run pomerium without specifying default values, you will need to change those configuration variables following setup.
 
 ## Install the chart
 
 An example of a minimal, but complete installation of pomerium with identity provider settings, random secrets, certificates, and external URLs is as follows:
 
 ```sh
-helm install --name my-release \
-    --set config.rootDomain="corp.example.com" \
-    --set ingress.tls.certificate=$(base64 -i "*.corp.example.com.cer") \
-    --set ingress.tls.key=$(base64 -i "*.corp.example.com.key") \
-    --set config.policy=$(base64 -i "policy.yaml") \
-    --set authenticate.idp.provider="google" \
-    --set authenticate.idp.clientID="REPLACE_ME" \
-    --set authenticate.idp.clientSecret="REPLACE_ME"
-    stable/pomerium
+kubectl create configmap config --from-file="config.yaml"="$HOME/pomerium/docs/docs/examples/config/config.example.yaml"
+
+helm install $HOME/pomerium-helm \
+	--set service.type="NodePort" \
+	--set config.rootDomain="corp.beyondperimeter.com" \
+	--set config.existingConfig="config" \
+	--set config.sharedSecret=$(head -c32 /dev/urandom | base64) \
+	--set config.cookieSecret=$(head -c32 /dev/urandom | base64) \
+	--set ingress.secret.name="pomerium-tls" \
+	--set ingress.secret.cert=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer") \
+	--set ingress.secret.key=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key") \
+	--set authenticate.idp.provider="google" \
+	--set authenticate.idp.clientID="REPLACE_ME" \
+	--set authenticate.idp.clientSecret="REPLACE_ME" \
+	stable/pomerium
+
 ```
 
 ## Uninstalling the Chart

stable/pomerium/ci/default-values.yaml

@@ -0,0 +1,21 @@
+config:
+  policy:
+    - from: httpbin.corp.pomerium.io
+      to: http://httpbin
+      allowed_domains:
+      - pomerium.io
+    - from: external-httpbin.corp.pomerium.io
+      to: httpbin.org
+      allowed_domains:
+      - gmail.com
+    - from: weirdlyssl.corp.pomerium.io
+      to: http://neverssl.com
+      allowed_users:
+      - bdd@pomerium.io
+      allowed_groups:
+      - admins
+      - developers
+    - from: hello.corp.pomerium.io
+      to: http://hello:8080
+      allowed_groups:
+      - admins

stable/pomerium/templates/authenticate-deployment.yaml

@@ -1,3 +1,4 @@
+{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }}
 {{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }}
 apiVersion: apps/v1
 kind: Deployment
@@ -21,8 +22,9 @@ spec:
       app.kubernetes.io/instance: {{ .Release.Name }}
   template:
     metadata:
-{{- if .Values.podAnnotations }}
       annotations:
+        config/checksum: {{ print .Values.config.extraOpts | sha256sum }}
+{{- if .Values.podAnnotations }}
 {{ toYaml .Values.podAnnotations | indent 8 }}
 {{- end }}
       labels:
@@ -42,6 +44,9 @@ spec:
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
+{{- if or .Values.config.existingConfig .Values.config.policy }}
+          - --config=/etc/pomerium/config.yaml
+{{- end }}
 {{- range $key, $value := .Values.extraArgs }}
 {{- if $value }}
           - --{{ $key }}={{ $value }}
@@ -52,6 +57,8 @@ spec:
         env:
         - name: SERVICES
           value: authenticate
+        - name: AUTHENTICATE_SERVICE_URL
+          value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
         - name: COOKIE_SECRET
           valueFrom:
             secretKeyRef:
@@ -62,10 +69,6 @@ spec:
             secretKeyRef:
               name: {{ $secretName }}
               key: shared-secret
-        - name: REDIRECT_URL
-          value: {{ default (printf "https://%s.%s/oauth2/callback" (include "pomerium.authenticate.fullname" .)  .Values.config.rootDomain ) .Values.authenticate.redirectUrl }}
-        - name: PROXY_ROOT_DOMAIN
-          value: {{ .Values.config.rootDomain }}
         - name: IDP_PROVIDER
           value: {{ .Values.authenticate.idp.provider }}
         - name: IDP_CLIENT_ID
@@ -80,11 +83,13 @@ spec:
               key: idp-client-secret
         - name: IDP_PROVIDER_URL
           value: {{ .Values.authenticate.idp.url }}
+{{- if .Values.authenticate.idp.serviceAccount }}
         - name: IDP_SERVICE_ACCOUNT
           valueFrom:
             secretKeyRef:
               name:  {{ $secretName }}
               key: idp-service-account
+{{- end }}
         - name: CERTIFICATE
           valueFrom:
             secretKeyRef:
@@ -118,8 +123,15 @@ spec:
             path: /ping
             port: https
             scheme: HTTPS
-      resources:
-{{ toYaml .Values.resources | indent 10 }}
+{{- if or .Values.config.existingConfig .Values.config.policy }}
+        volumeMounts:
+        - mountPath: /etc/pomerium/
+          name: config
+      volumes:
+      - name: config
+        configMap:
+          name: {{ $configName }}
+{{- end }}
 {{- if .Values.extraVolumes }}
       volumes:
 {{- toYaml .Values.extraVolumes | indent 8 }}

stable/pomerium/templates/authorize-deployment.yaml

@@ -12,6 +12,7 @@ metadata:
   name: {{ template "pomerium.authorize.fullname" . }}
 {{- if .Values.annotations }}
   annotations:
+    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
 {{ toYaml .Values.annotations | indent 4 }}
 {{- end }}
 spec:
@@ -22,8 +23,9 @@ spec:
       app.kubernetes.io/instance: {{ .Release.Name }}
   template:
     metadata:
-{{- if .Values.podAnnotations }}
       annotations:
+        config/checksum: {{ print .Values.config.extraOpts | sha256sum }}
+{{- if .Values.podAnnotations }}
 {{ toYaml .Values.podAnnotations | indent 8 }}
 {{- end }}
       labels:
@@ -43,6 +45,9 @@ spec:
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
+{{- if or .Values.config.existingConfig .Values.config.policy }}
+          - --config=/etc/pomerium/config.yaml
+{{- end }}
 {{- range $key, $value := .Values.extraArgs }}
 {{- if $value }}
           - --{{ $key }}={{ $value }}
@@ -58,14 +63,6 @@ spec:
             secretKeyRef:
               name: {{ $secretName }}
               key: shared-secret
-{{- if or .Values.config.existingConfig .Values.config.policyFile}}
-        - name: POLICY_FILE
-          value: /etc/pomerium/policy.yaml
-{{- end }}
-{{- if .Values.config.policy}}
-        - name: POLICY
-          value: {{ .Values.config.policy }}
-{{- end }}
         - name: CERTIFICATE
           valueFrom:
             secretKeyRef:
@@ -99,17 +96,15 @@ spec:
             path: /ping
             port: https
             scheme: HTTPS
-{{- if or .Values.config.existingConfig .Values.config.policyFile}}
+{{- if or .Values.config.existingConfig .Values.config.policy }}
         volumeMounts:
         - mountPath: /etc/pomerium/
-          name: policy
+          name: config
       volumes:
-      - name: policy
+      - name: config
         configMap:
           name: {{ $configName }}
 {{- end }}
-      resources:
-{{ toYaml .Values.resources | indent 10 }}
 {{- if .Values.extraVolumes }}
       volumes:
 {{- toYaml .Values.extraVolumes | indent 8 }}

stable/pomerium/templates/configmap.yaml

@@ -9,5 +9,18 @@ metadata:
     app.kubernetes.io/managed-by: {{ .Release.Service }}
     app.kubernetes.io/instance: {{ .Release.Name }}
 data:
-  policy.yaml: {{toYaml .Values.config.policyFile | indent 4}}
+  config.yaml: |
+{{- if and .Values.config.existingPolicy .Values.config.extraOpts }}
+{{ fail "Cannot use config.extraOpts with config.existingPolicy" }}
+{{- end }}
+{{- if and .Values.config.existingPolicy .Values.config.policy }}
+{{ fail "Cannot use config.policy with config.existingPolicy" }}
+{{- end }}
+{{- if .Values.config.extraOpts }}
+{{ toYaml .Values.config.extraOpts | indent 4 -}}
+{{- end -}}
+{{- if .Values.config.policy }}
+    policy: 
+{{ toYaml .Values.config.policy | indent 6 }}
+{{- end -}}
 {{- end }}

stable/pomerium/templates/ingress.yaml

@@ -16,29 +16,29 @@ spec:
   tls:
     - secretName: {{ default .Values.ingress.secretName .Values.ingress.secret.name}}
       hosts:
-        - '*.{{ .Values.config.rootDomain }}'
-        - {{ default (printf "authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }}
-        - {{ default (printf "authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
+        - {{ printf "*.%s" .Values.config.rootDomain | quote }}
+        - {{ printf "authorize.%s" .Values.config.rootDomain | quote }}
+        - {{ printf "authenticate.%s" .Values.config.rootDomain | quote }}
   rules:
-    - host: {{ default (printf "authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }}
+    - host: {{ printf "*.%s" .Values.config.rootDomain| quote }}
       http:
         paths:
           - paths:
             backend:
-              serviceName: {{ include "pomerium.authorize.fullname" .}}
+              serviceName: {{ template "pomerium.proxy.fullname" . }}
               servicePort: https
-    - host: {{ default (printf "authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
+    - host:  {{ printf "authorize.%s" .Values.config.rootDomain }}
       http:
         paths:
           - paths:
             backend:
-              serviceName: {{ include "pomerium.authenticate.fullname" .}}
+              serviceName: {{ template "pomerium.authorize.fullname" . }}
               servicePort: https
-    - host: '*.{{ .Values.config.rootDomain }}'
+    - host: {{ printf "authenticate.%s" .Values.config.rootDomain }}
       http:
         paths:
           - paths:
             backend:
-              serviceName: {{ include "pomerium.proxy.fullname" .}}
+              serviceName: {{ template "pomerium.authenticate.fullname" . }}
               servicePort: https
 {{- end }}

stable/pomerium/templates/proxy-deployment.yaml

@@ -12,6 +12,7 @@ metadata:
   name: {{ template "pomerium.proxy.fullname" . }}
 {{- if .Values.annotations }}
   annotations:
+    checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
 {{ toYaml .Values.annotations | indent 4 }}
 {{- end }}
 spec:
@@ -22,8 +23,9 @@ spec:
       app.kubernetes.io/instance: {{ .Release.Name }}
   template:
     metadata:
-{{- if .Values.podAnnotations }}
       annotations:
+        config/checksum: {{ print .Values.config.extraOpts | sha256sum }}
+{{- if .Values.podAnnotations }}
 {{ toYaml .Values.podAnnotations | indent 8 }}
 {{- end }}
       labels:
@@ -43,6 +45,9 @@ spec:
         image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
+{{- if or .Values.config.existingConfig .Values.config.policy }}
+          - --config=/etc/pomerium/config.yaml
+{{- end }}
 {{- range $key, $value := .Values.extraArgs }}
 {{- if $value }}
           - --{{ $key }}={{ $value }}
@@ -66,19 +71,9 @@ spec:
         - name: AUTHENTICATE_SERVICE_URL
           value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }}
         - name: AUTHORIZE_SERVICE_URL
-          value: {{ default (printf "https://authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }}
+          value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace ) .Values.proxy.authorizeInternalUrl}}
         - name: AUTHENTICATE_INTERNAL_URL
-          value: {{ default (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace ) .Values.proxy.authenticateInternalUrl}}
-        - name: AUTHORIZE_INTERNAL_URL
-          value: {{ default (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace ) .Values.proxy.authorizeInternalUrl}}
-{{- if or .Values.config.existingConfig .Values.config.policyFile}}
-        - name: POLICY_FILE
-          value: /etc/pomerium/policy.yaml
-{{- end }}
-{{- if .Values.config.policy}}
-        - name: POLICY
-          value: {{ .Values.config.policy }}
-{{- end }}
+          value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace ) .Values.proxy.authenticateInternalUrl}}
         - name: CERTIFICATE
           valueFrom:
             secretKeyRef:
@@ -112,17 +107,15 @@ spec:
             path: /ping
             port: https
             scheme: HTTPS
-{{- if or .Values.config.existingConfig .Values.config.policyFile}}
+{{- if or .Values.config.existingConfig .Values.config.policy }}
         volumeMounts:
         - mountPath: /etc/pomerium/
-          name: policy
+          name: config
       volumes:
-      - name: policy
+      - name: config
         configMap:
           name: {{ $configName }}
 {{- end }}
-      resources:
-{{ toYaml .Values.resources | indent 10 }}
 {{- if .Values.extraVolumes }}
       volumes:
 {{- toYaml .Values.extraVolumes | indent 8 }}

stable/pomerium/templates/secret.yaml

@@ -15,11 +15,13 @@ data:
   shared-secret: {{ default (randAscii 32 | b64enc | b64enc) (.Values.config.sharedSecret | b64enc )}}
   idp-client-id: {{ .Values.authenticate.idp.clientID | b64enc }}
   idp-client-secret: {{ .Values.authenticate.idp.clientSecret | b64enc }}
+{{- if .Values.authenticate.idp.serviceAccount }}
   idp-service-account: {{ .Values.authenticate.idp.serviceAccount | b64enc }}
+{{- end }}
 {{- if .Values.config.generateTLS }}
 {{- $ca := genCA "default-ca" 3650 }}
-{{- $authenticateSN:= list (printf "%s.%s" .Values.authenticate.name .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}}
-{{- $authorizeSN:= list (printf "%s.%s" .Values.authorize.name .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}}
+{{- $authenticateSN:= list (printf "authenticate.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}}
+{{- $authorizeSN:= list (printf "authorize.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}}
 {{- $cn := default "example.com" .Values.config.rootDomain }}
   ca-cert: {{ $ca.Cert | b64enc | b64enc }}
   ca-key: {{ $ca.Key | b64enc | b64enc }}

stable/pomerium/values.yaml

@@ -1,35 +1,18 @@
 # For detailed explanation of each of the configuration settings see
-# https://www.pomerium.io/docs/config-reference.htmls
+# https://www.pomerium.io/reference/
 
 # settings that are shared by all services
 config:
   # routes under this wildcard domain are handled by pomerium
-  rootDomain: corp.pomerium.io
+  rootDomain: corp.beyondperimeter.com
   # existingSecret:
   # existingConfig:
   sharedSecret: ""
   cookieSecret: ""
   generateTLS: true
-  policyFile: |-
-    - from: httpbin.corp.pomerium.io
-      to: http://httpbin
-      allowed_domains:
-      - pomerium.io
-    - from: external-httpbin.corp.pomerium.io
-      to: httpbin.org
-      allowed_domains:
-      - gmail.com
-    - from: weirdlyssl.corp.pomerium.io
-      to: http://neverssl.com
-      allowed_users:
-      - bdd@pomerium.io
-      allowed_groups:
-      - admins
-      - developers
-    - from: hello.corp.pomerium.io
-      to: http://hello:8080
-      allowed_groups:
-      - admins
+  extraOpts: {}
+  existingPolicy: ""
+  policy: {}
 
 authenticate:
   # fullnameOverride: authenticate
@@ -76,9 +59,9 @@ service:
   externalPort: 443
   annotations:
     {}
-    # ===  GKE load balancer tweaks
+    # ===  GKE load balancer tweaks; default on until I can figure out
+    # how the hell to escape this string from the helm CLI
     # cloud.google.com/app-protocols: '{"https":"HTTPS"}'
-    # kubernetes.io/ingress.allow-http: "false"
   labels: {}
 
 ingress:
@@ -94,8 +77,8 @@ ingress:
     # kubernetes.io/ingress.class: nginx
     # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
     # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-    # ===  GKE load balancer tweaks ==
-    # cloud.google.com/app-protocols: '{"https":"HTTPS"}'
+    # ===  GKE load balancer tweaks; default on until I can figure out
+    # how the hell to escape this string from the helm CLI
     # kubernetes.io/ingress.allow-http: "false"
 resources:
   {}
@@ -132,5 +115,5 @@ extraVolumes: {}
 
 image:
   repository: "pomerium/pomerium"
-  tag: "v0.0.3"
+  tag: "v0.0.5"
   pullPolicy: "IfNotPresent"