From 1cea58f5eb0bebd36a5bd548bcfa350d068b5ae3 Mon Sep 17 00:00:00 2001 From: Bobby DeSimone Date: Wed, 12 Jun 2019 15:18:15 -0700 Subject: [PATCH] stable/pomerium: update v0.0.5 (#14542) https://github.com/pomerium/pomerium/releases/tag/v0.0.5 Signed-off-by: Bobby DeSimone --- stable/pomerium/Chart.yaml | 4 +- stable/pomerium/README.md | 27 +++++++++----- stable/pomerium/ci/default-values.yaml | 21 +++++++++++ .../templates/authenticate-deployment.yaml | 26 +++++++++---- .../templates/authorize-deployment.yaml | 23 +++++------- stable/pomerium/templates/configmap.yaml | 15 +++++++- stable/pomerium/templates/ingress.yaml | 18 ++++----- .../pomerium/templates/proxy-deployment.yaml | 29 ++++++--------- stable/pomerium/templates/secret.yaml | 6 ++- stable/pomerium/values.yaml | 37 +++++-------------- 10 files changed, 116 insertions(+), 90 deletions(-) create mode 100644 stable/pomerium/ci/default-values.yaml diff --git a/stable/pomerium/Chart.yaml b/stable/pomerium/Chart.yaml index 5c4f5279d0..6d2e7495c3 100644 --- a/stable/pomerium/Chart.yaml +++ b/stable/pomerium/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: pomerium -version: 1.0.1 -appVersion: 0.0.3 +version: 1.1.0 +appVersion: 0.0.5 home: http://www.pomerium.io/ icon: https://www.pomerium.io/logo.svg description: Pomerium is an identity-aware access proxy. diff --git a/stable/pomerium/README.md b/stable/pomerium/README.md index db0d5927eb..f53448abdb 100644 --- a/stable/pomerium/README.md +++ b/stable/pomerium/README.md @@ -8,22 +8,29 @@ helm install --name my-release stable/pomerium ``` -> Note: Pomerium depends on being configured with a third party identity providers to function properly. If you run pomerium without specifiying default values, you will need to change those configuration variables following setup. +> Note: Pomerium depends on being configured with a third party identity providers to function properly. If you run pomerium without specifying default values, you will need to change those configuration variables following setup. ## Install the chart An example of a minimal, but complete installation of pomerium with identity provider settings, random secrets, certificates, and external URLs is as follows: ```sh -helm install --name my-release \ - --set config.rootDomain="corp.example.com" \ - --set ingress.tls.certificate=$(base64 -i "*.corp.example.com.cer") \ - --set ingress.tls.key=$(base64 -i "*.corp.example.com.key") \ - --set config.policy=$(base64 -i "policy.yaml") \ - --set authenticate.idp.provider="google" \ - --set authenticate.idp.clientID="REPLACE_ME" \ - --set authenticate.idp.clientSecret="REPLACE_ME" - stable/pomerium +kubectl create configmap config --from-file="config.yaml"="$HOME/pomerium/docs/docs/examples/config/config.example.yaml" + +helm install $HOME/pomerium-helm \ + --set service.type="NodePort" \ + --set config.rootDomain="corp.beyondperimeter.com" \ + --set config.existingConfig="config" \ + --set config.sharedSecret=$(head -c32 /dev/urandom | base64) \ + --set config.cookieSecret=$(head -c32 /dev/urandom | base64) \ + --set ingress.secret.name="pomerium-tls" \ + --set ingress.secret.cert=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/fullchain.cer") \ + --set ingress.secret.key=$(base64 -i "$HOME/.acme.sh/*.corp.beyondperimeter.com_ecc/*.corp.beyondperimeter.com.key") \ + --set authenticate.idp.provider="google" \ + --set authenticate.idp.clientID="REPLACE_ME" \ + --set authenticate.idp.clientSecret="REPLACE_ME" \ + stable/pomerium + ``` ## Uninstalling the Chart diff --git a/stable/pomerium/ci/default-values.yaml b/stable/pomerium/ci/default-values.yaml new file mode 100644 index 0000000000..b303ba820a --- /dev/null +++ b/stable/pomerium/ci/default-values.yaml @@ -0,0 +1,21 @@ +config: + policy: + - from: httpbin.corp.pomerium.io + to: http://httpbin + allowed_domains: + - pomerium.io + - from: external-httpbin.corp.pomerium.io + to: httpbin.org + allowed_domains: + - gmail.com + - from: weirdlyssl.corp.pomerium.io + to: http://neverssl.com + allowed_users: + - bdd@pomerium.io + allowed_groups: + - admins + - developers + - from: hello.corp.pomerium.io + to: http://hello:8080 + allowed_groups: + - admins diff --git a/stable/pomerium/templates/authenticate-deployment.yaml b/stable/pomerium/templates/authenticate-deployment.yaml index 96396c237f..83628189b7 100644 --- a/stable/pomerium/templates/authenticate-deployment.yaml +++ b/stable/pomerium/templates/authenticate-deployment.yaml @@ -1,3 +1,4 @@ +{{- $configName := default (include "pomerium.fullname" .) .Values.config.existingConfig }} {{- $secretName := default (include "pomerium.fullname" .) .Values.config.existingSecret }} apiVersion: apps/v1 kind: Deployment @@ -21,8 +22,9 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} template: metadata: -{{- if .Values.podAnnotations }} annotations: + config/checksum: {{ print .Values.config.extraOpts | sha256sum }} +{{- if .Values.podAnnotations }} {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} labels: @@ -42,6 +44,9 @@ spec: image: {{ .Values.image.repository }}:{{ .Values.image.tag }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: +{{- if or .Values.config.existingConfig .Values.config.policy }} + - --config=/etc/pomerium/config.yaml +{{- end }} {{- range $key, $value := .Values.extraArgs }} {{- if $value }} - --{{ $key }}={{ $value }} @@ -52,6 +57,8 @@ spec: env: - name: SERVICES value: authenticate + - name: AUTHENTICATE_SERVICE_URL + value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }} - name: COOKIE_SECRET valueFrom: secretKeyRef: @@ -62,10 +69,6 @@ spec: secretKeyRef: name: {{ $secretName }} key: shared-secret - - name: REDIRECT_URL - value: {{ default (printf "https://%s.%s/oauth2/callback" (include "pomerium.authenticate.fullname" .) .Values.config.rootDomain ) .Values.authenticate.redirectUrl }} - - name: PROXY_ROOT_DOMAIN - value: {{ .Values.config.rootDomain }} - name: IDP_PROVIDER value: {{ .Values.authenticate.idp.provider }} - name: IDP_CLIENT_ID @@ -80,11 +83,13 @@ spec: key: idp-client-secret - name: IDP_PROVIDER_URL value: {{ .Values.authenticate.idp.url }} +{{- if .Values.authenticate.idp.serviceAccount }} - name: IDP_SERVICE_ACCOUNT valueFrom: secretKeyRef: name: {{ $secretName }} key: idp-service-account +{{- end }} - name: CERTIFICATE valueFrom: secretKeyRef: @@ -118,8 +123,15 @@ spec: path: /ping port: https scheme: HTTPS - resources: -{{ toYaml .Values.resources | indent 10 }} +{{- if or .Values.config.existingConfig .Values.config.policy }} + volumeMounts: + - mountPath: /etc/pomerium/ + name: config + volumes: + - name: config + configMap: + name: {{ $configName }} +{{- end }} {{- if .Values.extraVolumes }} volumes: {{- toYaml .Values.extraVolumes | indent 8 }} diff --git a/stable/pomerium/templates/authorize-deployment.yaml b/stable/pomerium/templates/authorize-deployment.yaml index 97f83f73bc..fa4002044c 100644 --- a/stable/pomerium/templates/authorize-deployment.yaml +++ b/stable/pomerium/templates/authorize-deployment.yaml @@ -12,6 +12,7 @@ metadata: name: {{ template "pomerium.authorize.fullname" . }} {{- if .Values.annotations }} annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} {{ toYaml .Values.annotations | indent 4 }} {{- end }} spec: @@ -22,8 +23,9 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} template: metadata: -{{- if .Values.podAnnotations }} annotations: + config/checksum: {{ print .Values.config.extraOpts | sha256sum }} +{{- if .Values.podAnnotations }} {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} labels: @@ -43,6 +45,9 @@ spec: image: {{ .Values.image.repository }}:{{ .Values.image.tag }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: +{{- if or .Values.config.existingConfig .Values.config.policy }} + - --config=/etc/pomerium/config.yaml +{{- end }} {{- range $key, $value := .Values.extraArgs }} {{- if $value }} - --{{ $key }}={{ $value }} @@ -58,14 +63,6 @@ spec: secretKeyRef: name: {{ $secretName }} key: shared-secret -{{- if or .Values.config.existingConfig .Values.config.policyFile}} - - name: POLICY_FILE - value: /etc/pomerium/policy.yaml -{{- end }} -{{- if .Values.config.policy}} - - name: POLICY - value: {{ .Values.config.policy }} -{{- end }} - name: CERTIFICATE valueFrom: secretKeyRef: @@ -99,17 +96,15 @@ spec: path: /ping port: https scheme: HTTPS -{{- if or .Values.config.existingConfig .Values.config.policyFile}} +{{- if or .Values.config.existingConfig .Values.config.policy }} volumeMounts: - mountPath: /etc/pomerium/ - name: policy + name: config volumes: - - name: policy + - name: config configMap: name: {{ $configName }} {{- end }} - resources: -{{ toYaml .Values.resources | indent 10 }} {{- if .Values.extraVolumes }} volumes: {{- toYaml .Values.extraVolumes | indent 8 }} diff --git a/stable/pomerium/templates/configmap.yaml b/stable/pomerium/templates/configmap.yaml index 4f708febdc..09facb326f 100644 --- a/stable/pomerium/templates/configmap.yaml +++ b/stable/pomerium/templates/configmap.yaml @@ -9,5 +9,18 @@ metadata: app.kubernetes.io/managed-by: {{ .Release.Service }} app.kubernetes.io/instance: {{ .Release.Name }} data: - policy.yaml: {{toYaml .Values.config.policyFile | indent 4}} + config.yaml: | +{{- if and .Values.config.existingPolicy .Values.config.extraOpts }} +{{ fail "Cannot use config.extraOpts with config.existingPolicy" }} +{{- end }} +{{- if and .Values.config.existingPolicy .Values.config.policy }} +{{ fail "Cannot use config.policy with config.existingPolicy" }} +{{- end }} +{{- if .Values.config.extraOpts }} +{{ toYaml .Values.config.extraOpts | indent 4 -}} +{{- end -}} +{{- if .Values.config.policy }} + policy: +{{ toYaml .Values.config.policy | indent 6 }} +{{- end -}} {{- end }} diff --git a/stable/pomerium/templates/ingress.yaml b/stable/pomerium/templates/ingress.yaml index e0dea9e53e..8c14134b1f 100644 --- a/stable/pomerium/templates/ingress.yaml +++ b/stable/pomerium/templates/ingress.yaml @@ -16,29 +16,29 @@ spec: tls: - secretName: {{ default .Values.ingress.secretName .Values.ingress.secret.name}} hosts: - - '*.{{ .Values.config.rootDomain }}' - - {{ default (printf "authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }} - - {{ default (printf "authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }} + - {{ printf "*.%s" .Values.config.rootDomain | quote }} + - {{ printf "authorize.%s" .Values.config.rootDomain | quote }} + - {{ printf "authenticate.%s" .Values.config.rootDomain | quote }} rules: - - host: {{ default (printf "authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }} + - host: {{ printf "*.%s" .Values.config.rootDomain| quote }} http: paths: - paths: backend: - serviceName: {{ include "pomerium.authorize.fullname" .}} + serviceName: {{ template "pomerium.proxy.fullname" . }} servicePort: https - - host: {{ default (printf "authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }} + - host: {{ printf "authorize.%s" .Values.config.rootDomain }} http: paths: - paths: backend: - serviceName: {{ include "pomerium.authenticate.fullname" .}} + serviceName: {{ template "pomerium.authorize.fullname" . }} servicePort: https - - host: '*.{{ .Values.config.rootDomain }}' + - host: {{ printf "authenticate.%s" .Values.config.rootDomain }} http: paths: - paths: backend: - serviceName: {{ include "pomerium.proxy.fullname" .}} + serviceName: {{ template "pomerium.authenticate.fullname" . }} servicePort: https {{- end }} \ No newline at end of file diff --git a/stable/pomerium/templates/proxy-deployment.yaml b/stable/pomerium/templates/proxy-deployment.yaml index 7e80dff086..8caa9f0c0d 100644 --- a/stable/pomerium/templates/proxy-deployment.yaml +++ b/stable/pomerium/templates/proxy-deployment.yaml @@ -12,6 +12,7 @@ metadata: name: {{ template "pomerium.proxy.fullname" . }} {{- if .Values.annotations }} annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} {{ toYaml .Values.annotations | indent 4 }} {{- end }} spec: @@ -22,8 +23,9 @@ spec: app.kubernetes.io/instance: {{ .Release.Name }} template: metadata: -{{- if .Values.podAnnotations }} annotations: + config/checksum: {{ print .Values.config.extraOpts | sha256sum }} +{{- if .Values.podAnnotations }} {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} labels: @@ -43,6 +45,9 @@ spec: image: {{ .Values.image.repository }}:{{ .Values.image.tag }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: +{{- if or .Values.config.existingConfig .Values.config.policy }} + - --config=/etc/pomerium/config.yaml +{{- end }} {{- range $key, $value := .Values.extraArgs }} {{- if $value }} - --{{ $key }}={{ $value }} @@ -66,19 +71,9 @@ spec: - name: AUTHENTICATE_SERVICE_URL value: {{ default (printf "https://authenticate.%s" .Values.config.rootDomain ) .Values.proxy.authenticateServiceUrl }} - name: AUTHORIZE_SERVICE_URL - value: {{ default (printf "https://authorize.%s" .Values.config.rootDomain ) .Values.proxy.authorizeServiceUrl }} + value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace ) .Values.proxy.authorizeInternalUrl}} - name: AUTHENTICATE_INTERNAL_URL - value: {{ default (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace ) .Values.proxy.authenticateInternalUrl}} - - name: AUTHORIZE_INTERNAL_URL - value: {{ default (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace ) .Values.proxy.authorizeInternalUrl}} -{{- if or .Values.config.existingConfig .Values.config.policyFile}} - - name: POLICY_FILE - value: /etc/pomerium/policy.yaml -{{- end }} -{{- if .Values.config.policy}} - - name: POLICY - value: {{ .Values.config.policy }} -{{- end }} + value: {{ default (printf "https://%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace ) .Values.proxy.authenticateInternalUrl}} - name: CERTIFICATE valueFrom: secretKeyRef: @@ -112,17 +107,15 @@ spec: path: /ping port: https scheme: HTTPS -{{- if or .Values.config.existingConfig .Values.config.policyFile}} +{{- if or .Values.config.existingConfig .Values.config.policy }} volumeMounts: - mountPath: /etc/pomerium/ - name: policy + name: config volumes: - - name: policy + - name: config configMap: name: {{ $configName }} {{- end }} - resources: -{{ toYaml .Values.resources | indent 10 }} {{- if .Values.extraVolumes }} volumes: {{- toYaml .Values.extraVolumes | indent 8 }} diff --git a/stable/pomerium/templates/secret.yaml b/stable/pomerium/templates/secret.yaml index 7200a13d1c..51a43cb5db 100644 --- a/stable/pomerium/templates/secret.yaml +++ b/stable/pomerium/templates/secret.yaml @@ -15,11 +15,13 @@ data: shared-secret: {{ default (randAscii 32 | b64enc | b64enc) (.Values.config.sharedSecret | b64enc )}} idp-client-id: {{ .Values.authenticate.idp.clientID | b64enc }} idp-client-secret: {{ .Values.authenticate.idp.clientSecret | b64enc }} +{{- if .Values.authenticate.idp.serviceAccount }} idp-service-account: {{ .Values.authenticate.idp.serviceAccount | b64enc }} +{{- end }} {{- if .Values.config.generateTLS }} {{- $ca := genCA "default-ca" 3650 }} -{{- $authenticateSN:= list (printf "%s.%s" .Values.authenticate.name .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}} -{{- $authorizeSN:= list (printf "%s.%s" .Values.authorize.name .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}} +{{- $authenticateSN:= list (printf "authenticate.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authenticate.fullname" .) .Release.Namespace )}} +{{- $authorizeSN:= list (printf "authorize.%s" .Values.config.rootDomain) (printf "%s.%s.svc.cluster.local" (include "pomerium.authorize.fullname" .) .Release.Namespace )}} {{- $cn := default "example.com" .Values.config.rootDomain }} ca-cert: {{ $ca.Cert | b64enc | b64enc }} ca-key: {{ $ca.Key | b64enc | b64enc }} diff --git a/stable/pomerium/values.yaml b/stable/pomerium/values.yaml index 4af2650ae5..5e8a581387 100644 --- a/stable/pomerium/values.yaml +++ b/stable/pomerium/values.yaml @@ -1,35 +1,18 @@ # For detailed explanation of each of the configuration settings see -# https://www.pomerium.io/docs/config-reference.htmls +# https://www.pomerium.io/reference/ # settings that are shared by all services config: # routes under this wildcard domain are handled by pomerium - rootDomain: corp.pomerium.io + rootDomain: corp.beyondperimeter.com # existingSecret: # existingConfig: sharedSecret: "" cookieSecret: "" generateTLS: true - policyFile: |- - - from: httpbin.corp.pomerium.io - to: http://httpbin - allowed_domains: - - pomerium.io - - from: external-httpbin.corp.pomerium.io - to: httpbin.org - allowed_domains: - - gmail.com - - from: weirdlyssl.corp.pomerium.io - to: http://neverssl.com - allowed_users: - - bdd@pomerium.io - allowed_groups: - - admins - - developers - - from: hello.corp.pomerium.io - to: http://hello:8080 - allowed_groups: - - admins + extraOpts: {} + existingPolicy: "" + policy: {} authenticate: # fullnameOverride: authenticate @@ -76,9 +59,9 @@ service: externalPort: 443 annotations: {} - # === GKE load balancer tweaks + # === GKE load balancer tweaks; default on until I can figure out + # how the hell to escape this string from the helm CLI # cloud.google.com/app-protocols: '{"https":"HTTPS"}' - # kubernetes.io/ingress.allow-http: "false" labels: {} ingress: @@ -94,8 +77,8 @@ ingress: # kubernetes.io/ingress.class: nginx # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/proxy-buffer-size: "16k" - # === GKE load balancer tweaks == - # cloud.google.com/app-protocols: '{"https":"HTTPS"}' + # === GKE load balancer tweaks; default on until I can figure out + # how the hell to escape this string from the helm CLI # kubernetes.io/ingress.allow-http: "false" resources: {} @@ -132,5 +115,5 @@ extraVolumes: {} image: repository: "pomerium/pomerium" - tag: "v0.0.3" + tag: "v0.0.5" pullPolicy: "IfNotPresent"