From 20cc1a3d696ecfeb1040376b2a0119b9f06a8bf5 Mon Sep 17 00:00:00 2001 From: Mohsen Date: Mon, 11 Nov 2019 13:47:42 +0000 Subject: [PATCH] [stable/pomerium] Setting Ingress Hosts from policy (#18726) * [stable/pomerium] Setting Ingress Hosts from policy The kubernetes-sigs/external-dns create DNS records based on the Hostnames in Ingress objects. Setting the hostnames explicitly in the Ingress object and not using a wildcard can help to take advantage of this functionality https://github.com/pomerium/pomerium-helm/pull/32 Signed-off-by: Mohsen * Making .policy mutually exclusive with the ingress.hosts Signed-off-by: Mohsen --- stable/pomerium/Chart.yaml | 2 +- stable/pomerium/README.md | 4 +-- stable/pomerium/templates/NOTES.txt | 4 +-- stable/pomerium/templates/ingress.yaml | 34 +++++++++++++++++++++----- stable/pomerium/values.yaml | 1 + 5 files changed, 34 insertions(+), 11 deletions(-) diff --git a/stable/pomerium/Chart.yaml b/stable/pomerium/Chart.yaml index 61976a4df1..c570e04612 100644 --- a/stable/pomerium/Chart.yaml +++ b/stable/pomerium/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: pomerium -version: 4.0.4 +version: 4.1.0 appVersion: 0.4.2 home: http://www.pomerium.io/ icon: https://www.pomerium.io/logo.svg diff --git a/stable/pomerium/README.md b/stable/pomerium/README.md index 7fe39d3922..45a0fb7dbb 100644 --- a/stable/pomerium/README.md +++ b/stable/pomerium/README.md @@ -120,7 +120,7 @@ A full listing of Pomerium's configuration variables can be found on the [config | `authorize.existingTLSSecret` | Name of existing TLS Secret for authorize service | | | `images.server.repository` | Pomerium image | `pomerium/pomerium` | | `images.server.tag` | Pomerium image tag | `v0.4.2` | -| `images.server.pullPolicy` | Pomerium image pull policy | `IfNotPresent` | +| `images.server.pullPolicy` | Pomerium image pull policy | `IfNotPresent` | | `service.annotations` | Service annotations | `{}` | | `service.externalPort` | Pomerium's port | `443` | | `service.type` | Service type (ClusterIP, NodePort or LoadBalancer) | `ClusterIP` | @@ -135,7 +135,7 @@ A full listing of Pomerium's configuration variables can be found on the [config | `tracing.jaeger.agent_endpoint` | The jaeger agent endpoint | Required | | `ingress.enabled` | Enables Ingress for pomerium | `false` | | `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `nil` | +| `ingress.hosts` | Ingress accepted hostnames | `[]` | | `ingress.tls` | Ingress TLS configuration | `[]` | | `metrics.enabled` | Enable prometheus metrics endpoint | `false` | | `metrics.port` | Prometheus metrics endpoint port | `9090` | diff --git a/stable/pomerium/templates/NOTES.txt b/stable/pomerium/templates/NOTES.txt index 80ac288d72..5d82ab1dda 100644 --- a/stable/pomerium/templates/NOTES.txt +++ b/stable/pomerium/templates/NOTES.txt @@ -1,8 +1,8 @@ {{- if eq (include "pomerium.providerOK" .) "true" }} {{- if .Values.ingress.enabled }} From outside the cluster, the server URL(s) are: -{{- range .Values.ingress.hosts }} - {{ $.Values.server.protocol }}://{{ . }} +{{- range .Values.config.policy }} + {{ .from | quote}} {{- end }} {{- else if contains "NodePort" .Values.service.type }} diff --git a/stable/pomerium/templates/ingress.yaml b/stable/pomerium/templates/ingress.yaml index bc3a265dfc..0163a8273b 100644 --- a/stable/pomerium/templates/ingress.yaml +++ b/stable/pomerium/templates/ingress.yaml @@ -16,16 +16,38 @@ spec: tls: - secretName: {{ default .Values.ingress.secretName .Values.ingress.secret.name}} hosts: - - {{ printf "*.%s" .Values.config.rootDomain | quote }} + - {{ printf "authorize.%s" .Values.config.rootDomain | quote }} + - {{ printf "authenticate.%s" .Values.config.rootDomain | quote }} + {{- if not .Values.ingress.hosts }} + {{- range .Values.config.policy }} + - {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }} + {{- end }} + {{- end }} + {{- range .Values.ingress.hosts }} + - {{ . | quote }} + {{- end }} rules: - - host: {{ printf "*.%s" .Values.config.rootDomain| quote }} + {{- range .Values.ingress.hosts }} + - host: {{ . | quote }} http: paths: - paths: backend: - serviceName: {{ template "pomerium.proxy.fullname" . }} + serviceName: {{ template "pomerium.proxy.fullname" $ }} servicePort: https -{{- if not .Values.service.authorize.headless }} + {{- end }} + {{- if not .Values.ingress.hosts }} + {{- range .Values.config.policy }} + - host: {{ .from | trimPrefix "https://" | trimPrefix "http://" | quote }} + http: + paths: + - paths: + backend: + serviceName: {{ template "pomerium.proxy.fullname" $ }} + servicePort: https + {{- end }} + {{- end }} + {{- if not .Values.service.authorize.headless }} - host: {{ printf "authorize.%s" .Values.config.rootDomain }} http: paths: @@ -33,7 +55,7 @@ spec: backend: serviceName: {{ template "pomerium.authorize.fullname" . }} servicePort: https -{{- end }} + {{- end }} - host: {{ printf "authenticate.%s" .Values.config.rootDomain }} http: paths: @@ -41,4 +63,4 @@ spec: backend: serviceName: {{ template "pomerium.authenticate.fullname" . }} servicePort: https -{{- end }} \ No newline at end of file +{{- end }} diff --git a/stable/pomerium/values.yaml b/stable/pomerium/values.yaml index dc498a38db..e6fd041531 100644 --- a/stable/pomerium/values.yaml +++ b/stable/pomerium/values.yaml @@ -82,6 +82,7 @@ ingress: cert: "" key: "" enabled: true + hosts: [] annotations: {} # === nginx tweaks