mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[incubator/oauth-proxy] add oauth-proxy chart (#2717)
This commit is contained in:
Casey Kuhlman
committed by
Reinhard Nägele
Reinhard Nägele
parent
4e33fc6c26
commit
2c64538cfe
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,16 @@
|
||||
name: oauth-proxy
|
||||
version: 0.1.0
|
||||
appVersion: 2.2
|
||||
description: A reverse proxy that provides authentication with Google, Github or other providers
|
||||
keywords:
|
||||
- kubernetes
|
||||
- oauth
|
||||
- authentication
|
||||
- google
|
||||
- github
|
||||
maintainers:
|
||||
- name: compleatang
|
||||
email: casey@monax.io
|
||||
sources:
|
||||
- https://github.com/bitly/oauth2_proxy
|
||||
engine: gotpl
|
||||
@@ -0,0 +1,76 @@
|
||||
# oauth-proxy
|
||||
|
||||
[oauth-proxy](https://github.com/bitly/oauth2_proxy) is a reverse proxy and static file server that provides authentication using Providers (Google, GitHub, and others) to validate accounts by email, domain or group.
|
||||
|
||||
|
||||
**Note - at this time, there is a known incompatibility between `oauth-proxy` version 2.2 (which is it's latest release) and `nginx-ingress` versions >= 0.9beta12. To utilize this chart at this time please use nginx-ingress version 0.9beta11**
|
||||
|
||||
## TL;DR;
|
||||
|
||||
```console
|
||||
$ helm install incubator/oauth-proxy
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a oauth-proxy deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm install incubator/oauth-proxy --name my-release
|
||||
```
|
||||
|
||||
The command deploys oauth-proxy on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following tables lists the configurable parameters of the oauth-proxy chart and their default values.
|
||||
|
||||
Parameter | Description | Default
|
||||
--- | --- | ---
|
||||
`affinity` | node/pod affinities | None
|
||||
`config.clientId` | oauth client ID | `""`
|
||||
`config.clientSecret` | oauth client secret | `""`
|
||||
`config.cookieSecret` | server specific cookie for the secret; create a new one with `python -c 'import os,base64; print base64.b64encode(os.urandom(16))'` | `""`
|
||||
`extraArgs` | key:value list of extra arguments to give the binary | `{}`
|
||||
`image.pullPolicy` | Image pull policy | `IfNotPresent`
|
||||
`image.repository` | Image repository | `a5huynh/oauth2_proxy`
|
||||
`image.tag` | Image tag | `2.2`
|
||||
`ingress.enabled` | enable ingress | `false`
|
||||
`nodeSelector` | node labels for pod assignment | `{}`
|
||||
`podAnnotations` | annotations to add to each pod | `{}`
|
||||
`podLabels` | additional labesl to add to each pod | `{}`
|
||||
`replicaCount` | desired number of pods | `1`
|
||||
`resources` | pod resource requests & limits | `{}`
|
||||
`service.externalPort` | external port for the service | `443`
|
||||
`service.internalPort` | internal port for the service | `4180`
|
||||
`service.type` | type of service | `ClusterIP`
|
||||
`tolerations` | List of node taints to tolerate | `[]`
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install incubator/oauth-proxy --name my-release \
|
||||
--set=image.tag=v0.0.2,resources.limits.cpu=200m
|
||||
```
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install incubator/oauth-proxy --name my-release -f values.yaml
|
||||
```
|
||||
|
||||
> **Tip**: You can use the default [values.yaml](values.yaml)
|
||||
@@ -0,0 +1,3 @@
|
||||
To verify that oauth-proxy has started, run:
|
||||
|
||||
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth-proxy.fullname" . }}"
|
||||
@@ -0,0 +1,20 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "oauth-proxy.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "oauth-proxy.fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if ne $name .Release.Name -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,70 @@
|
||||
apiVersion: apps/v1beta1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml .Values.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
release: "{{ .Release.Name }}"
|
||||
{{- if .Values.podLabels }}
|
||||
{{ toYaml .Values.podLabels | indent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
{{- range $key, $value := .Values.extraArgs }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: OAUTH2_PROXY_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
key: client-id
|
||||
- name: OAUTH2_PROXY_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
key: client-secret
|
||||
- name: OAUTH2_PROXY_COOKIE_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
key: cookie-secret
|
||||
ports:
|
||||
- containerPort: {{ .Values.service.internalPort }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: {{ .Values.service.internalPort }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: {{ .Values.service.internalPort }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $serviceName := include "oauth-proxy.fullname" . -}}
|
||||
{{- $servicePort := .Values.service.externalPort -}}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
rules:
|
||||
{{- range $host := .Values.ingress.hosts }}
|
||||
- host: {{ $host }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ $serviceName }}
|
||||
servicePort: {{ $servicePort }}
|
||||
{{- end -}}
|
||||
{{- if .Values.ingress.tls }}
|
||||
tls:
|
||||
{{ toYaml .Values.ingress.tls | indent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: {{ .Release.Service }}
|
||||
release: {{ .Release.Name }}
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
type: Opaque
|
||||
data:
|
||||
cookie-secret: {{ .Values.config.cookieSecret | b64enc | quote }}
|
||||
client-secret: {{ .Values.config.clientSecret | b64enc | quote }}
|
||||
client-id: {{ .Values.config.clientID | b64enc | quote }}
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
name: {{ template "oauth-proxy.fullname" . }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.service.externalPort }}
|
||||
targetPort: {{ .Values.service.internalPort }}
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: {{ template "oauth-proxy.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
@@ -0,0 +1,62 @@
|
||||
# Oauth client configuration specifics
|
||||
config:
|
||||
# OAuth client ID
|
||||
clientID: "XXXXXXX"
|
||||
# OAuth client secret
|
||||
clientSecret: "XXXXXXXX"
|
||||
# Create a new secret with the following command
|
||||
# python -c 'import os,base64; print base64.b64encode(os.urandom(16))'
|
||||
cookieSecret: "XXXXXXXXXX"
|
||||
|
||||
image:
|
||||
repository: "a5huynh/oauth2_proxy"
|
||||
tag: "2.2"
|
||||
pullPolicy: "IfNotPresent"
|
||||
|
||||
extraArgs:
|
||||
email-domain: "*"
|
||||
upstream: "file:///dev/null"
|
||||
http-address: "0.0.0.0:4180"
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
externalPort: 443
|
||||
internalPort: 4180
|
||||
|
||||
ingress:
|
||||
enabled: false
|
||||
# Used to create an Ingress record.
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
# annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# tls:
|
||||
# Secrets must be manually created in the namespace.
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - chart-example.local
|
||||
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 300Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 300Mi
|
||||
|
||||
# Affinity for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
||||
# affinity: {}
|
||||
|
||||
# Tolerations for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
||||
tolerations: []
|
||||
|
||||
# Node labels for pod assignment
|
||||
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
nodeSelector: {}
|
||||
|
||||
podAnnotations: {}
|
||||
podLabels: {}
|
||||
replicaCount: 1
|
||||
Reference in New Issue
Block a user