mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
[incubator/buzzfeed-sso] add ingress.extraLabels, optional tls, extraEnv, and fix cluster variable (#13428)
* [buzzfeed-sso] add ingress.extraLabels Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] make ingress tls optional Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] move cluster to top level of values.yaml and use for auth-deployment Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] add auth.extraEnv and proxy.extraEnv and update readme Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] fix typo Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] update app version and update README Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] fix ingress tls conditional Signed-off-by: Cameron Attard <cameron.attard@siteminder.com> * [buzzfeed-sso] bump chart version Signed-off-by: Cameron Attard <cameron.attard@siteminder.com>
This commit is contained in:
Cameron Attard
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
82b71f75c6
commit
9aeaf2095c
@@ -1,8 +1,8 @@
|
||||
apiVersion: v1
|
||||
description: Single sign-on for your Kubernetes services using Google OAuth
|
||||
name: buzzfeed-sso
|
||||
version: 0.0.3
|
||||
appVersion: 1.1.0
|
||||
version: 0.0.4
|
||||
appVersion: 1.2.0
|
||||
home: https://github.com/buzzfeed/sso
|
||||
sources:
|
||||
- https://hub.docker.com/r/buzzfeed/sso/
|
||||
|
||||
@@ -53,8 +53,10 @@ Parameter | Description | Default
|
||||
`namespace` | namespace to use | `default`
|
||||
`emailDomain` | the sso email domain for authentication | REQUIRED
|
||||
`rootDomain` | the parent domain used for protecting your backends | REQUIRED
|
||||
`cluster` | the cluster name for SSO | `dev`
|
||||
`auth.annotations` | extra annotations for auth pods | `{}`
|
||||
`auth.domain` | the auth domain used for OAuth callbacks | REQUIRED
|
||||
`auth.extraEnv` | extra auth env vars | `[]`
|
||||
`auth.replicaCount` | desired number of auth pods | `1`
|
||||
`auth.resources` | resource limits and requests for auth pods | `{ limits: { memory: "256Mi", cpu: "200m" }}`
|
||||
`auth.nodeSelector` | node selector logic for auth pods | `{}`
|
||||
@@ -63,11 +65,11 @@ Parameter | Description | Default
|
||||
`auth.service.type` | type of auth service to create | `ClusterIP`
|
||||
`auth.service.port` | port for the http auth service | `80`
|
||||
`auth.secret` | secrets to be generated randomly with `openssl rand -base64 32 | head -c 32`. | REQUIRED if `auth.customSecret` is not set
|
||||
`auth.tls` | tls configuration for central sso auth ingress. | `{ secretName: "sso-auth-tls-secret" }`
|
||||
`auth.tls` | tls configuration for central sso auth ingress. | `{}`
|
||||
`auth.customSecret` | the secret key to reuse (avoids secret creation via helm) | REQUIRED if `auth.secret` is not set
|
||||
`proxy.annotations` | extra annotations for proxy pods | `{}`
|
||||
`proxy.providerUrlInternal` | url for split dns deployments |
|
||||
`proxy.cluster` | the cluster name for SSO | `dev`
|
||||
`proxy.extraEnv` | extra proxy env vars | `[]`
|
||||
`proxy.replicaCount` | desired number of proxy pods | `1`
|
||||
`proxy.resources` | resource limits and requests for proxy pods | `{ limits: { memory: "256Mi", cpu: "200m" }}`
|
||||
`proxy.nodeSelector` | node selector logic for proxy pods | `{}`
|
||||
@@ -82,9 +84,10 @@ Parameter | Description | Default
|
||||
`provider.google.secret` | the Google OAuth secrets | REQUIRED if `provider.google.customSecret` is not set
|
||||
`provider.google.customSecret` | the secret key to reuse instead of creating it via helm | REQUIRED if `provider.google.secret` is not set
|
||||
`image.repository` | container image repository | `buzzfeed/sso`
|
||||
`image.tag` | container image tag | `v1.0.0`
|
||||
`image.tag` | container image tag | `v1.2.0`
|
||||
`image.pullPolicy` | container image pull policy | `IfNotPresent`
|
||||
`ingress.annotations` | ingress load balancer annotations | `{}`
|
||||
`ingress.extraLabels` | extra ingress labels | `{}`
|
||||
`ingress.hosts` | proxied hosts | `[]`
|
||||
`ingress.tls` | tls certificates for the proxied hosts | `[]`
|
||||
`upstreams` | configuration of services that use sso | `[]`
|
||||
|
||||
@@ -95,7 +95,7 @@ spec:
|
||||
- name: COOKIE_SECURE
|
||||
value: "true"
|
||||
- name: CLUSTER
|
||||
value: dev
|
||||
value: {{ .Values.cluster | quote }}
|
||||
# Provider variables
|
||||
{{- with .Values.provider.google }}
|
||||
{{- if .adminEmail }}
|
||||
@@ -115,6 +115,9 @@ spec:
|
||||
name: {{ $googleSecret }}
|
||||
key: google-client-secret
|
||||
{{- end }}
|
||||
{{- if .Values.auth.extraEnv }}
|
||||
{{ toYaml .Values.auth.extraEnv | indent 12 }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
|
||||
@@ -10,15 +10,21 @@ metadata:
|
||||
chart: {{ template "buzzfeed-sso.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
{{- range $key, $value := .Values.ingress.extraLabels }}
|
||||
{{ $key }}: {{ $value }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if or .Values.auth.tls .Values.ingress.tls }}
|
||||
tls:
|
||||
{{- if .Values.auth.tls }}
|
||||
- hosts:
|
||||
- {{ $authDomain }}
|
||||
secretName: {{ .Values.auth.tls.secretName -}}
|
||||
{{- end }}
|
||||
{{- range .Values.ingress.tls }}
|
||||
- hosts:
|
||||
{{- range .hosts }}
|
||||
@@ -26,6 +32,7 @@ spec:
|
||||
{{- end }}
|
||||
secretName: {{ .secretName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
rules:
|
||||
# Upstreams that need SSO authentication
|
||||
{{- range .Values.ingress.hosts }}
|
||||
|
||||
@@ -75,11 +75,14 @@ spec:
|
||||
- name: COOKIE_SECURE
|
||||
value: "true"
|
||||
- name: CLUSTER
|
||||
value: {{ .Values.proxy.cluster | quote }}
|
||||
value: {{ .Values.cluster | quote }}
|
||||
{{- if .Values.proxy.providerUrlInternal }}
|
||||
- name: PROVIDER_URL_INTERNAL
|
||||
value: {{ .Values.proxy.providerUrlInternal | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.proxy.extraEnv }}
|
||||
{{ toYaml .Values.proxy.extraEnv | indent 12 }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ping
|
||||
|
||||
@@ -2,10 +2,12 @@
|
||||
|
||||
emailDomain: "<your_email_domain>" # Required. e.g "email.mydomain.foo"
|
||||
rootDomain: "<your_root_domain>" # Required. e.g "mydomain.foo"
|
||||
cluster: dev
|
||||
|
||||
auth:
|
||||
annotations: {}
|
||||
domain: "<your_auth_domain>" # Required. e.g "sso-auth.mydomain.foo"
|
||||
extraEnv: []
|
||||
replicaCount: 1
|
||||
resources:
|
||||
limits:
|
||||
@@ -24,13 +26,13 @@ auth:
|
||||
# cookieSecret: ''
|
||||
# # Or if you do not want to create the secret via helm
|
||||
# customSecret: my-sso-auth-secret
|
||||
tls:
|
||||
secretName: sso-auth-tls-secret
|
||||
tls: {}
|
||||
# secretName: sso-auth-tls-secret
|
||||
|
||||
proxy:
|
||||
annotations: {}
|
||||
extraEnv: []
|
||||
# providerUrlInternal: https://sso-auth.mydomain.com
|
||||
cluster: dev
|
||||
replicaCount: 1
|
||||
resources:
|
||||
limits:
|
||||
@@ -66,7 +68,7 @@ provider:
|
||||
|
||||
image:
|
||||
repository: buzzfeed/sso
|
||||
tag: v1.1.0
|
||||
tag: v1.2.0
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
ingress:
|
||||
@@ -74,6 +76,7 @@ ingress:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# certmanager.k8s.io/cluster-issuer: my-letsencrypt-issuer
|
||||
# ingress.kubernetes.io/ssl-redirect: "true"
|
||||
extraLabels: {}
|
||||
hosts: []
|
||||
# - domain: mybackend.mydomain.foo
|
||||
# path: /
|
||||
|
||||
Reference in New Issue
Block a user