From 9aeaf2095c8b302718968829505a87ef4201ff6a Mon Sep 17 00:00:00 2001 From: Cameron Attard Date: Fri, 14 Jun 2019 16:50:22 +1000 Subject: [PATCH] [incubator/buzzfeed-sso] add ingress.extraLabels, optional tls, extraEnv, and fix cluster variable (#13428) * [buzzfeed-sso] add ingress.extraLabels Signed-off-by: Cameron Attard * [buzzfeed-sso] make ingress tls optional Signed-off-by: Cameron Attard * [buzzfeed-sso] move cluster to top level of values.yaml and use for auth-deployment Signed-off-by: Cameron Attard * [buzzfeed-sso] add auth.extraEnv and proxy.extraEnv and update readme Signed-off-by: Cameron Attard * [buzzfeed-sso] fix typo Signed-off-by: Cameron Attard * [buzzfeed-sso] update app version and update README Signed-off-by: Cameron Attard * [buzzfeed-sso] fix ingress tls conditional Signed-off-by: Cameron Attard * [buzzfeed-sso] bump chart version Signed-off-by: Cameron Attard --- incubator/buzzfeed-sso/Chart.yaml | 4 ++-- incubator/buzzfeed-sso/README.md | 9 ++++++--- incubator/buzzfeed-sso/templates/auth-deployment.yaml | 5 ++++- incubator/buzzfeed-sso/templates/ingress.yaml | 7 +++++++ .../buzzfeed-sso/templates/proxy-deployment.yaml | 5 ++++- incubator/buzzfeed-sso/values.yaml | 11 +++++++---- 6 files changed, 30 insertions(+), 11 deletions(-) diff --git a/incubator/buzzfeed-sso/Chart.yaml b/incubator/buzzfeed-sso/Chart.yaml index 8ccbd31091..c55324cc28 100644 --- a/incubator/buzzfeed-sso/Chart.yaml +++ b/incubator/buzzfeed-sso/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 description: Single sign-on for your Kubernetes services using Google OAuth name: buzzfeed-sso -version: 0.0.3 -appVersion: 1.1.0 +version: 0.0.4 +appVersion: 1.2.0 home: https://github.com/buzzfeed/sso sources: - https://hub.docker.com/r/buzzfeed/sso/ diff --git a/incubator/buzzfeed-sso/README.md b/incubator/buzzfeed-sso/README.md index 420f0331d8..a5692df5b7 100644 --- a/incubator/buzzfeed-sso/README.md +++ b/incubator/buzzfeed-sso/README.md @@ -53,8 +53,10 @@ Parameter | Description | Default `namespace` | namespace to use | `default` `emailDomain` | the sso email domain for authentication | REQUIRED `rootDomain` | the parent domain used for protecting your backends | REQUIRED +`cluster` | the cluster name for SSO | `dev` `auth.annotations` | extra annotations for auth pods | `{}` `auth.domain` | the auth domain used for OAuth callbacks | REQUIRED +`auth.extraEnv` | extra auth env vars | `[]` `auth.replicaCount` | desired number of auth pods | `1` `auth.resources` | resource limits and requests for auth pods | `{ limits: { memory: "256Mi", cpu: "200m" }}` `auth.nodeSelector` | node selector logic for auth pods | `{}` @@ -63,11 +65,11 @@ Parameter | Description | Default `auth.service.type` | type of auth service to create | `ClusterIP` `auth.service.port` | port for the http auth service | `80` `auth.secret` | secrets to be generated randomly with `openssl rand -base64 32 | head -c 32`. | REQUIRED if `auth.customSecret` is not set -`auth.tls` | tls configuration for central sso auth ingress. | `{ secretName: "sso-auth-tls-secret" }` +`auth.tls` | tls configuration for central sso auth ingress. | `{}` `auth.customSecret` | the secret key to reuse (avoids secret creation via helm) | REQUIRED if `auth.secret` is not set `proxy.annotations` | extra annotations for proxy pods | `{}` `proxy.providerUrlInternal` | url for split dns deployments | -`proxy.cluster` | the cluster name for SSO | `dev` +`proxy.extraEnv` | extra proxy env vars | `[]` `proxy.replicaCount` | desired number of proxy pods | `1` `proxy.resources` | resource limits and requests for proxy pods | `{ limits: { memory: "256Mi", cpu: "200m" }}` `proxy.nodeSelector` | node selector logic for proxy pods | `{}` @@ -82,9 +84,10 @@ Parameter | Description | Default `provider.google.secret` | the Google OAuth secrets | REQUIRED if `provider.google.customSecret` is not set `provider.google.customSecret` | the secret key to reuse instead of creating it via helm | REQUIRED if `provider.google.secret` is not set `image.repository` | container image repository | `buzzfeed/sso` -`image.tag` | container image tag | `v1.0.0` +`image.tag` | container image tag | `v1.2.0` `image.pullPolicy` | container image pull policy | `IfNotPresent` `ingress.annotations` | ingress load balancer annotations | `{}` +`ingress.extraLabels` | extra ingress labels | `{}` `ingress.hosts` | proxied hosts | `[]` `ingress.tls` | tls certificates for the proxied hosts | `[]` `upstreams` | configuration of services that use sso | `[]` diff --git a/incubator/buzzfeed-sso/templates/auth-deployment.yaml b/incubator/buzzfeed-sso/templates/auth-deployment.yaml index 748879288c..cce2249f86 100644 --- a/incubator/buzzfeed-sso/templates/auth-deployment.yaml +++ b/incubator/buzzfeed-sso/templates/auth-deployment.yaml @@ -95,7 +95,7 @@ spec: - name: COOKIE_SECURE value: "true" - name: CLUSTER - value: dev + value: {{ .Values.cluster | quote }} # Provider variables {{- with .Values.provider.google }} {{- if .adminEmail }} @@ -115,6 +115,9 @@ spec: name: {{ $googleSecret }} key: google-client-secret {{- end }} + {{- if .Values.auth.extraEnv }} +{{ toYaml .Values.auth.extraEnv | indent 12 }} + {{- end }} readinessProbe: httpGet: path: /ping diff --git a/incubator/buzzfeed-sso/templates/ingress.yaml b/incubator/buzzfeed-sso/templates/ingress.yaml index 5f7c3f3b7c..36aaecb0d4 100644 --- a/incubator/buzzfeed-sso/templates/ingress.yaml +++ b/incubator/buzzfeed-sso/templates/ingress.yaml @@ -10,15 +10,21 @@ metadata: chart: {{ template "buzzfeed-sso.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} +{{- range $key, $value := .Values.ingress.extraLabels }} + {{ $key }}: {{ $value }} +{{- end }} {{- with .Values.ingress.annotations }} annotations: {{ toYaml . | indent 4 }} {{- end }} spec: +{{- if or .Values.auth.tls .Values.ingress.tls }} tls: + {{- if .Values.auth.tls }} - hosts: - {{ $authDomain }} secretName: {{ .Values.auth.tls.secretName -}} + {{- end }} {{- range .Values.ingress.tls }} - hosts: {{- range .hosts }} @@ -26,6 +32,7 @@ spec: {{- end }} secretName: {{ .secretName }} {{- end }} +{{- end }} rules: # Upstreams that need SSO authentication {{- range .Values.ingress.hosts }} diff --git a/incubator/buzzfeed-sso/templates/proxy-deployment.yaml b/incubator/buzzfeed-sso/templates/proxy-deployment.yaml index 963765f3cc..9c390b1c1e 100644 --- a/incubator/buzzfeed-sso/templates/proxy-deployment.yaml +++ b/incubator/buzzfeed-sso/templates/proxy-deployment.yaml @@ -75,11 +75,14 @@ spec: - name: COOKIE_SECURE value: "true" - name: CLUSTER - value: {{ .Values.proxy.cluster | quote }} + value: {{ .Values.cluster | quote }} {{- if .Values.proxy.providerUrlInternal }} - name: PROVIDER_URL_INTERNAL value: {{ .Values.proxy.providerUrlInternal | quote }} {{- end }} + {{- if .Values.proxy.extraEnv }} +{{ toYaml .Values.proxy.extraEnv | indent 12 }} + {{- end }} readinessProbe: httpGet: path: /ping diff --git a/incubator/buzzfeed-sso/values.yaml b/incubator/buzzfeed-sso/values.yaml index dfaf3c1ca5..34d4be1e1a 100644 --- a/incubator/buzzfeed-sso/values.yaml +++ b/incubator/buzzfeed-sso/values.yaml @@ -2,10 +2,12 @@ emailDomain: "" # Required. e.g "email.mydomain.foo" rootDomain: "" # Required. e.g "mydomain.foo" +cluster: dev auth: annotations: {} domain: "" # Required. e.g "sso-auth.mydomain.foo" + extraEnv: [] replicaCount: 1 resources: limits: @@ -24,13 +26,13 @@ auth: # cookieSecret: '' # # Or if you do not want to create the secret via helm # customSecret: my-sso-auth-secret - tls: - secretName: sso-auth-tls-secret + tls: {} + # secretName: sso-auth-tls-secret proxy: annotations: {} + extraEnv: [] # providerUrlInternal: https://sso-auth.mydomain.com - cluster: dev replicaCount: 1 resources: limits: @@ -66,7 +68,7 @@ provider: image: repository: buzzfeed/sso - tag: v1.1.0 + tag: v1.2.0 pullPolicy: IfNotPresent ingress: @@ -74,6 +76,7 @@ ingress: # kubernetes.io/ingress.class: nginx # certmanager.k8s.io/cluster-issuer: my-letsencrypt-issuer # ingress.kubernetes.io/ssl-redirect: "true" + extraLabels: {} hosts: [] # - domain: mybackend.mydomain.foo # path: /