Buzzfeed sso/fix default allowed email domains (#22044)

* allow setting default allowed domains in proxy deployment

Signed-off-by: Will Salt <williamejsalt@gmail.com>

* bump chart patch number to reflect changes

Signed-off-by: Will Salt <williamejsalt@gmail.com>

* add value to readme and correctly namespace it

Signed-off-by: Will Salt <williamejsalt@gmail.com>

* fix accidental image tag modification

Signed-off-by: Will Salt <williamejsalt@gmail.com>

* fix typos in comments

Signed-off-by: Will Salt <williamejsalt@gmail.com>

incubator/buzzfeed-sso/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Single sign-on for your Kubernetes services using Google OAuth
 name: buzzfeed-sso
-version: 0.2.0
+version: 0.2.1
 appVersion: 2.1.0
 home: https://github.com/buzzfeed/sso
 sources:

incubator/buzzfeed-sso/README.md

@@ -81,6 +81,7 @@ Parameter | Description | Default
 `proxy.service.port` | port for the http proxy service | `80`
 `proxy.secret` | secrets to be generated randomly with `openssl rand -base64 32 | head -c 32 | base64`. | REQUIRED if `proxy.customSecret` is not set
 `proxy.customSecret` | the secret key to reuse (avoids secret creation via helm) | REQUIRED if `proxy.secret` is not set
+`proxy.defaultAllowedEmailDomains` | the default allowed domains for upstreams | ``
 `provider.google` | the Oauth provider to use (only Google support for now) | REQUIRED
 `provider.google.adminEmail` | the Google admin email | `undefined`
 `provider.google.slug` | the Google provider slug | `oauth2`

incubator/buzzfeed-sso/templates/proxy-deployment.yaml

@@ -61,8 +61,18 @@ spec:
                 secretKeyRef:
                   name: {{ $proxySecret }}
                   key: proxy-cookie-secret
+            {{- if .Values.proxy.defaultAllowedEmailDomains }}
+            {{- if (eq "-" .Values.proxy.defaultAllowedEmailDomains) }}
+            - name: DEFAULT_ALLOWED_EMAIL_DOMAINS
+              value: ""
+            {{- else }}
+            - name: DEFAULT_ALLOWED_EMAIL_DOMAINS
+              value: {{ .Values.proxy.defaultAllowedEmailDomains | quote }}
+            {{- end }}
+            {{- else }}
             - name: DEFAULT_ALLOWED_EMAIL_DOMAINS
               value: {{ .Values.emailDomain | quote }}
+            {{- end }}
             {{- if .Values.whitelistedEmails }}
             - name: DEFAULT_ALLOWED_EMAIL_ADDRESSES
               value: {{ .Values.whitelistedEmails }}

incubator/buzzfeed-sso/values.yaml

@@ -62,6 +62,12 @@ proxy:
   # # Or if you do not want to create the secret via helm
   # customSecret: my-sso-proxy-secret
 
+  # If you are using_allowed groups in upstreams, DEFAULT_ALLOWED_EMAIL_DOMAINS needs to be an empty string
+  # this is explained in this pr https://github.com/buzzfeed/sso/pull/280#issuecomment-584088825
+  # to get an empty value, set the string below to -, as per this issue https://github.com/helm/helm/issues/2600#issuecomment-310108850
+  # otherwise populate it with your default allowed email domains
+  defaultAllowedEmailDomains: ""
+
 provider:
   google: {}  # Required.
   # google: