From d0dc1770483d7b62f09fd032fb82e8c9b3ef1cb8 Mon Sep 17 00:00:00 2001 From: Will Salt Date: Tue, 21 Apr 2020 23:53:51 +0100 Subject: [PATCH] Buzzfeed sso/fix default allowed email domains (#22044) * allow setting default allowed domains in proxy deployment Signed-off-by: Will Salt * bump chart patch number to reflect changes Signed-off-by: Will Salt * add value to readme and correctly namespace it Signed-off-by: Will Salt * fix accidental image tag modification Signed-off-by: Will Salt * fix typos in comments Signed-off-by: Will Salt --- incubator/buzzfeed-sso/Chart.yaml | 2 +- incubator/buzzfeed-sso/README.md | 1 + incubator/buzzfeed-sso/templates/proxy-deployment.yaml | 10 ++++++++++ incubator/buzzfeed-sso/values.yaml | 6 ++++++ 4 files changed, 18 insertions(+), 1 deletion(-) diff --git a/incubator/buzzfeed-sso/Chart.yaml b/incubator/buzzfeed-sso/Chart.yaml index 2206ada6f9..dbd85dbbdf 100644 --- a/incubator/buzzfeed-sso/Chart.yaml +++ b/incubator/buzzfeed-sso/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Single sign-on for your Kubernetes services using Google OAuth name: buzzfeed-sso -version: 0.2.0 +version: 0.2.1 appVersion: 2.1.0 home: https://github.com/buzzfeed/sso sources: diff --git a/incubator/buzzfeed-sso/README.md b/incubator/buzzfeed-sso/README.md index 2d8bcf6bc1..6574a48880 100644 --- a/incubator/buzzfeed-sso/README.md +++ b/incubator/buzzfeed-sso/README.md @@ -81,6 +81,7 @@ Parameter | Description | Default `proxy.service.port` | port for the http proxy service | `80` `proxy.secret` | secrets to be generated randomly with `openssl rand -base64 32 | head -c 32 | base64`. | REQUIRED if `proxy.customSecret` is not set `proxy.customSecret` | the secret key to reuse (avoids secret creation via helm) | REQUIRED if `proxy.secret` is not set +`proxy.defaultAllowedEmailDomains` | the default allowed domains for upstreams | `` `provider.google` | the Oauth provider to use (only Google support for now) | REQUIRED `provider.google.adminEmail` | the Google admin email | `undefined` `provider.google.slug` | the Google provider slug | `oauth2` diff --git a/incubator/buzzfeed-sso/templates/proxy-deployment.yaml b/incubator/buzzfeed-sso/templates/proxy-deployment.yaml index 026c752561..32cd48104f 100644 --- a/incubator/buzzfeed-sso/templates/proxy-deployment.yaml +++ b/incubator/buzzfeed-sso/templates/proxy-deployment.yaml @@ -61,8 +61,18 @@ spec: secretKeyRef: name: {{ $proxySecret }} key: proxy-cookie-secret + {{- if .Values.proxy.defaultAllowedEmailDomains }} + {{- if (eq "-" .Values.proxy.defaultAllowedEmailDomains) }} + - name: DEFAULT_ALLOWED_EMAIL_DOMAINS + value: "" + {{- else }} + - name: DEFAULT_ALLOWED_EMAIL_DOMAINS + value: {{ .Values.proxy.defaultAllowedEmailDomains | quote }} + {{- end }} + {{- else }} - name: DEFAULT_ALLOWED_EMAIL_DOMAINS value: {{ .Values.emailDomain | quote }} + {{- end }} {{- if .Values.whitelistedEmails }} - name: DEFAULT_ALLOWED_EMAIL_ADDRESSES value: {{ .Values.whitelistedEmails }} diff --git a/incubator/buzzfeed-sso/values.yaml b/incubator/buzzfeed-sso/values.yaml index e7776c0fda..5f4a9e82ed 100644 --- a/incubator/buzzfeed-sso/values.yaml +++ b/incubator/buzzfeed-sso/values.yaml @@ -62,6 +62,12 @@ proxy: # # Or if you do not want to create the secret via helm # customSecret: my-sso-proxy-secret + # If you are using_allowed groups in upstreams, DEFAULT_ALLOWED_EMAIL_DOMAINS needs to be an empty string + # this is explained in this pr https://github.com/buzzfeed/sso/pull/280#issuecomment-584088825 + # to get an empty value, set the string below to -, as per this issue https://github.com/helm/helm/issues/2600#issuecomment-310108850 + # otherwise populate it with your default allowed email domains + defaultAllowedEmailDomains: "" + provider: google: {} # Required. # google: