From fb935c70ebb8192876fa21580b35eb0de77f73a6 Mon Sep 17 00:00:00 2001 From: David Ashford Date: Thu, 1 Aug 2019 12:48:14 +0100 Subject: [PATCH] [stable/oauth2-proxy] add htpasswd-file components (#13958) * add htpasswd components Signed-off-by: David Ashford * bump chart version Signed-off-by: David Ashford * Move htpasswd file to a secret Signed-off-by: David Ashford --- stable/oauth2-proxy/Chart.yaml | 2 +- stable/oauth2-proxy/README.md | 3 +++ .../templates/configmap-htpasswd-file.yaml | 17 +++++++++++++++++ stable/oauth2-proxy/templates/deployment.yaml | 16 ++++++++++++++++ stable/oauth2-proxy/values.yaml | 11 +++++++++++ 5 files changed, 48 insertions(+), 1 deletion(-) create mode 100644 stable/oauth2-proxy/templates/configmap-htpasswd-file.yaml diff --git a/stable/oauth2-proxy/Chart.yaml b/stable/oauth2-proxy/Chart.yaml index 1b5662d048..22e9c3b58c 100644 --- a/stable/oauth2-proxy/Chart.yaml +++ b/stable/oauth2-proxy/Chart.yaml @@ -1,5 +1,5 @@ name: oauth2-proxy -version: 0.13.0 +version: 0.14.0 apiVersion: v1 appVersion: 3.2.0 home: http://www.videntity.com/ diff --git a/stable/oauth2-proxy/README.md b/stable/oauth2-proxy/README.md index fd868cc182..9692500593 100644 --- a/stable/oauth2-proxy/README.md +++ b/stable/oauth2-proxy/README.md @@ -52,6 +52,9 @@ Parameter | Description | Default `config.google.serviceAccountJson` | google service account json contents | `""` `config.google.existingConfig` | existing Kubernetes configmap to use for the service account file. See [google secret template](https://github.com/helm/charts/blob/master/stable/oauth2-proxy/templates/google-secret.yaml) for the required values | `nil` `extraArgs` | key:value list of extra arguments to give the binary | `{}` +`htpasswdFile.enabled` | enable htpasswd-file option | `false` +`htpasswdFile.entries` | list of [SHA encrypted user:passwords](https://pusher.github.io/oauth2_proxy/configuration#command-line-options) | `{}` +`htpasswdFile.existingSecret` | existing Kubernetes secret to use for OAuth2 htpasswd file` | `""` `image.pullPolicy` | Image pull policy | `IfNotPresent` `image.repository` | Image repository | `quay.io/pusher/oauth2_proxy` `image.tag` | Image tag | `v3.2.0` diff --git a/stable/oauth2-proxy/templates/configmap-htpasswd-file.yaml b/stable/oauth2-proxy/templates/configmap-htpasswd-file.yaml new file mode 100644 index 0000000000..c40b63716b --- /dev/null +++ b/stable/oauth2-proxy/templates/configmap-htpasswd-file.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.htpasswdFile.enabled (not .Values.htpasswdFile.existingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + labels: + app: {{ template "oauth2-proxy.name" . }} + chart: {{ template "oauth2-proxy.chart" . }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file +type: Opaque +stringData: + users.txt: |- + {{- range $entries := .Values.htpasswdFile.entries }} + {{ $entries }} + {{- end -}} +{{- end }} \ No newline at end of file diff --git a/stable/oauth2-proxy/templates/deployment.yaml b/stable/oauth2-proxy/templates/deployment.yaml index 91eaa29a0f..7df09a5b80 100644 --- a/stable/oauth2-proxy/templates/deployment.yaml +++ b/stable/oauth2-proxy/templates/deployment.yaml @@ -62,6 +62,9 @@ spec: - --google-service-account-json=/google/service-account.json {{- end }} {{- end }} + {{- if .Values.htpasswdFile.enabled }} + - --htpasswd-file=/etc/oauth2_proxy/htpasswd/users.txt + {{- end }} env: - name: OAUTH2_PROXY_CLIENT_ID valueFrom: @@ -118,6 +121,11 @@ spec: - mountPath: /etc/oauth2-proxy name: configaccesslist readOnly: true +{{- end }} +{{- if .Values.htpasswdFile.enabled }} + - mountPath: /etc/oauth2_proxy/htpasswd + name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file + readOnly: true {{- end }} volumes: {{- with .Values.config.google }} @@ -127,6 +135,13 @@ spec: secretName: {{ if .existingSecret }}{{ .existingSecret }}{{ else }} {{ template "oauth2-proxy.secretName" . }}{{ end }} {{- end }} {{- end }} + +{{- if .Values.htpasswdFile.enabled }} + - name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file + secret: + secretName: {{ if .Values.htpasswdFile.existingSecret }}{{ .Values.htpasswdFile.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-htpasswd-file {{ end }} +{{- end }} + {{- if or .Values.config.existingConfig .Values.config.configFile }} - configMap: defaultMode: 420 @@ -149,6 +164,7 @@ spec: {{- end }} name: configaccesslist {{- end }} + {{- if .Values.imagePullSecrets }} imagePullSecrets: {{ toYaml .Values.imagePullSecrets | indent 8 }} diff --git a/stable/oauth2-proxy/values.yaml b/stable/oauth2-proxy/values.yaml index 02479e48f0..9515627f3b 100644 --- a/stable/oauth2-proxy/values.yaml +++ b/stable/oauth2-proxy/values.yaml @@ -124,3 +124,14 @@ readinessProbe: podAnnotations: {} podLabels: {} replicaCount: 1 + +# Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -s" for SHA encryption. +# Alternatively supply an existing secret which contains the required information. +htpasswdFile: + enabled: false + existingSecret: "" + entries: {} + # One row for each user + # example: + # entries: + # - testuser:{SHA}EWhzdhgoYJWy0z2gyzhRYlN9DSiv