[stable/traefik] Basic auth support for dashboard (#414)

* Basic auth support for traefik dashboard
* Moved auth config to dashboard.auth.basic
* Align to versioning convention
* Add auth config guidance to default values file
* Missing backtick
* bump version
* README tweak

stable/traefik/Chart.yaml

@@ -1,6 +1,7 @@
 apiVersion: v1
 name: traefik
-version: 1.1.2-e
+# Lock step with the Traefik version, appended with -a, -b, etc. to denote versions of the chart
+version: 1.1.2-f
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:
 - traefik

stable/traefik/README.md

@@ -89,6 +89,7 @@ The following tables lists the configurable parameters of the Traefik chart and
 | `dashboard.enabled`             | Whether to enable the Traefik dashboard                              | `false`                                   |
 | `dashboard.domain`              | Domain for the Traefik dashboard                                     | `traefik.example.com`                     |
 | `dashboard.ingress.annotations` | Annotations for the Traefik dashboard Ingress definition, specified as a map | None                              |
+| `dashboard.auth.basic`          | Basic auth for the Traefik dashboard specified as a map, see Authentication section | unset by default; this means basic auth is disabled |
 | `service.annotations`           | Annotations for the Traefik Service definition, specified as a map   | None                                      |
 | `service.labels`                | Additional labels for the Traefik Service definition, specified as a map | None                                  |
 | `gzip.enabled`                  | Whether to use gzip compression                                      | `true`                                    |
@@ -98,7 +99,8 @@ The following tables lists the configurable parameters of the Traefik chart and
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
 
 ```bash
-$ helm install --name my-release --namespace kube-system --set dashboard.enabled=true,dashboard.domain=traefik.example.com stable/traefik
+$ helm install --name my-release --namespace kube-system \
+  --set dashboard.enabled=true,dashboard.domain=traefik.example.com stable/traefik
 ```
 
 The above command enables the Traefik dashboard on the domain `traefik.example.com`.
@@ -116,6 +118,25 @@ Currently it is possible to specify the number of `replicas` but the implementat
 
 **Full Traefik clustering with leader election is not yet supported.**
 
-It is heavily advised to not set a value for `replicas` if you also have Let's Encrypt configured. While setting `replicas` will work for many cases, since no leader is elected it has the consequence 
-that each node will end up requesting Let's Encrypt certificates if this is also configured.
-This will quickly cut into the very modest rate limit that Let's Encrypt enforces. 
+It is heavily advised to not set a value for `replicas` if you also have Let's Encrypt configured. While setting `replicas` will work for many cases, since no leader is elected it has the consequence that each node will end up requesting Let's Encrypt certificates if this is also configured. This will quickly cut into the very modest rate limit that Let's Encrypt enforces.
+
+[Basic auth](https://docs.traefik.io/toml/#api-backend) can be specified via `dashboard.auth.basic` as a map of usernames to passwords as below.
+See the linked Traefik documentation for accepted passwords encodings.
+It is advised to single quote passwords to avoid issues with special characters:
+
+```bash
+$ helm install --name my-release --namespace kube-system \
+  --set dashboard.enabled=true,dashboard.auth.basic.test='$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/' \
+  stable/traefik
+```
+
+Alternatively in YAML form:
+
+```yaml
+dashboard:
+  enabled: true
+  domain: traefik.example.com
+  auth:
+    basic:
+      test: $apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+```

stable/traefik/templates/configmap.yaml

@@ -60,4 +60,10 @@ data:
     {{- if .Values.dashboard.enabled }}
     [web]
     address = ":8080"
+      {{- if .Values.dashboard.auth }}
+      {{- if .Values.dashboard.auth.basic }}
+      [web.auth.basic]
+        users = [{{ range $key, $value := .Values.dashboard.auth.basic }}"{{ $key }}:{{ $value }}",{{ end }}]
+      {{- end}}
+      {{- end}}
     {{- end }}

stable/traefik/values.yaml

@@ -31,6 +31,9 @@ dashboard:
   ingress:
     # annotations:
     #   key: value
+  auth:
+    # basic:
+    #   username: password
 service:
   # annotations:
   #   key: value