From fbcfd19656eaa49a893d7566a1e7d1f0bd436864 Mon Sep 17 00:00:00 2001
From: Chris Knowles <c-knowles@users.noreply.github.com>
Date: Tue, 14 Feb 2017 06:28:29 +0800
Subject: [PATCH] [stable/traefik] Basic auth support for dashboard (#414)

* Basic auth support for traefik dashboard
* Moved auth config to dashboard.auth.basic
* Align to versioning convention
* Add auth config guidance to default values file
* Missing backtick
* bump version
* README tweak
---
 stable/traefik/Chart.yaml               |  3 ++-
 stable/traefik/README.md                | 29 +++++++++++++++++++++----
 stable/traefik/templates/configmap.yaml |  6 +++++
 stable/traefik/values.yaml              |  3 +++
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml
index 7b24b304bb..8a6fb2a423 100755
--- a/stable/traefik/Chart.yaml
+++ b/stable/traefik/Chart.yaml
@@ -1,6 +1,7 @@
 apiVersion: v1
 name: traefik
-version: 1.1.2-e
+# Lock step with the Traefik version, appended with -a, -b, etc. to denote versions of the chart
+version: 1.1.2-f
 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
 keywords:
 - traefik
diff --git a/stable/traefik/README.md b/stable/traefik/README.md
index 43abe4ac57..bbf4fcd20e 100644
--- a/stable/traefik/README.md
+++ b/stable/traefik/README.md
@@ -89,6 +89,7 @@ The following tables lists the configurable parameters of the Traefik chart and
 | `dashboard.enabled`             | Whether to enable the Traefik dashboard                              | `false`                                   |
 | `dashboard.domain`              | Domain for the Traefik dashboard                                     | `traefik.example.com`                     |
 | `dashboard.ingress.annotations` | Annotations for the Traefik dashboard Ingress definition, specified as a map | None                              |
+| `dashboard.auth.basic`          | Basic auth for the Traefik dashboard specified as a map, see Authentication section | unset by default; this means basic auth is disabled |
 | `service.annotations`           | Annotations for the Traefik Service definition, specified as a map   | None                                      |
 | `service.labels`                | Additional labels for the Traefik Service definition, specified as a map | None                                  |
 | `gzip.enabled`                  | Whether to use gzip compression                                      | `true`                                    |
@@ -98,7 +99,8 @@ The following tables lists the configurable parameters of the Traefik chart and
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example:
 
 ```bash
-$ helm install --name my-release --namespace kube-system --set dashboard.enabled=true,dashboard.domain=traefik.example.com stable/traefik
+$ helm install --name my-release --namespace kube-system \
+  --set dashboard.enabled=true,dashboard.domain=traefik.example.com stable/traefik
 ```
 
 The above command enables the Traefik dashboard on the domain `traefik.example.com`.
@@ -116,6 +118,25 @@ Currently it is possible to specify the number of `replicas` but the implementat
 
 **Full Traefik clustering with leader election is not yet supported.**
 
-It is heavily advised to not set a value for `replicas` if you also have Let's Encrypt configured. While setting `replicas` will work for many cases, since no leader is elected it has the consequence 
-that each node will end up requesting Let's Encrypt certificates if this is also configured.
-This will quickly cut into the very modest rate limit that Let's Encrypt enforces. 
+It is heavily advised to not set a value for `replicas` if you also have Let's Encrypt configured. While setting `replicas` will work for many cases, since no leader is elected it has the consequence that each node will end up requesting Let's Encrypt certificates if this is also configured. This will quickly cut into the very modest rate limit that Let's Encrypt enforces.
+
+[Basic auth](https://docs.traefik.io/toml/#api-backend) can be specified via `dashboard.auth.basic` as a map of usernames to passwords as below.
+See the linked Traefik documentation for accepted passwords encodings.
+It is advised to single quote passwords to avoid issues with special characters:
+
+```bash
+$ helm install --name my-release --namespace kube-system \
+  --set dashboard.enabled=true,dashboard.auth.basic.test='$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/' \
+  stable/traefik
+```
+
+Alternatively in YAML form:
+
+```yaml
+dashboard:
+  enabled: true
+  domain: traefik.example.com
+  auth:
+    basic:
+      test: $apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/
+```
diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml
index dadd222e07..db25629765 100644
--- a/stable/traefik/templates/configmap.yaml
+++ b/stable/traefik/templates/configmap.yaml
@@ -60,4 +60,10 @@ data:
     {{- if .Values.dashboard.enabled }}
     [web]
     address = ":8080"
+      {{- if .Values.dashboard.auth }}
+      {{- if .Values.dashboard.auth.basic }}
+      [web.auth.basic]
+        users = [{{ range $key, $value := .Values.dashboard.auth.basic }}"{{ $key }}:{{ $value }}",{{ end }}]
+      {{- end}}
+      {{- end}}
     {{- end }}
diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml
index 48e860ec59..efc1f5f9fa 100644
--- a/stable/traefik/values.yaml
+++ b/stable/traefik/values.yaml
@@ -31,6 +31,9 @@ dashboard:
   ingress:
     # annotations:
     #   key: value
+  auth:
+    # basic:
+    #   username: password
 service:
   # annotations:
   #   key: value