mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Oliver
bd32c5248c
* Added option for hal config to be created by the values.yaml file Signed-off-by: Oliver Isaac <oisaac@gmail.com> * Added support for creating scripts, config maps, and secrets from the values.yaml file. Included an example in values_saml.yaml on how to use this functinality to implement saml authentication. Signed-off-by: Oliver Isaac <oisaac@gmail.com> * Version bump Signed-off-by: Oliver Isaac <oisaac@gmail.com>
73 lines
2.9 KiB
YAML
73 lines
2.9 KiB
YAML
# Configure ingress to allow access to both gate and deck from your machine:
|
|
ingress:
|
|
enabled: true
|
|
host: spinnaker.example.com
|
|
annotations:
|
|
ingress.kubernetes.io/ssl-redirect: 'true'
|
|
kubernetes.io/ingress.class: nginx
|
|
kubernetes.io/tls-acme: "true"
|
|
certmanager.k8s.io/cluster-issuer: letsencrypt-prod
|
|
tls:
|
|
- secretName: deck-tls
|
|
hosts:
|
|
- spinnaker.example.com
|
|
|
|
ingressGate:
|
|
enabled: true
|
|
host: gate.spinnaker.example.com
|
|
annotations:
|
|
ingress.kubernetes.io/ssl-redirect: 'true'
|
|
kubernetes.io/ingress.class: nginx
|
|
kubernetes.io/tls-acme: "true"
|
|
certmanager.k8s.io/cluster-issuer: letsencrypt-prod
|
|
tls:
|
|
- secretName: gate-tls
|
|
hosts:
|
|
- gate.spinnaker.example.com
|
|
|
|
# Configure halyard to support saml
|
|
halyard:
|
|
# Provide a config map with Hal commands that will be run the core config (storage)
|
|
# The config map should contain a script in the config.sh key
|
|
additionalSecrets:
|
|
create: true
|
|
data:
|
|
keystore.p12: aW4tc2VjcmV0cwo= # base64 encoded keystore in pkcs12 format
|
|
password.txt: aW4tc2VjcmV0cwo= # base64 encoded password for the keystore
|
|
metadata.xml: aW4tc2VjcmV0cwo= # base64 encoded metadata.xml file from your SAML authenticator
|
|
additionalConfigMaps:
|
|
create: true
|
|
data:
|
|
config.src: |-
|
|
KEYSTORE_ALIAS=saml # Alias in the keystore for the cert
|
|
GATE_URL="https://gate.spinnaker.example.com" # URL to access your gate
|
|
DECK_URL="https://spinnaker.example.com" # Url to access your deck
|
|
|
|
# Put the keystore, metadata, and keystore password in these files under additioanlSecrets
|
|
KEYSTORE_FILE=/opt/halyard/additionalSecrets/keystore.p12
|
|
PASSWORD_FILE=/opt/halyard/additionalSecrets/password.txt
|
|
METADATA_FILE=/opt/halyard/additionalSecrets/metadata.xml
|
|
additionalScripts:
|
|
create: true
|
|
data:
|
|
configure_saml.sh: |
|
|
# This source file contains these variables:
|
|
# -> GATE_URL DECK_URL KEYSTORE_FILE PASSWORD_FILE METADATA_FILE KEYSTORE_ALIAS
|
|
# I put config.src in additionalConfigMaps so you can break it out into a separate values.yaml file
|
|
# You should create both halyard.additionalConfigMaps.data.config.src AND halyard.additionalConfigMaps.create = true
|
|
source /opt/halyard/additionalConfigMaps/config.src
|
|
|
|
KEYSTORE_PASSWORD="$( cat "$PASSWORD_FILE" )"
|
|
|
|
$HAL_COMMAND config security ui edit --override-base-url "$DECK_URL"
|
|
$HAL_COMMAND config security api edit --override-base-url "$GATE_URL"
|
|
$HAL_COMMAND config security authn saml edit \
|
|
--keystore "$KEYSTORE_FILE" \
|
|
--keystore-alias "$KEYSTORE_ALIAS" \
|
|
--keystore-password "$KEYSTORE_PASSWORD" \
|
|
--metadata "$METADATA_FILE" \
|
|
--issuer-id "$GATE_URL" \
|
|
--no-validate \
|
|
--service-address-url "$GATE_URL"
|
|
$HAL_COMMAND config security authn saml enable
|