mirror of
https://github.com/helm/charts.git
synced 2026-08-23 06:17:18 +00:00
127 lines
3.7 KiB
YAML
127 lines
3.7 KiB
YAML
# Oauth client configuration specifics
|
|
config:
|
|
# OAuth client ID
|
|
clientID: "XXXXXXX"
|
|
# OAuth client secret
|
|
clientSecret: "XXXXXXXX"
|
|
# Create a new secret with the following command
|
|
# openssl rand -base64 32 | head -c 32 | base64
|
|
# Use an existing secret for OAuth2 credentials (see secret.yaml for required fields)
|
|
# Example:
|
|
# existingSecret: secret
|
|
cookieSecret: "XXXXXXXXXX"
|
|
google: {}
|
|
# adminEmail: xxxx
|
|
# serviceAccountJson: xxxx
|
|
# Alternatively, use an existing secret (see google-secret.yaml for required fields)
|
|
# Example:
|
|
# existingSecret: google-secret
|
|
# Default configuration, to be overridden
|
|
configFile: |-
|
|
email_domains = [ "*" ]
|
|
upstreams = [ "file:///dev/null" ]
|
|
# Custom configuration file: oauth2_proxy.cfg
|
|
# configFile: |-
|
|
# pass_basic_auth = false
|
|
# pass_access_token = true
|
|
# Use an existing config map (see configmap.yaml for required fields)
|
|
# Example:
|
|
# existingConfig: config
|
|
|
|
image:
|
|
repository: "quay.io/pusher/oauth2_proxy"
|
|
tag: "v3.2.0"
|
|
pullPolicy: "IfNotPresent"
|
|
|
|
# Optionally specify an array of imagePullSecrets.
|
|
# Secrets must be manually created in the namespace.
|
|
# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod
|
|
# imagePullSecrets:
|
|
# - name: myRegistryKeySecretName
|
|
|
|
extraArgs: {}
|
|
|
|
# To authorize individual email addresses
|
|
# That is part of extraArgs but since this needs special treatment we need to do a separate section
|
|
authenticatedEmailsFile:
|
|
enabled: false
|
|
# template is the name of the configmap what contains the email user list but has been configured without this chart.
|
|
# It's a simpler way to maintain only one configmap (user list) instead changing it for each oauth2-proxy service.
|
|
# Be aware the value name in the extern config map in data needs to be named to "restricted_user_access".
|
|
template: ""
|
|
# One email per line
|
|
# example:
|
|
# restricted_access: |-
|
|
# name1@domain
|
|
# name2@domain
|
|
# If you override the config with restricted_access it will configure a user list within this chart what takes care of the
|
|
# config map resource.
|
|
restricted_access: ""
|
|
|
|
service:
|
|
type: ClusterIP
|
|
# when service.type is ClusterIP ...
|
|
# clusterIP: 192.0.2.20
|
|
# when service.type is LoadBalancer ...
|
|
# loadBalancerIP: 198.51.100.40
|
|
# loadBalancerSourceRanges: 203.0.113.0/24
|
|
port: 80
|
|
annotations: {}
|
|
# foo.io/bar: "true"
|
|
|
|
ingress:
|
|
enabled: false
|
|
path: /
|
|
# Used to create an Ingress record.
|
|
# hosts:
|
|
# - chart-example.local
|
|
# annotations:
|
|
# kubernetes.io/ingress.class: nginx
|
|
# kubernetes.io/tls-acme: "true"
|
|
# tls:
|
|
# Secrets must be manually created in the namespace.
|
|
# - secretName: chart-example-tls
|
|
# hosts:
|
|
# - chart-example.local
|
|
|
|
resources: {}
|
|
# limits:
|
|
# cpu: 100m
|
|
# memory: 300Mi
|
|
# requests:
|
|
# cpu: 100m
|
|
# memory: 300Mi
|
|
|
|
priorityClassName: ""
|
|
|
|
# Affinity for pod assignment
|
|
# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
|
|
# affinity: {}
|
|
|
|
# Tolerations for pod assignment
|
|
# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
|
|
tolerations: []
|
|
|
|
# Node labels for pod assignment
|
|
# Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
|
nodeSelector: {}
|
|
|
|
# Configure Kubernetes liveness and readiness probes.
|
|
# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
|
|
# Disable both when deploying with Istio 1.0 mTLS. https://istio.io/help/faq/security/#k8s-health-checks
|
|
livenessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 1
|
|
|
|
readinessProbe:
|
|
enabled: true
|
|
initialDelaySeconds: 0
|
|
timeoutSeconds: 1
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
replicaCount: 1
|