chart: add missing hpa and pdb for forwardauth, move related keys to separate stanza

charts/wonderwall/Feature.yaml

@@ -25,20 +25,21 @@ values:
     description: Enable Azure AD.
     config:
       type: bool
-  azure.forwardAuth:
+  azure.forwardAuth.enabled:
     description: Enables forward auth server
     config:
       type: bool
-  azure.sessionCookieEncryptionKey:
-    description: Cookie encryption key, 256 bits encoded with standard base64.
+  azure.forwardAuth.sessionCookieEncryptionKey:
+    description: Cookie encryption key, 256 bits (e.g. 32 ASCII characters) encoded with standard base64.
     config:
       type: string
       secret: true
-  azure.ssoDomain:
+  azure.forwardAuth.ssoDomain:
     description: Cookie domain for forward auth
     config:
       type: string
-  azure.ssoDefaultRedirectURL:
+  azure.forwardAuth.ssoDefaultRedirectURL:
+    description: Default redirect URL for forward auth
     config:
       type: string
   idporten.enabled:
@@ -62,7 +63,7 @@ values:
     config:
       type: int
   idporten.sessionCookieEncryptionKey:
-    description: Cookie encryption key, 256 bits encoded with standard base64.
+    description: Cookie encryption key, 256 bits (e.g. 32 ASCII characters) encoded with standard base64.
     config:
       type: string
       secret: true

charts/wonderwall/templates/_helpers.tpl

@@ -95,13 +95,13 @@ Create the name of the service account to use
 {{- end }}
 
 {{/*
-Azure SSO server URL.
+Azure forward auth URL.
 */}}
-{{- define "wonderwall.azure.ssoServerURL" -}}
-{{- if not .Values.azure.ssoDomain }}
-{{- fail ".Values.azure.ssoDomain is required." }}
+{{- define "wonderwall.azure.forwardAuthURL" -}}
+{{- if not .Values.azure.forwardAuth.ssoDomain }}
+{{- fail ".Values.azure.forwardAuth.ssoDomain is required." }}
 {{ else }}
-{{- printf "https://%s" .Values.azure.ssoDomain }}
+{{- printf "https://%s" .Values.azure.forwardAuth.ssoDomain }}
 {{- end }}
 {{- end }}
 

charts/wonderwall/templates/fa-azureapp.yaml

@@ -1,4 +1,4 @@
-{{ if .Values.azure.forwardAuth }}
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
 ---
 apiVersion: nais.io/v1
 kind: AzureAdApplication
@@ -7,10 +7,10 @@ metadata:
   labels:
     {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
 spec:
-  secretName: {{ .Values.azure.clientSecretName }}
+  secretName: {{ .Values.azure.forwardAuth.clientSecretName }}
   allowAllUsers: true
-  logoutUrl: "{{ include "wonderwall.azure.ssoServerURL" . }}/oauth2/logout/frontchannel"
+  logoutUrl: "{{ include "wonderwall.azure.forwardAuthURL" . }}/oauth2/logout/frontchannel"
   replyUrls:
-    - url: "{{- include "wonderwall.azure.ssoServerURL" . }}/oauth2/callback"
+    - url: "{{- include "wonderwall.azure.forwardAuthURL" . }}/oauth2/callback"
   tenant: nav.no
-{{ end }}
+{{- end }}

charts/wonderwall/templates/fa-deployment.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.azure.forwardAuth -}}
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -63,9 +63,9 @@ spec:
                 name: {{ .Values.azure.redisSecretName }}
           envFrom:
             - secretRef:
-                name: "{{ .Values.azure.clientSecretName }}"
+                name: "{{ .Values.azure.forwardAuth.clientSecretName }}"
             - secretRef:
-                name: "{{ .Values.azure.ssoServerSecretName }}"
+                name: "{{ .Values.azure.forwardAuth.ssoServerSecretName }}"
           image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
           imagePullPolicy: IfNotPresent
           livenessProbe:

charts/wonderwall/templates/fa-horizontalpodautoscaler.yaml

@@ -0,0 +1,22 @@
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
+  name: {{ include "wonderwall.fullname" . }}-fa
+spec:
+  minReplicas: {{ .Values.azure.forwardAuth.replicasMin }}
+  maxReplicas: {{ .Values.azure.forwardAuth.replicasMax }}
+  metrics:
+    - resource:
+        name: cpu
+        target:
+          averageUtilization: 75
+          type: Utilization
+      type: Resource
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "wonderwall.fullname" . }}-fa
+{{- end }}

charts/wonderwall/templates/fa-ingress.yaml

@@ -1,4 +1,4 @@
-{{ if .Values.azure.forwardAuth }}
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -11,9 +11,9 @@ metadata:
     {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
   name: {{ include "wonderwall.fullname" . }}-fa
 spec:
-  ingressClassName: {{ .Values.azure.ingressClassName }}
+  ingressClassName: {{ .Values.azure.forwardAuth.ingressClassName }}
   rules:
-    - host: {{ .Values.azure.ssoDomain }}
+    - host: {{ .Values.azure.forwardAuth.ssoDomain }}
       http:
         paths:
           - backend:
@@ -23,4 +23,4 @@ spec:
                   number: 80
             path: /
             pathType: ImplementationSpecific
-{{ end }}
+{{- end }}

charts/wonderwall/templates/fa-poddisruptionbudget.yaml

@@ -0,0 +1,13 @@
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  labels:
+    {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
+  name: {{ include "wonderwall.fullname" . }}-fa
+spec:
+  {{- toYaml .Values.podDisruptionBudget | nindent 2 }}
+  selector:
+    matchLabels:
+      {{- include "wonderwall.selectorLabelsForwardAuth" . | nindent 6 }}
+{{- end }}

charts/wonderwall/templates/fa-secret.yaml

@@ -1,28 +1,28 @@
-{{ if .Values.azure.forwardAuth }}
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
 ---
 apiVersion: v1
 kind: Secret
 type: kubernetes.io/Opaque
 metadata:
-  name: "{{ .Values.azure.ssoServerSecretName }}"
+  name: "{{ .Values.azure.forwardAuth.ssoServerSecretName }}"
   annotations:
     reloader.stakater.com/match: "true"
   labels:
-    {{- include "wonderwall.labels" . | nindent 4 }}
+    {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
 stringData:
   WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080"
   WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081"
-  WONDERWALL_INGRESS: "{{- include "wonderwall.azure.ssoServerURL" . }}"
+  WONDERWALL_INGRESS: "{{- include "wonderwall.azure.forwardAuthURL" . }}"
   WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s"
   WONDERWALL_OPENID_PROVIDER: "azure"
   WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}"
-  WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.sessionCookieEncryptionKey | required ".Values.azure.sessionCookieEncryptionKey is required." }}"
-  WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.sessionMaxLifetime is required." }}"
+  WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." }}"
+  WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}"
   WONDERWALL_SESSION_REFRESH: "false"
   WONDERWALL_SESSION_REFRESH_AUTO: "false"
-  WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.ssoDomain | required ".Values.azure.ssoDomain is required." }}"
+  WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}"
   WONDERWALL_SSO_ENABLED: "true"
   WONDERWALL_SSO_MODE: "server"
-  WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.sessionCookieName | required ".Values.azure.sessionCookieName is required." }}"
-  WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.ssoDefaultRedirectURL | required ".Values.azure.ssoDefaultRedirectURL is required." }}"
-{{ end }}
+  WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}"
+  WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}"
+{{- end }}

charts/wonderwall/templates/fa-service.yaml

@@ -1,4 +1,4 @@
-{{ if .Values.azure.forwardAuth }}
+{{- if and .Values.azure.enabled .Values.azure.forwardAuth }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -14,4 +14,4 @@ spec:
       targetPort: http
   selector:
     {{- include "wonderwall.selectorLabelsForwardAuth" . | nindent 4 }}
-{{ end }}
+{{- end }}

charts/wonderwall/templates/horizontalpodautoscaler.yaml

@@ -1,4 +1,4 @@
-{{ if .Values.idporten.enabled }}
+{{- if .Values.idporten.enabled }}
 apiVersion: autoscaling/v2
 kind: HorizontalPodAutoscaler
 metadata:
@@ -19,4 +19,4 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: {{ include "wonderwall.fullname" . }}-idporten
-{{ end }}
+{{- end }}

charts/wonderwall/templates/networkpolicy.yaml

@@ -3,7 +3,7 @@ kind: NetworkPolicy
 metadata:
   labels:
     {{- include "wonderwall.labels" . | nindent 4 }}
-  name: {{ include "wonderwall.fullname" . }}-idporten
+  name: {{ include "wonderwall.fullname" . }}
 spec:
   egress:
     - to:
@@ -36,7 +36,7 @@ spec:
               kubernetes.io/metadata.name: nais-system
           podSelector:
             matchLabels:
-              nais.io/ingressClass: {{ .Values.azure.ingressClassName }}
+              nais.io/ingressClass: {{ .Values.azure.forwardAuth.ingressClassName }}
     - from:
         - namespaceSelector:
             matchLabels:

charts/wonderwall/templates/poddisruptionbudget.yaml

@@ -1,11 +1,13 @@
+{{- if .Values.idporten.enabled }}
 apiVersion: policy/v1
 kind: PodDisruptionBudget
 metadata:
   labels:
-    {{- include "wonderwall.labels" . | nindent 4 }}
-  name: {{ include "wonderwall.fullname" . }}
+    {{- include "wonderwall.labelsIdporten" . | nindent 4 }}
+  name: {{ include "wonderwall.fullname" . }}-idporten
 spec:
   {{- toYaml .Values.podDisruptionBudget | nindent 2 }}
   selector:
     matchLabels:
-      {{- include "wonderwall.selectorLabels" . | nindent 6 }}
+      {{- include "wonderwall.selectorLabelsIdporten" . | nindent 6 }}
+{{- end }}

charts/wonderwall/templates/secret.yaml

@@ -8,7 +8,7 @@ metadata:
   annotations:
     reloader.stakater.com/match: "true"
   labels:
-    {{- include "wonderwall.labels" . | nindent 4 }}
+    {{- include "wonderwall.labelsIdporten" . | nindent 4 }}
 stringData:
   WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080"
   WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081"

charts/wonderwall/values.yaml

@@ -12,18 +12,21 @@ aiven:
   redisPlan:
 azure:
   enabled: true
-  clientSecretName: azure-sso-secret
-  ingressClassName: nais-ingress-fa
   redisSecretName: wonderwall-azure-redis-rw
-  forwardAuth: false
-  sessionCookieName: forwardauth
-  # 256 bits key, in standard base64 encoding
-  sessionCookieEncryptionKey:
-  ssoDomain:
-  ssoDefaultRedirectURL:
   sessionMaxLifetime: 10h
   sessionRefresh: true
-  ssoServerSecretName: wonderwall-azure-sso-server
+  forwardAuth:
+    enabled: false
+    replicasMin: 2
+    replicasMax: 4
+    clientSecretName: azure-sso-server
+    ingressClassName: nais-ingress-fa
+    # 256 bits key, in standard base64 encoding
+    sessionCookieEncryptionKey:
+    sessionCookieName: forwardauth
+    ssoDefaultRedirectURL:
+    ssoDomain:
+    ssoServerSecretName: wonderwall-azure-sso-server
 idporten:
   enabled: true
   clientAccessTokenLifetime: 3600
@@ -37,7 +40,7 @@ idporten:
   redisSecretNames:
     read: wonderwall-idporten-redis-ro
     readwrite: wonderwall-idporten-redis-rw
-  replicasMax: 2
+  replicasMax: 4
   replicasMin: 2
   sessionCookieName:
   # 256 bits key, in standard base64 encoding