From 9132361a525ee33a6e6fee84b0803408bc227ed5 Mon Sep 17 00:00:00 2001 From: Trong Huu Nguyen Date: Fri, 5 Apr 2024 12:58:18 +0200 Subject: [PATCH] chart: add missing hpa and pdb for forwardauth, move related keys to separate stanza --- charts/wonderwall/Feature.yaml | 13 ++++++----- charts/wonderwall/templates/_helpers.tpl | 10 ++++---- charts/wonderwall/templates/fa-azureapp.yaml | 10 ++++---- .../wonderwall/templates/fa-deployment.yaml | 6 ++--- .../templates/fa-horizontalpodautoscaler.yaml | 22 ++++++++++++++++++ charts/wonderwall/templates/fa-ingress.yaml | 8 +++---- .../templates/fa-poddisruptionbudget.yaml | 13 +++++++++++ charts/wonderwall/templates/fa-secret.yaml | 20 ++++++++-------- charts/wonderwall/templates/fa-service.yaml | 4 ++-- .../templates/horizontalpodautoscaler.yaml | 4 ++-- .../wonderwall/templates/networkpolicy.yaml | 4 ++-- .../templates/poddisruptionbudget.yaml | 8 ++++--- charts/wonderwall/templates/secret.yaml | 2 +- charts/wonderwall/values.yaml | 23 +++++++++++-------- 14 files changed, 94 insertions(+), 53 deletions(-) create mode 100644 charts/wonderwall/templates/fa-horizontalpodautoscaler.yaml create mode 100644 charts/wonderwall/templates/fa-poddisruptionbudget.yaml diff --git a/charts/wonderwall/Feature.yaml b/charts/wonderwall/Feature.yaml index ce4cea2..4c9c4e1 100644 --- a/charts/wonderwall/Feature.yaml +++ b/charts/wonderwall/Feature.yaml @@ -25,20 +25,21 @@ values: description: Enable Azure AD. config: type: bool - azure.forwardAuth: + azure.forwardAuth.enabled: description: Enables forward auth server config: type: bool - azure.sessionCookieEncryptionKey: - description: Cookie encryption key, 256 bits encoded with standard base64. + azure.forwardAuth.sessionCookieEncryptionKey: + description: Cookie encryption key, 256 bits (e.g. 32 ASCII characters) encoded with standard base64. config: type: string secret: true - azure.ssoDomain: + azure.forwardAuth.ssoDomain: description: Cookie domain for forward auth config: type: string - azure.ssoDefaultRedirectURL: + azure.forwardAuth.ssoDefaultRedirectURL: + description: Default redirect URL for forward auth config: type: string idporten.enabled: @@ -62,7 +63,7 @@ values: config: type: int idporten.sessionCookieEncryptionKey: - description: Cookie encryption key, 256 bits encoded with standard base64. + description: Cookie encryption key, 256 bits (e.g. 32 ASCII characters) encoded with standard base64. config: type: string secret: true diff --git a/charts/wonderwall/templates/_helpers.tpl b/charts/wonderwall/templates/_helpers.tpl index 6f7e11d..05afc91 100644 --- a/charts/wonderwall/templates/_helpers.tpl +++ b/charts/wonderwall/templates/_helpers.tpl @@ -95,13 +95,13 @@ Create the name of the service account to use {{- end }} {{/* -Azure SSO server URL. +Azure forward auth URL. */}} -{{- define "wonderwall.azure.ssoServerURL" -}} -{{- if not .Values.azure.ssoDomain }} -{{- fail ".Values.azure.ssoDomain is required." }} +{{- define "wonderwall.azure.forwardAuthURL" -}} +{{- if not .Values.azure.forwardAuth.ssoDomain }} +{{- fail ".Values.azure.forwardAuth.ssoDomain is required." }} {{ else }} -{{- printf "https://%s" .Values.azure.ssoDomain }} +{{- printf "https://%s" .Values.azure.forwardAuth.ssoDomain }} {{- end }} {{- end }} diff --git a/charts/wonderwall/templates/fa-azureapp.yaml b/charts/wonderwall/templates/fa-azureapp.yaml index 1bbfc2d..20ac508 100644 --- a/charts/wonderwall/templates/fa-azureapp.yaml +++ b/charts/wonderwall/templates/fa-azureapp.yaml @@ -1,4 +1,4 @@ -{{ if .Values.azure.forwardAuth }} +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} --- apiVersion: nais.io/v1 kind: AzureAdApplication @@ -7,10 +7,10 @@ metadata: labels: {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} spec: - secretName: {{ .Values.azure.clientSecretName }} + secretName: {{ .Values.azure.forwardAuth.clientSecretName }} allowAllUsers: true - logoutUrl: "{{ include "wonderwall.azure.ssoServerURL" . }}/oauth2/logout/frontchannel" + logoutUrl: "{{ include "wonderwall.azure.forwardAuthURL" . }}/oauth2/logout/frontchannel" replyUrls: - - url: "{{- include "wonderwall.azure.ssoServerURL" . }}/oauth2/callback" + - url: "{{- include "wonderwall.azure.forwardAuthURL" . }}/oauth2/callback" tenant: nav.no -{{ end }} +{{- end }} diff --git a/charts/wonderwall/templates/fa-deployment.yaml b/charts/wonderwall/templates/fa-deployment.yaml index 7492310..f823781 100644 --- a/charts/wonderwall/templates/fa-deployment.yaml +++ b/charts/wonderwall/templates/fa-deployment.yaml @@ -1,4 +1,4 @@ -{{- if .Values.azure.forwardAuth -}} +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} apiVersion: apps/v1 kind: Deployment metadata: @@ -63,9 +63,9 @@ spec: name: {{ .Values.azure.redisSecretName }} envFrom: - secretRef: - name: "{{ .Values.azure.clientSecretName }}" + name: "{{ .Values.azure.forwardAuth.clientSecretName }}" - secretRef: - name: "{{ .Values.azure.ssoServerSecretName }}" + name: "{{ .Values.azure.forwardAuth.ssoServerSecretName }}" image: {{ .Values.image.repository }}:{{ .Values.image.tag }} imagePullPolicy: IfNotPresent livenessProbe: diff --git a/charts/wonderwall/templates/fa-horizontalpodautoscaler.yaml b/charts/wonderwall/templates/fa-horizontalpodautoscaler.yaml new file mode 100644 index 0000000..01c42a9 --- /dev/null +++ b/charts/wonderwall/templates/fa-horizontalpodautoscaler.yaml @@ -0,0 +1,22 @@ +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + labels: + {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} + name: {{ include "wonderwall.fullname" . }}-fa +spec: + minReplicas: {{ .Values.azure.forwardAuth.replicasMin }} + maxReplicas: {{ .Values.azure.forwardAuth.replicasMax }} + metrics: + - resource: + name: cpu + target: + averageUtilization: 75 + type: Utilization + type: Resource + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "wonderwall.fullname" . }}-fa +{{- end }} diff --git a/charts/wonderwall/templates/fa-ingress.yaml b/charts/wonderwall/templates/fa-ingress.yaml index 55791d4..d002aee 100644 --- a/charts/wonderwall/templates/fa-ingress.yaml +++ b/charts/wonderwall/templates/fa-ingress.yaml @@ -1,4 +1,4 @@ -{{ if .Values.azure.forwardAuth }} +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} apiVersion: networking.k8s.io/v1 kind: Ingress metadata: @@ -11,9 +11,9 @@ metadata: {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} name: {{ include "wonderwall.fullname" . }}-fa spec: - ingressClassName: {{ .Values.azure.ingressClassName }} + ingressClassName: {{ .Values.azure.forwardAuth.ingressClassName }} rules: - - host: {{ .Values.azure.ssoDomain }} + - host: {{ .Values.azure.forwardAuth.ssoDomain }} http: paths: - backend: @@ -23,4 +23,4 @@ spec: number: 80 path: / pathType: ImplementationSpecific -{{ end }} +{{- end }} diff --git a/charts/wonderwall/templates/fa-poddisruptionbudget.yaml b/charts/wonderwall/templates/fa-poddisruptionbudget.yaml new file mode 100644 index 0000000..4a1b9a1 --- /dev/null +++ b/charts/wonderwall/templates/fa-poddisruptionbudget.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + labels: + {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} + name: {{ include "wonderwall.fullname" . }}-fa +spec: + {{- toYaml .Values.podDisruptionBudget | nindent 2 }} + selector: + matchLabels: + {{- include "wonderwall.selectorLabelsForwardAuth" . | nindent 6 }} +{{- end }} diff --git a/charts/wonderwall/templates/fa-secret.yaml b/charts/wonderwall/templates/fa-secret.yaml index 536e91f..e4dbbc2 100644 --- a/charts/wonderwall/templates/fa-secret.yaml +++ b/charts/wonderwall/templates/fa-secret.yaml @@ -1,28 +1,28 @@ -{{ if .Values.azure.forwardAuth }} +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} --- apiVersion: v1 kind: Secret type: kubernetes.io/Opaque metadata: - name: "{{ .Values.azure.ssoServerSecretName }}" + name: "{{ .Values.azure.forwardAuth.ssoServerSecretName }}" annotations: reloader.stakater.com/match: "true" labels: - {{- include "wonderwall.labels" . | nindent 4 }} + {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} stringData: WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080" WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081" - WONDERWALL_INGRESS: "{{- include "wonderwall.azure.ssoServerURL" . }}" + WONDERWALL_INGRESS: "{{- include "wonderwall.azure.forwardAuthURL" . }}" WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s" WONDERWALL_OPENID_PROVIDER: "azure" WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}" - WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.sessionCookieEncryptionKey | required ".Values.azure.sessionCookieEncryptionKey is required." }}" - WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.sessionMaxLifetime is required." }}" + WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." }}" + WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}" WONDERWALL_SESSION_REFRESH: "false" WONDERWALL_SESSION_REFRESH_AUTO: "false" - WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.ssoDomain | required ".Values.azure.ssoDomain is required." }}" + WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}" WONDERWALL_SSO_ENABLED: "true" WONDERWALL_SSO_MODE: "server" - WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.sessionCookieName | required ".Values.azure.sessionCookieName is required." }}" - WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.ssoDefaultRedirectURL | required ".Values.azure.ssoDefaultRedirectURL is required." }}" -{{ end }} + WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}" + WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}" +{{- end }} diff --git a/charts/wonderwall/templates/fa-service.yaml b/charts/wonderwall/templates/fa-service.yaml index 44d89e2..de539d0 100644 --- a/charts/wonderwall/templates/fa-service.yaml +++ b/charts/wonderwall/templates/fa-service.yaml @@ -1,4 +1,4 @@ -{{ if .Values.azure.forwardAuth }} +{{- if and .Values.azure.enabled .Values.azure.forwardAuth }} apiVersion: v1 kind: Service metadata: @@ -14,4 +14,4 @@ spec: targetPort: http selector: {{- include "wonderwall.selectorLabelsForwardAuth" . | nindent 4 }} -{{ end }} +{{- end }} diff --git a/charts/wonderwall/templates/horizontalpodautoscaler.yaml b/charts/wonderwall/templates/horizontalpodautoscaler.yaml index 78252f0..8367d9b 100644 --- a/charts/wonderwall/templates/horizontalpodautoscaler.yaml +++ b/charts/wonderwall/templates/horizontalpodautoscaler.yaml @@ -1,4 +1,4 @@ -{{ if .Values.idporten.enabled }} +{{- if .Values.idporten.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: @@ -19,4 +19,4 @@ spec: apiVersion: apps/v1 kind: Deployment name: {{ include "wonderwall.fullname" . }}-idporten -{{ end }} +{{- end }} diff --git a/charts/wonderwall/templates/networkpolicy.yaml b/charts/wonderwall/templates/networkpolicy.yaml index 526e49a..e00f0f8 100644 --- a/charts/wonderwall/templates/networkpolicy.yaml +++ b/charts/wonderwall/templates/networkpolicy.yaml @@ -3,7 +3,7 @@ kind: NetworkPolicy metadata: labels: {{- include "wonderwall.labels" . | nindent 4 }} - name: {{ include "wonderwall.fullname" . }}-idporten + name: {{ include "wonderwall.fullname" . }} spec: egress: - to: @@ -36,7 +36,7 @@ spec: kubernetes.io/metadata.name: nais-system podSelector: matchLabels: - nais.io/ingressClass: {{ .Values.azure.ingressClassName }} + nais.io/ingressClass: {{ .Values.azure.forwardAuth.ingressClassName }} - from: - namespaceSelector: matchLabels: diff --git a/charts/wonderwall/templates/poddisruptionbudget.yaml b/charts/wonderwall/templates/poddisruptionbudget.yaml index ccee325..51abca2 100644 --- a/charts/wonderwall/templates/poddisruptionbudget.yaml +++ b/charts/wonderwall/templates/poddisruptionbudget.yaml @@ -1,11 +1,13 @@ +{{- if .Values.idporten.enabled }} apiVersion: policy/v1 kind: PodDisruptionBudget metadata: labels: - {{- include "wonderwall.labels" . | nindent 4 }} - name: {{ include "wonderwall.fullname" . }} + {{- include "wonderwall.labelsIdporten" . | nindent 4 }} + name: {{ include "wonderwall.fullname" . }}-idporten spec: {{- toYaml .Values.podDisruptionBudget | nindent 2 }} selector: matchLabels: - {{- include "wonderwall.selectorLabels" . | nindent 6 }} + {{- include "wonderwall.selectorLabelsIdporten" . | nindent 6 }} +{{- end }} diff --git a/charts/wonderwall/templates/secret.yaml b/charts/wonderwall/templates/secret.yaml index 101e248..254f194 100644 --- a/charts/wonderwall/templates/secret.yaml +++ b/charts/wonderwall/templates/secret.yaml @@ -8,7 +8,7 @@ metadata: annotations: reloader.stakater.com/match: "true" labels: - {{- include "wonderwall.labels" . | nindent 4 }} + {{- include "wonderwall.labelsIdporten" . | nindent 4 }} stringData: WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080" WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081" diff --git a/charts/wonderwall/values.yaml b/charts/wonderwall/values.yaml index cfb7c05..0bae04f 100644 --- a/charts/wonderwall/values.yaml +++ b/charts/wonderwall/values.yaml @@ -12,18 +12,21 @@ aiven: redisPlan: azure: enabled: true - clientSecretName: azure-sso-secret - ingressClassName: nais-ingress-fa redisSecretName: wonderwall-azure-redis-rw - forwardAuth: false - sessionCookieName: forwardauth - # 256 bits key, in standard base64 encoding - sessionCookieEncryptionKey: - ssoDomain: - ssoDefaultRedirectURL: sessionMaxLifetime: 10h sessionRefresh: true - ssoServerSecretName: wonderwall-azure-sso-server + forwardAuth: + enabled: false + replicasMin: 2 + replicasMax: 4 + clientSecretName: azure-sso-server + ingressClassName: nais-ingress-fa + # 256 bits key, in standard base64 encoding + sessionCookieEncryptionKey: + sessionCookieName: forwardauth + ssoDefaultRedirectURL: + ssoDomain: + ssoServerSecretName: wonderwall-azure-sso-server idporten: enabled: true clientAccessTokenLifetime: 3600 @@ -37,7 +40,7 @@ idporten: redisSecretNames: read: wonderwall-idporten-redis-ro readwrite: wonderwall-idporten-redis-rw - replicasMax: 2 + replicasMax: 4 replicasMin: 2 sessionCookieName: # 256 bits key, in standard base64 encoding