diff --git a/charts/wonderwall-forward-auth/Chart.lock b/charts/wonderwall-forward-auth/Chart.lock deleted file mode 100644 index b1dded2..0000000 --- a/charts/wonderwall-forward-auth/Chart.lock +++ /dev/null @@ -1,6 +0,0 @@ -dependencies: -- name: valkey - repository: https://charts.bitnami.com/bitnami - version: 3.0.7 -digest: sha256:d6621585cb66ddc9802c7a6303b20a33a5970aeaaaf57ee9b45d1cbd9f7a7b27 -generated: "2025-05-20T14:28:10.651543+02:00" diff --git a/charts/wonderwall-forward-auth/Chart.yaml b/charts/wonderwall-forward-auth/Chart.yaml index 105fd6e..8cee6d1 100644 --- a/charts/wonderwall-forward-auth/Chart.yaml +++ b/charts/wonderwall-forward-auth/Chart.yaml @@ -5,7 +5,3 @@ type: application version: 1.0.0 sources: - https://github.com/nais/wonderwall/tree/master/charts/wonderwall-forward-auth -dependencies: - - name: valkey - version: 3.0.7 - repository: https://charts.bitnami.com/bitnami diff --git a/charts/wonderwall-forward-auth/Feature.yaml b/charts/wonderwall-forward-auth/Feature.yaml index 95beed7..217c927 100644 --- a/charts/wonderwall-forward-auth/Feature.yaml +++ b/charts/wonderwall-forward-auth/Feature.yaml @@ -1,6 +1,8 @@ environmentKinds: - management -timeout: "1800s" +dependencies: + - allOf: + - nais-netpols-management values: openid.clientID: computed: @@ -41,3 +43,19 @@ values: computed: template: | {{ printf "https://%s" (subdomain . "console") | quote }} + valkey.host: + computed: + template: | + {{ .Env.wonderwall_forward_auth_valkey_host | quote }} + valkey.port: + computed: + template: | + {{ .Env.wonderwall_forward_auth_valkey_port | quote }} + valkey.username: + computed: + template: | + {{ .Env.wonderwall_forward_auth_valkey_username | quote }} + valkey.password: + computed: + template: | + {{ .Env.wonderwall_forward_auth_valkey_password | quote }} diff --git a/charts/wonderwall-forward-auth/templates/deployment.yaml b/charts/wonderwall-forward-auth/templates/deployment.yaml index 53aa61b..d44670a 100644 --- a/charts/wonderwall-forward-auth/templates/deployment.yaml +++ b/charts/wonderwall-forward-auth/templates/deployment.yaml @@ -2,8 +2,6 @@ apiVersion: apps/v1 kind: Deployment metadata: - annotations: - reloader.stakater.com/search: "true" labels: {{- include "wonderwall-forward-auth.labels" . | nindent 4 }} name: {{ include "wonderwall-forward-auth.fullname" . }} @@ -18,8 +16,8 @@ spec: kubectl.kubernetes.io/default-container: {{ include "wonderwall-forward-auth.fullname" . }} checksum/secret: {{ pick ( include (print $.Template.BasePath "/secret.yaml") . | fromYaml ) "data" | toYaml | sha256sum }} labels: + aiven: enabled {{- include "wonderwall-forward-auth.labels" . | nindent 8 }} - {{ printf "%s-client" .Values.valkey.fullnameOverride }}: "true" name: {{ include "wonderwall-forward-auth.fullname" . }} spec: affinity: @@ -40,11 +38,6 @@ spec: value: {{ include "wonderwall-forward-auth.fullname" . }} - name: OTEL_EXPORTER_OTLP_ENDPOINT value: {{ .Values.otel.endpoint }} - - name: WONDERWALL_REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.valkey.fullnameOverride }} - key: "valkey-password" envFrom: - secretRef: name: {{ include "wonderwall-forward-auth.fullname" . }} diff --git a/charts/wonderwall-forward-auth/templates/networkpolicy.yaml b/charts/wonderwall-forward-auth/templates/networkpolicy.yaml index 6a480ff..fca7e2c 100644 --- a/charts/wonderwall-forward-auth/templates/networkpolicy.yaml +++ b/charts/wonderwall-forward-auth/templates/networkpolicy.yaml @@ -21,21 +21,11 @@ spec: podSelector: matchLabels: nais.io/ingressClass: {{ .Values.ingressClassName }} - egress: - - to: - - namespaceSelector: - matchLabels: - kubernetes.io/metadata.name: nais-system - podSelector: - matchLabels: - app.kubernetes.io/instance: {{ .Release.Name }} - app.kubernetes.io/name: valkey podSelector: matchLabels: {{- include "wonderwall-forward-auth.selectorLabels" . | nindent 6 }} policyTypes: - Ingress - - Egress {{- if .Capabilities.APIVersions.Has "networking.gke.io/v1alpha3" }} --- apiVersion: networking.gke.io/v1alpha3 diff --git a/charts/wonderwall-forward-auth/templates/prometheusrule.yaml b/charts/wonderwall-forward-auth/templates/prometheusrule.yaml index b0491c6..34d9696 100644 --- a/charts/wonderwall-forward-auth/templates/prometheusrule.yaml +++ b/charts/wonderwall-forward-auth/templates/prometheusrule.yaml @@ -18,7 +18,7 @@ spec: consequence: This probably means that end-users are having trouble with authentication. action: | * Check the logs and metrics in the dashboard - * Check the Valkey instance in the cluster + * Check Aiven Valkey (session store) and verify Aiven network connectivity * Check the Zitadel dashboard: dashboard_url: "https://monitoring.nais.io/d/ben86a369fj7kd?var-tenant={{ .Values.fasit.tenant.name }}" labels: diff --git a/charts/wonderwall-forward-auth/templates/secret.yaml b/charts/wonderwall-forward-auth/templates/secret.yaml index ebb184a..4750996 100644 --- a/charts/wonderwall-forward-auth/templates/secret.yaml +++ b/charts/wonderwall-forward-auth/templates/secret.yaml @@ -4,8 +4,6 @@ kind: Secret type: kubernetes.io/Opaque metadata: name: {{ include "wonderwall-forward-auth.fullname" . }} - annotations: - reloader.stakater.com/match: "true" labels: {{- include "wonderwall-forward-auth.labels" . | nindent 4 }} stringData: @@ -25,9 +23,10 @@ stringData: {{ end }} WONDERWALL_OPENID_WELL_KNOWN_URL: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}" WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." }}" - WONDERWALL_REDIS_URI: "redis://{{ .Values.valkey.fullnameOverride }}-primary:6379" - WONDERWALL_REDIS_USERNAME: "default" - WONDERWALL_REDIS_TLS: "false" + WONDERWALL_REDIS_URI: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}" + WONDERWALL_REDIS_USERNAME: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}" + WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." }}" + WONDERWALL_REDIS_TLS: "true" WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}" WONDERWALL_SESSION_FORWARD_AUTH: "true" WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS: "true" diff --git a/charts/wonderwall-forward-auth/values.yaml b/charts/wonderwall-forward-auth/values.yaml index 20a88c6..359b809 100644 --- a/charts/wonderwall-forward-auth/values.yaml +++ b/charts/wonderwall-forward-auth/values.yaml @@ -42,13 +42,7 @@ sso: domain: valkey: - fullnameOverride: "wonderwall-forward-auth-valkey" - architecture: "standalone" - primary: - resourcesPreset: "medium" - persistence: - enabled: false - networkPolicy: - enabled: true - allowExternal: false - allowExternalEgress: false + host: + port: + username: + password: