mirror of
https://github.com/nais/wonderwall.git
synced 2026-08-23 21:16:14 +00:00
refactor(charts): move non-secret configuration to deployment
Also converts secrets to use data instead of stringData to avoid stale keys being kept, due to server-side apply merging stringData with existing data instead of overwriting (i.e. removing unset keys).
This commit is contained in:
Trong Huu Nguyen
@@ -38,6 +38,55 @@ spec:
|
||||
value: {{ include "wonderwall-forward-auth.fullname" . }}
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.otel.endpoint }}
|
||||
- name: WONDERWALL_BIND_ADDRESS
|
||||
value: "0.0.0.0:8080"
|
||||
- name: WONDERWALL_COOKIE_SAME_SITE
|
||||
value: "None"
|
||||
- name: WONDERWALL_METRICS_BIND_ADDRESS
|
||||
value: "0.0.0.0:8081"
|
||||
- name: WONDERWALL_INGRESS
|
||||
value: "https://{{ .Values.sso.domain }}"
|
||||
- name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD
|
||||
value: "5s"
|
||||
- name: WONDERWALL_OPENID_PROVIDER
|
||||
value: "openid"
|
||||
- name: WONDERWALL_OPENID_CLIENT_ID
|
||||
value: "{{ .Values.openid.clientID | required ".Values.openid.clientID is required." }}"
|
||||
- name: WONDERWALL_OPENID_AUDIENCES
|
||||
value: "{{ .Values.openid.extraAudience }}"
|
||||
{{- if .Values.openid.extraScopes }}
|
||||
- name: WONDERWALL_OPENID_SCOPES
|
||||
value: "profile,email,offline_access,{{ .Values.openid.extraScopes }}"
|
||||
{{- else }}
|
||||
- name: WONDERWALL_OPENID_SCOPES
|
||||
value: "profile,email,offline_access"
|
||||
{{- end }}
|
||||
- name: WONDERWALL_OPENID_WELL_KNOWN_URL
|
||||
value: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}"
|
||||
- name: WONDERWALL_REDIS_URI
|
||||
value: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}"
|
||||
- name: WONDERWALL_REDIS_USERNAME
|
||||
value: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}"
|
||||
- name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT
|
||||
value: "{{ .Values.valkey.connectionIdleTimeoutSeconds }}"
|
||||
- name: WONDERWALL_REDIS_TLS
|
||||
value: "true"
|
||||
- name: WONDERWALL_SESSION_MAX_LIFETIME
|
||||
value: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}"
|
||||
- name: WONDERWALL_SESSION_FORWARD_AUTH
|
||||
value: "true"
|
||||
- name: WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS
|
||||
value: "true"
|
||||
- name: WONDERWALL_SSO_DOMAIN
|
||||
value: "{{ .Values.sso.domain | required ".Values.sso.domain is required." }}"
|
||||
- name: WONDERWALL_SSO_ENABLED
|
||||
value: "true"
|
||||
- name: WONDERWALL_SSO_MODE
|
||||
value: "server"
|
||||
- name: WONDERWALL_SSO_SESSION_COOKIE_NAME
|
||||
value: "{{ .Values.session.cookieName | required ".Values.session.cookieName is required." }}"
|
||||
- name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL
|
||||
value: "{{ .Values.sso.defaultRedirectURL | required ".Values.sso.defaultRedirectURL is required." }}"
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: {{ include "wonderwall-forward-auth.fullname" . }}
|
||||
|
||||
@@ -6,33 +6,7 @@ metadata:
|
||||
name: {{ include "wonderwall-forward-auth.fullname" . }}
|
||||
labels:
|
||||
{{- include "wonderwall-forward-auth.labels" . | nindent 4 }}
|
||||
stringData:
|
||||
WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080"
|
||||
WONDERWALL_COOKIE_SAME_SITE: "None"
|
||||
WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081"
|
||||
WONDERWALL_INGRESS: "https://{{ .Values.sso.domain }}"
|
||||
WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s"
|
||||
WONDERWALL_OPENID_PROVIDER: "openid"
|
||||
WONDERWALL_OPENID_CLIENT_ID: "{{ .Values.openid.clientID | required ".Values.openid.clientID is required." }}"
|
||||
WONDERWALL_OPENID_CLIENT_SECRET: "{{ .Values.openid.clientSecret | required ".Values.openid.clientSecret is required." }}"
|
||||
WONDERWALL_OPENID_AUDIENCES: "{{ .Values.openid.extraAudience }}"
|
||||
{{ if .Values.openid.extraScopes }}
|
||||
WONDERWALL_OPENID_SCOPES: "profile,email,offline_access,{{ .Values.openid.extraScopes }}"
|
||||
{{ else }}
|
||||
WONDERWALL_OPENID_SCOPES: "profile,email,offline_access"
|
||||
{{ end }}
|
||||
WONDERWALL_OPENID_WELL_KNOWN_URL: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}"
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." }}"
|
||||
WONDERWALL_REDIS_URI: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}"
|
||||
WONDERWALL_REDIS_USERNAME: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}"
|
||||
WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." }}"
|
||||
WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.valkey.connectionIdleTimeoutSeconds }}"
|
||||
WONDERWALL_REDIS_TLS: "true"
|
||||
WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}"
|
||||
WONDERWALL_SESSION_FORWARD_AUTH: "true"
|
||||
WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS: "true"
|
||||
WONDERWALL_SSO_DOMAIN: "{{ .Values.sso.domain | required ".Values.sso.domain is required." }}"
|
||||
WONDERWALL_SSO_ENABLED: "true"
|
||||
WONDERWALL_SSO_MODE: "server"
|
||||
WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.session.cookieName | required ".Values.session.cookieName is required." }}"
|
||||
WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.sso.defaultRedirectURL | required ".Values.sso.defaultRedirectURL is required." }}"
|
||||
data:
|
||||
WONDERWALL_OPENID_CLIENT_SECRET: "{{ .Values.openid.clientSecret | required ".Values.openid.clientSecret is required." | b64enc }}"
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." | b64enc }}"
|
||||
WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." | b64enc }}"
|
||||
|
||||
@@ -40,6 +40,38 @@ spec:
|
||||
weight: 10
|
||||
containers:
|
||||
- env:
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: wonderwall-fa
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.otel.endpoint }}
|
||||
- name: WONDERWALL_BIND_ADDRESS
|
||||
value: "0.0.0.0:8080"
|
||||
- name: WONDERWALL_COOKIE_SAME_SITE
|
||||
value: "None"
|
||||
- name: WONDERWALL_METRICS_BIND_ADDRESS
|
||||
value: "0.0.0.0:8081"
|
||||
- name: WONDERWALL_INGRESS
|
||||
value: "{{- include "wonderwall.azure.forwardAuthURL" . }}"
|
||||
- name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD
|
||||
value: "5s"
|
||||
- name: WONDERWALL_OPENID_PROVIDER
|
||||
value: "azure"
|
||||
- name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT
|
||||
value: "{{ .Values.redis.connectionIdleTimeout }}"
|
||||
- name: WONDERWALL_SESSION_MAX_LIFETIME
|
||||
value: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}"
|
||||
- name: WONDERWALL_SESSION_FORWARD_AUTH
|
||||
value: "true"
|
||||
- name: WONDERWALL_SSO_DOMAIN
|
||||
value: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}"
|
||||
- name: WONDERWALL_SSO_ENABLED
|
||||
value: "true"
|
||||
- name: WONDERWALL_SSO_MODE
|
||||
value: "server"
|
||||
- name: WONDERWALL_SSO_SESSION_COOKIE_NAME
|
||||
value: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}"
|
||||
- name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL
|
||||
value: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}"
|
||||
- name: WONDERWALL_REDIS_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -49,10 +81,6 @@ spec:
|
||||
key: REDIS_URI_WONDERWALL_AZURE
|
||||
{{- end }}
|
||||
name: {{ .Values.azure.redisSecretName }}
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: wonderwall-fa
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.otel.endpoint }}
|
||||
- name: WONDERWALL_REDIS_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
|
||||
@@ -9,20 +9,6 @@ metadata:
|
||||
reloader.stakater.com/match: "true"
|
||||
labels:
|
||||
{{- include "wonderwall.labelsForwardAuth" . | nindent 4 }}
|
||||
stringData:
|
||||
WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080"
|
||||
WONDERWALL_COOKIE_SAME_SITE: "None"
|
||||
WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081"
|
||||
WONDERWALL_INGRESS: "{{- include "wonderwall.azure.forwardAuthURL" . }}"
|
||||
WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s"
|
||||
WONDERWALL_OPENID_PROVIDER: "azure"
|
||||
WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}"
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." }}"
|
||||
WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}"
|
||||
WONDERWALL_SESSION_FORWARD_AUTH: "true"
|
||||
WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}"
|
||||
WONDERWALL_SSO_ENABLED: "true"
|
||||
WONDERWALL_SSO_MODE: "server"
|
||||
WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}"
|
||||
WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}"
|
||||
data:
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." | b64enc }}"
|
||||
{{- end }}
|
||||
|
||||
@@ -48,6 +48,48 @@ spec:
|
||||
weight: 10
|
||||
containers:
|
||||
- env:
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: wonderwall-idporten
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.otel.endpoint }}
|
||||
- name: WONDERWALL_BIND_ADDRESS
|
||||
value: "0.0.0.0:8080"
|
||||
- name: WONDERWALL_METRICS_BIND_ADDRESS
|
||||
value: "0.0.0.0:8081"
|
||||
- name: WONDERWALL_INGRESS
|
||||
value: "{{- include "wonderwall.idporten.ssoServerURL" . }}"
|
||||
- name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD
|
||||
value: "5s"
|
||||
- name: WONDERWALL_LEGACY_COOKIE
|
||||
value: "{{ .Values.idporten.legacyCookie }}"
|
||||
- name: WONDERWALL_OPENID_ACR_VALUES
|
||||
value: "{{ .Values.idporten.openidAcrValues | required ".Values.idporten.openidAcrValues is required." }}"
|
||||
- name: WONDERWALL_OPENID_LOCALE
|
||||
value: "{{ .Values.idporten.openidLocale | required ".Values.idporten.openidLocale is required." }}"
|
||||
- name: WONDERWALL_OPENID_POST_LOGOUT_REDIRECT_URI
|
||||
value: "{{ .Values.idporten.openidPostLogoutRedirectURL | required ".Values.idporten.postLogoutRedirectURL is required." }}"
|
||||
- name: WONDERWALL_OPENID_PROVIDER
|
||||
value: "idporten"
|
||||
- name: WONDERWALL_OPENID_RESOURCE_INDICATOR
|
||||
value: "{{ .Values.idporten.openidResourceIndicator | required ".Values.idporten.openidResourceIndicator is required." }}"
|
||||
- name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT
|
||||
value: "{{ .Values.redis.connectionIdleTimeout }}"
|
||||
- name: WONDERWALL_SESSION_INACTIVITY
|
||||
value: "{{ .Values.idporten.sessionInactivity | required ".Values.idporten.sessionInactivity is required." }}"
|
||||
- name: WONDERWALL_SESSION_INACTIVITY_TIMEOUT
|
||||
value: "{{ .Values.idporten.sessionInactivityTimeout | required ".Values.idporten.sessionInactivityTimeout is required." }}"
|
||||
- name: WONDERWALL_SESSION_MAX_LIFETIME
|
||||
value: "{{ .Values.idporten.sessionMaxLifetime | required ".Values.idporten.sessionMaxLifetime is required." }}"
|
||||
- name: WONDERWALL_SSO_DOMAIN
|
||||
value: "{{ .Values.idporten.ssoDomain | required ".Values.idporten.ssoDomain is required." }}"
|
||||
- name: WONDERWALL_SSO_ENABLED
|
||||
value: "true"
|
||||
- name: WONDERWALL_SSO_MODE
|
||||
value: "server"
|
||||
- name: WONDERWALL_SSO_SESSION_COOKIE_NAME
|
||||
value: "{{ .Values.idporten.sessionCookieName | required ".Values.idporten.sessionCookieName is required." }}"
|
||||
- name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL
|
||||
value: "{{ .Values.idporten.ssoDefaultRedirectURL | required ".Values.idporten.ssoDefaultRedirectURL is required." }}"
|
||||
- name: WONDERWALL_REDIS_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -57,10 +99,6 @@ spec:
|
||||
key: REDIS_URI_WONDERWALL_IDPORTEN
|
||||
{{- end }}
|
||||
name: {{ .Values.idporten.redisSecretNames.readwrite }}
|
||||
- name: OTEL_SERVICE_NAME
|
||||
value: wonderwall-idporten
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: {{ .Values.otel.endpoint }}
|
||||
- name: WONDERWALL_REDIS_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
|
||||
@@ -9,25 +9,6 @@ metadata:
|
||||
reloader.stakater.com/match: "true"
|
||||
labels:
|
||||
{{- include "wonderwall.labelsIdporten" . | nindent 4 }}
|
||||
stringData:
|
||||
WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080"
|
||||
WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081"
|
||||
WONDERWALL_INGRESS: "{{- include "wonderwall.idporten.ssoServerURL" . }}"
|
||||
WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s"
|
||||
WONDERWALL_LEGACY_COOKIE: "{{ .Values.idporten.legacyCookie }}"
|
||||
WONDERWALL_OPENID_ACR_VALUES: "{{ .Values.idporten.openidAcrValues | required ".Values.idporten.openidAcrValues is required." }}"
|
||||
WONDERWALL_OPENID_LOCALE: "{{ .Values.idporten.openidLocale | required ".Values.idporten.openidLocale is required." }}"
|
||||
WONDERWALL_OPENID_POST_LOGOUT_REDIRECT_URI: "{{ .Values.idporten.openidPostLogoutRedirectURL | required ".Values.idporten.postLogoutRedirectURL is required." }}"
|
||||
WONDERWALL_OPENID_PROVIDER: "idporten"
|
||||
WONDERWALL_OPENID_RESOURCE_INDICATOR: "{{ .Values.idporten.openidResourceIndicator | required ".Values.idporten.openidResourceIndicator is required." }}"
|
||||
WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}"
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.idporten.sessionCookieEncryptionKey | required ".Values.idporten.sessionCookieEncryptionKey is required." }}"
|
||||
WONDERWALL_SESSION_INACTIVITY: "{{ .Values.idporten.sessionInactivity | required ".Values.idporten.sessionInactivity is required." }}"
|
||||
WONDERWALL_SESSION_INACTIVITY_TIMEOUT: "{{ .Values.idporten.sessionInactivityTimeout | required ".Values.idporten.sessionInactivityTimeout is required." }}"
|
||||
WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.idporten.sessionMaxLifetime | required ".Values.idporten.sessionMaxLifetime is required." }}"
|
||||
WONDERWALL_SSO_DOMAIN: "{{ .Values.idporten.ssoDomain | required ".Values.idporten.ssoDomain is required." }}"
|
||||
WONDERWALL_SSO_ENABLED: "true"
|
||||
WONDERWALL_SSO_MODE: "server"
|
||||
WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.idporten.sessionCookieName | required ".Values.idporten.sessionCookieName is required." }}"
|
||||
WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.idporten.ssoDefaultRedirectURL | required ".Values.idporten.ssoDefaultRedirectURL is required." }}"
|
||||
data:
|
||||
WONDERWALL_ENCRYPTION_KEY: "{{ .Values.idporten.sessionCookieEncryptionKey | required ".Values.idporten.sessionCookieEncryptionKey is required." | b64enc }}"
|
||||
{{ end }}
|
||||
|
||||
Reference in New Issue
Block a user