diff --git a/charts/wonderwall-forward-auth/templates/deployment.yaml b/charts/wonderwall-forward-auth/templates/deployment.yaml index d44670a..4298655 100644 --- a/charts/wonderwall-forward-auth/templates/deployment.yaml +++ b/charts/wonderwall-forward-auth/templates/deployment.yaml @@ -38,6 +38,55 @@ spec: value: {{ include "wonderwall-forward-auth.fullname" . }} - name: OTEL_EXPORTER_OTLP_ENDPOINT value: {{ .Values.otel.endpoint }} + - name: WONDERWALL_BIND_ADDRESS + value: "0.0.0.0:8080" + - name: WONDERWALL_COOKIE_SAME_SITE + value: "None" + - name: WONDERWALL_METRICS_BIND_ADDRESS + value: "0.0.0.0:8081" + - name: WONDERWALL_INGRESS + value: "https://{{ .Values.sso.domain }}" + - name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD + value: "5s" + - name: WONDERWALL_OPENID_PROVIDER + value: "openid" + - name: WONDERWALL_OPENID_CLIENT_ID + value: "{{ .Values.openid.clientID | required ".Values.openid.clientID is required." }}" + - name: WONDERWALL_OPENID_AUDIENCES + value: "{{ .Values.openid.extraAudience }}" + {{- if .Values.openid.extraScopes }} + - name: WONDERWALL_OPENID_SCOPES + value: "profile,email,offline_access,{{ .Values.openid.extraScopes }}" + {{- else }} + - name: WONDERWALL_OPENID_SCOPES + value: "profile,email,offline_access" + {{- end }} + - name: WONDERWALL_OPENID_WELL_KNOWN_URL + value: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}" + - name: WONDERWALL_REDIS_URI + value: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}" + - name: WONDERWALL_REDIS_USERNAME + value: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}" + - name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT + value: "{{ .Values.valkey.connectionIdleTimeoutSeconds }}" + - name: WONDERWALL_REDIS_TLS + value: "true" + - name: WONDERWALL_SESSION_MAX_LIFETIME + value: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}" + - name: WONDERWALL_SESSION_FORWARD_AUTH + value: "true" + - name: WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS + value: "true" + - name: WONDERWALL_SSO_DOMAIN + value: "{{ .Values.sso.domain | required ".Values.sso.domain is required." }}" + - name: WONDERWALL_SSO_ENABLED + value: "true" + - name: WONDERWALL_SSO_MODE + value: "server" + - name: WONDERWALL_SSO_SESSION_COOKIE_NAME + value: "{{ .Values.session.cookieName | required ".Values.session.cookieName is required." }}" + - name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL + value: "{{ .Values.sso.defaultRedirectURL | required ".Values.sso.defaultRedirectURL is required." }}" envFrom: - secretRef: name: {{ include "wonderwall-forward-auth.fullname" . }} diff --git a/charts/wonderwall-forward-auth/templates/secret.yaml b/charts/wonderwall-forward-auth/templates/secret.yaml index fdf32dc..02ac24c 100644 --- a/charts/wonderwall-forward-auth/templates/secret.yaml +++ b/charts/wonderwall-forward-auth/templates/secret.yaml @@ -6,33 +6,7 @@ metadata: name: {{ include "wonderwall-forward-auth.fullname" . }} labels: {{- include "wonderwall-forward-auth.labels" . | nindent 4 }} -stringData: - WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080" - WONDERWALL_COOKIE_SAME_SITE: "None" - WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081" - WONDERWALL_INGRESS: "https://{{ .Values.sso.domain }}" - WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s" - WONDERWALL_OPENID_PROVIDER: "openid" - WONDERWALL_OPENID_CLIENT_ID: "{{ .Values.openid.clientID | required ".Values.openid.clientID is required." }}" - WONDERWALL_OPENID_CLIENT_SECRET: "{{ .Values.openid.clientSecret | required ".Values.openid.clientSecret is required." }}" - WONDERWALL_OPENID_AUDIENCES: "{{ .Values.openid.extraAudience }}" - {{ if .Values.openid.extraScopes }} - WONDERWALL_OPENID_SCOPES: "profile,email,offline_access,{{ .Values.openid.extraScopes }}" - {{ else }} - WONDERWALL_OPENID_SCOPES: "profile,email,offline_access" - {{ end }} - WONDERWALL_OPENID_WELL_KNOWN_URL: "{{ .Values.openid.wellKnownURL | required ".Values.openid.wellKnownURL is required." }}" - WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." }}" - WONDERWALL_REDIS_URI: "rediss://{{ .Values.valkey.host | required ".Values.valkey.host is required." }}:{{ .Values.valkey.port | required ".Values.valkey.port is required." }}" - WONDERWALL_REDIS_USERNAME: "{{ .Values.valkey.username | required ".Values.valkey.username is required." }}" - WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." }}" - WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.valkey.connectionIdleTimeoutSeconds }}" - WONDERWALL_REDIS_TLS: "true" - WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.session.maxLifetime | required ".Values.session.maxLifetime is required." }}" - WONDERWALL_SESSION_FORWARD_AUTH: "true" - WONDERWALL_SESSION_FORWARD_AUTH_SET_HEADERS: "true" - WONDERWALL_SSO_DOMAIN: "{{ .Values.sso.domain | required ".Values.sso.domain is required." }}" - WONDERWALL_SSO_ENABLED: "true" - WONDERWALL_SSO_MODE: "server" - WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.session.cookieName | required ".Values.session.cookieName is required." }}" - WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.sso.defaultRedirectURL | required ".Values.sso.defaultRedirectURL is required." }}" +data: + WONDERWALL_OPENID_CLIENT_SECRET: "{{ .Values.openid.clientSecret | required ".Values.openid.clientSecret is required." | b64enc }}" + WONDERWALL_ENCRYPTION_KEY: "{{ .Values.session.cookieEncryptionKey | required ".Values.session.cookieEncryptionKey is required." | b64enc }}" + WONDERWALL_REDIS_PASSWORD: "{{ .Values.valkey.password | required ".Values.valkey.password is required." | b64enc }}" diff --git a/charts/wonderwall/templates/fa-deployment.yaml b/charts/wonderwall/templates/fa-deployment.yaml index b389d66..d6f7658 100644 --- a/charts/wonderwall/templates/fa-deployment.yaml +++ b/charts/wonderwall/templates/fa-deployment.yaml @@ -40,6 +40,38 @@ spec: weight: 10 containers: - env: + - name: OTEL_SERVICE_NAME + value: wonderwall-fa + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: {{ .Values.otel.endpoint }} + - name: WONDERWALL_BIND_ADDRESS + value: "0.0.0.0:8080" + - name: WONDERWALL_COOKIE_SAME_SITE + value: "None" + - name: WONDERWALL_METRICS_BIND_ADDRESS + value: "0.0.0.0:8081" + - name: WONDERWALL_INGRESS + value: "{{- include "wonderwall.azure.forwardAuthURL" . }}" + - name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD + value: "5s" + - name: WONDERWALL_OPENID_PROVIDER + value: "azure" + - name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT + value: "{{ .Values.redis.connectionIdleTimeout }}" + - name: WONDERWALL_SESSION_MAX_LIFETIME + value: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}" + - name: WONDERWALL_SESSION_FORWARD_AUTH + value: "true" + - name: WONDERWALL_SSO_DOMAIN + value: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}" + - name: WONDERWALL_SSO_ENABLED + value: "true" + - name: WONDERWALL_SSO_MODE + value: "server" + - name: WONDERWALL_SSO_SESSION_COOKIE_NAME + value: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}" + - name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL + value: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}" - name: WONDERWALL_REDIS_URI valueFrom: secretKeyRef: @@ -49,10 +81,6 @@ spec: key: REDIS_URI_WONDERWALL_AZURE {{- end }} name: {{ .Values.azure.redisSecretName }} - - name: OTEL_SERVICE_NAME - value: wonderwall-fa - - name: OTEL_EXPORTER_OTLP_ENDPOINT - value: {{ .Values.otel.endpoint }} - name: WONDERWALL_REDIS_USERNAME valueFrom: secretKeyRef: diff --git a/charts/wonderwall/templates/fa-secret.yaml b/charts/wonderwall/templates/fa-secret.yaml index 1e6606f..26e885b 100644 --- a/charts/wonderwall/templates/fa-secret.yaml +++ b/charts/wonderwall/templates/fa-secret.yaml @@ -9,20 +9,6 @@ metadata: reloader.stakater.com/match: "true" labels: {{- include "wonderwall.labelsForwardAuth" . | nindent 4 }} -stringData: - WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080" - WONDERWALL_COOKIE_SAME_SITE: "None" - WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081" - WONDERWALL_INGRESS: "{{- include "wonderwall.azure.forwardAuthURL" . }}" - WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s" - WONDERWALL_OPENID_PROVIDER: "azure" - WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}" - WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." }}" - WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.azure.sessionMaxLifetime | required ".Values.azure.forwardAuth.sessionMaxLifetime is required." }}" - WONDERWALL_SESSION_FORWARD_AUTH: "true" - WONDERWALL_SSO_DOMAIN: "{{ .Values.azure.forwardAuth.ssoDomain | required ".Values.azure.forwardAuth.ssoDomain is required." }}" - WONDERWALL_SSO_ENABLED: "true" - WONDERWALL_SSO_MODE: "server" - WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.azure.forwardAuth.sessionCookieName | required ".Values.azure.forwardAuth.sessionCookieName is required." }}" - WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.azure.forwardAuth.ssoDefaultRedirectURL | required ".Values.azure.forwardAuth.ssoDefaultRedirectURL is required." }}" +data: + WONDERWALL_ENCRYPTION_KEY: "{{ .Values.azure.forwardAuth.sessionCookieEncryptionKey | required ".Values.azure.forwardAuth.sessionCookieEncryptionKey is required." | b64enc }}" {{- end }} diff --git a/charts/wonderwall/templates/idporten-deployment.yaml b/charts/wonderwall/templates/idporten-deployment.yaml index f8c5933..cf23e38 100644 --- a/charts/wonderwall/templates/idporten-deployment.yaml +++ b/charts/wonderwall/templates/idporten-deployment.yaml @@ -48,6 +48,48 @@ spec: weight: 10 containers: - env: + - name: OTEL_SERVICE_NAME + value: wonderwall-idporten + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: {{ .Values.otel.endpoint }} + - name: WONDERWALL_BIND_ADDRESS + value: "0.0.0.0:8080" + - name: WONDERWALL_METRICS_BIND_ADDRESS + value: "0.0.0.0:8081" + - name: WONDERWALL_INGRESS + value: "{{- include "wonderwall.idporten.ssoServerURL" . }}" + - name: WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD + value: "5s" + - name: WONDERWALL_LEGACY_COOKIE + value: "{{ .Values.idporten.legacyCookie }}" + - name: WONDERWALL_OPENID_ACR_VALUES + value: "{{ .Values.idporten.openidAcrValues | required ".Values.idporten.openidAcrValues is required." }}" + - name: WONDERWALL_OPENID_LOCALE + value: "{{ .Values.idporten.openidLocale | required ".Values.idporten.openidLocale is required." }}" + - name: WONDERWALL_OPENID_POST_LOGOUT_REDIRECT_URI + value: "{{ .Values.idporten.openidPostLogoutRedirectURL | required ".Values.idporten.postLogoutRedirectURL is required." }}" + - name: WONDERWALL_OPENID_PROVIDER + value: "idporten" + - name: WONDERWALL_OPENID_RESOURCE_INDICATOR + value: "{{ .Values.idporten.openidResourceIndicator | required ".Values.idporten.openidResourceIndicator is required." }}" + - name: WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT + value: "{{ .Values.redis.connectionIdleTimeout }}" + - name: WONDERWALL_SESSION_INACTIVITY + value: "{{ .Values.idporten.sessionInactivity | required ".Values.idporten.sessionInactivity is required." }}" + - name: WONDERWALL_SESSION_INACTIVITY_TIMEOUT + value: "{{ .Values.idporten.sessionInactivityTimeout | required ".Values.idporten.sessionInactivityTimeout is required." }}" + - name: WONDERWALL_SESSION_MAX_LIFETIME + value: "{{ .Values.idporten.sessionMaxLifetime | required ".Values.idporten.sessionMaxLifetime is required." }}" + - name: WONDERWALL_SSO_DOMAIN + value: "{{ .Values.idporten.ssoDomain | required ".Values.idporten.ssoDomain is required." }}" + - name: WONDERWALL_SSO_ENABLED + value: "true" + - name: WONDERWALL_SSO_MODE + value: "server" + - name: WONDERWALL_SSO_SESSION_COOKIE_NAME + value: "{{ .Values.idporten.sessionCookieName | required ".Values.idporten.sessionCookieName is required." }}" + - name: WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL + value: "{{ .Values.idporten.ssoDefaultRedirectURL | required ".Values.idporten.ssoDefaultRedirectURL is required." }}" - name: WONDERWALL_REDIS_URI valueFrom: secretKeyRef: @@ -57,10 +99,6 @@ spec: key: REDIS_URI_WONDERWALL_IDPORTEN {{- end }} name: {{ .Values.idporten.redisSecretNames.readwrite }} - - name: OTEL_SERVICE_NAME - value: wonderwall-idporten - - name: OTEL_EXPORTER_OTLP_ENDPOINT - value: {{ .Values.otel.endpoint }} - name: WONDERWALL_REDIS_USERNAME valueFrom: secretKeyRef: diff --git a/charts/wonderwall/templates/idporten-secret.yaml b/charts/wonderwall/templates/idporten-secret.yaml index 211f849..4a4bfc2 100644 --- a/charts/wonderwall/templates/idporten-secret.yaml +++ b/charts/wonderwall/templates/idporten-secret.yaml @@ -9,25 +9,6 @@ metadata: reloader.stakater.com/match: "true" labels: {{- include "wonderwall.labelsIdporten" . | nindent 4 }} -stringData: - WONDERWALL_BIND_ADDRESS: "0.0.0.0:8080" - WONDERWALL_METRICS_BIND_ADDRESS: "0.0.0.0:8081" - WONDERWALL_INGRESS: "{{- include "wonderwall.idporten.ssoServerURL" . }}" - WONDERWALL_SHUTDOWN_WAIT_BEFORE_PERIOD: "5s" - WONDERWALL_LEGACY_COOKIE: "{{ .Values.idporten.legacyCookie }}" - WONDERWALL_OPENID_ACR_VALUES: "{{ .Values.idporten.openidAcrValues | required ".Values.idporten.openidAcrValues is required." }}" - WONDERWALL_OPENID_LOCALE: "{{ .Values.idporten.openidLocale | required ".Values.idporten.openidLocale is required." }}" - WONDERWALL_OPENID_POST_LOGOUT_REDIRECT_URI: "{{ .Values.idporten.openidPostLogoutRedirectURL | required ".Values.idporten.postLogoutRedirectURL is required." }}" - WONDERWALL_OPENID_PROVIDER: "idporten" - WONDERWALL_OPENID_RESOURCE_INDICATOR: "{{ .Values.idporten.openidResourceIndicator | required ".Values.idporten.openidResourceIndicator is required." }}" - WONDERWALL_REDIS_CONNECTION_IDLE_TIMEOUT: "{{ .Values.redis.connectionIdleTimeout }}" - WONDERWALL_ENCRYPTION_KEY: "{{ .Values.idporten.sessionCookieEncryptionKey | required ".Values.idporten.sessionCookieEncryptionKey is required." }}" - WONDERWALL_SESSION_INACTIVITY: "{{ .Values.idporten.sessionInactivity | required ".Values.idporten.sessionInactivity is required." }}" - WONDERWALL_SESSION_INACTIVITY_TIMEOUT: "{{ .Values.idporten.sessionInactivityTimeout | required ".Values.idporten.sessionInactivityTimeout is required." }}" - WONDERWALL_SESSION_MAX_LIFETIME: "{{ .Values.idporten.sessionMaxLifetime | required ".Values.idporten.sessionMaxLifetime is required." }}" - WONDERWALL_SSO_DOMAIN: "{{ .Values.idporten.ssoDomain | required ".Values.idporten.ssoDomain is required." }}" - WONDERWALL_SSO_ENABLED: "true" - WONDERWALL_SSO_MODE: "server" - WONDERWALL_SSO_SESSION_COOKIE_NAME: "{{ .Values.idporten.sessionCookieName | required ".Values.idporten.sessionCookieName is required." }}" - WONDERWALL_SSO_SERVER_DEFAULT_REDIRECT_URL: "{{ .Values.idporten.ssoDefaultRedirectURL | required ".Values.idporten.ssoDefaultRedirectURL is required." }}" +data: + WONDERWALL_ENCRYPTION_KEY: "{{ .Values.idporten.sessionCookieEncryptionKey | required ".Values.idporten.sessionCookieEncryptionKey is required." | b64enc }}" {{ end }}