From 12724e8309ceb435c1d8e456b97d1c7b30243db9 Mon Sep 17 00:00:00 2001
From: yasarm <mohamed.yasar@philips.com>
Date: Tue, 7 Mar 2023 14:55:31 +0530
Subject: [PATCH 1/6] draft

---
 helm/hsd-oauth-proxy/.helmignore              |  23 ++++
 helm/hsd-oauth-proxy/Chart.yaml               |  24 ++++
 helm/hsd-oauth-proxy/templates/NOTES.txt      |  22 +++
 helm/hsd-oauth-proxy/templates/_helpers.tpl   |  62 +++++++++
 .../hsd-oauth-proxy/templates/deployment.yaml |  75 ++++++++++
 helm/hsd-oauth-proxy/templates/hpa.yaml       |  28 ++++
 .../templates/hsd-oauth-env-cm.yaml           |  42 ++++++
 helm/hsd-oauth-proxy/templates/ingress.yaml   |  61 +++++++++
 helm/hsd-oauth-proxy/templates/service.yaml   |  15 ++
 .../templates/serviceaccount.yaml             |  12 ++
 .../templates/tests/test-connection.yaml      |  15 ++
 helm/hsd-oauth-proxy/values.yaml              | 129 ++++++++++++++++++
 12 files changed, 508 insertions(+)
 create mode 100644 helm/hsd-oauth-proxy/.helmignore
 create mode 100644 helm/hsd-oauth-proxy/Chart.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/NOTES.txt
 create mode 100644 helm/hsd-oauth-proxy/templates/_helpers.tpl
 create mode 100644 helm/hsd-oauth-proxy/templates/deployment.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/hpa.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/ingress.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/service.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/serviceaccount.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/tests/test-connection.yaml
 create mode 100644 helm/hsd-oauth-proxy/values.yaml

diff --git a/helm/hsd-oauth-proxy/.helmignore b/helm/hsd-oauth-proxy/.helmignore
new file mode 100644
index 00000000..0e8a0eb3
--- /dev/null
+++ b/helm/hsd-oauth-proxy/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/helm/hsd-oauth-proxy/Chart.yaml b/helm/hsd-oauth-proxy/Chart.yaml
new file mode 100644
index 00000000..4c29a6bd
--- /dev/null
+++ b/helm/hsd-oauth-proxy/Chart.yaml
@@ -0,0 +1,24 @@
+apiVersion: v2
+name: hsd-oauth-proxy
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.0.20-rc"
diff --git a/helm/hsd-oauth-proxy/templates/NOTES.txt b/helm/hsd-oauth-proxy/templates/NOTES.txt
new file mode 100644
index 00000000..137b4bbe
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hsd-oauth-proxy.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "hsd-oauth-proxy.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "hsd-oauth-proxy.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "hsd-oauth-proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/_helpers.tpl b/helm/hsd-oauth-proxy/templates/_helpers.tpl
new file mode 100644
index 00000000..70c9e322
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hsd-oauth-proxy.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hsd-oauth-proxy.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "hsd-oauth-proxy.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "hsd-oauth-proxy.labels" -}}
+helm.sh/chart: {{ include "hsd-oauth-proxy.chart" . }}
+{{ include "hsd-oauth-proxy.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "hsd-oauth-proxy.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "hsd-oauth-proxy.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "hsd-oauth-proxy.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "hsd-oauth-proxy.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
new file mode 100644
index 00000000..7f324abd
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "hsd-oauth-proxy.fullname" . }}
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "hsd-oauth-proxy.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "hsd-oauth-proxy.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "hsd-oauth-proxy.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          envFrom:
+            - configMapRef:
+                name: hsd-oauth-env-cm
+
+          env:
+          {{- range $k, $v := .Values.envSecrets }}
+            - name: {{ $k | quote }}
+              value: {{ $v | quote }}
+          {{- end }} 
+          
+          {{- range $k, $v := .Values.OptionalEnvVariables }}
+            - name: {{ $k | quote }}
+              value: {{ $v | quote }}
+          {{- end }}   
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/hpa.yaml b/helm/hsd-oauth-proxy/templates/hpa.yaml
new file mode 100644
index 00000000..19bb95f4
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/hpa.yaml
@@ -0,0 +1,28 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "hsd-oauth-proxy.fullname" . }}
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "hsd-oauth-proxy.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
new file mode 100644
index 00000000..91960031
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hsd-oauth-env-cm
+data:
+  OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }}
+  OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }}
+  OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }}
+  OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }}
+  OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }}
+  OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }}
+  OAUTH2_PROXY_COOKIE_SECURE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_SECURE | quote }}
+  OAUTH2_PROXY_EMAIL_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_EMAIL_DOMAINS | quote }}
+  OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }}
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL |  quote }}
+  OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION | quote }}
+  OAUTH2_PROXY_INTROSPECT_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v4/introspect"
+  OAUTH2_PROXY_LOGIN_URL: "https://foundation-client-test.us-east.philips-healthsuite.com/loginapp"
+  OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }}
+  OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }}
+  OAUTH2_PROXY_OIDC_JWKS_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/jwks"
+  OAUTH2_PROXY_PASS_ACCESS_TOKEN: {{ .Values.envVariables.OAUTH2_PROXY_PASS_ACCESS_TOKEN | quote }}
+  OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER | quote }}
+  OAUTH2_PROXY_PASS_BASIC_AUTH: {{ .Values.envVariables.OAUTH2_PROXY_PASS_BASIC_AUTH | quote }}
+  OAUTH2_PROXY_PROFILE_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/userinfo"
+  OAUTH2_PROXY_PROVIDER: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER | quote }}
+  OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER_DISPLAY_NAME | quote }}
+  OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }}
+  OAUTH2_PROXY_REDEEM_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/token"
+  OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }}
+  OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }}
+  OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }}
+  OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }}
+  OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_SET_AUTHORIZATION_HEADER | quote }}
+  OAUTH2_PROXY_SET_INTROSPECTION_VALUE: {{ .Values.envVariables.OAUTH2_PROXY_SET_INTROSPECTION_VALUE | quote }}
+  OAUTH2_PROXY_SET_XAUTHREQUEST: {{ .Values.envVariables.OAUTH2_PROXY_SET_XAUTHREQUEST | quote }}
+  OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: {{ .Values.envVariables.OAUTH2_PROXY_SKIP_PROVIDER_BUTTON | quote }}
+  OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }}
+  OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }}
+  OAUTH2_PROXY_UPSTREAMS: {{ .Values.envVariables.OAUTH2_PROXY_UPSTREAMS | quote }}
+  OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }}
diff --git a/helm/hsd-oauth-proxy/templates/ingress.yaml b/helm/hsd-oauth-proxy/templates/ingress.yaml
new file mode 100644
index 00000000..73199fee
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/ingress.yaml
@@ -0,0 +1,61 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "hsd-oauth-proxy.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
+  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
+  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
+  {{- end }}
+{{- end }}
+{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1
+{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: networking.k8s.io/v1beta1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
+  ingressClassName: {{ .Values.ingress.className }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
+            pathType: {{ .pathType }}
+            {{- end }}
+            backend:
+              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+              {{- else }}
+              serviceName: {{ $fullName }}
+              servicePort: {{ $svcPort }}
+              {{- end }}
+          {{- end }}
+    {{- end }}
+{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/service.yaml b/helm/hsd-oauth-proxy/templates/service.yaml
new file mode 100644
index 00000000..fe881e5f
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "hsd-oauth-proxy.fullname" . }}
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "hsd-oauth-proxy.selectorLabels" . | nindent 4 }}
diff --git a/helm/hsd-oauth-proxy/templates/serviceaccount.yaml b/helm/hsd-oauth-proxy/templates/serviceaccount.yaml
new file mode 100644
index 00000000..c80791e2
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "hsd-oauth-proxy.serviceAccountName" . }}
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/tests/test-connection.yaml b/helm/hsd-oauth-proxy/templates/tests/test-connection.yaml
new file mode 100644
index 00000000..28fd0b18
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/tests/test-connection.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "hsd-oauth-proxy.fullname" . }}-test-connection"
+  labels:
+    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
+  annotations:
+    "helm.sh/hook": test
+spec:
+  containers:
+    - name: wget
+      image: busybox
+      command: ['wget']
+      args: ['{{ include "hsd-oauth-proxy.fullname" . }}:{{ .Values.service.port }}']
+  restartPolicy: Never
diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml
new file mode 100644
index 00000000..180be8b0
--- /dev/null
+++ b/helm/hsd-oauth-proxy/values.yaml
@@ -0,0 +1,129 @@
+# Default values for hsd-oauth-proxy.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  repository: 070446044274.dkr.ecr.us-east-1.amazonaws.com/hsd-pfs-auth-gateway-oauth-proxy
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: false
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+service:
+  type: ClusterIP
+  port: 8080
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  hosts:
+    - host: chart-example.local
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls: []
+  #  - secretName: chart-example-tls
+  #    hosts:
+  #      - chart-example.local
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 100
+  targetCPUUtilizationPercentage: 80
+  # targetMemoryUtilizationPercentage: 80
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+envSecrets:
+  OAUTH2_PROXY_CLIENT_SECRET: ""
+  OAUTH2_PROXY_COOKIE_SECRET: ""
+  OAUTH2_PROXY_REDIS_CONNECTION_URL: ""
+
+envVariables:
+  OAUTH2_PROXY_AUTH_LOGGING: "true"
+  OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
+  OAUTH2_PROXY_CLIENT_ID: ""
+  OAUTH2_PROXY_COOKIE_DOMAINS: ""
+  OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s"
+  OAUTH2_PROXY_COOKIE_NAME: "edi_session_wfm-ci"
+  OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s"
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080"
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true"
+  OAUTH2_PROXY_INTROSPECT_URL: ""
+  OAUTH2_PROXY_LOGIN_URL: ""
+  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090"
+  OAUTH2_PROXY_OIDC_ISSUER_URL: ""
+  OAUTH2_PROXY_OIDC_JWKS_URL: ""
+  OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true"
+  OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true"
+  OAUTH2_PROXY_PASS_BASIC_AUTH: "true"
+  OAUTH2_PROXY_PROFILE_URL: ""
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc"
+  OAUTH2_PROXY_PROXY_PREFIX: ""
+  OAUTH2_PROXY_REDEEM_URL: ""
+  OAUTH2_PROXY_REDIRECT_URL: ""
+  OAUTH2_PROXY_REQUEST_LOGGING: "true"
+  OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
+  OAUTH2_PROXY_SESSION_STORE_TYPE: "redis"
+  OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true"
+  OAUTH2_PROXY_SET_INTROSPECTION_VALUE: "true"
+  OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
+  OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  OAUTH2_PROXY_STANDARD_LOGGING: "true"
+  OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}"
+  OAUTH2_PROXY_UPSTREAMS: "static://"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: ""
+
+OptionalEnvVariables: {}
\ No newline at end of file

From dedabb36518ac63b07772ad0d014fc0938a089aa Mon Sep 17 00:00:00 2001
From: yasarm <mohamed.yasar@philips.com>
Date: Tue, 7 Mar 2023 18:27:19 +0530
Subject: [PATCH 2/6] draft2

---
 helm/hsd-oauth-proxy/Chart.yaml               | 20 +----
 .../hsd-oauth-proxy/templates/deployment.yaml |  3 +-
 .../templates/hsd-oauth-env-cm.yaml           | 42 ----------
 .../templates/hsd-oauth-proxy-env-cm.yaml     | 45 +++++++++++
 helm/hsd-oauth-proxy/templates/ingress.yaml   | 61 ---------------
 helm/hsd-oauth-proxy/templates/service.yaml   |  9 ++-
 .../templates/serviceaccount.yaml             | 12 ---
 helm/hsd-oauth-proxy/values.yaml              | 76 ++++++-------------
 8 files changed, 76 insertions(+), 192 deletions(-)
 delete mode 100644 helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
 create mode 100644 helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
 delete mode 100644 helm/hsd-oauth-proxy/templates/ingress.yaml
 delete mode 100644 helm/hsd-oauth-proxy/templates/serviceaccount.yaml

diff --git a/helm/hsd-oauth-proxy/Chart.yaml b/helm/hsd-oauth-proxy/Chart.yaml
index 4c29a6bd..f1d7d5e6 100644
--- a/helm/hsd-oauth-proxy/Chart.yaml
+++ b/helm/hsd-oauth-proxy/Chart.yaml
@@ -1,24 +1,6 @@
 apiVersion: v2
 name: hsd-oauth-proxy
-description: A Helm chart for Kubernetes
-
-# A chart can be either an 'application' or a 'library' chart.
-#
-# Application charts are a collection of templates that can be packaged into versioned archives
-# to be deployed.
-#
-# Library charts provide useful utilities or functions for the chart developer. They're included as
-# a dependency of application charts to inject those utilities and functions into the rendering
-# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+description: A Helm chart to deploy hsd auth gateway oauth proxy
 type: application
-
-# This is the chart version. This version number should be incremented each time you make changes
-# to the chart and its templates, including the app version.
-# Versions are expected to follow Semantic Versioning (https://semver.org/)
 version: 0.1.0
-
-# This is the version number of the application being deployed. This version number should be
-# incremented each time you make changes to the application. Versions are not expected to
-# follow Semantic Versioning. They should reflect the version the application is using.
-# It is recommended to use it with quotes.
 appVersion: "1.0.20-rc"
diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
index 7f324abd..77c39e9c 100644
--- a/helm/hsd-oauth-proxy/templates/deployment.yaml
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -24,7 +24,6 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "hsd-oauth-proxy.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
@@ -42,7 +41,7 @@ spec:
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
           {{- end }} 
-          
+
           {{- range $k, $v := .Values.OptionalEnvVariables }}
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
deleted file mode 100644
index 91960031..00000000
--- a/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: hsd-oauth-env-cm
-data:
-  OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }}
-  OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }}
-  OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }}
-  OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }}
-  OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }}
-  OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }}
-  OAUTH2_PROXY_COOKIE_SECURE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_SECURE | quote }}
-  OAUTH2_PROXY_EMAIL_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_EMAIL_DOMAINS | quote }}
-  OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }}
-  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL |  quote }}
-  OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION | quote }}
-  OAUTH2_PROXY_INTROSPECT_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v4/introspect"
-  OAUTH2_PROXY_LOGIN_URL: "https://foundation-client-test.us-east.philips-healthsuite.com/loginapp"
-  OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }}
-  OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }}
-  OAUTH2_PROXY_OIDC_JWKS_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/jwks"
-  OAUTH2_PROXY_PASS_ACCESS_TOKEN: {{ .Values.envVariables.OAUTH2_PROXY_PASS_ACCESS_TOKEN | quote }}
-  OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER | quote }}
-  OAUTH2_PROXY_PASS_BASIC_AUTH: {{ .Values.envVariables.OAUTH2_PROXY_PASS_BASIC_AUTH | quote }}
-  OAUTH2_PROXY_PROFILE_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/userinfo"
-  OAUTH2_PROXY_PROVIDER: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER | quote }}
-  OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER_DISPLAY_NAME | quote }}
-  OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }}
-  OAUTH2_PROXY_REDEEM_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/token"
-  OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }}
-  OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }}
-  OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }}
-  OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }}
-  OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_SET_AUTHORIZATION_HEADER | quote }}
-  OAUTH2_PROXY_SET_INTROSPECTION_VALUE: {{ .Values.envVariables.OAUTH2_PROXY_SET_INTROSPECTION_VALUE | quote }}
-  OAUTH2_PROXY_SET_XAUTHREQUEST: {{ .Values.envVariables.OAUTH2_PROXY_SET_XAUTHREQUEST | quote }}
-  OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: {{ .Values.envVariables.OAUTH2_PROXY_SKIP_PROVIDER_BUTTON | quote }}
-  OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }}
-  OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }}
-  OAUTH2_PROXY_UPSTREAMS: {{ .Values.envVariables.OAUTH2_PROXY_UPSTREAMS | quote }}
-  OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }}
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
new file mode 100644
index 00000000..b370a398
--- /dev/null
+++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hsd-oauth-proxy-env-cm
+data:
+  OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }}
+  OAUTH2_PROXY_AUTH_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING_FORMAT | quote }}
+  OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }}
+  OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }}
+  OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }}
+  OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }}
+  OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }}
+  OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }}
+  OAUTH2_PROXY_INTROSPECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_INTROSPECT_URL | quote }}
+  OAUTH2_PROXY_LOGIN_URL: {{ .Values.envVariables.OAUTH2_PROXY_LOGIN_URL | quote }}
+  OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }}
+  OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }}
+  OAUTH2_PROXY_OIDC_JWKS_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_JWKS_URL | quote }}
+  OAUTH2_PROXY_PROFILE_URL:  {{ .Values.envVariables.OAUTH2_PROXY_PROFILE_URL | quote }}
+  OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }}
+  OAUTH2_PROXY_REDEEM_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDEEM_URL | quote }}
+  OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }}
+  OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }}
+  OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }}
+  OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }}
+  OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }}
+  OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }}
+  OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }}
+  
+  OAUTH2_PROXY_COOKIE_SECURE: "true"
+  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
+  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
+  OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true"
+  OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true"
+  OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true"
+  OAUTH2_PROXY_PASS_BASIC_AUTH: "true"
+  OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true"
+  OAUTH2_PROXY_SET_INTROSPECTION_VALUE: "true"
+  OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
+  OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true"
+  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
+  OAUTH2_PROXY_PROVIDER: "oidc"
+  OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc"
+  OAUTH2_PROXY_SESSION_STORE_TYPE: "redis"
+  OAUTH2_PROXY_UPSTREAMS: "static://"
\ No newline at end of file
diff --git a/helm/hsd-oauth-proxy/templates/ingress.yaml b/helm/hsd-oauth-proxy/templates/ingress.yaml
deleted file mode 100644
index 73199fee..00000000
--- a/helm/hsd-oauth-proxy/templates/ingress.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-{{- if .Values.ingress.enabled -}}
-{{- $fullName := include "hsd-oauth-proxy.fullname" . -}}
-{{- $svcPort := .Values.service.port -}}
-{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
-  {{- end }}
-{{- end }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- end }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
-            pathType: {{ .pathType }}
-            {{- end }}
-            backend:
-              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
-              service:
-                name: {{ $fullName }}
-                port:
-                  number: {{ $svcPort }}
-              {{- else }}
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-              {{- end }}
-          {{- end }}
-    {{- end }}
-{{- end }}
diff --git a/helm/hsd-oauth-proxy/templates/service.yaml b/helm/hsd-oauth-proxy/templates/service.yaml
index fe881e5f..24c833d7 100644
--- a/helm/hsd-oauth-proxy/templates/service.yaml
+++ b/helm/hsd-oauth-proxy/templates/service.yaml
@@ -7,9 +7,10 @@ metadata:
 spec:
   type: {{ .Values.service.type }}
   ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
+    {{- range $key, $value := .Values.service.ports }}
+    - name: {{ $key }}
+{{ toYaml $value | indent 6 }}
+    {{- end }}
+    
   selector:
     {{- include "hsd-oauth-proxy.selectorLabels" . | nindent 4 }}
diff --git a/helm/hsd-oauth-proxy/templates/serviceaccount.yaml b/helm/hsd-oauth-proxy/templates/serviceaccount.yaml
deleted file mode 100644
index c80791e2..00000000
--- a/helm/hsd-oauth-proxy/templates/serviceaccount.yaml
+++ /dev/null
@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "hsd-oauth-proxy.serviceAccountName" . }}
-  labels:
-    {{- include "hsd-oauth-proxy.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml
index 180be8b0..9d49097e 100644
--- a/helm/hsd-oauth-proxy/values.yaml
+++ b/helm/hsd-oauth-proxy/values.yaml
@@ -14,15 +14,6 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
-serviceAccount:
-  # Specifies whether a service account should be created
-  create: false
-  # Annotations to add to the service account
-  annotations: {}
-  # The name of the service account to use.
-  # If not set and create is true, a name is generated using the fullname template
-  name: ""
-
 podAnnotations: {}
 
 podSecurityContext: {}
@@ -39,22 +30,15 @@ securityContext: {}
 service:
   type: ClusterIP
   port: 8080
-
-ingress:
-  enabled: false
-  className: ""
-  annotations: {}
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  hosts:
-    - host: chart-example.local
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
+  ports:
+    web1:
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+    web2:
+      port: 9090
+      targetPort: 9090
+      protocol: TCP
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
@@ -82,48 +66,36 @@ tolerations: []
 affinity: {}
 
 envSecrets:
+  #mandatory secrets
   OAUTH2_PROXY_CLIENT_SECRET: ""
   OAUTH2_PROXY_COOKIE_SECRET: ""
   OAUTH2_PROXY_REDIS_CONNECTION_URL: ""
 
 envVariables:
-  OAUTH2_PROXY_AUTH_LOGGING: "true"
-  OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
+  #mandatory input variables
   OAUTH2_PROXY_CLIENT_ID: ""
   OAUTH2_PROXY_COOKIE_DOMAINS: ""
-  OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s"
-  OAUTH2_PROXY_COOKIE_NAME: "edi_session_wfm-ci"
-  OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s"
-  OAUTH2_PROXY_COOKIE_SECURE: "true"
-  OAUTH2_PROXY_EMAIL_DOMAINS: "*"
-  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080"
-  OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true"
-  OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true"
-  OAUTH2_PROXY_INTROSPECT_URL: ""
+  OAUTH2_PROXY_COOKIE_NAME: ""
   OAUTH2_PROXY_LOGIN_URL: ""
-  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090"
   OAUTH2_PROXY_OIDC_ISSUER_URL: ""
   OAUTH2_PROXY_OIDC_JWKS_URL: ""
-  OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true"
-  OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true"
-  OAUTH2_PROXY_PASS_BASIC_AUTH: "true"
   OAUTH2_PROXY_PROFILE_URL: ""
-  OAUTH2_PROXY_PROVIDER: "oidc"
-  OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc"
-  OAUTH2_PROXY_PROXY_PREFIX: ""
+  OAUTH2_PROXY_INTROSPECT_URL: ""
   OAUTH2_PROXY_REDEEM_URL: ""
+  OAUTH2_PROXY_WHITELIST_DOMAINS: ""
+  OAUTH2_PROXY_PROXY_PREFIX: ""
   OAUTH2_PROXY_REDIRECT_URL: ""
+ 
+  #optional input variables with default values
+  OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s"
+  OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s"
+  OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080"  #Any change in port number needs to be updated in service port
+  OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090" #Any change in port number needs to be updated in service port
+  OAUTH2_PROXY_AUTH_LOGGING: "true"
+  OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
   OAUTH2_PROXY_REQUEST_LOGGING: "true"
   OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
-  OAUTH2_PROXY_SESSION_STORE_TYPE: "redis"
-  OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true"
-  OAUTH2_PROXY_SET_INTROSPECTION_VALUE: "true"
-  OAUTH2_PROXY_SET_XAUTHREQUEST: "true"
-  OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true"
-  OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true"
   OAUTH2_PROXY_STANDARD_LOGGING: "true"
   OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}"
-  OAUTH2_PROXY_UPSTREAMS: "static://"
-  OAUTH2_PROXY_WHITELIST_DOMAINS: ""
-
+  
 OptionalEnvVariables: {}
\ No newline at end of file

From 618694b0f4079c8e581a582451f8afdf0b226d25 Mon Sep 17 00:00:00 2001
From: yasarm <mohamed.yasar@philips.com>
Date: Fri, 10 Mar 2023 15:10:02 +0530
Subject: [PATCH 3/6] draft2

---
 helm/hsd-oauth-proxy/templates/NOTES.txt      |  8 +-----
 .../hsd-oauth-proxy/templates/deployment.yaml |  8 +++---
 .../templates/hsd-oauth-proxy-env-cm.yaml     |  1 -
 helm/hsd-oauth-proxy/values.yaml              | 26 ++++++++++++++-----
 4 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/helm/hsd-oauth-proxy/templates/NOTES.txt b/helm/hsd-oauth-proxy/templates/NOTES.txt
index 137b4bbe..ded2ee42 100644
--- a/helm/hsd-oauth-proxy/templates/NOTES.txt
+++ b/helm/hsd-oauth-proxy/templates/NOTES.txt
@@ -1,11 +1,5 @@
 1. Get the application URL by running these commands:
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
+{{- if contains "NodePort" .Values.service.type }}
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "hsd-oauth-proxy.fullname" . }})
   export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
   echo http://$NODE_IP:$NODE_PORT
diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
index 77c39e9c..7846e5ee 100644
--- a/helm/hsd-oauth-proxy/templates/deployment.yaml
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -34,15 +34,13 @@ spec:
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           envFrom:
             - configMapRef:
-                name: hsd-oauth-env-cm
-
+                name: hsd-oauth-proxy-env-cm
           env:
-          {{- range $k, $v := .Values.envSecrets }}
+          {{- range $k, $v := .Values.envVariables }}
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
           {{- end }} 
-
-          {{- range $k, $v := .Values.OptionalEnvVariables }}
+          {{- range $k, $v := .Values.optionalEnvVariables }}
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
           {{- end }}   
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
index b370a398..eb981eef 100644
--- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
+++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
@@ -5,7 +5,6 @@ metadata:
 data:
   OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }}
   OAUTH2_PROXY_AUTH_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING_FORMAT | quote }}
-  OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }}
   OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }}
   OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }}
   OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }}
diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml
index 9d49097e..8aa988df 100644
--- a/helm/hsd-oauth-proxy/values.yaml
+++ b/helm/hsd-oauth-proxy/values.yaml
@@ -65,15 +65,26 @@ tolerations: []
 
 affinity: {}
 
-envSecrets:
-  #mandatory secrets
-  OAUTH2_PROXY_CLIENT_SECRET: ""
-  OAUTH2_PROXY_COOKIE_SECRET: ""
-  OAUTH2_PROXY_REDIS_CONNECTION_URL: ""
+envFromSecrets: 
+  OAUTH2_PROXY_CLIENT_ID:
+    secretKeyRef: 
+      name: oauthSecrets
+      key: clientId
+  OAUTH2_PROXY_CLIENT_SECRET:
+    secretKeyRef: 
+      name: oauthSecrets
+      key: clientSecret
+  OAUTH2_PROXY_COOKIE_SECRET:
+    secretKeyRef: 
+      name: oauthSecrets
+      key: cookieSecret
+  OAUTH2_PROXY_REDIS_CONNECTION_URL:
+    secretKeyRef: 
+      name: oauthSecrets
+      key: redisConnectionUrl
 
 envVariables:
   #mandatory input variables
-  OAUTH2_PROXY_CLIENT_ID: ""
   OAUTH2_PROXY_COOKIE_DOMAINS: ""
   OAUTH2_PROXY_COOKIE_NAME: ""
   OAUTH2_PROXY_LOGIN_URL: ""
@@ -98,4 +109,5 @@ envVariables:
   OAUTH2_PROXY_STANDARD_LOGGING: "true"
   OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}"
   
-OptionalEnvVariables: {}
\ No newline at end of file
+#Any additional OAuth2 specific enviroment variables can be passed here
+optionalEnvVariables: {}
\ No newline at end of file

From c295fd8e229745b172a6c98a14c862ba783411de Mon Sep 17 00:00:00 2001
From: yasar <mohamed.yasar@philips.com>
Date: Fri, 10 Mar 2023 16:35:51 +0530
Subject: [PATCH 4/6] secretenvupdate

---
 .../hsd-oauth-proxy/templates/deployment.yaml | 24 +++++++++++++++----
 .../templates/hsd-oauth-proxy-env-cm.yaml     |  1 -
 helm/hsd-oauth-proxy/values.yaml              |  4 ++--
 3 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
index 7846e5ee..37f098aa 100644
--- a/helm/hsd-oauth-proxy/templates/deployment.yaml
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -36,10 +36,26 @@ spec:
             - configMapRef:
                 name: hsd-oauth-proxy-env-cm
           env:
-          {{- range $k, $v := .Values.envVariables }}
-            - name: {{ $k | quote }}
-              value: {{ $v | quote }}
-          {{- end }} 
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_ID.secretKeyRef.name}}
+                  key: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_ID.secretKeyRef.key}}
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_SECRET.secretKeyRef.name}}
+                  key: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_SECRET.secretKeyRef.key}}
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: {{.Values.envFromSecret.OAUTH2_PROXY_COOKIE_SECRET.secretKeyRef.name}}
+                  key: {{.Values.envFromSecret.OAUTH2_PROXY_COOKIE_SECRET.secretKeyRef.key}}
+            - name: OAUTH2_PROXY_REDIS_CONNECTION_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.name}}
+                  key: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.key}}
           {{- range $k, $v := .Values.optionalEnvVariables }}
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
index eb981eef..3e0ae5db 100644
--- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
+++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
@@ -21,7 +21,6 @@ data:
   OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }}
   OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }}
   OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }}
-  OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }}
   OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }}
   OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }}
   OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }}
diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml
index 8aa988df..e483d68d 100644
--- a/helm/hsd-oauth-proxy/values.yaml
+++ b/helm/hsd-oauth-proxy/values.yaml
@@ -65,9 +65,9 @@ tolerations: []
 
 affinity: {}
 
-envFromSecrets: 
+envFromSecret: 
   OAUTH2_PROXY_CLIENT_ID:
-    secretKeyRef: 
+    secretKeyRef:
       name: oauthSecrets
       key: clientId
   OAUTH2_PROXY_CLIENT_SECRET:

From 2f26688a0087fd39c90c88999fdb7038f51382e9 Mon Sep 17 00:00:00 2001
From: yasar <mohamed.yasar@philips.com>
Date: Fri, 10 Mar 2023 16:44:04 +0530
Subject: [PATCH 5/6] updatepath

---
 helm/hsd-oauth-proxy/templates/deployment.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
index 37f098aa..4e8b4619 100644
--- a/helm/hsd-oauth-proxy/templates/deployment.yaml
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -66,11 +66,11 @@ spec:
               protocol: TCP
           livenessProbe:
             httpGet:
-              path: /
+              path: /ping
               port: http
           readinessProbe:
             httpGet:
-              path: /
+              path: /ping #change to /ready for version greater than 7.4.0
               port: http
           resources:
             {{- toYaml .Values.resources | nindent 12 }}

From f5a36601de301562455df40904767a0e2ddd8ddf Mon Sep 17 00:00:00 2001
From: yasar <mohamed.yasar@philips.com>
Date: Mon, 13 Mar 2023 12:00:11 +0530
Subject: [PATCH 6/6] updatesecrets

---
 .../hsd-oauth-proxy/templates/deployment.yaml |  1 +
 .../templates/hsd-oauth-proxy-env-cm.yaml     |  2 +-
 helm/hsd-oauth-proxy/values.yaml              | 32 ++++++++++---------
 3 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml
index 4e8b4619..8b0db1ea 100644
--- a/helm/hsd-oauth-proxy/templates/deployment.yaml
+++ b/helm/hsd-oauth-proxy/templates/deployment.yaml
@@ -56,6 +56,7 @@ spec:
                 secretKeyRef:
                   name: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.name}}
                   key: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.key}}
+
           {{- range $k, $v := .Values.optionalEnvVariables }}
             - name: {{ $k | quote }}
               value: {{ $v | quote }}
diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
index 3e0ae5db..db326b68 100644
--- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
+++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml
@@ -40,4 +40,4 @@ data:
   OAUTH2_PROXY_PROVIDER: "oidc"
   OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc"
   OAUTH2_PROXY_SESSION_STORE_TYPE: "redis"
-  OAUTH2_PROXY_UPSTREAMS: "static://"
\ No newline at end of file
+  OAUTH2_PROXY_UPSTREAMS: "static://"  
\ No newline at end of file
diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml
index e483d68d..64487da4 100644
--- a/helm/hsd-oauth-proxy/values.yaml
+++ b/helm/hsd-oauth-proxy/values.yaml
@@ -68,34 +68,36 @@ affinity: {}
 envFromSecret: 
   OAUTH2_PROXY_CLIENT_ID:
     secretKeyRef:
-      name: oauthSecrets
+      name: oauth-secrets
       key: clientId
   OAUTH2_PROXY_CLIENT_SECRET:
     secretKeyRef: 
-      name: oauthSecrets
+      name: oauth-secrets
       key: clientSecret
   OAUTH2_PROXY_COOKIE_SECRET:
     secretKeyRef: 
-      name: oauthSecrets
+      name: oauth-secrets
       key: cookieSecret
   OAUTH2_PROXY_REDIS_CONNECTION_URL:
     secretKeyRef: 
-      name: oauthSecrets
-      key: redisConnectionUrl
+      name: redis
+      key: oauthRedisConnectionUrl
 
 envVariables:
   #mandatory input variables
-  OAUTH2_PROXY_COOKIE_DOMAINS: ""
-  OAUTH2_PROXY_COOKIE_NAME: ""
-  OAUTH2_PROXY_LOGIN_URL: ""
-  OAUTH2_PROXY_OIDC_ISSUER_URL: ""
-  OAUTH2_PROXY_OIDC_JWKS_URL: ""
-  OAUTH2_PROXY_PROFILE_URL: ""
-  OAUTH2_PROXY_INTROSPECT_URL: ""
-  OAUTH2_PROXY_REDEEM_URL: ""
-  OAUTH2_PROXY_WHITELIST_DOMAINS: ""
+  OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS: "redis://hsd-development-cluster-pfm.qvw0di.0001.use1.cache.amazonaws.com:6379"
+  OAUTH2_PROXY_REDIS_USE_CLUSTER: "true"
+  OAUTH2_PROXY_COOKIE_DOMAINS: "cardioorg-test.us-east.philips-healthsuite.com"
+  OAUTH2_PROXY_COOKIE_NAME: "edi_session_edi-platform-foundationeks"
+  OAUTH2_PROXY_LOGIN_URL: "https://foundation-client-test.us-east.philips-healthsuite.com/loginapp"
+  OAUTH2_PROXY_OIDC_ISSUER_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2"
+  OAUTH2_PROXY_OIDC_JWKS_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/jwks"
+  OAUTH2_PROXY_PROFILE_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/userinfo"
+  OAUTH2_PROXY_INTROSPECT_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v4/introspect"
+  OAUTH2_PROXY_REDEEM_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/token"
+  OAUTH2_PROXY_WHITELIST_DOMAINS: "cardioorg-test.us-east.philips-healthsuite.com"
   OAUTH2_PROXY_PROXY_PREFIX: ""
-  OAUTH2_PROXY_REDIRECT_URL: ""
+  OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback"
  
   #optional input variables with default values
   OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s"