diff --git a/CHANGELOG.md b/CHANGELOG.md index d1568de2..f4dd76e1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,6 +55,7 @@ ## Changes since v5.1.1 +- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev) - [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves) - [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed) - [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed) diff --git a/contrib/local-environment/Makefile b/contrib/local-environment/Makefile index f3df6d33..512e6fab 100644 --- a/contrib/local-environment/Makefile +++ b/contrib/local-environment/Makefile @@ -21,3 +21,12 @@ keycloak-up: .PHONY: keycloak-% keycloak-%: docker-compose -f docker-compose-keycloak.yaml $* + +.PHONY: kubernetes-up +kubernetes-up: + make -C kubernetes create-cluster + make -C kubernetes deploy + +.PHONY: kubernetes-down +kubernetes-down: + make -C kubernetes delete-cluster diff --git a/contrib/local-environment/kubernetes/.gitignore b/contrib/local-environment/kubernetes/.gitignore new file mode 100644 index 00000000..ee3892e8 --- /dev/null +++ b/contrib/local-environment/kubernetes/.gitignore @@ -0,0 +1 @@ +charts/ diff --git a/contrib/local-environment/kubernetes/Chart.lock b/contrib/local-environment/kubernetes/Chart.lock new file mode 100644 index 00000000..d174dc7e --- /dev/null +++ b/contrib/local-environment/kubernetes/Chart.lock @@ -0,0 +1,15 @@ +dependencies: +- name: dex + repository: https://kubernetes-charts.storage.googleapis.com + version: 2.11.0 +- name: oauth2-proxy + repository: https://kubernetes-charts.storage.googleapis.com + version: 3.1.0 +- name: httpbin + repository: https://conservis.github.io/helm-charts + version: 1.0.1 +- name: hello-world + repository: https://conservis.github.io/helm-charts + version: 1.0.1 +digest: sha256:ce64f06102abb551ee23b6de7b4cec3537f4900de89412458e53760781005aac +generated: "2020-06-16T16:59:19.126187-05:00" diff --git a/contrib/local-environment/kubernetes/Chart.yaml b/contrib/local-environment/kubernetes/Chart.yaml new file mode 100644 index 00000000..7fafe4fb --- /dev/null +++ b/contrib/local-environment/kubernetes/Chart.yaml @@ -0,0 +1,19 @@ +apiVersion: v2 +description: K8S example based on https://kind.sigs.k8s.io +name: kubernetes +version: 5.1.1 +appVersion: 5.1.1 +dependencies: + - name: dex + version: 2.11.0 + repository: https://kubernetes-charts.storage.googleapis.com + - name: oauth2-proxy + version: 3.1.0 + repository: https://kubernetes-charts.storage.googleapis.com + # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart + - name: httpbin + version: 1.0.1 + repository: https://conservis.github.io/helm-charts + - name: hello-world + version: 1.0.1 + repository: https://conservis.github.io/helm-charts diff --git a/contrib/local-environment/kubernetes/Makefile b/contrib/local-environment/kubernetes/Makefile new file mode 100644 index 00000000..c2ed5d29 --- /dev/null +++ b/contrib/local-environment/kubernetes/Makefile @@ -0,0 +1,67 @@ +all: + @echo "Usage:" + @echo " make create-cluster" + @echo " make deploy" + +# create kind cluster with nginx-ingress as the most popular ingress controller for K8S +.PHONY: deploy +create-cluster: + kind create cluster --name oauth2-proxy --config kind-cluster.yaml + make setup-dns + make setup-ingress + +.PHONY: setup-ingress +setup-ingress: + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml + kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller + +# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/a6e8108025bc7a9440beedb8ef7714aec84fe87e/pkg/apis/config/v1alpha4/default.go#L52 +# what makes cluster host IP equal to 10.244.0.1 +# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP +# NOT NEEDED IN REAL LIFE! +.PHONY: setup-dns +setup-dns: + kubectl apply -f custom-dns.yaml + kubectl -n kube-system rollout restart deployment/coredns + kubectl -n kube-system rollout status --timeout 5m deployment/coredns + +.PHONY: delete-cluster +delete-cluster: + kind delete cluster --name oauth2-proxy + +.PHONY: deploy +deploy: + kubectl apply -f oauth2-proxy-example-full.yaml + kubectl rollout status --timeout 5m deployment/oauth2-proxy-example-oauth2-proxy-sample + kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-httpbin + kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-hello-world + +.PHONY: undeploy +undeploy: + kubectl delete -f oauth2-proxy-example-full.yaml + +###################### +###### HELM CMDs ##### +###################### +.PHONY: helm-init +helm-init: + helm dep update + +# unpacking is useful to be able to explore underlying helm charts +.PHONY: helm-unpack +helm-unpack: + cd charts; for f in *.tgz; do tar -zxf "$$f"; done + +.PHONY: helm-deploy +helm-deploy: helm-init + helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example . + +.PHONY: helm-undeploy +helm-undeploy: + helm del oauth2-proxy-example + +# creates K8S manifest from helm chart +.PHONY: helm-create-manifest +helm-create-manifest: helm-init + echo "# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml + helm template --namespace default oauth2-proxy-example . >> oauth2-proxy-example-full.yaml diff --git a/contrib/local-environment/kubernetes/README.md b/contrib/local-environment/kubernetes/README.md new file mode 100644 index 00000000..a1361a6e --- /dev/null +++ b/contrib/local-environment/kubernetes/README.md @@ -0,0 +1,24 @@ +# Kubernetes example +Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster. + +## Quick start + +Before you start: + +_Required_ +* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) +* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) + +_Optional_ +* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm). + +Then: + +* `make create-cluster` +* `make deploy` OR `make helm-deploy` for helm + +Visit http://httpbin.localtest.me or http://hello-world.localtest.me/ + +## Uninstall + +* `make delete-cluster` diff --git a/contrib/local-environment/kubernetes/custom-dns.yaml b/contrib/local-environment/kubernetes/custom-dns.yaml new file mode 100644 index 00000000..c0d09e4f --- /dev/null +++ b/contrib/local-environment/kubernetes/custom-dns.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +data: + Corefile: | + .:53 { + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + forward . /etc/resolv.conf + cache 30 + loop + reload + loadbalance + hosts { + 10.244.0.1 dex.localtest.me + 10.244.0.1 oauth2-proxy.localtest.me + fallthrough + } + } +kind: ConfigMap +metadata: + name: coredns + namespace: kube-system diff --git a/contrib/local-environment/kubernetes/kind-cluster.yaml b/contrib/local-environment/kubernetes/kind-cluster.yaml new file mode 100644 index 00000000..89ded6b2 --- /dev/null +++ b/contrib/local-environment/kubernetes/kind-cluster.yaml @@ -0,0 +1,17 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +nodes: + - role: control-plane + kubeadmConfigPatches: + - | + kind: InitConfiguration + nodeRegistration: + kubeletExtraArgs: + node-labels: "ingress-ready=true" + extraPortMappings: + - containerPort: 80 + hostPort: 80 + protocol: TCP + - containerPort: 443 + hostPort: 443 + protocol: TCP diff --git a/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml new file mode 100644 index 00000000..8ccc5977 --- /dev/null +++ b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml @@ -0,0 +1,564 @@ +# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY! +--- +# Source: kubernetes/charts/dex/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +--- +# Source: kubernetes/charts/hello-world/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.1 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +--- +# Source: kubernetes/charts/httpbin/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.1 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +--- +# Source: kubernetes/charts/oauth2-proxy/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + release: oauth2-proxy-example + heritage: Helm + name: oauth2-proxy-example-oauth2-proxy-sample +--- +# Source: kubernetes/charts/dex/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +stringData: + config.yaml: |- + issuer: http://dex.localtest.me + storage: + config: + inCluster: true + type: kubernetes + logger: + level: debug + web: + http: 0.0.0.0:5556 + oauth2: + alwaysShowLoginScreen: false + skipApprovalScreen: true + staticClients: + - id: oauth2-proxy + name: OAuth2 Proxy + redirectURIs: + - http://oauth2-proxy.localtest.me/oauth2/callback + secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK + enablePasswordDB: true + staticPasswords: + - email: admin@example.com + hash: $2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W + userID: 08a8684b-db88-4b73-90a9-3cd1661f5466 + username: admin + expiry: + idTokens: 1h + signingKeys: 4h +--- +# Source: kubernetes/charts/oauth2-proxy/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample +data: + oauth2_proxy.cfg: "cookie_secret=\"OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=\"\ncookie_domain=\".localtest.me\"\nwhitelist_domains=[\".localtest.me\"]\n# only users with this domain will be let in\nemail_domains=[\"example.com\"]\n\nclient_id=\"oauth2-proxy\"\nclient_secret=\"b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK\"\ncookie_secure=\"false\"\n\nredirect_url=\"http://oauth2-proxy.localtest.me/oauth2/callback\"\n\n# we don't want to proxy anything so pick a non-existent directory\nupstreams = [ \"file:///dev/null\" ]\n\n# return authenticated user to nginx\nset_xauthrequest = true\n# using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate\n# login_url, redeem_url, and oidc_jwks_url\nprovider=\"oidc\"\noidc_issuer_url=\"http://dex.localtest.me\"" +--- +# Source: kubernetes/charts/dex/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +rules: +- apiGroups: ["dex.coreos.com"] # API group created by dex + resources: ["*"] + verbs: ["*"] +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions +--- +# Source: kubernetes/charts/dex/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: oauth2-proxy-example-dex +subjects: + - kind: ServiceAccount + name: oauth2-proxy-example-dex + namespace: default +--- +# Source: kubernetes/charts/dex/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + sessionAffinity: None + ports: + - name: http + targetPort: http + port: 32000 + selector: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/hello-world/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.1 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - port: 9080 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/httpbin/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.1 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/oauth2-proxy/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + release: oauth2-proxy-example + heritage: Helm + name: oauth2-proxy-example-oauth2-proxy-sample +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + selector: + app: oauth2-proxy-sample + release: oauth2-proxy-example +--- +# Source: kubernetes/charts/dex/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: dex +spec: + replicas: 1 + strategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate + selector: + matchLabels: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/component: dex + template: + metadata: + labels: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/component: dex + annotations: + checksum/config: 185f32cfabdf4f7467868dc301d4bd33e68951e12eddeb69f23ebc1d0f91ba28 + spec: + serviceAccountName: oauth2-proxy-example-dex + nodeSelector: + {} + containers: + - name: main + image: "quay.io/dexidp/dex:v2.23.0" + imagePullPolicy: IfNotPresent + command: + - /usr/local/bin/dex + - serve + - /etc/dex/cfg/config.yaml + resources: + null + ports: + - name: http + containerPort: 5556 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 1 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 1 + readinessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 1 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 1 + env: + [] + volumeMounts: + - mountPath: /etc/dex/cfg + name: config + volumes: + - secret: + defaultMode: 420 + items: + - key: config.yaml + path: config.yaml + secretName: oauth2-proxy-example-dex + name: config +--- +# Source: kubernetes/charts/hello-world/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.1 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + template: + metadata: + labels: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + spec: + serviceAccountName: oauth2-proxy-example-hello-world + securityContext: + {} + containers: + - name: hello-world + securityContext: + {} + image: "conservis/hello-world:1.0.0" + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 9080 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {} +--- +# Source: kubernetes/charts/httpbin/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.1 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + template: + metadata: + labels: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + spec: + serviceAccountName: oauth2-proxy-example-httpbin + securityContext: + {} + containers: + - name: httpbin + securityContext: + {} + image: "kennethreitz/httpbin:latest" + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {} +--- +# Source: kubernetes/charts/oauth2-proxy/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample +spec: + replicas: 1 + selector: + matchLabels: + app: oauth2-proxy-sample + release: oauth2-proxy-example + template: + metadata: + annotations: + checksum/config: 5d8892a7b1d9eb03f9d59b787ce339b374fa2be51991e4e7533cb0a541984fac + checksum/config-emails: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + checksum/google-secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + labels: + app: oauth2-proxy-sample + release: "oauth2-proxy-example" + spec: + serviceAccountName: oauth2-proxy-example-oauth2-proxy-sample + containers: + - name: oauth2-proxy + image: "quay.io/pusher/oauth2_proxy:v5.1.0" + imagePullPolicy: IfNotPresent + args: + - --http-address=0.0.0.0:4180 + - --config=/etc/oauth2_proxy/oauth2_proxy.cfg + ports: + - containerPort: 4180 + name: http + protocol: TCP + livenessProbe: + httpGet: + path: /ping + port: http + scheme: HTTP + initialDelaySeconds: 0 + timeoutSeconds: 1 + readinessProbe: + httpGet: + path: /ping + port: http + scheme: HTTP + initialDelaySeconds: 0 + timeoutSeconds: 1 + successThreshold: 1 + periodSeconds: 10 + resources: + {} + volumeMounts: + - mountPath: /etc/oauth2_proxy + name: configmain + volumes: + - configMap: + defaultMode: 420 + name: oauth2-proxy-example-oauth2-proxy-sample + name: configmain + tolerations: + [] +--- +# Source: kubernetes/charts/dex/templates/ingress.yaml +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm +spec: + rules: + - host: "dex.localtest.me" + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-dex + servicePort: 32000 +--- +# Source: kubernetes/charts/hello-world/templates/ingress.yaml +apiVersion: networking.k8s.io/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.1 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + annotations: + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth +spec: + rules: + - host: hello-world.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-hello-world + servicePort: 9080 +--- +# Source: kubernetes/charts/httpbin/templates/ingress.yaml +apiVersion: networking.k8s.io/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.1 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth +spec: + rules: + - host: httpbin.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-httpbin + servicePort: 80 +--- +# Source: kubernetes/charts/oauth2-proxy/templates/ingress.yaml +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample + annotations: + nginx.ingress.kubernetes.io/server-snippet: | + large_client_header_buffers 4 32k; +spec: + rules: + - host: oauth2-proxy.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-oauth2-proxy-sample + servicePort: 80 diff --git a/contrib/local-environment/kubernetes/values.yaml b/contrib/local-environment/kubernetes/values.yaml new file mode 100644 index 00000000..7b69845f --- /dev/null +++ b/contrib/local-environment/kubernetes/values.yaml @@ -0,0 +1,91 @@ +dex: + ingress: + enabled: true + hosts: + - dex.localtest.me + grpc: false + certs: + grpc: + create: false + web: + create: false + + config: + issuer: http://dex.localtest.me + expiry: + signingKeys: "4h" + idTokens: "1h" + staticClients: + - id: oauth2-proxy + redirectURIs: + # These redirect URI points to the `--redirect-url` for OAuth2 proxy. + - 'http://oauth2-proxy.localtest.me/oauth2/callback' + name: 'OAuth2 Proxy' + secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK" + staticPasswords: + - email: "admin@example.com" + # bcrypt hash of the string "password" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + username: "admin" + userID: "08a8684b-db88-4b73-90a9-3cd1661f5466" + +oauth2-proxy: + nameOverride: oauth2-proxy-sample + ingress: + enabled: true + hosts: + - oauth2-proxy.localtest.me + annotations: + nginx.ingress.kubernetes.io/server-snippet: | + large_client_header_buffers 4 32k; + # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret + proxyVarsAsSecrets: false + config: + configFile: |- + cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=" + cookie_domain=".localtest.me" + whitelist_domains=[".localtest.me"] + # only users with this domain will be let in + email_domains=["example.com"] + + client_id="oauth2-proxy" + client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK" + cookie_secure="false" + + redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback" + + # we don't want to proxy anything so pick a non-existent directory + upstreams = [ "file:///dev/null" ] + + # return authenticated user to nginx + set_xauthrequest = true + # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate + # login_url, redeem_url, and oidc_jwks_url + provider="oidc" + oidc_issuer_url="http://dex.localtest.me" + +httpbin: + ingress: + enabled: true + hosts: + - httpbin.localtest.me + annotations: + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + # That's what will be used in REAL LIFE + #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth + # but because of https://github.com/kubernetes/ingress-nginx/issues/3665 + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + +hello-world: + ingress: + enabled: true + hosts: + - hello-world.localtest.me + annotations: + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + # That's what will be used in REAL LIFE + #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth + # but because of https://github.com/kubernetes/ingress-nginx/issues/3665 + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email