From 0f343cf0adcd457eeff479787f683cc82992e462 Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Fri, 12 Jun 2020 13:12:59 -0500 Subject: [PATCH 1/9] helm kubernetes example based on kind cluster --- contrib/helm/.gitignore | 1 + contrib/helm/Chart.lock | 15 +++ contrib/helm/Chart.yaml | 20 ++++ contrib/helm/Makefile | 44 +++++++++ contrib/helm/README.md | 23 +++++ contrib/helm/custom-dns.yaml | 30 ++++++ contrib/helm/hello-world/Chart.yaml | 23 +++++ .../helm/hello-world/templates/_helpers.tpl | 63 ++++++++++++ .../hello-world/templates/deployment.yaml | 61 ++++++++++++ .../helm/hello-world/templates/ingress.yaml | 41 ++++++++ .../helm/hello-world/templates/service.yaml | 15 +++ .../hello-world/templates/serviceaccount.yaml | 12 +++ contrib/helm/hello-world/values.yaml | 79 +++++++++++++++ contrib/helm/httpbin/Chart.yaml | 23 +++++ contrib/helm/httpbin/templates/_helpers.tpl | 63 ++++++++++++ .../helm/httpbin/templates/deployment.yaml | 61 ++++++++++++ contrib/helm/httpbin/templates/ingress.yaml | 41 ++++++++ contrib/helm/httpbin/templates/service.yaml | 15 +++ .../httpbin/templates/serviceaccount.yaml | 12 +++ contrib/helm/httpbin/values.yaml | 79 +++++++++++++++ contrib/helm/kind-cluster.yaml | 14 +++ contrib/helm/values.yaml | 95 +++++++++++++++++++ 22 files changed, 830 insertions(+) create mode 100644 contrib/helm/.gitignore create mode 100644 contrib/helm/Chart.lock create mode 100644 contrib/helm/Chart.yaml create mode 100644 contrib/helm/Makefile create mode 100644 contrib/helm/README.md create mode 100644 contrib/helm/custom-dns.yaml create mode 100644 contrib/helm/hello-world/Chart.yaml create mode 100644 contrib/helm/hello-world/templates/_helpers.tpl create mode 100644 contrib/helm/hello-world/templates/deployment.yaml create mode 100644 contrib/helm/hello-world/templates/ingress.yaml create mode 100644 contrib/helm/hello-world/templates/service.yaml create mode 100644 contrib/helm/hello-world/templates/serviceaccount.yaml create mode 100644 contrib/helm/hello-world/values.yaml create mode 100644 contrib/helm/httpbin/Chart.yaml create mode 100644 contrib/helm/httpbin/templates/_helpers.tpl create mode 100644 contrib/helm/httpbin/templates/deployment.yaml create mode 100644 contrib/helm/httpbin/templates/ingress.yaml create mode 100644 contrib/helm/httpbin/templates/service.yaml create mode 100644 contrib/helm/httpbin/templates/serviceaccount.yaml create mode 100644 contrib/helm/httpbin/values.yaml create mode 100644 contrib/helm/kind-cluster.yaml create mode 100644 contrib/helm/values.yaml diff --git a/contrib/helm/.gitignore b/contrib/helm/.gitignore new file mode 100644 index 00000000..ee3892e8 --- /dev/null +++ b/contrib/helm/.gitignore @@ -0,0 +1 @@ +charts/ diff --git a/contrib/helm/Chart.lock b/contrib/helm/Chart.lock new file mode 100644 index 00000000..5c7eb625 --- /dev/null +++ b/contrib/helm/Chart.lock @@ -0,0 +1,15 @@ +dependencies: +- name: dex + repository: https://kubernetes-charts.storage.googleapis.com + version: 2.11.0 +- name: oauth2-proxy + repository: https://kubernetes-charts.storage.googleapis.com + version: 3.1.0 +- name: httpbin + repository: file://./httpbin + version: 0.6.1 +- name: hello-world + repository: file://./hello-world + version: 0.0.1 +digest: sha256:b5fe4db7a523b28321708a12ae0d2608ea32836b322ae7941c820b626a180af2 +generated: "2020-06-12T13:10:21.718689-05:00" diff --git a/contrib/helm/Chart.yaml b/contrib/helm/Chart.yaml new file mode 100644 index 00000000..3d71e9d0 --- /dev/null +++ b/contrib/helm/Chart.yaml @@ -0,0 +1,20 @@ +apiVersion: v2 +description: K8S example based on https://kind.sigs.k8s.io and https://helm.sh. +name: helm +version: 5.1.1 +appVersion: 5.1.1 +# helm search repo -l stable/nginx-ingress | head -n 5 +dependencies: + - name: dex + version: 2.11.0 + repository: https://kubernetes-charts.storage.googleapis.com + - name: oauth2-proxy + version: 3.1.0 + repository: https://kubernetes-charts.storage.googleapis.com + # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now creating our own chart + - name: httpbin + version: 0.6.1 + repository: file://./httpbin + - name: hello-world + version: 0.0.1 + repository: file://./hello-world diff --git a/contrib/helm/Makefile b/contrib/helm/Makefile new file mode 100644 index 00000000..0f59ce9a --- /dev/null +++ b/contrib/helm/Makefile @@ -0,0 +1,44 @@ +# create kind cluster with nginx-ingress as the most popular ingress controller for K8S +.PHONY: deploy +create-cluster: + kind create cluster --name oauth2-proxy --config kind-cluster.yaml + make setup-dns + make setup-ingress + +.PHONY: setup-ingress +setup-ingress: + kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml + sleep 5 # because of https://github.com/kubernetes/kubernetes/issues/83242 + kubectl --namespace ingress-nginx wait --for=condition=available --timeout=30s deployment/ingress-nginx-controller + kubectl --namespace ingress-nginx rollout status --timeout 90s deployment/ingress-nginx-controller + +# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/master/pkg/apis/config/v1alpha4/default.go +# what makes cluster host IP equal to 10.244.0.1 +# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP +# NOT NEEDED IN REAL LIFE! +.PHONY: setup-dns +setup-dns: + kubectl apply -f custom-dns.yaml + kubectl -n kube-system rollout restart deployment/coredns + kubectl -n kube-system rollout status --timeout 60s deployment/coredns + +.PHONY: undeploy +delete-cluster: + kind delete cluster --name oauth2-proxy + +.PHONY: helm-init +helm-init: + helm dep update + +.PHONY: undeploy +deploy: helm-init + helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example . + +.PHONY: undeploy +undeploy: + helm del oauth2-proxy-example + +# unpacking is useful to be able to explore underlying helm charts +.PHONY: helm-unpack +helm-unpack: + cd charts; for f in *.tgz; do tar -zxf "$$f"; done diff --git a/contrib/helm/README.md b/contrib/helm/README.md new file mode 100644 index 00000000..8352051d --- /dev/null +++ b/contrib/helm/README.md @@ -0,0 +1,23 @@ +# Kubernetes example +Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster and the package manager [helm](https://helm.sh). + + +## Quick start + +Before you start: + +_Required_ +* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) +* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm). +* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) + +Then: + +* `make create-cluster` +* `make deploy` + +Visit http://httpbin.localtest.me or http://hello-world.localtest.me/ + +## Uninstall + +* `make delete-cluster` diff --git a/contrib/helm/custom-dns.yaml b/contrib/helm/custom-dns.yaml new file mode 100644 index 00000000..c0d09e4f --- /dev/null +++ b/contrib/helm/custom-dns.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +data: + Corefile: | + .:53 { + errors + health { + lameduck 5s + } + ready + kubernetes cluster.local in-addr.arpa ip6.arpa { + pods insecure + fallthrough in-addr.arpa ip6.arpa + ttl 30 + } + prometheus :9153 + forward . /etc/resolv.conf + cache 30 + loop + reload + loadbalance + hosts { + 10.244.0.1 dex.localtest.me + 10.244.0.1 oauth2-proxy.localtest.me + fallthrough + } + } +kind: ConfigMap +metadata: + name: coredns + namespace: kube-system diff --git a/contrib/helm/hello-world/Chart.yaml b/contrib/helm/hello-world/Chart.yaml new file mode 100644 index 00000000..f49092f9 --- /dev/null +++ b/contrib/helm/hello-world/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: hello-world +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.0.1 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +appVersion: 0.0.1 diff --git a/contrib/helm/hello-world/templates/_helpers.tpl b/contrib/helm/hello-world/templates/_helpers.tpl new file mode 100644 index 00000000..630f9a3f --- /dev/null +++ b/contrib/helm/hello-world/templates/_helpers.tpl @@ -0,0 +1,63 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "helloWorld.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "helloWorld.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "helloWorld.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "helloWorld.labels" -}} +helm.sh/chart: {{ include "helloWorld.chart" . }} +{{ include "helloWorld.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "helloWorld.selectorLabels" -}} +app.kubernetes.io/name: {{ include "helloWorld.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "helloWorld.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "helloWorld.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/contrib/helm/hello-world/templates/deployment.yaml b/contrib/helm/hello-world/templates/deployment.yaml new file mode 100644 index 00000000..64639d67 --- /dev/null +++ b/contrib/helm/hello-world/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "helloWorld.fullname" . }} + labels: + {{- include "helloWorld.labels" . | nindent 4 }} +spec: +{{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} +{{- end }} + selector: + matchLabels: + {{- include "helloWorld.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "helloWorld.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "helloWorld.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/contrib/helm/hello-world/templates/ingress.yaml b/contrib/helm/hello-world/templates/ingress.yaml new file mode 100644 index 00000000..b8bbb4e0 --- /dev/null +++ b/contrib/helm/hello-world/templates/ingress.yaml @@ -0,0 +1,41 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "helloWorld.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "helloWorld.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ . }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} diff --git a/contrib/helm/hello-world/templates/service.yaml b/contrib/helm/hello-world/templates/service.yaml new file mode 100644 index 00000000..0631e394 --- /dev/null +++ b/contrib/helm/hello-world/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "helloWorld.fullname" . }} + labels: + {{- include "helloWorld.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "helloWorld.selectorLabels" . | nindent 4 }} diff --git a/contrib/helm/hello-world/templates/serviceaccount.yaml b/contrib/helm/hello-world/templates/serviceaccount.yaml new file mode 100644 index 00000000..6f5f7ae3 --- /dev/null +++ b/contrib/helm/hello-world/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "helloWorld.serviceAccountName" . }} + labels: + {{- include "helloWorld.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/contrib/helm/hello-world/values.yaml b/contrib/helm/hello-world/values.yaml new file mode 100644 index 00000000..20071bcb --- /dev/null +++ b/contrib/helm/hello-world/values.yaml @@ -0,0 +1,79 @@ +# Default values for helloWorld. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: tutum/hello-world + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart version. + tag: latest + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 80 + +ingress: + enabled: false + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: [] + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/contrib/helm/httpbin/Chart.yaml b/contrib/helm/httpbin/Chart.yaml new file mode 100644 index 00000000..523589eb --- /dev/null +++ b/contrib/helm/httpbin/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +name: httpbin +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.6.1 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +appVersion: 0.6.1 diff --git a/contrib/helm/httpbin/templates/_helpers.tpl b/contrib/helm/httpbin/templates/_helpers.tpl new file mode 100644 index 00000000..dbe09819 --- /dev/null +++ b/contrib/helm/httpbin/templates/_helpers.tpl @@ -0,0 +1,63 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "httpbin.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "httpbin.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "httpbin.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "httpbin.labels" -}} +helm.sh/chart: {{ include "httpbin.chart" . }} +{{ include "httpbin.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "httpbin.selectorLabels" -}} +app.kubernetes.io/name: {{ include "httpbin.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "httpbin.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "httpbin.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/contrib/helm/httpbin/templates/deployment.yaml b/contrib/helm/httpbin/templates/deployment.yaml new file mode 100644 index 00000000..8ad029bd --- /dev/null +++ b/contrib/helm/httpbin/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "httpbin.fullname" . }} + labels: + {{- include "httpbin.labels" . | nindent 4 }} +spec: +{{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} +{{- end }} + selector: + matchLabels: + {{- include "httpbin.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "httpbin.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "httpbin.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/contrib/helm/httpbin/templates/ingress.yaml b/contrib/helm/httpbin/templates/ingress.yaml new file mode 100644 index 00000000..3d830e82 --- /dev/null +++ b/contrib/helm/httpbin/templates/ingress.yaml @@ -0,0 +1,41 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "httpbin.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "httpbin.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ . }} + backend: + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} diff --git a/contrib/helm/httpbin/templates/service.yaml b/contrib/helm/httpbin/templates/service.yaml new file mode 100644 index 00000000..676c8a1e --- /dev/null +++ b/contrib/helm/httpbin/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "httpbin.fullname" . }} + labels: + {{- include "httpbin.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "httpbin.selectorLabels" . | nindent 4 }} diff --git a/contrib/helm/httpbin/templates/serviceaccount.yaml b/contrib/helm/httpbin/templates/serviceaccount.yaml new file mode 100644 index 00000000..60023d4f --- /dev/null +++ b/contrib/helm/httpbin/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "httpbin.serviceAccountName" . }} + labels: + {{- include "httpbin.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/contrib/helm/httpbin/values.yaml b/contrib/helm/httpbin/values.yaml new file mode 100644 index 00000000..f44ef324 --- /dev/null +++ b/contrib/helm/httpbin/values.yaml @@ -0,0 +1,79 @@ +# Default values for httpbin. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + repository: kennethreitz/httpbin + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart version. + tag: latest + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 80 + +ingress: + enabled: false + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: [] + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} diff --git a/contrib/helm/kind-cluster.yaml b/contrib/helm/kind-cluster.yaml new file mode 100644 index 00000000..c35f39d1 --- /dev/null +++ b/contrib/helm/kind-cluster.yaml @@ -0,0 +1,14 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +nodes: + - role: control-plane + kubeadmConfigPatches: + - | + kind: InitConfiguration + nodeRegistration: + kubeletExtraArgs: + node-labels: "ingress-ready=true" + extraPortMappings: + - containerPort: 80 + hostPort: 80 + protocol: TCP diff --git a/contrib/helm/values.yaml b/contrib/helm/values.yaml new file mode 100644 index 00000000..b4bdf9dc --- /dev/null +++ b/contrib/helm/values.yaml @@ -0,0 +1,95 @@ +dex: + ingress: + enabled: true + hosts: + - dex.localtest.me + grpc: false + certs: + grpc: + create: false + web: + create: false + + config: + issuer: http://dex.localtest.me + expiry: + signingKeys: "4h" + idTokens: "1h" + staticClients: + - id: oauth2-proxy + redirectURIs: + # These redirect URI points to the `--redirect-url` for OAuth2 proxy. + - 'http://oauth2-proxy.localtest.me/oauth2/callback' + name: 'OAuth2 Proxy' + secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK" + staticPasswords: + - email: "admin@example.com" + # bcrypt hash of the string "password" + hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W" + username: "admin" + userID: "08a8684b-db88-4b73-90a9-3cd1661f5466" + +oauth2-proxy: + nameOverride: oauth2-proxy-sample + ingress: + enabled: true + hosts: + - oauth2-proxy.localtest.me + annotations: + nginx.ingress.kubernetes.io/server-snippet: | + large_client_header_buffers 4 32k; + # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret + proxyVarsAsSecrets: false + config: + configFile: |- + cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=" + cookie_domain=".localtest.me" + whitelist_domains=[".localtest.me"] + # only users with this domain will be let in + email_domains=["example.com"] + + client_id="oauth2-proxy" + client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK" + cookie_secure="false" + + redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback" + + # we don't want to proxy anything so pick a non-existent directory + upstreams = [ "file:///dev/null" ] + + # return authenticated user to nginx + set_xauthrequest = true + # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate + # login_url, redeem_url, and oidc_jwks_url + provider="oidc" + oidc_issuer_url="http://dex.localtest.me" + +httpbin: + ingress: + enabled: true + hosts: + - host: httpbin.localtest.me + paths: + - / + annotations: + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + # That's what will be used in REAL LIFE + #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth + # but because of https://github.com/kubernetes/ingress-nginx/issues/3665 + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + +hello-world: + ingress: + enabled: true + hosts: + - host: hello-world.localtest.me + paths: + - / + annotations: + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + # That's what will be used in REAL LIFE + #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth + # but because of https://github.com/kubernetes/ingress-nginx/issues/3665 + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email From dbf1b451d9cd31b638f736e11ce192e6f30a624c Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Fri, 12 Jun 2020 13:15:43 -0500 Subject: [PATCH 2/9] polish --- contrib/helm/Chart.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/contrib/helm/Chart.yaml b/contrib/helm/Chart.yaml index 3d71e9d0..7c566c3d 100644 --- a/contrib/helm/Chart.yaml +++ b/contrib/helm/Chart.yaml @@ -3,7 +3,6 @@ description: K8S example based on https://kind.sigs.k8s.io and https://helm.sh. name: helm version: 5.1.1 appVersion: 5.1.1 -# helm search repo -l stable/nginx-ingress | head -n 5 dependencies: - name: dex version: 2.11.0 From 363eaf1fac86df789e752702233a380f44167725 Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Fri, 12 Jun 2020 13:55:38 -0500 Subject: [PATCH 3/9] changelog entry --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f35a3b43..8e423df4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,6 +55,7 @@ ## Changes since v5.1.1 +- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Helm Example based on Kind cluster and Nginx ingress (@EvgeniGordeev) - [#601](https://github.com/oauth2-proxy/oauth2-proxy/pull/601) Ensure decrypted user/email are valid UTF8 (@JoelSpeed) - [#560](https://github.com/oauth2-proxy/oauth2-proxy/pull/560) Fallback to UserInfo is User ID claim not present (@JoelSpeed) - [#598](https://github.com/oauth2-proxy/oauth2-proxy/pull/598) acr_values no longer sent to IdP when empty (@ScottGuymer) From 11c033e2c8468cf5280c9250d529da100ad22dbb Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Tue, 16 Jun 2020 16:39:11 -0500 Subject: [PATCH 4/9] * move httpbin and hello-world charts outside. * expose kind to 443 port * make helm optional * rename folder to kubernetes --- CHANGELOG.md | 2 +- contrib/helm/Chart.lock | 15 - contrib/helm/hello-world/Chart.yaml | 23 - .../helm/hello-world/templates/_helpers.tpl | 63 -- .../hello-world/templates/deployment.yaml | 61 -- .../helm/hello-world/templates/ingress.yaml | 41 -- .../helm/hello-world/templates/service.yaml | 15 - .../hello-world/templates/serviceaccount.yaml | 12 - contrib/helm/hello-world/values.yaml | 79 --- contrib/helm/httpbin/Chart.yaml | 23 - contrib/helm/httpbin/templates/_helpers.tpl | 63 -- .../helm/httpbin/templates/deployment.yaml | 61 -- contrib/helm/httpbin/templates/ingress.yaml | 41 -- contrib/helm/httpbin/templates/service.yaml | 15 - .../httpbin/templates/serviceaccount.yaml | 12 - contrib/helm/httpbin/values.yaml | 79 --- contrib/{helm => kubernetes}/.gitignore | 0 contrib/kubernetes/Chart.lock | 0 contrib/{helm => kubernetes}/Chart.yaml | 14 +- contrib/{helm => kubernetes}/Makefile | 50 +- contrib/{helm => kubernetes}/README.md | 11 +- contrib/{helm => kubernetes}/custom-dns.yaml | 0 .../{helm => kubernetes}/kind-cluster.yaml | 3 + .../kubernetes/oauth2-proxy-example-full.yaml | 605 ++++++++++++++++++ contrib/{helm => kubernetes}/values.yaml | 8 +- 25 files changed, 660 insertions(+), 636 deletions(-) delete mode 100644 contrib/helm/Chart.lock delete mode 100644 contrib/helm/hello-world/Chart.yaml delete mode 100644 contrib/helm/hello-world/templates/_helpers.tpl delete mode 100644 contrib/helm/hello-world/templates/deployment.yaml delete mode 100644 contrib/helm/hello-world/templates/ingress.yaml delete mode 100644 contrib/helm/hello-world/templates/service.yaml delete mode 100644 contrib/helm/hello-world/templates/serviceaccount.yaml delete mode 100644 contrib/helm/hello-world/values.yaml delete mode 100644 contrib/helm/httpbin/Chart.yaml delete mode 100644 contrib/helm/httpbin/templates/_helpers.tpl delete mode 100644 contrib/helm/httpbin/templates/deployment.yaml delete mode 100644 contrib/helm/httpbin/templates/ingress.yaml delete mode 100644 contrib/helm/httpbin/templates/service.yaml delete mode 100644 contrib/helm/httpbin/templates/serviceaccount.yaml delete mode 100644 contrib/helm/httpbin/values.yaml rename contrib/{helm => kubernetes}/.gitignore (100%) create mode 100644 contrib/kubernetes/Chart.lock rename contrib/{helm => kubernetes}/Chart.yaml (57%) rename contrib/{helm => kubernetes}/Makefile (51%) rename contrib/{helm => kubernetes}/README.md (79%) rename contrib/{helm => kubernetes}/custom-dns.yaml (100%) rename contrib/{helm => kubernetes}/kind-cluster.yaml (82%) create mode 100644 contrib/kubernetes/oauth2-proxy-example-full.yaml rename contrib/{helm => kubernetes}/values.yaml (96%) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4d811c8d..23316645 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -55,7 +55,7 @@ ## Changes since v5.1.1 -- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Helm Example based on Kind cluster and Nginx ingress (@EvgeniGordeev) +- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev) - [#604](https://github.com/oauth2-proxy/oauth2-proxy/pull/604) Add Keycloak local testing environment (@EvgeniGordeev) - [#539](https://github.com/oauth2-proxy/oauth2-proxy/pull/539) Refactor encryption ciphers and add AES-GCM support (@NickMeves) - [#601](https://github.com/oauth2-proxy/oauth2-proxy/pull/601) Ensure decrypted user/email are valid UTF8 (@JoelSpeed) diff --git a/contrib/helm/Chart.lock b/contrib/helm/Chart.lock deleted file mode 100644 index 5c7eb625..00000000 --- a/contrib/helm/Chart.lock +++ /dev/null @@ -1,15 +0,0 @@ -dependencies: -- name: dex - repository: https://kubernetes-charts.storage.googleapis.com - version: 2.11.0 -- name: oauth2-proxy - repository: https://kubernetes-charts.storage.googleapis.com - version: 3.1.0 -- name: httpbin - repository: file://./httpbin - version: 0.6.1 -- name: hello-world - repository: file://./hello-world - version: 0.0.1 -digest: sha256:b5fe4db7a523b28321708a12ae0d2608ea32836b322ae7941c820b626a180af2 -generated: "2020-06-12T13:10:21.718689-05:00" diff --git a/contrib/helm/hello-world/Chart.yaml b/contrib/helm/hello-world/Chart.yaml deleted file mode 100644 index f49092f9..00000000 --- a/contrib/helm/hello-world/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v2 -name: hello-world -description: A Helm chart for Kubernetes - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.0.1 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -appVersion: 0.0.1 diff --git a/contrib/helm/hello-world/templates/_helpers.tpl b/contrib/helm/hello-world/templates/_helpers.tpl deleted file mode 100644 index 630f9a3f..00000000 --- a/contrib/helm/hello-world/templates/_helpers.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "helloWorld.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "helloWorld.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "helloWorld.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "helloWorld.labels" -}} -helm.sh/chart: {{ include "helloWorld.chart" . }} -{{ include "helloWorld.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "helloWorld.selectorLabels" -}} -app.kubernetes.io/name: {{ include "helloWorld.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "helloWorld.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "helloWorld.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/contrib/helm/hello-world/templates/deployment.yaml b/contrib/helm/hello-world/templates/deployment.yaml deleted file mode 100644 index 64639d67..00000000 --- a/contrib/helm/hello-world/templates/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "helloWorld.fullname" . }} - labels: - {{- include "helloWorld.labels" . | nindent 4 }} -spec: -{{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} -{{- end }} - selector: - matchLabels: - {{- include "helloWorld.selectorLabels" . | nindent 6 }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "helloWorld.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "helloWorld.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: http - containerPort: 80 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - readinessProbe: - httpGet: - path: / - port: http - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/contrib/helm/hello-world/templates/ingress.yaml b/contrib/helm/hello-world/templates/ingress.yaml deleted file mode 100644 index b8bbb4e0..00000000 --- a/contrib/helm/hello-world/templates/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "helloWorld.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "helloWorld.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ . }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} diff --git a/contrib/helm/hello-world/templates/service.yaml b/contrib/helm/hello-world/templates/service.yaml deleted file mode 100644 index 0631e394..00000000 --- a/contrib/helm/hello-world/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "helloWorld.fullname" . }} - labels: - {{- include "helloWorld.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "helloWorld.selectorLabels" . | nindent 4 }} diff --git a/contrib/helm/hello-world/templates/serviceaccount.yaml b/contrib/helm/hello-world/templates/serviceaccount.yaml deleted file mode 100644 index 6f5f7ae3..00000000 --- a/contrib/helm/hello-world/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "helloWorld.serviceAccountName" . }} - labels: - {{- include "helloWorld.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/contrib/helm/hello-world/values.yaml b/contrib/helm/hello-world/values.yaml deleted file mode 100644 index 20071bcb..00000000 --- a/contrib/helm/hello-world/values.yaml +++ /dev/null @@ -1,79 +0,0 @@ -# Default values for helloWorld. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - repository: tutum/hello-world - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart version. - tag: latest - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -podAnnotations: {} - -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -service: - type: ClusterIP - port: 80 - -ingress: - enabled: false - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: chart-example.local - paths: [] - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/contrib/helm/httpbin/Chart.yaml b/contrib/helm/httpbin/Chart.yaml deleted file mode 100644 index 523589eb..00000000 --- a/contrib/helm/httpbin/Chart.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v2 -name: httpbin -description: A Helm chart for Kubernetes - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.6.1 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -appVersion: 0.6.1 diff --git a/contrib/helm/httpbin/templates/_helpers.tpl b/contrib/helm/httpbin/templates/_helpers.tpl deleted file mode 100644 index dbe09819..00000000 --- a/contrib/helm/httpbin/templates/_helpers.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "httpbin.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "httpbin.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "httpbin.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "httpbin.labels" -}} -helm.sh/chart: {{ include "httpbin.chart" . }} -{{ include "httpbin.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "httpbin.selectorLabels" -}} -app.kubernetes.io/name: {{ include "httpbin.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "httpbin.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "httpbin.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/contrib/helm/httpbin/templates/deployment.yaml b/contrib/helm/httpbin/templates/deployment.yaml deleted file mode 100644 index 8ad029bd..00000000 --- a/contrib/helm/httpbin/templates/deployment.yaml +++ /dev/null @@ -1,61 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "httpbin.fullname" . }} - labels: - {{- include "httpbin.labels" . | nindent 4 }} -spec: -{{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} -{{- end }} - selector: - matchLabels: - {{- include "httpbin.selectorLabels" . | nindent 6 }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "httpbin.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "httpbin.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: http - containerPort: 80 - protocol: TCP - livenessProbe: - httpGet: - path: / - port: http - readinessProbe: - httpGet: - path: / - port: http - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/contrib/helm/httpbin/templates/ingress.yaml b/contrib/helm/httpbin/templates/ingress.yaml deleted file mode 100644 index 3d830e82..00000000 --- a/contrib/helm/httpbin/templates/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "httpbin.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "httpbin.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ . }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} diff --git a/contrib/helm/httpbin/templates/service.yaml b/contrib/helm/httpbin/templates/service.yaml deleted file mode 100644 index 676c8a1e..00000000 --- a/contrib/helm/httpbin/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "httpbin.fullname" . }} - labels: - {{- include "httpbin.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "httpbin.selectorLabels" . | nindent 4 }} diff --git a/contrib/helm/httpbin/templates/serviceaccount.yaml b/contrib/helm/httpbin/templates/serviceaccount.yaml deleted file mode 100644 index 60023d4f..00000000 --- a/contrib/helm/httpbin/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "httpbin.serviceAccountName" . }} - labels: - {{- include "httpbin.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/contrib/helm/httpbin/values.yaml b/contrib/helm/httpbin/values.yaml deleted file mode 100644 index f44ef324..00000000 --- a/contrib/helm/httpbin/values.yaml +++ /dev/null @@ -1,79 +0,0 @@ -# Default values for httpbin. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - repository: kennethreitz/httpbin - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart version. - tag: latest - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -podAnnotations: {} - -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -service: - type: ClusterIP - port: 80 - -ingress: - enabled: false - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: chart-example.local - paths: [] - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - -nodeSelector: {} - -tolerations: [] - -affinity: {} diff --git a/contrib/helm/.gitignore b/contrib/kubernetes/.gitignore similarity index 100% rename from contrib/helm/.gitignore rename to contrib/kubernetes/.gitignore diff --git a/contrib/kubernetes/Chart.lock b/contrib/kubernetes/Chart.lock new file mode 100644 index 00000000..e69de29b diff --git a/contrib/helm/Chart.yaml b/contrib/kubernetes/Chart.yaml similarity index 57% rename from contrib/helm/Chart.yaml rename to contrib/kubernetes/Chart.yaml index 7c566c3d..7e7bd69d 100644 --- a/contrib/helm/Chart.yaml +++ b/contrib/kubernetes/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 -description: K8S example based on https://kind.sigs.k8s.io and https://helm.sh. -name: helm +description: K8S example based on https://kind.sigs.k8s.io +name: kubernetes version: 5.1.1 appVersion: 5.1.1 dependencies: @@ -10,10 +10,10 @@ dependencies: - name: oauth2-proxy version: 3.1.0 repository: https://kubernetes-charts.storage.googleapis.com - # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now creating our own chart + # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart - name: httpbin - version: 0.6.1 - repository: file://./httpbin + version: 1.0.0 + repository: https://conservis.github.io/helm-charts - name: hello-world - version: 0.0.1 - repository: file://./hello-world + version: 1.0.0 + repository: https://conservis.github.io/helm-charts diff --git a/contrib/helm/Makefile b/contrib/kubernetes/Makefile similarity index 51% rename from contrib/helm/Makefile rename to contrib/kubernetes/Makefile index 0f59ce9a..2e70af3d 100644 --- a/contrib/helm/Makefile +++ b/contrib/kubernetes/Makefile @@ -1,3 +1,8 @@ +all: + @echo "Usage:" + @echo " make create-cluster" + @echo " make deploy" + # create kind cluster with nginx-ingress as the most popular ingress controller for K8S .PHONY: deploy create-cluster: @@ -8,11 +13,9 @@ create-cluster: .PHONY: setup-ingress setup-ingress: kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml - sleep 5 # because of https://github.com/kubernetes/kubernetes/issues/83242 - kubectl --namespace ingress-nginx wait --for=condition=available --timeout=30s deployment/ingress-nginx-controller - kubectl --namespace ingress-nginx rollout status --timeout 90s deployment/ingress-nginx-controller + kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller -# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/master/pkg/apis/config/v1alpha4/default.go +# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/a6e8108025bc7a9440beedb8ef7714aec84fe87e/pkg/apis/config/v1alpha4/default.go#L52 # what makes cluster host IP equal to 10.244.0.1 # thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP # NOT NEEDED IN REAL LIFE! @@ -20,25 +23,44 @@ setup-ingress: setup-dns: kubectl apply -f custom-dns.yaml kubectl -n kube-system rollout restart deployment/coredns - kubectl -n kube-system rollout status --timeout 60s deployment/coredns + kubectl -n kube-system rollout status --timeout 5m deployment/coredns -.PHONY: undeploy +.PHONY: delete-cluster delete-cluster: kind delete cluster --name oauth2-proxy -.PHONY: helm-init -helm-init: - helm dep update - -.PHONY: undeploy -deploy: helm-init - helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example . +.PHONY: deploy +deploy: + kubectl apply -f oauth2-proxy-example-full.yaml + kubectl rollout status --timeout 5m deployment/oauth2-proxy-example-oauth2-proxy-sample + kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-httpbin + kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-hello-world .PHONY: undeploy undeploy: - helm del oauth2-proxy-example + kubectl delete -f oauth2-proxy-example-full.yaml + +###################### +###### HELM CMDs ##### +###################### +.PHONY: helm-init +helm-init: + helm dep update # unpacking is useful to be able to explore underlying helm charts .PHONY: helm-unpack helm-unpack: cd charts; for f in *.tgz; do tar -zxf "$$f"; done + +.PHONY: helm-deploy +helm-deploy: helm-init + helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example . + +.PHONY: helm-undeploy +helm-undeploy: + helm del oauth2-proxy-example + +# creates K8S manifest from helm chart +.PHONY: helm-create-manifest +helm-create-manifest: + helm template --namespace default oauth2-proxy-example . > oauth2-proxy-example-full.yaml diff --git a/contrib/helm/README.md b/contrib/kubernetes/README.md similarity index 79% rename from contrib/helm/README.md rename to contrib/kubernetes/README.md index 8352051d..7294962b 100644 --- a/contrib/helm/README.md +++ b/contrib/kubernetes/README.md @@ -1,6 +1,5 @@ # Kubernetes example -Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster and the package manager [helm](https://helm.sh). - +Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster. ## Quick start @@ -8,16 +7,18 @@ Before you start: _Required_ * install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) -* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm). * install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/) +_Optional_ +* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm). + Then: * `make create-cluster` -* `make deploy` +* `make deploy` OR `make helm-deploy` for helm Visit http://httpbin.localtest.me or http://hello-world.localtest.me/ ## Uninstall -* `make delete-cluster` +* `make delete-cluster` OR `make helm-undeploy` for helm diff --git a/contrib/helm/custom-dns.yaml b/contrib/kubernetes/custom-dns.yaml similarity index 100% rename from contrib/helm/custom-dns.yaml rename to contrib/kubernetes/custom-dns.yaml diff --git a/contrib/helm/kind-cluster.yaml b/contrib/kubernetes/kind-cluster.yaml similarity index 82% rename from contrib/helm/kind-cluster.yaml rename to contrib/kubernetes/kind-cluster.yaml index c35f39d1..89ded6b2 100644 --- a/contrib/helm/kind-cluster.yaml +++ b/contrib/kubernetes/kind-cluster.yaml @@ -12,3 +12,6 @@ nodes: - containerPort: 80 hostPort: 80 protocol: TCP + - containerPort: 443 + hostPort: 443 + protocol: TCP diff --git a/contrib/kubernetes/oauth2-proxy-example-full.yaml b/contrib/kubernetes/oauth2-proxy-example-full.yaml new file mode 100644 index 00000000..a0a6af4c --- /dev/null +++ b/contrib/kubernetes/oauth2-proxy-example-full.yaml @@ -0,0 +1,605 @@ +--- +# Source: kubernetes/charts/dex/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +--- +# Source: kubernetes/charts/hello-world/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.0 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +--- +# Source: kubernetes/charts/httpbin/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.0 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +--- +# Source: kubernetes/charts/oauth2-proxy/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + release: oauth2-proxy-example + heritage: Helm + name: oauth2-proxy-example-oauth2-proxy-sample +--- +# Source: kubernetes/charts/dex/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +stringData: + config.yaml: |- + issuer: http://dex.localtest.me + storage: + config: + inCluster: true + type: kubernetes + logger: + level: debug + web: + http: 0.0.0.0:5556 + oauth2: + alwaysShowLoginScreen: false + skipApprovalScreen: true + staticClients: + - id: oauth2-proxy + name: OAuth2 Proxy + redirectURIs: + - http://oauth2-proxy.localtest.me/oauth2/callback + secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK + enablePasswordDB: true + staticPasswords: + - email: admin@example.com + hash: $2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W + userID: 08a8684b-db88-4b73-90a9-3cd1661f5466 + username: admin + expiry: + idTokens: 1h + signingKeys: 4h +--- +# Source: kubernetes/charts/oauth2-proxy/templates/configmap.yaml +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample +data: + oauth2_proxy.cfg: "cookie_secret=\"OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=\"\ncookie_domain=\".localtest.me\"\nwhitelist_domains=[\".localtest.me\"]\n# only users with this domain will be let in\nemail_domains=[\"example.com\"]\n\nclient_id=\"oauth2-proxy\"\nclient_secret=\"b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK\"\ncookie_secure=\"false\"\n\nredirect_url=\"http://oauth2-proxy.localtest.me/oauth2/callback\"\n\n# we don't want to proxy anything so pick a non-existent directory\nupstreams = [ \"file:///dev/null\" ]\n\n# return authenticated user to nginx\nset_xauthrequest = true\n# using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate\n# login_url, redeem_url, and oidc_jwks_url\nprovider=\"oidc\"\noidc_issuer_url=\"http://dex.localtest.me\"" +--- +# Source: kubernetes/charts/dex/templates/clusterrole.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +rules: +- apiGroups: ["dex.coreos.com"] # API group created by dex + resources: ["*"] + verbs: ["*"] +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions +--- +# Source: kubernetes/charts/dex/templates/clusterrolebinding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + name: oauth2-proxy-example-dex +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: oauth2-proxy-example-dex +subjects: + - kind: ServiceAccount + name: oauth2-proxy-example-dex + namespace: default +--- +# Source: kubernetes/charts/dex/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + sessionAffinity: None + ports: + - name: http + targetPort: http + port: 32000 + selector: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/hello-world/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.0 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - port: 9080 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/httpbin/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.0 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example +--- +# Source: kubernetes/charts/oauth2-proxy/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + release: oauth2-proxy-example + heritage: Helm + name: oauth2-proxy-example-oauth2-proxy-sample +spec: + type: ClusterIP + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + selector: + app: oauth2-proxy-sample + release: oauth2-proxy-example +--- +# Source: kubernetes/charts/dex/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: dex +spec: + replicas: 1 + strategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate + selector: + matchLabels: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/component: dex + template: + metadata: + labels: + app.kubernetes.io/name: dex + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/component: dex + annotations: + checksum/config: 185f32cfabdf4f7467868dc301d4bd33e68951e12eddeb69f23ebc1d0f91ba28 + spec: + serviceAccountName: oauth2-proxy-example-dex + nodeSelector: + {} + containers: + - name: main + image: "quay.io/dexidp/dex:v2.23.0" + imagePullPolicy: IfNotPresent + command: + - /usr/local/bin/dex + - serve + - /etc/dex/cfg/config.yaml + resources: + null + ports: + - name: http + containerPort: 5556 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 1 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 1 + readinessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 1 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 1 + env: + [] + volumeMounts: + - mountPath: /etc/dex/cfg + name: config + volumes: + - secret: + defaultMode: 420 + items: + - key: config.yaml + path: config.yaml + secretName: oauth2-proxy-example-dex + name: config +--- +# Source: kubernetes/charts/hello-world/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.0 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + template: + metadata: + labels: + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + spec: + serviceAccountName: oauth2-proxy-example-hello-world + securityContext: + {} + containers: + - name: hello-world + securityContext: + {} + image: "conservis/hello-world:1.0.0" + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 9080 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {} +--- +# Source: kubernetes/charts/httpbin/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.0 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + template: + metadata: + labels: + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + spec: + serviceAccountName: oauth2-proxy-example-httpbin + securityContext: + {} + containers: + - name: httpbin + securityContext: + {} + image: "kennethreitz/httpbin:latest" + imagePullPolicy: IfNotPresent + ports: + - name: http + containerPort: 80 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + {} +--- +# Source: kubernetes/charts/oauth2-proxy/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample +spec: + replicas: 1 + selector: + matchLabels: + app: oauth2-proxy-sample + release: oauth2-proxy-example + template: + metadata: + annotations: + checksum/config: 5d8892a7b1d9eb03f9d59b787ce339b374fa2be51991e4e7533cb0a541984fac + checksum/config-emails: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + checksum/google-secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 + labels: + app: oauth2-proxy-sample + release: "oauth2-proxy-example" + spec: + serviceAccountName: oauth2-proxy-example-oauth2-proxy-sample + containers: + - name: oauth2-proxy + image: "quay.io/pusher/oauth2_proxy:v5.1.0" + imagePullPolicy: IfNotPresent + args: + - --http-address=0.0.0.0:4180 + - --config=/etc/oauth2_proxy/oauth2_proxy.cfg + ports: + - containerPort: 4180 + name: http + protocol: TCP + livenessProbe: + httpGet: + path: /ping + port: http + scheme: HTTP + initialDelaySeconds: 0 + timeoutSeconds: 1 + readinessProbe: + httpGet: + path: /ping + port: http + scheme: HTTP + initialDelaySeconds: 0 + timeoutSeconds: 1 + successThreshold: 1 + periodSeconds: 10 + resources: + {} + volumeMounts: + - mountPath: /etc/oauth2_proxy + name: configmain + volumes: + - configMap: + defaultMode: 420 + name: oauth2-proxy-example-oauth2-proxy-sample + name: configmain + tolerations: + [] +--- +# Source: kubernetes/charts/dex/templates/ingress.yaml +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-dex + labels: + app.kubernetes.io/name: dex + helm.sh/chart: dex-2.11.0 + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "2.23.0" + app.kubernetes.io/managed-by: Helm +spec: + rules: + - host: "dex.localtest.me" + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-dex + servicePort: 32000 +--- +# Source: kubernetes/charts/hello-world/templates/ingress.yaml +apiVersion: networking.k8s.io/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-hello-world + labels: + helm.sh/chart: hello-world-1.0.0 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + annotations: + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth +spec: + rules: + - host: hello-world.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-hello-world + servicePort: 9080 +--- +# Source: kubernetes/charts/httpbin/templates/ingress.yaml +apiVersion: networking.k8s.io/v1beta1 +kind: Ingress +metadata: + name: oauth2-proxy-example-httpbin + labels: + helm.sh/chart: httpbin-1.0.0 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email + nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start + nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth +spec: + rules: + - host: httpbin.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-httpbin + servicePort: 80 +--- +# Source: kubernetes/charts/oauth2-proxy/templates/ingress.yaml +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + labels: + app: oauth2-proxy-sample + chart: oauth2-proxy-3.1.0 + heritage: Helm + release: oauth2-proxy-example + name: oauth2-proxy-example-oauth2-proxy-sample + annotations: + nginx.ingress.kubernetes.io/server-snippet: | + large_client_header_buffers 4 32k; +spec: + rules: + - host: oauth2-proxy.localtest.me + http: + paths: + - path: / + backend: + serviceName: oauth2-proxy-example-oauth2-proxy-sample + servicePort: 80 +--- +# Source: kubernetes/charts/hello-world/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "oauth2-proxy-example-hello-world-test-connection" + labels: + helm.sh/chart: hello-world-1.0.0 + app.kubernetes.io/name: hello-world + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "1.0.0" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": test-success +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['oauth2-proxy-example-hello-world:9080'] + restartPolicy: Never +--- +# Source: kubernetes/charts/httpbin/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "oauth2-proxy-example-httpbin-test-connection" + labels: + helm.sh/chart: httpbin-1.0.0 + app.kubernetes.io/name: httpbin + app.kubernetes.io/instance: oauth2-proxy-example + app.kubernetes.io/version: "latest" + app.kubernetes.io/managed-by: Helm + annotations: + "helm.sh/hook": test-success +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['oauth2-proxy-example-httpbin:80'] + restartPolicy: Never diff --git a/contrib/helm/values.yaml b/contrib/kubernetes/values.yaml similarity index 96% rename from contrib/helm/values.yaml rename to contrib/kubernetes/values.yaml index b4bdf9dc..7b69845f 100644 --- a/contrib/helm/values.yaml +++ b/contrib/kubernetes/values.yaml @@ -68,9 +68,7 @@ httpbin: ingress: enabled: true hosts: - - host: httpbin.localtest.me - paths: - - / + - httpbin.localtest.me annotations: nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start # That's what will be used in REAL LIFE @@ -83,9 +81,7 @@ hello-world: ingress: enabled: true hosts: - - host: hello-world.localtest.me - paths: - - / + - hello-world.localtest.me annotations: nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start # That's what will be used in REAL LIFE From c85e5297b5b23812e6e674d6362b4a59b97ec834 Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Tue, 16 Jun 2020 16:47:10 -0500 Subject: [PATCH 5/9] * some polish --- contrib/kubernetes/Chart.lock | 0 contrib/local-environment/Makefile | 9 +++++++++ .../{ => local-environment}/kubernetes/.gitignore | 0 contrib/local-environment/kubernetes/Chart.lock | 15 +++++++++++++++ .../{ => local-environment}/kubernetes/Chart.yaml | 0 .../{ => local-environment}/kubernetes/Makefile | 0 .../{ => local-environment}/kubernetes/README.md | 0 .../kubernetes/custom-dns.yaml | 0 .../kubernetes/kind-cluster.yaml | 0 .../kubernetes/oauth2-proxy-example-full.yaml | 0 .../kubernetes/values.yaml | 0 11 files changed, 24 insertions(+) delete mode 100644 contrib/kubernetes/Chart.lock rename contrib/{ => local-environment}/kubernetes/.gitignore (100%) create mode 100644 contrib/local-environment/kubernetes/Chart.lock rename contrib/{ => local-environment}/kubernetes/Chart.yaml (100%) rename contrib/{ => local-environment}/kubernetes/Makefile (100%) rename contrib/{ => local-environment}/kubernetes/README.md (100%) rename contrib/{ => local-environment}/kubernetes/custom-dns.yaml (100%) rename contrib/{ => local-environment}/kubernetes/kind-cluster.yaml (100%) rename contrib/{ => local-environment}/kubernetes/oauth2-proxy-example-full.yaml (100%) rename contrib/{ => local-environment}/kubernetes/values.yaml (100%) diff --git a/contrib/kubernetes/Chart.lock b/contrib/kubernetes/Chart.lock deleted file mode 100644 index e69de29b..00000000 diff --git a/contrib/local-environment/Makefile b/contrib/local-environment/Makefile index f3df6d33..5b43aba4 100644 --- a/contrib/local-environment/Makefile +++ b/contrib/local-environment/Makefile @@ -21,3 +21,12 @@ keycloak-up: .PHONY: keycloak-% keycloak-%: docker-compose -f docker-compose-keycloak.yaml $* + +.PHONY: kubernetes-up +kubernetes-up: + cd kubernetes && make create-cluster + cd kubernetes && make deploy + +.PHONY: kubernetes-down +kubernetes-down: + cd kubernetes && make delete-cluster diff --git a/contrib/kubernetes/.gitignore b/contrib/local-environment/kubernetes/.gitignore similarity index 100% rename from contrib/kubernetes/.gitignore rename to contrib/local-environment/kubernetes/.gitignore diff --git a/contrib/local-environment/kubernetes/Chart.lock b/contrib/local-environment/kubernetes/Chart.lock new file mode 100644 index 00000000..c637ff5f --- /dev/null +++ b/contrib/local-environment/kubernetes/Chart.lock @@ -0,0 +1,15 @@ +dependencies: +- name: dex + repository: https://kubernetes-charts.storage.googleapis.com + version: 2.11.0 +- name: oauth2-proxy + repository: https://kubernetes-charts.storage.googleapis.com + version: 3.1.0 +- name: httpbin + repository: https://conservis.github.io/helm-charts + version: 1.0.0 +- name: hello-world + repository: https://conservis.github.io/helm-charts + version: 1.0.0 +digest: sha256:2791284a47750de56455cbe41b8587b2ef953111663ea9a99ef58aab4ae9734b +generated: "2020-06-16T16:39:06.668252-05:00" diff --git a/contrib/kubernetes/Chart.yaml b/contrib/local-environment/kubernetes/Chart.yaml similarity index 100% rename from contrib/kubernetes/Chart.yaml rename to contrib/local-environment/kubernetes/Chart.yaml diff --git a/contrib/kubernetes/Makefile b/contrib/local-environment/kubernetes/Makefile similarity index 100% rename from contrib/kubernetes/Makefile rename to contrib/local-environment/kubernetes/Makefile diff --git a/contrib/kubernetes/README.md b/contrib/local-environment/kubernetes/README.md similarity index 100% rename from contrib/kubernetes/README.md rename to contrib/local-environment/kubernetes/README.md diff --git a/contrib/kubernetes/custom-dns.yaml b/contrib/local-environment/kubernetes/custom-dns.yaml similarity index 100% rename from contrib/kubernetes/custom-dns.yaml rename to contrib/local-environment/kubernetes/custom-dns.yaml diff --git a/contrib/kubernetes/kind-cluster.yaml b/contrib/local-environment/kubernetes/kind-cluster.yaml similarity index 100% rename from contrib/kubernetes/kind-cluster.yaml rename to contrib/local-environment/kubernetes/kind-cluster.yaml diff --git a/contrib/kubernetes/oauth2-proxy-example-full.yaml b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml similarity index 100% rename from contrib/kubernetes/oauth2-proxy-example-full.yaml rename to contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml diff --git a/contrib/kubernetes/values.yaml b/contrib/local-environment/kubernetes/values.yaml similarity index 100% rename from contrib/kubernetes/values.yaml rename to contrib/local-environment/kubernetes/values.yaml From fa7855a99d57d77cea73261abbc159ed4b0c530f Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Tue, 16 Jun 2020 16:59:56 -0500 Subject: [PATCH 6/9] get rid of test-connection pods for hello-world and httpbin --- .../local-environment/kubernetes/Chart.lock | 8 +-- .../local-environment/kubernetes/Chart.yaml | 4 +- contrib/local-environment/kubernetes/Makefile | 2 +- .../kubernetes/oauth2-proxy-example-full.yaml | 58 +++---------------- 4 files changed, 15 insertions(+), 57 deletions(-) diff --git a/contrib/local-environment/kubernetes/Chart.lock b/contrib/local-environment/kubernetes/Chart.lock index c637ff5f..d174dc7e 100644 --- a/contrib/local-environment/kubernetes/Chart.lock +++ b/contrib/local-environment/kubernetes/Chart.lock @@ -7,9 +7,9 @@ dependencies: version: 3.1.0 - name: httpbin repository: https://conservis.github.io/helm-charts - version: 1.0.0 + version: 1.0.1 - name: hello-world repository: https://conservis.github.io/helm-charts - version: 1.0.0 -digest: sha256:2791284a47750de56455cbe41b8587b2ef953111663ea9a99ef58aab4ae9734b -generated: "2020-06-16T16:39:06.668252-05:00" + version: 1.0.1 +digest: sha256:ce64f06102abb551ee23b6de7b4cec3537f4900de89412458e53760781005aac +generated: "2020-06-16T16:59:19.126187-05:00" diff --git a/contrib/local-environment/kubernetes/Chart.yaml b/contrib/local-environment/kubernetes/Chart.yaml index 7e7bd69d..7fafe4fb 100644 --- a/contrib/local-environment/kubernetes/Chart.yaml +++ b/contrib/local-environment/kubernetes/Chart.yaml @@ -12,8 +12,8 @@ dependencies: repository: https://kubernetes-charts.storage.googleapis.com # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart - name: httpbin - version: 1.0.0 + version: 1.0.1 repository: https://conservis.github.io/helm-charts - name: hello-world - version: 1.0.0 + version: 1.0.1 repository: https://conservis.github.io/helm-charts diff --git a/contrib/local-environment/kubernetes/Makefile b/contrib/local-environment/kubernetes/Makefile index 2e70af3d..917207ac 100644 --- a/contrib/local-environment/kubernetes/Makefile +++ b/contrib/local-environment/kubernetes/Makefile @@ -62,5 +62,5 @@ helm-undeploy: # creates K8S manifest from helm chart .PHONY: helm-create-manifest -helm-create-manifest: +helm-create-manifest: helm-init helm template --namespace default oauth2-proxy-example . > oauth2-proxy-example-full.yaml diff --git a/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml index a0a6af4c..5bf137c6 100644 --- a/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml +++ b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml @@ -17,7 +17,7 @@ kind: ServiceAccount metadata: name: oauth2-proxy-example-hello-world labels: - helm.sh/chart: hello-world-1.0.0 + helm.sh/chart: hello-world-1.0.1 app.kubernetes.io/name: hello-world app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "1.0.0" @@ -29,7 +29,7 @@ kind: ServiceAccount metadata: name: oauth2-proxy-example-httpbin labels: - helm.sh/chart: httpbin-1.0.0 + helm.sh/chart: httpbin-1.0.1 app.kubernetes.io/name: httpbin app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "latest" @@ -167,7 +167,7 @@ kind: Service metadata: name: oauth2-proxy-example-hello-world labels: - helm.sh/chart: hello-world-1.0.0 + helm.sh/chart: hello-world-1.0.1 app.kubernetes.io/name: hello-world app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "1.0.0" @@ -189,7 +189,7 @@ kind: Service metadata: name: oauth2-proxy-example-httpbin labels: - helm.sh/chart: httpbin-1.0.0 + helm.sh/chart: httpbin-1.0.1 app.kubernetes.io/name: httpbin app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "latest" @@ -312,7 +312,7 @@ kind: Deployment metadata: name: oauth2-proxy-example-hello-world labels: - helm.sh/chart: hello-world-1.0.0 + helm.sh/chart: hello-world-1.0.1 app.kubernetes.io/name: hello-world app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "1.0.0" @@ -359,7 +359,7 @@ kind: Deployment metadata: name: oauth2-proxy-example-httpbin labels: - helm.sh/chart: httpbin-1.0.0 + helm.sh/chart: httpbin-1.0.1 app.kubernetes.io/name: httpbin app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "latest" @@ -495,7 +495,7 @@ kind: Ingress metadata: name: oauth2-proxy-example-hello-world labels: - helm.sh/chart: hello-world-1.0.0 + helm.sh/chart: hello-world-1.0.1 app.kubernetes.io/name: hello-world app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "1.0.0" @@ -520,7 +520,7 @@ kind: Ingress metadata: name: oauth2-proxy-example-httpbin labels: - helm.sh/chart: httpbin-1.0.0 + helm.sh/chart: httpbin-1.0.1 app.kubernetes.io/name: httpbin app.kubernetes.io/instance: oauth2-proxy-example app.kubernetes.io/version: "latest" @@ -561,45 +561,3 @@ spec: backend: serviceName: oauth2-proxy-example-oauth2-proxy-sample servicePort: 80 ---- -# Source: kubernetes/charts/hello-world/templates/tests/test-connection.yaml -apiVersion: v1 -kind: Pod -metadata: - name: "oauth2-proxy-example-hello-world-test-connection" - labels: - helm.sh/chart: hello-world-1.0.0 - app.kubernetes.io/name: hello-world - app.kubernetes.io/instance: oauth2-proxy-example - app.kubernetes.io/version: "1.0.0" - app.kubernetes.io/managed-by: Helm - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['oauth2-proxy-example-hello-world:9080'] - restartPolicy: Never ---- -# Source: kubernetes/charts/httpbin/templates/tests/test-connection.yaml -apiVersion: v1 -kind: Pod -metadata: - name: "oauth2-proxy-example-httpbin-test-connection" - labels: - helm.sh/chart: httpbin-1.0.0 - app.kubernetes.io/name: httpbin - app.kubernetes.io/instance: oauth2-proxy-example - app.kubernetes.io/version: "latest" - app.kubernetes.io/managed-by: Helm - annotations: - "helm.sh/hook": test-success -spec: - containers: - - name: wget - image: busybox - command: ['wget'] - args: ['oauth2-proxy-example-httpbin:80'] - restartPolicy: Never From 84360114e220d4ae98c11bccad1f4e06ae0091bc Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Wed, 17 Jun 2020 19:18:52 -0500 Subject: [PATCH 7/9] polish --- contrib/local-environment/kubernetes/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/local-environment/kubernetes/README.md b/contrib/local-environment/kubernetes/README.md index 7294962b..a1361a6e 100644 --- a/contrib/local-environment/kubernetes/README.md +++ b/contrib/local-environment/kubernetes/README.md @@ -21,4 +21,4 @@ Visit http://httpbin.localtest.me or http://hello-world.localtest.me/ ## Uninstall -* `make delete-cluster` OR `make helm-undeploy` for helm +* `make delete-cluster` From 8bec67beb71eb75cbd73442ced8282c9bd124af9 Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Fri, 19 Jun 2020 22:27:36 -0500 Subject: [PATCH 8/9] code review comments --- contrib/local-environment/Makefile | 6 +++--- contrib/local-environment/kubernetes/Makefile | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/contrib/local-environment/Makefile b/contrib/local-environment/Makefile index 5b43aba4..512e6fab 100644 --- a/contrib/local-environment/Makefile +++ b/contrib/local-environment/Makefile @@ -24,9 +24,9 @@ keycloak-%: .PHONY: kubernetes-up kubernetes-up: - cd kubernetes && make create-cluster - cd kubernetes && make deploy + make -C kubernetes create-cluster + make -C kubernetes deploy .PHONY: kubernetes-down kubernetes-down: - cd kubernetes && make delete-cluster + make -C kubernetes delete-cluster diff --git a/contrib/local-environment/kubernetes/Makefile b/contrib/local-environment/kubernetes/Makefile index 917207ac..55fe927b 100644 --- a/contrib/local-environment/kubernetes/Makefile +++ b/contrib/local-environment/kubernetes/Makefile @@ -63,4 +63,5 @@ helm-undeploy: # creates K8S manifest from helm chart .PHONY: helm-create-manifest helm-create-manifest: helm-init - helm template --namespace default oauth2-proxy-example . > oauth2-proxy-example-full.yaml + echo "# WARNING: This file is auto-generated by `make helm-create-manifest`! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml + helm template --namespace default oauth2-proxy-example . >> oauth2-proxy-example-full.yaml From 88a8a7053775272d7c5b1eb26c0fb7adf58bfec2 Mon Sep 17 00:00:00 2001 From: Evgeni Gordeev Date: Fri, 19 Jun 2020 22:33:40 -0500 Subject: [PATCH 9/9] update k8s manifest --- contrib/local-environment/kubernetes/Makefile | 2 +- .../local-environment/kubernetes/oauth2-proxy-example-full.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/contrib/local-environment/kubernetes/Makefile b/contrib/local-environment/kubernetes/Makefile index 55fe927b..c2ed5d29 100644 --- a/contrib/local-environment/kubernetes/Makefile +++ b/contrib/local-environment/kubernetes/Makefile @@ -63,5 +63,5 @@ helm-undeploy: # creates K8S manifest from helm chart .PHONY: helm-create-manifest helm-create-manifest: helm-init - echo "# WARNING: This file is auto-generated by `make helm-create-manifest`! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml + echo "# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml helm template --namespace default oauth2-proxy-example . >> oauth2-proxy-example-full.yaml diff --git a/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml index 5bf137c6..8ccc5977 100644 --- a/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml +++ b/contrib/local-environment/kubernetes/oauth2-proxy-example-full.yaml @@ -1,3 +1,4 @@ +# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY! --- # Source: kubernetes/charts/dex/templates/serviceaccount.yaml apiVersion: v1