diff --git a/helm/hsd-oauth-proxy/Chart.yaml b/helm/hsd-oauth-proxy/Chart.yaml index 4c29a6bd..f1d7d5e6 100644 --- a/helm/hsd-oauth-proxy/Chart.yaml +++ b/helm/hsd-oauth-proxy/Chart.yaml @@ -1,24 +1,6 @@ apiVersion: v2 name: hsd-oauth-proxy -description: A Helm chart for Kubernetes - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. +description: A Helm chart to deploy hsd auth gateway oauth proxy type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) version: 0.1.0 - -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. appVersion: "1.0.20-rc" diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml index 7f324abd..77c39e9c 100644 --- a/helm/hsd-oauth-proxy/templates/deployment.yaml +++ b/helm/hsd-oauth-proxy/templates/deployment.yaml @@ -24,7 +24,6 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} - serviceAccountName: {{ include "hsd-oauth-proxy.serviceAccountName" . }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: @@ -42,7 +41,7 @@ spec: - name: {{ $k | quote }} value: {{ $v | quote }} {{- end }} - + {{- range $k, $v := .Values.OptionalEnvVariables }} - name: {{ $k | quote }} value: {{ $v | quote }} diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml deleted file mode 100644 index 91960031..00000000 --- a/helm/hsd-oauth-proxy/templates/hsd-oauth-env-cm.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: hsd-oauth-env-cm -data: - OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }} - OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }} - OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }} - OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }} - OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }} - OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }} - OAUTH2_PROXY_COOKIE_SECURE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_SECURE | quote }} - OAUTH2_PROXY_EMAIL_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_EMAIL_DOMAINS | quote }} - OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }} - OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL | quote }} - OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: {{ .Values.envVariables.OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION | quote }} - OAUTH2_PROXY_INTROSPECT_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v4/introspect" - OAUTH2_PROXY_LOGIN_URL: "https://foundation-client-test.us-east.philips-healthsuite.com/loginapp" - OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }} - OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }} - OAUTH2_PROXY_OIDC_JWKS_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/jwks" - OAUTH2_PROXY_PASS_ACCESS_TOKEN: {{ .Values.envVariables.OAUTH2_PROXY_PASS_ACCESS_TOKEN | quote }} - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER | quote }} - OAUTH2_PROXY_PASS_BASIC_AUTH: {{ .Values.envVariables.OAUTH2_PROXY_PASS_BASIC_AUTH | quote }} - OAUTH2_PROXY_PROFILE_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/userinfo" - OAUTH2_PROXY_PROVIDER: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER | quote }} - OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: {{ .Values.envVariables.OAUTH2_PROXY_PROVIDER_DISPLAY_NAME | quote }} - OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }} - OAUTH2_PROXY_REDEEM_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/token" - OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }} - OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }} - OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }} - OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }} - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: {{ .Values.envVariables.OAUTH2_PROXY_SET_AUTHORIZATION_HEADER | quote }} - OAUTH2_PROXY_SET_INTROSPECTION_VALUE: {{ .Values.envVariables.OAUTH2_PROXY_SET_INTROSPECTION_VALUE | quote }} - OAUTH2_PROXY_SET_XAUTHREQUEST: {{ .Values.envVariables.OAUTH2_PROXY_SET_XAUTHREQUEST | quote }} - OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true" - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: {{ .Values.envVariables.OAUTH2_PROXY_SKIP_PROVIDER_BUTTON | quote }} - OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }} - OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }} - OAUTH2_PROXY_UPSTREAMS: {{ .Values.envVariables.OAUTH2_PROXY_UPSTREAMS | quote }} - OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }} diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml new file mode 100644 index 00000000..b370a398 --- /dev/null +++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: hsd-oauth-proxy-env-cm +data: + OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }} + OAUTH2_PROXY_AUTH_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING_FORMAT | quote }} + OAUTH2_PROXY_CLIENT_ID: {{ .Values.envVariables.OAUTH2_PROXY_CLIENT_ID | quote }} + OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }} + OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }} + OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }} + OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }} + OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }} + OAUTH2_PROXY_INTROSPECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_INTROSPECT_URL | quote }} + OAUTH2_PROXY_LOGIN_URL: {{ .Values.envVariables.OAUTH2_PROXY_LOGIN_URL | quote }} + OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }} + OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }} + OAUTH2_PROXY_OIDC_JWKS_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_JWKS_URL | quote }} + OAUTH2_PROXY_PROFILE_URL: {{ .Values.envVariables.OAUTH2_PROXY_PROFILE_URL | quote }} + OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }} + OAUTH2_PROXY_REDEEM_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDEEM_URL | quote }} + OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }} + OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }} + OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }} + OAUTH2_PROXY_SESSION_STORE_TYPE: {{ .Values.envVariables.OAUTH2_PROXY_SESSION_STORE_TYPE | quote }} + OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }} + OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }} + OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }} + + OAUTH2_PROXY_COOKIE_SECURE: "true" + OAUTH2_PROXY_EMAIL_DOMAINS: "*" + OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" + OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true" + OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true" + OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true" + OAUTH2_PROXY_PASS_BASIC_AUTH: "true" + OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true" + OAUTH2_PROXY_SET_INTROSPECTION_VALUE: "true" + OAUTH2_PROXY_SET_XAUTHREQUEST: "true" + OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true" + OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true" + OAUTH2_PROXY_PROVIDER: "oidc" + OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc" + OAUTH2_PROXY_SESSION_STORE_TYPE: "redis" + OAUTH2_PROXY_UPSTREAMS: "static://" \ No newline at end of file diff --git a/helm/hsd-oauth-proxy/templates/ingress.yaml b/helm/hsd-oauth-proxy/templates/ingress.yaml deleted file mode 100644 index 73199fee..00000000 --- a/helm/hsd-oauth-proxy/templates/ingress.yaml +++ /dev/null @@ -1,61 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "hsd-oauth-proxy.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} - {{- end }} -{{- end }} -{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "hsd-oauth-proxy.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} - ingressClassName: {{ .Values.ingress.className }} - {{- end }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ .path }} - {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} - pathType: {{ .pathType }} - {{- end }} - backend: - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - service: - name: {{ $fullName }} - port: - number: {{ $svcPort }} - {{- else }} - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/helm/hsd-oauth-proxy/templates/service.yaml b/helm/hsd-oauth-proxy/templates/service.yaml index fe881e5f..24c833d7 100644 --- a/helm/hsd-oauth-proxy/templates/service.yaml +++ b/helm/hsd-oauth-proxy/templates/service.yaml @@ -7,9 +7,10 @@ metadata: spec: type: {{ .Values.service.type }} ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http + {{- range $key, $value := .Values.service.ports }} + - name: {{ $key }} +{{ toYaml $value | indent 6 }} + {{- end }} + selector: {{- include "hsd-oauth-proxy.selectorLabels" . | nindent 4 }} diff --git a/helm/hsd-oauth-proxy/templates/serviceaccount.yaml b/helm/hsd-oauth-proxy/templates/serviceaccount.yaml deleted file mode 100644 index c80791e2..00000000 --- a/helm/hsd-oauth-proxy/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "hsd-oauth-proxy.serviceAccountName" . }} - labels: - {{- include "hsd-oauth-proxy.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml index 180be8b0..9d49097e 100644 --- a/helm/hsd-oauth-proxy/values.yaml +++ b/helm/hsd-oauth-proxy/values.yaml @@ -14,15 +14,6 @@ imagePullSecrets: [] nameOverride: "" fullnameOverride: "" -serviceAccount: - # Specifies whether a service account should be created - create: false - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - podAnnotations: {} podSecurityContext: {} @@ -39,22 +30,15 @@ securityContext: {} service: type: ClusterIP port: 8080 - -ingress: - enabled: false - className: "" - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: chart-example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local + ports: + web1: + port: 8080 + targetPort: 8080 + protocol: TCP + web2: + port: 9090 + targetPort: 9090 + protocol: TCP resources: {} # We usually recommend not to specify default resources and to leave this as a conscious @@ -82,48 +66,36 @@ tolerations: [] affinity: {} envSecrets: + #mandatory secrets OAUTH2_PROXY_CLIENT_SECRET: "" OAUTH2_PROXY_COOKIE_SECRET: "" OAUTH2_PROXY_REDIS_CONNECTION_URL: "" envVariables: - OAUTH2_PROXY_AUTH_LOGGING: "true" - OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}" + #mandatory input variables OAUTH2_PROXY_CLIENT_ID: "" OAUTH2_PROXY_COOKIE_DOMAINS: "" - OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" - OAUTH2_PROXY_COOKIE_NAME: "edi_session_wfm-ci" - OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" - OAUTH2_PROXY_COOKIE_SECURE: "true" - OAUTH2_PROXY_EMAIL_DOMAINS: "*" - OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080" - OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" - OAUTH2_PROXY_INSECURE_OIDC_SKIP_ISSUER_VERIFICATION: "true" - OAUTH2_PROXY_INTROSPECT_URL: "" + OAUTH2_PROXY_COOKIE_NAME: "" OAUTH2_PROXY_LOGIN_URL: "" - OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090" OAUTH2_PROXY_OIDC_ISSUER_URL: "" OAUTH2_PROXY_OIDC_JWKS_URL: "" - OAUTH2_PROXY_PASS_ACCESS_TOKEN: "true" - OAUTH2_PROXY_PASS_AUTHORIZATION_HEADER: "true" - OAUTH2_PROXY_PASS_BASIC_AUTH: "true" OAUTH2_PROXY_PROFILE_URL: "" - OAUTH2_PROXY_PROVIDER: "oidc" - OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc" - OAUTH2_PROXY_PROXY_PREFIX: "" + OAUTH2_PROXY_INTROSPECT_URL: "" OAUTH2_PROXY_REDEEM_URL: "" + OAUTH2_PROXY_WHITELIST_DOMAINS: "" + OAUTH2_PROXY_PROXY_PREFIX: "" OAUTH2_PROXY_REDIRECT_URL: "" + + #optional input variables with default values + OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" + OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" + OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080" #Any change in port number needs to be updated in service port + OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090" #Any change in port number needs to be updated in service port + OAUTH2_PROXY_AUTH_LOGGING: "true" + OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}" OAUTH2_PROXY_REQUEST_LOGGING: "true" OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}" - OAUTH2_PROXY_SESSION_STORE_TYPE: "redis" - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER: "true" - OAUTH2_PROXY_SET_INTROSPECTION_VALUE: "true" - OAUTH2_PROXY_SET_XAUTHREQUEST: "true" - OAUTH2_PROXY_SKIP_OIDC_DISCOVERY: "true" - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON: "true" OAUTH2_PROXY_STANDARD_LOGGING: "true" OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}" - OAUTH2_PROXY_UPSTREAMS: "static://" - OAUTH2_PROXY_WHITELIST_DOMAINS: "" - + OptionalEnvVariables: {} \ No newline at end of file