From 1ddda44a0b2e675d798c103c422de93bc1323329 Mon Sep 17 00:00:00 2001 From: yasar Date: Mon, 20 Mar 2023 18:27:12 +0530 Subject: [PATCH 1/3] helmupdate --- .../hsd-oauth-proxy/templates/deployment.yaml | 24 +-------- .../templates/hsd-oauth-proxy-env-cm.yaml | 19 ++----- helm/hsd-oauth-proxy/values.yaml | 49 +++---------------- 3 files changed, 11 insertions(+), 81 deletions(-) diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml index 8b0db1ea..f1f9d283 100644 --- a/helm/hsd-oauth-proxy/templates/deployment.yaml +++ b/helm/hsd-oauth-proxy/templates/deployment.yaml @@ -35,28 +35,8 @@ spec: envFrom: - configMapRef: name: hsd-oauth-proxy-env-cm - env: - - name: OAUTH2_PROXY_CLIENT_ID - valueFrom: - secretKeyRef: - name: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_ID.secretKeyRef.name}} - key: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_ID.secretKeyRef.key}} - - name: OAUTH2_PROXY_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_SECRET.secretKeyRef.name}} - key: {{.Values.envFromSecret.OAUTH2_PROXY_CLIENT_SECRET.secretKeyRef.key}} - - name: OAUTH2_PROXY_COOKIE_SECRET - valueFrom: - secretKeyRef: - name: {{.Values.envFromSecret.OAUTH2_PROXY_COOKIE_SECRET.secretKeyRef.name}} - key: {{.Values.envFromSecret.OAUTH2_PROXY_COOKIE_SECRET.secretKeyRef.key}} - - name: OAUTH2_PROXY_REDIS_CONNECTION_URL - valueFrom: - secretKeyRef: - name: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.name}} - key: {{.Values.envFromSecret.OAUTH2_PROXY_REDIS_CONNECTION_URL.secretKeyRef.key}} - + - secretRef: + name: hsd-oauth-proxy-es {{- range $k, $v := .Values.optionalEnvVariables }} - name: {{ $k | quote }} value: {{ $v | quote }} diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml index db326b68..614965c8 100644 --- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml +++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml @@ -3,27 +3,13 @@ kind: ConfigMap metadata: name: hsd-oauth-proxy-env-cm data: - OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }} - OAUTH2_PROXY_AUTH_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING_FORMAT | quote }} - OAUTH2_PROXY_COOKIE_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_DOMAINS | quote }} + OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }} - OAUTH2_PROXY_COOKIE_NAME: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_NAME | quote }} OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }} OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }} - OAUTH2_PROXY_INTROSPECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_INTROSPECT_URL | quote }} - OAUTH2_PROXY_LOGIN_URL: {{ .Values.envVariables.OAUTH2_PROXY_LOGIN_URL | quote }} OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }} - OAUTH2_PROXY_OIDC_ISSUER_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_ISSUER_URL | quote }} - OAUTH2_PROXY_OIDC_JWKS_URL: {{ .Values.envVariables.OAUTH2_PROXY_OIDC_JWKS_URL | quote }} - OAUTH2_PROXY_PROFILE_URL: {{ .Values.envVariables.OAUTH2_PROXY_PROFILE_URL | quote }} OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }} - OAUTH2_PROXY_REDEEM_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDEEM_URL | quote }} OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }} - OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }} - OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING_FORMAT | quote }} - OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }} - OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING_FORMAT | quote }} - OAUTH2_PROXY_WHITELIST_DOMAINS: {{ .Values.envVariables.OAUTH2_PROXY_WHITELIST_DOMAINS | quote }} OAUTH2_PROXY_COOKIE_SECURE: "true" OAUTH2_PROXY_EMAIL_DOMAINS: "*" @@ -40,4 +26,5 @@ data: OAUTH2_PROXY_PROVIDER: "oidc" OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc" OAUTH2_PROXY_SESSION_STORE_TYPE: "redis" - OAUTH2_PROXY_UPSTREAMS: "static://" \ No newline at end of file + OAUTH2_PROXY_UPSTREAMS: "static://" + OAUTH2_PROXY_REDIS_USE_CLUSTER: "true" \ No newline at end of file diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml index 64487da4..e7eafb78 100644 --- a/helm/hsd-oauth-proxy/values.yaml +++ b/helm/hsd-oauth-proxy/values.yaml @@ -64,52 +64,15 @@ nodeSelector: {} tolerations: [] affinity: {} - -envFromSecret: - OAUTH2_PROXY_CLIENT_ID: - secretKeyRef: - name: oauth-secrets - key: clientId - OAUTH2_PROXY_CLIENT_SECRET: - secretKeyRef: - name: oauth-secrets - key: clientSecret - OAUTH2_PROXY_COOKIE_SECRET: - secretKeyRef: - name: oauth-secrets - key: cookieSecret - OAUTH2_PROXY_REDIS_CONNECTION_URL: - secretKeyRef: - name: redis - key: oauthRedisConnectionUrl - + envVariables: - #mandatory input variables - OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS: "redis://hsd-development-cluster-pfm.qvw0di.0001.use1.cache.amazonaws.com:6379" - OAUTH2_PROXY_REDIS_USE_CLUSTER: "true" - OAUTH2_PROXY_COOKIE_DOMAINS: "cardioorg-test.us-east.philips-healthsuite.com" - OAUTH2_PROXY_COOKIE_NAME: "edi_session_edi-platform-foundationeks" - OAUTH2_PROXY_LOGIN_URL: "https://foundation-client-test.us-east.philips-healthsuite.com/loginapp" - OAUTH2_PROXY_OIDC_ISSUER_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2" - OAUTH2_PROXY_OIDC_JWKS_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/jwks" - OAUTH2_PROXY_PROFILE_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/userinfo" - OAUTH2_PROXY_INTROSPECT_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v4/introspect" - OAUTH2_PROXY_REDEEM_URL: "https://iam-client-test.us-east.philips-healthsuite.com/authorize/oauth2/v2/token" - OAUTH2_PROXY_WHITELIST_DOMAINS: "cardioorg-test.us-east.philips-healthsuite.com" - OAUTH2_PROXY_PROXY_PREFIX: "" - OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback" - #optional input variables with default values - OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" - OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080" #Any change in port number needs to be updated in service port OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090" #Any change in port number needs to be updated in service port - OAUTH2_PROXY_AUTH_LOGGING: "true" - OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}" - OAUTH2_PROXY_REQUEST_LOGGING: "true" - OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}" - OAUTH2_PROXY_STANDARD_LOGGING: "true" - OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}" - + OAUTH2_PROXY_PROXY_PREFIX: "" + OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback" + OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" + OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" + #Any additional OAuth2 specific enviroment variables can be passed here optionalEnvVariables: {} \ No newline at end of file From f26b920573e73ff3faf20a8512f88c89dbe7b6f8 Mon Sep 17 00:00:00 2001 From: yasar Date: Mon, 20 Mar 2023 20:01:51 +0530 Subject: [PATCH 2/3] valuesyamlupdate --- .../templates/hsd-oauth-proxy-env-cm.yaml | 9 +++++++-- helm/hsd-oauth-proxy/values.yaml | 14 ++++++++++---- 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml index 614965c8..7c51f50e 100644 --- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml +++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml @@ -10,7 +10,10 @@ data: OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }} OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }} OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }} - + OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }} + OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }} + OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }} + OAUTH2_PROXY_COOKIE_SECURE: "true" OAUTH2_PROXY_EMAIL_DOMAINS: "*" OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" @@ -27,4 +30,6 @@ data: OAUTH2_PROXY_PROVIDER_DISPLAY_NAME: "oidc" OAUTH2_PROXY_SESSION_STORE_TYPE: "redis" OAUTH2_PROXY_UPSTREAMS: "static://" - OAUTH2_PROXY_REDIS_USE_CLUSTER: "true" \ No newline at end of file + OAUTH2_PROXY_STANDARD_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|[{{.Timestamp}}] [{{.File}}] {{.Message}}" + OAUTH2_PROXY_REQUEST_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}" + OAUTH2_PROXY_AUTH_LOGGING_FORMAT: "info|CustomLogEvent||OAuth2Proxy|{{.Client}} - [{{.Timestamp}}] [{{.Status}}] {{.Message}}" \ No newline at end of file diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml index e7eafb78..5be65007 100644 --- a/helm/hsd-oauth-proxy/values.yaml +++ b/helm/hsd-oauth-proxy/values.yaml @@ -66,13 +66,19 @@ tolerations: [] affinity: {} envVariables: - #optional input variables with default values + #Input variables with default values OAUTH2_PROXY_HTTP_ADDRESS: "0.0.0.0:8080" #Any change in port number needs to be updated in service port OAUTH2_PROXY_METRICS_ADDRESS: "0.0.0.0:9090" #Any change in port number needs to be updated in service port - OAUTH2_PROXY_PROXY_PREFIX: "" - OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback" + + OAUTH2_PROXY_PROXY_PREFIX: "" #eg: //oauth2 + OAUTH2_PROXY_REDIRECT_URL: "/oauth2/callback" #eg: //oauth2/callback + OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" - + + OAUTH2_PROXY_STANDARD_LOGGING: false + OAUTH2_PROXY_REQUEST_LOGGING: false + OAUTH2_PROXY_AUTH_LOGGING: false + #Any additional OAuth2 specific enviroment variables can be passed here optionalEnvVariables: {} \ No newline at end of file From b8dac5f907bd101eb381b2d6a6de1fd346d2b410 Mon Sep 17 00:00:00 2001 From: yasar Date: Tue, 21 Mar 2023 12:22:46 +0530 Subject: [PATCH 3/3] updated deployment.yaml --- .../hsd-oauth-proxy/templates/deployment.yaml | 4 ++-- .../templates/hsd-oauth-proxy-env-cm.yaml | 11 ----------- .../hsd-oauth-proxy-externalsecret.yaml | 19 +++++++++++++++++++ helm/hsd-oauth-proxy/values.yaml | 11 +++++------ 4 files changed, 26 insertions(+), 19 deletions(-) create mode 100644 helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-externalsecret.yaml diff --git a/helm/hsd-oauth-proxy/templates/deployment.yaml b/helm/hsd-oauth-proxy/templates/deployment.yaml index f1f9d283..a48c69db 100644 --- a/helm/hsd-oauth-proxy/templates/deployment.yaml +++ b/helm/hsd-oauth-proxy/templates/deployment.yaml @@ -36,8 +36,8 @@ spec: - configMapRef: name: hsd-oauth-proxy-env-cm - secretRef: - name: hsd-oauth-proxy-es - {{- range $k, $v := .Values.optionalEnvVariables }} + name: hsd-oauth-proxy-externalsecret + {{- range $k, $v := .Values.envVariables }} - name: {{ $k | quote }} value: {{ $v | quote }} {{- end }} diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml index 7c51f50e..1e0a6b87 100644 --- a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml +++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-env-cm.yaml @@ -3,17 +3,6 @@ kind: ConfigMap metadata: name: hsd-oauth-proxy-env-cm data: - - OAUTH2_PROXY_COOKIE_EXPIRE: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_EXPIRE | quote }} - OAUTH2_PROXY_COOKIE_REFRESH: {{ .Values.envVariables.OAUTH2_PROXY_COOKIE_REFRESH | quote }} - OAUTH2_PROXY_HTTP_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_HTTP_ADDRESS | quote }} - OAUTH2_PROXY_METRICS_ADDRESS: {{ .Values.envVariables.OAUTH2_PROXY_METRICS_ADDRESS | quote }} - OAUTH2_PROXY_PROXY_PREFIX: {{ .Values.envVariables.OAUTH2_PROXY_PROXY_PREFIX | quote }} - OAUTH2_PROXY_REDIRECT_URL: {{ .Values.envVariables.OAUTH2_PROXY_REDIRECT_URL | quote }} - OAUTH2_PROXY_STANDARD_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_STANDARD_LOGGING | quote }} - OAUTH2_PROXY_REQUEST_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_REQUEST_LOGGING | quote }} - OAUTH2_PROXY_AUTH_LOGGING: {{ .Values.envVariables.OAUTH2_PROXY_AUTH_LOGGING | quote }} - OAUTH2_PROXY_COOKIE_SECURE: "true" OAUTH2_PROXY_EMAIL_DOMAINS: "*" OAUTH2_PROXY_INSECURE_OIDC_ALLOW_UNVERIFIED_EMAIL: "true" diff --git a/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-externalsecret.yaml b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-externalsecret.yaml new file mode 100644 index 00000000..554eef01 --- /dev/null +++ b/helm/hsd-oauth-proxy/templates/hsd-oauth-proxy-externalsecret.yaml @@ -0,0 +1,19 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: hsd-oauth-proxy-externalsecret +spec: + secretStoreRef: + name: aws-parameter-cluster-store + kind: ClusterSecretStore + refreshInterval: "10m" + target: + name: hsd-oauth-proxy-externalsecret + creationPolicy: 'Owner' + dataFrom: + - extract: + key: {{ .Values.secretStoreBasePath}}/authgateway/oauthproxy-secrets + - extract: + key: {{ .Values.secretStoreBasePath}}/authgateway/oauth-cookiedomain-env + - extract: + key: {{ .Values.secretStoreBasePath}}/authgateway/oauth-whitelistdomain-env \ No newline at end of file diff --git a/helm/hsd-oauth-proxy/values.yaml b/helm/hsd-oauth-proxy/values.yaml index 5be65007..1678b5dd 100644 --- a/helm/hsd-oauth-proxy/values.yaml +++ b/helm/hsd-oauth-proxy/values.yaml @@ -76,9 +76,8 @@ envVariables: OAUTH2_PROXY_COOKIE_EXPIRE: "24h0m0s" OAUTH2_PROXY_COOKIE_REFRESH: "0h28m0s" - OAUTH2_PROXY_STANDARD_LOGGING: false - OAUTH2_PROXY_REQUEST_LOGGING: false - OAUTH2_PROXY_AUTH_LOGGING: false - -#Any additional OAuth2 specific enviroment variables can be passed here -optionalEnvVariables: {} \ No newline at end of file + OAUTH2_PROXY_STANDARD_LOGGING: "false" + OAUTH2_PROXY_REQUEST_LOGGING: "false" + OAUTH2_PROXY_AUTH_LOGGING: "false" + + #Any additional OAuth2 specific enviroment variables can be added here