0f343cf · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

helm kubernetes example based on kind cluster

commit0f343cf0adcd457eeff479787f683cc82992e462 authorEvgeni Gordeev <egordeev@conserviscorp.com> dateFri 12 Jun 2020, 13:12 (6 years ago) parent160bbaf

22 files changed+830

compare with master

unifiedsplit

contrib/helm/.gitignore+1 contrib/helm/Chart.lock+15 contrib/helm/Chart.yaml+20 contrib/helm/Makefile+44 contrib/helm/README.md+23 contrib/helm/custom-dns.yaml+30 contrib/helm/hello-world/Chart.yaml+23 contrib/helm/hello-world/templates/_helpers.tpl+63 contrib/helm/hello-world/templates/deployment.yaml+61 contrib/helm/hello-world/templates/ingress.yaml+41 contrib/helm/hello-world/templates/service.yaml+15 contrib/helm/hello-world/templates/serviceaccount.yaml+12 contrib/helm/hello-world/values.yaml+79 contrib/helm/httpbin/Chart.yaml+23 contrib/helm/httpbin/templates/_helpers.tpl+63 contrib/helm/httpbin/templates/deployment.yaml+61 contrib/helm/httpbin/templates/ingress.yaml+41 contrib/helm/httpbin/templates/service.yaml+15 contrib/helm/httpbin/templates/serviceaccount.yaml+12 contrib/helm/httpbin/values.yaml+79 contrib/helm/kind-cluster.yaml+14 contrib/helm/values.yaml+95

contrib/helm/.gitignorenew file+1

@@ -0,0 +1 @@

1+charts/

contrib/helm/Chart.locknew file+15

@@ -0,0 +1,15 @@

1+dependencies:

2+- name: dex

3+ repository: https://kubernetes-charts.storage.googleapis.com

4+ version: 2.11.0

5+- name: oauth2-proxy

6+ repository: https://kubernetes-charts.storage.googleapis.com

7+ version: 3.1.0

8+- name: httpbin

9+ repository: file://./httpbin

10+ version: 0.6.1

11+- name: hello-world

12+ repository: file://./hello-world

13+ version: 0.0.1

14+digest: sha256:b5fe4db7a523b28321708a12ae0d2608ea32836b322ae7941c820b626a180af2

15+generated: "2020-06-12T13:10:21.718689-05:00"

contrib/helm/Chart.yamlnew file+20

@@ -0,0 +1,20 @@

1+apiVersion: v2

2+description: K8S example based on https://kind.sigs.k8s.io and https://helm.sh.

3+name: helm

4+version: 5.1.1

5+appVersion: 5.1.1

6+# helm search repo -l stable/nginx-ingress | head -n 5

7+dependencies:

8+ - name: dex

9+ version: 2.11.0

10+ repository: https://kubernetes-charts.storage.googleapis.com

11+ - name: oauth2-proxy

12+ version: 3.1.0

13+ repository: https://kubernetes-charts.storage.googleapis.com

14+ # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now creating our own chart

15+ - name: httpbin

16+ version: 0.6.1

17+ repository: file://./httpbin

18+ - name: hello-world

19+ version: 0.0.1

20+ repository: file://./hello-world

contrib/helm/Makefilenew file+44

@@ -0,0 +1,44 @@

1+# create kind cluster with nginx-ingress as the most popular ingress controller for K8S

2+.PHONY: deploy

3+create-cluster:

4+ kind create cluster --name oauth2-proxy --config kind-cluster.yaml

5+ make setup-dns

6+ make setup-ingress

8+.PHONY: setup-ingress

9+setup-ingress:

10+ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml

11+ sleep 5 # because of https://github.com/kubernetes/kubernetes/issues/83242

12+ kubectl --namespace ingress-nginx wait --for=condition=available --timeout=30s deployment/ingress-nginx-controller

13+ kubectl --namespace ingress-nginx rollout status --timeout 90s deployment/ingress-nginx-controller

14+

15+# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/master/pkg/apis/config/v1alpha4/default.go

16+# what makes cluster host IP equal to 10.244.0.1

17+# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP

18+# NOT NEEDED IN REAL LIFE!

19+.PHONY: setup-dns

20+setup-dns:

21+ kubectl apply -f custom-dns.yaml

22+ kubectl -n kube-system rollout restart deployment/coredns

23+ kubectl -n kube-system rollout status --timeout 60s deployment/coredns

24+

25+.PHONY: undeploy

26+delete-cluster:

27+ kind delete cluster --name oauth2-proxy

28+

29+.PHONY: helm-init

30+helm-init:

31+ helm dep update

32+

33+.PHONY: undeploy

34+deploy: helm-init

35+ helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example .

36+

37+.PHONY: undeploy

38+undeploy:

39+ helm del oauth2-proxy-example

40+

41+# unpacking is useful to be able to explore underlying helm charts

42+.PHONY: helm-unpack

43+helm-unpack:

44+ cd charts; for f in *.tgz; do tar -zxf "$$f"; done

contrib/helm/README.mdnew file+23

@@ -0,0 +1,23 @@

1+# Kubernetes example

2+Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster and the package manager [helm](https://helm.sh).

5+## Quick start

7+Before you start:

9+_Required_

10+* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)

11+* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm).

12+* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)

13+

14+Then:

15+

16+* `make create-cluster`

17+* `make deploy`

18+

19+Visit http://httpbin.localtest.me or http://hello-world.localtest.me/

20+

21+## Uninstall

22+

23+* `make delete-cluster`

contrib/helm/custom-dns.yamlnew file+30

@@ -0,0 +1,30 @@

1+apiVersion: v1

2+data:

3+ Corefile: |

4+ .:53 {

5+ errors

6+ health {

7+ lameduck 5s

8+ }

9+ ready

10+ kubernetes cluster.local in-addr.arpa ip6.arpa {

11+ pods insecure

12+ fallthrough in-addr.arpa ip6.arpa

13+ ttl 30

14+ }

15+ prometheus :9153

16+ forward . /etc/resolv.conf

17+ cache 30

18+ loop

19+ reload

20+ loadbalance

21+ hosts {

22+ 10.244.0.1 dex.localtest.me

23+ 10.244.0.1 oauth2-proxy.localtest.me

24+ fallthrough

25+ }

26+ }

27+kind: ConfigMap

28+metadata:

29+ name: coredns

30+ namespace: kube-system

contrib/helm/hello-world/Chart.yamlnew file+23

@@ -0,0 +1,23 @@

1+apiVersion: v2

2+name: hello-world

3+description: A Helm chart for Kubernetes

5+# A chart can be either an 'application' or a 'library' chart.

6+#

7+# Application charts are a collection of templates that can be packaged into versioned archives

8+# to be deployed.

9+#

10+# Library charts provide useful utilities or functions for the chart developer. They're included as

11+# a dependency of application charts to inject those utilities and functions into the rendering

12+# pipeline. Library charts do not define any templates and therefore cannot be deployed.

13+type: application

14+

15+# This is the chart version. This version number should be incremented each time you make changes

16+# to the chart and its templates, including the app version.

17+# Versions are expected to follow Semantic Versioning (https://semver.org/)

18+version: 0.0.1

19+

20+# This is the version number of the application being deployed. This version number should be

21+# incremented each time you make changes to the application. Versions are not expected to

22+# follow Semantic Versioning. They should reflect the version the application is using.

23+appVersion: 0.0.1

contrib/helm/hello-world/templates/_helpers.tplnew file+63

@@ -0,0 +1,63 @@

1+{{/* vim: set filetype=mustache: */}}

2+{{/*

3+Expand the name of the chart.

4+*/}}

5+{{- define "helloWorld.name" -}}

6+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}

7+{{- end }}

9+{{/*

10+Create a default fully qualified app name.

11+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).

12+If release name contains chart name it will be used as a full name.

13+*/}}

14+{{- define "helloWorld.fullname" -}}

15+{{- if .Values.fullnameOverride }}

16+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}

17+{{- else }}

18+{{- $name := default .Chart.Name .Values.nameOverride }}

19+{{- if contains $name .Release.Name }}

20+{{- .Release.Name | trunc 63 | trimSuffix "-" }}

21+{{- else }}

22+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}

23+{{- end }}

24+{{- end }}

25+{{- end }}

26+

27+{{/*

28+Create chart name and version as used by the chart label.

29+*/}}

30+{{- define "helloWorld.chart" -}}

31+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}

32+{{- end }}

33+

34+{{/*

35+Common labels

36+*/}}

37+{{- define "helloWorld.labels" -}}

38+helm.sh/chart: {{ include "helloWorld.chart" . }}

39+{{ include "helloWorld.selectorLabels" . }}

40+{{- if .Chart.AppVersion }}

41+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

42+{{- end }}

43+app.kubernetes.io/managed-by: {{ .Release.Service }}

44+{{- end }}

45+

46+{{/*

47+Selector labels

48+*/}}

49+{{- define "helloWorld.selectorLabels" -}}

50+app.kubernetes.io/name: {{ include "helloWorld.name" . }}

51+app.kubernetes.io/instance: {{ .Release.Name }}

52+{{- end }}

53+

54+{{/*

55+Create the name of the service account to use

56+*/}}

57+{{- define "helloWorld.serviceAccountName" -}}

58+{{- if .Values.serviceAccount.create }}

59+{{- default (include "helloWorld.fullname" .) .Values.serviceAccount.name }}

60+{{- else }}

61+{{- default "default" .Values.serviceAccount.name }}

62+{{- end }}

63+{{- end }}

contrib/helm/hello-world/templates/deployment.yamlnew file+61

@@ -0,0 +1,61 @@

1+apiVersion: apps/v1

2+kind: Deployment

3+metadata:

4+ name: {{ include "helloWorld.fullname" . }}

5+ labels:

6+ {{- include "helloWorld.labels" . | nindent 4 }}

7+spec:

8+{{- if not .Values.autoscaling.enabled }}

9+ replicas: {{ .Values.replicaCount }}

10+{{- end }}

11+ selector:

12+ matchLabels:

13+ {{- include "helloWorld.selectorLabels" . | nindent 6 }}

14+ template:

15+ metadata:

16+ {{- with .Values.podAnnotations }}

17+ annotations:

18+ {{- toYaml . | nindent 8 }}

19+ {{- end }}

20+ labels:

21+ {{- include "helloWorld.selectorLabels" . | nindent 8 }}

22+ spec:

23+ {{- with .Values.imagePullSecrets }}

24+ imagePullSecrets:

25+ {{- toYaml . | nindent 8 }}

26+ {{- end }}

27+ serviceAccountName: {{ include "helloWorld.serviceAccountName" . }}

28+ securityContext:

29+ {{- toYaml .Values.podSecurityContext | nindent 8 }}

30+ containers:

31+ - name: {{ .Chart.Name }}

32+ securityContext:

33+ {{- toYaml .Values.securityContext | nindent 12 }}

34+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

35+ imagePullPolicy: {{ .Values.image.pullPolicy }}

36+ ports:

37+ - name: http

38+ containerPort: 80

39+ protocol: TCP

40+ livenessProbe:

41+ httpGet:

42+ path: /

43+ port: http

44+ readinessProbe:

45+ httpGet:

46+ path: /

47+ port: http

48+ resources:

49+ {{- toYaml .Values.resources | nindent 12 }}

50+ {{- with .Values.nodeSelector }}

51+ nodeSelector:

52+ {{- toYaml . | nindent 8 }}

53+ {{- end }}

54+ {{- with .Values.affinity }}

55+ affinity:

56+ {{- toYaml . | nindent 8 }}

57+ {{- end }}

58+ {{- with .Values.tolerations }}

59+ tolerations:

60+ {{- toYaml . | nindent 8 }}

61+ {{- end }}

contrib/helm/hello-world/templates/ingress.yamlnew file+41

@@ -0,0 +1,41 @@

1+{{- if .Values.ingress.enabled -}}

2+{{- $fullName := include "helloWorld.fullname" . -}}

3+{{- $svcPort := .Values.service.port -}}

4+{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}

5+apiVersion: networking.k8s.io/v1beta1

6+{{- else -}}

7+apiVersion: extensions/v1beta1

8+{{- end }}

9+kind: Ingress

10+metadata:

11+ name: {{ $fullName }}

12+ labels:

13+ {{- include "helloWorld.labels" . | nindent 4 }}

14+ {{- with .Values.ingress.annotations }}

15+ annotations:

16+ {{- toYaml . | nindent 4 }}

17+ {{- end }}

18+spec:

19+ {{- if .Values.ingress.tls }}

20+ tls:

21+ {{- range .Values.ingress.tls }}

22+ - hosts:

23+ {{- range .hosts }}

24+ - {{ . | quote }}

25+ {{- end }}

26+ secretName: {{ .secretName }}

27+ {{- end }}

28+ {{- end }}

29+ rules:

30+ {{- range .Values.ingress.hosts }}

31+ - host: {{ .host | quote }}

32+ http:

33+ paths:

34+ {{- range .paths }}

35+ - path: {{ . }}

36+ backend:

37+ serviceName: {{ $fullName }}

38+ servicePort: {{ $svcPort }}

39+ {{- end }}

40+ {{- end }}

41+ {{- end }}

contrib/helm/hello-world/templates/service.yamlnew file+15

@@ -0,0 +1,15 @@

1+apiVersion: v1

2+kind: Service

3+metadata:

4+ name: {{ include "helloWorld.fullname" . }}

5+ labels:

6+ {{- include "helloWorld.labels" . | nindent 4 }}

7+spec:

8+ type: {{ .Values.service.type }}

9+ ports:

10+ - port: {{ .Values.service.port }}

11+ targetPort: http

12+ protocol: TCP

13+ name: http

14+ selector:

15+ {{- include "helloWorld.selectorLabels" . | nindent 4 }}

contrib/helm/hello-world/templates/serviceaccount.yamlnew file+12

@@ -0,0 +1,12 @@

1+{{- if .Values.serviceAccount.create -}}

2+apiVersion: v1

3+kind: ServiceAccount

4+metadata:

5+ name: {{ include "helloWorld.serviceAccountName" . }}

6+ labels:

7+ {{- include "helloWorld.labels" . | nindent 4 }}

8+ {{- with .Values.serviceAccount.annotations }}

9+ annotations:

10+ {{- toYaml . | nindent 4 }}

11+ {{- end }}

12+{{- end }}

contrib/helm/hello-world/values.yamlnew file+79

@@ -0,0 +1,79 @@

1+# Default values for helloWorld.

2+# This is a YAML-formatted file.

3+# Declare variables to be passed into your templates.

5+replicaCount: 1

7+image:

8+ repository: tutum/hello-world

9+ pullPolicy: IfNotPresent

10+ # Overrides the image tag whose default is the chart version.

11+ tag: latest

12+

13+imagePullSecrets: []

14+nameOverride: ""

15+fullnameOverride: ""

16+

17+serviceAccount:

18+ # Specifies whether a service account should be created

19+ create: true

20+ # Annotations to add to the service account

21+ annotations: {}

22+ # The name of the service account to use.

23+ # If not set and create is true, a name is generated using the fullname template

24+ name: ""

25+

26+podAnnotations: {}

27+

28+podSecurityContext: {}

29+ # fsGroup: 2000

30+

31+securityContext: {}

32+ # capabilities:

33+ # drop:

34+ # - ALL

35+ # readOnlyRootFilesystem: true

36+ # runAsNonRoot: true

37+ # runAsUser: 1000

38+

39+service:

40+ type: ClusterIP

41+ port: 80

42+

43+ingress:

44+ enabled: false

45+ annotations: {}

46+ # kubernetes.io/ingress.class: nginx

47+ # kubernetes.io/tls-acme: "true"

48+ hosts:

49+ - host: chart-example.local

50+ paths: []

51+ tls: []

52+ # - secretName: chart-example-tls

53+ # hosts:

54+ # - chart-example.local

55+

56+resources: {}

57+ # We usually recommend not to specify default resources and to leave this as a conscious

58+ # choice for the user. This also increases chances charts run on environments with little

59+ # resources, such as Minikube. If you do want to specify resources, uncomment the following

60+ # lines, adjust them as necessary, and remove the curly braces after 'resources:'.

61+ # limits:

62+ # cpu: 100m

63+ # memory: 128Mi

64+ # requests:

65+ # cpu: 100m

66+ # memory: 128Mi

67+

68+autoscaling:

69+ enabled: false

70+ minReplicas: 1

71+ maxReplicas: 100

72+ targetCPUUtilizationPercentage: 80

73+ # targetMemoryUtilizationPercentage: 80

74+

75+nodeSelector: {}

76+

77+tolerations: []

78+

79+affinity: {}

contrib/helm/httpbin/Chart.yamlnew file+23

@@ -0,0 +1,23 @@

1+apiVersion: v2

2+name: httpbin

3+description: A Helm chart for Kubernetes

5+# A chart can be either an 'application' or a 'library' chart.

6+#

7+# Application charts are a collection of templates that can be packaged into versioned archives

8+# to be deployed.

9+#

10+# Library charts provide useful utilities or functions for the chart developer. They're included as

11+# a dependency of application charts to inject those utilities and functions into the rendering

12+# pipeline. Library charts do not define any templates and therefore cannot be deployed.

13+type: application

14+

15+# This is the chart version. This version number should be incremented each time you make changes

16+# to the chart and its templates, including the app version.

17+# Versions are expected to follow Semantic Versioning (https://semver.org/)

18+version: 0.6.1

19+

20+# This is the version number of the application being deployed. This version number should be

21+# incremented each time you make changes to the application. Versions are not expected to

22+# follow Semantic Versioning. They should reflect the version the application is using.

23+appVersion: 0.6.1

contrib/helm/httpbin/templates/_helpers.tplnew file+63

@@ -0,0 +1,63 @@

1+{{/* vim: set filetype=mustache: */}}

2+{{/*

3+Expand the name of the chart.

4+*/}}

5+{{- define "httpbin.name" -}}

6+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}

7+{{- end }}

9+{{/*

10+Create a default fully qualified app name.

11+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).

12+If release name contains chart name it will be used as a full name.

13+*/}}

14+{{- define "httpbin.fullname" -}}

15+{{- if .Values.fullnameOverride }}

16+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}

17+{{- else }}

18+{{- $name := default .Chart.Name .Values.nameOverride }}

19+{{- if contains $name .Release.Name }}

20+{{- .Release.Name | trunc 63 | trimSuffix "-" }}

21+{{- else }}

22+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}

23+{{- end }}

24+{{- end }}

25+{{- end }}

26+

27+{{/*

28+Create chart name and version as used by the chart label.

29+*/}}

30+{{- define "httpbin.chart" -}}

31+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}

32+{{- end }}

33+

34+{{/*

35+Common labels

36+*/}}

37+{{- define "httpbin.labels" -}}

38+helm.sh/chart: {{ include "httpbin.chart" . }}

39+{{ include "httpbin.selectorLabels" . }}

40+{{- if .Chart.AppVersion }}

41+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}

42+{{- end }}

43+app.kubernetes.io/managed-by: {{ .Release.Service }}

44+{{- end }}

45+

46+{{/*

47+Selector labels

48+*/}}

49+{{- define "httpbin.selectorLabels" -}}

50+app.kubernetes.io/name: {{ include "httpbin.name" . }}

51+app.kubernetes.io/instance: {{ .Release.Name }}

52+{{- end }}

53+

54+{{/*

55+Create the name of the service account to use

56+*/}}

57+{{- define "httpbin.serviceAccountName" -}}

58+{{- if .Values.serviceAccount.create }}

59+{{- default (include "httpbin.fullname" .) .Values.serviceAccount.name }}

60+{{- else }}

61+{{- default "default" .Values.serviceAccount.name }}

62+{{- end }}

63+{{- end }}

contrib/helm/httpbin/templates/deployment.yamlnew file+61

@@ -0,0 +1,61 @@

1+apiVersion: apps/v1

2+kind: Deployment

3+metadata:

4+ name: {{ include "httpbin.fullname" . }}

5+ labels:

6+ {{- include "httpbin.labels" . | nindent 4 }}

7+spec:

8+{{- if not .Values.autoscaling.enabled }}

9+ replicas: {{ .Values.replicaCount }}

10+{{- end }}

11+ selector:

12+ matchLabels:

13+ {{- include "httpbin.selectorLabels" . | nindent 6 }}

14+ template:

15+ metadata:

16+ {{- with .Values.podAnnotations }}

17+ annotations:

18+ {{- toYaml . | nindent 8 }}

19+ {{- end }}

20+ labels:

21+ {{- include "httpbin.selectorLabels" . | nindent 8 }}

22+ spec:

23+ {{- with .Values.imagePullSecrets }}

24+ imagePullSecrets:

25+ {{- toYaml . | nindent 8 }}

26+ {{- end }}

27+ serviceAccountName: {{ include "httpbin.serviceAccountName" . }}

28+ securityContext:

29+ {{- toYaml .Values.podSecurityContext | nindent 8 }}

30+ containers:

31+ - name: {{ .Chart.Name }}

32+ securityContext:

33+ {{- toYaml .Values.securityContext | nindent 12 }}

34+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"

35+ imagePullPolicy: {{ .Values.image.pullPolicy }}

36+ ports:

37+ - name: http

38+ containerPort: 80

39+ protocol: TCP

40+ livenessProbe:

41+ httpGet:

42+ path: /

43+ port: http

44+ readinessProbe:

45+ httpGet:

46+ path: /

47+ port: http

48+ resources:

49+ {{- toYaml .Values.resources | nindent 12 }}

50+ {{- with .Values.nodeSelector }}

51+ nodeSelector:

52+ {{- toYaml . | nindent 8 }}

53+ {{- end }}

54+ {{- with .Values.affinity }}

55+ affinity:

56+ {{- toYaml . | nindent 8 }}

57+ {{- end }}

58+ {{- with .Values.tolerations }}

59+ tolerations:

60+ {{- toYaml . | nindent 8 }}

61+ {{- end }}

contrib/helm/httpbin/templates/ingress.yamlnew file+41

@@ -0,0 +1,41 @@

1+{{- if .Values.ingress.enabled -}}

2+{{- $fullName := include "httpbin.fullname" . -}}

3+{{- $svcPort := .Values.service.port -}}

4+{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}

5+apiVersion: networking.k8s.io/v1beta1

6+{{- else -}}

7+apiVersion: extensions/v1beta1

8+{{- end }}

9+kind: Ingress

10+metadata:

11+ name: {{ $fullName }}

12+ labels:

13+ {{- include "httpbin.labels" . | nindent 4 }}

14+ {{- with .Values.ingress.annotations }}

15+ annotations:

16+ {{- toYaml . | nindent 4 }}

17+ {{- end }}

18+spec:

19+ {{- if .Values.ingress.tls }}

20+ tls:

21+ {{- range .Values.ingress.tls }}

22+ - hosts:

23+ {{- range .hosts }}

24+ - {{ . | quote }}

25+ {{- end }}

26+ secretName: {{ .secretName }}

27+ {{- end }}

28+ {{- end }}

29+ rules:

30+ {{- range .Values.ingress.hosts }}

31+ - host: {{ .host | quote }}

32+ http:

33+ paths:

34+ {{- range .paths }}

35+ - path: {{ . }}

36+ backend:

37+ serviceName: {{ $fullName }}

38+ servicePort: {{ $svcPort }}

39+ {{- end }}

40+ {{- end }}

41+ {{- end }}

contrib/helm/httpbin/templates/service.yamlnew file+15

@@ -0,0 +1,15 @@

1+apiVersion: v1

2+kind: Service

3+metadata:

4+ name: {{ include "httpbin.fullname" . }}

5+ labels:

6+ {{- include "httpbin.labels" . | nindent 4 }}

7+spec:

8+ type: {{ .Values.service.type }}

9+ ports:

10+ - port: {{ .Values.service.port }}

11+ targetPort: http

12+ protocol: TCP

13+ name: http

14+ selector:

15+ {{- include "httpbin.selectorLabels" . | nindent 4 }}

contrib/helm/httpbin/templates/serviceaccount.yamlnew file+12

@@ -0,0 +1,12 @@

1+{{- if .Values.serviceAccount.create -}}

2+apiVersion: v1

3+kind: ServiceAccount

4+metadata:

5+ name: {{ include "httpbin.serviceAccountName" . }}

6+ labels:

7+ {{- include "httpbin.labels" . | nindent 4 }}

8+ {{- with .Values.serviceAccount.annotations }}

9+ annotations:

10+ {{- toYaml . | nindent 4 }}

11+ {{- end }}

12+{{- end }}

contrib/helm/httpbin/values.yamlnew file+79

@@ -0,0 +1,79 @@

1+# Default values for httpbin.

2+# This is a YAML-formatted file.

3+# Declare variables to be passed into your templates.

5+replicaCount: 1

7+image:

8+ repository: kennethreitz/httpbin

9+ pullPolicy: IfNotPresent

10+ # Overrides the image tag whose default is the chart version.

11+ tag: latest

12+

13+imagePullSecrets: []

14+nameOverride: ""

15+fullnameOverride: ""

16+

17+serviceAccount:

18+ # Specifies whether a service account should be created

19+ create: true

20+ # Annotations to add to the service account

21+ annotations: {}

22+ # The name of the service account to use.

23+ # If not set and create is true, a name is generated using the fullname template

24+ name: ""

25+

26+podAnnotations: {}

27+

28+podSecurityContext: {}

29+ # fsGroup: 2000

30+

31+securityContext: {}

32+ # capabilities:

33+ # drop:

34+ # - ALL

35+ # readOnlyRootFilesystem: true

36+ # runAsNonRoot: true

37+ # runAsUser: 1000

38+

39+service:

40+ type: ClusterIP

41+ port: 80

42+

43+ingress:

44+ enabled: false

45+ annotations: {}

46+ # kubernetes.io/ingress.class: nginx

47+ # kubernetes.io/tls-acme: "true"

48+ hosts:

49+ - host: chart-example.local

50+ paths: []

51+ tls: []

52+ # - secretName: chart-example-tls

53+ # hosts:

54+ # - chart-example.local

55+

56+resources: {}

57+ # We usually recommend not to specify default resources and to leave this as a conscious

58+ # choice for the user. This also increases chances charts run on environments with little

59+ # resources, such as Minikube. If you do want to specify resources, uncomment the following

60+ # lines, adjust them as necessary, and remove the curly braces after 'resources:'.

61+ # limits:

62+ # cpu: 100m

63+ # memory: 128Mi

64+ # requests:

65+ # cpu: 100m

66+ # memory: 128Mi

67+

68+autoscaling:

69+ enabled: false

70+ minReplicas: 1

71+ maxReplicas: 100

72+ targetCPUUtilizationPercentage: 80

73+ # targetMemoryUtilizationPercentage: 80

74+

75+nodeSelector: {}

76+

77+tolerations: []

78+

79+affinity: {}

contrib/helm/kind-cluster.yamlnew file+14

@@ -0,0 +1,14 @@

1+kind: Cluster

2+apiVersion: kind.x-k8s.io/v1alpha4

3+nodes:

4+ - role: control-plane

5+ kubeadmConfigPatches:

6+ - |

7+ kind: InitConfiguration

8+ nodeRegistration:

9+ kubeletExtraArgs:

10+ node-labels: "ingress-ready=true"

11+ extraPortMappings:

12+ - containerPort: 80

13+ hostPort: 80

14+ protocol: TCP

contrib/helm/values.yamlnew file+95

@@ -0,0 +1,95 @@

1+dex:

2+ ingress:

3+ enabled: true

4+ hosts:

5+ - dex.localtest.me

6+ grpc: false

7+ certs:

8+ grpc:

9+ create: false

10+ web:

11+ create: false

12+

13+ config:

14+ issuer: http://dex.localtest.me

15+ expiry:

16+ signingKeys: "4h"

17+ idTokens: "1h"

18+ staticClients:

19+ - id: oauth2-proxy

20+ redirectURIs:

21+ # These redirect URI points to the `--redirect-url` for OAuth2 proxy.

22+ - 'http://oauth2-proxy.localtest.me/oauth2/callback'

23+ name: 'OAuth2 Proxy'

24+ secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

25+ staticPasswords:

26+ - email: "admin@example.com"

27+ # bcrypt hash of the string "password"

28+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"

29+ username: "admin"

30+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"

31+

32+oauth2-proxy:

33+ nameOverride: oauth2-proxy-sample

34+ ingress:

35+ enabled: true

36+ hosts:

37+ - oauth2-proxy.localtest.me

38+ annotations:

39+ nginx.ingress.kubernetes.io/server-snippet: |

40+ large_client_header_buffers 4 32k;

41+ # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret

42+ proxyVarsAsSecrets: false

43+ config:

44+ configFile: |-

45+ cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="

46+ cookie_domain=".localtest.me"

47+ whitelist_domains=[".localtest.me"]

48+ # only users with this domain will be let in

49+ email_domains=["example.com"]

50+

51+ client_id="oauth2-proxy"

52+ client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"

53+ cookie_secure="false"

54+

55+ redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"

56+

57+ # we don't want to proxy anything so pick a non-existent directory

58+ upstreams = [ "file:///dev/null" ]

59+

60+ # return authenticated user to nginx

61+ set_xauthrequest = true

62+ # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate

63+ # login_url, redeem_url, and oidc_jwks_url

64+ provider="oidc"

65+ oidc_issuer_url="http://dex.localtest.me"

66+

67+httpbin:

68+ ingress:

69+ enabled: true

70+ hosts:

71+ - host: httpbin.localtest.me

72+ paths:

73+ - /

74+ annotations:

75+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start

76+ # That's what will be used in REAL LIFE

77+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth

78+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665

79+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth

80+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email

81+

82+hello-world:

83+ ingress:

84+ enabled: true

85+ hosts:

86+ - host: hello-world.localtest.me

87+ paths:

88+ - /

89+ annotations:

90+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start

91+ # That's what will be used in REAL LIFE

92+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth

93+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665

94+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth

95+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email