git.iko.soy/typeable/oauth2-proxy
on master help sign in
Merge pull request #615 from EvgeniGordeev/helm-example
daedbbdJoel Speed
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -55,6 +55,7 @@
55
55
56## Changes since v5.1.1
56## Changes since v5.1.1
57
57
58+- [#615](https://github.com/oauth2-proxy/oauth2-proxy/pull/615) Kubernetes example based on Kind cluster and Nginx ingress (@EvgeniGordeev)
58- [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)
59- [#596](https://github.com/oauth2-proxy/oauth2-proxy/pull/596) Validate Bearer IDTokens in headers with correct provider/extra JWT Verifier (@NickMeves)
59- [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed)
60- [#620](https://github.com/oauth2-proxy/oauth2-proxy/pull/620) Add HealthCheck middleware (@JoelSpeed)
60- [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed)
61- [#597](https://github.com/oauth2-proxy/oauth2-proxy/pull/597) Don't log invalid redirect if redirect is empty (@JoelSpeed)
contrib/local-environment/Makefile+9
@@ -21,3 +21,12 @@ keycloak-up:
21.PHONY: keycloak-%
21.PHONY: keycloak-%
22keycloak-%:
22keycloak-%:
23 docker-compose -f docker-compose-keycloak.yaml $*
23 docker-compose -f docker-compose-keycloak.yaml $*
24+
25+.PHONY: kubernetes-up
26+kubernetes-up:
27+ make -C kubernetes create-cluster
28+ make -C kubernetes deploy
29+
30+.PHONY: kubernetes-down
31+kubernetes-down:
32+ make -C kubernetes delete-cluster
contrib/local-environment/kubernetes/.gitignorenew file+1
@@ -0,0 +1 @@
1+charts/
contrib/local-environment/kubernetes/Chart.locknew file+15
@@ -0,0 +1,15 @@
1+dependencies:
2+- name: dex
3+ repository: https://kubernetes-charts.storage.googleapis.com
4+ version: 2.11.0
5+- name: oauth2-proxy
6+ repository: https://kubernetes-charts.storage.googleapis.com
7+ version: 3.1.0
8+- name: httpbin
9+ repository: https://conservis.github.io/helm-charts
10+ version: 1.0.1
11+- name: hello-world
12+ repository: https://conservis.github.io/helm-charts
13+ version: 1.0.1
14+digest: sha256:ce64f06102abb551ee23b6de7b4cec3537f4900de89412458e53760781005aac
15+generated: "2020-06-16T16:59:19.126187-05:00"
contrib/local-environment/kubernetes/Chart.yamlnew file+19
@@ -0,0 +1,19 @@
1+apiVersion: v2
2+description: K8S example based on https://kind.sigs.k8s.io
3+name: kubernetes
4+version: 5.1.1
5+appVersion: 5.1.1
6+dependencies:
7+ - name: dex
8+ version: 2.11.0
9+ repository: https://kubernetes-charts.storage.googleapis.com
10+ - name: oauth2-proxy
11+ version: 3.1.0
12+ repository: https://kubernetes-charts.storage.googleapis.com
13+ # https://github.com/postmanlabs/httpbin/issues/549 is still in progress, for now using a non-official chart
14+ - name: httpbin
15+ version: 1.0.1
16+ repository: https://conservis.github.io/helm-charts
17+ - name: hello-world
18+ version: 1.0.1
19+ repository: https://conservis.github.io/helm-charts
contrib/local-environment/kubernetes/Makefilenew file+67
@@ -0,0 +1,67 @@
1+all:
2+ @echo "Usage:"
3+ @echo " make create-cluster"
4+ @echo " make deploy"
5+
6+# create kind cluster with nginx-ingress as the most popular ingress controller for K8S
7+.PHONY: deploy
8+create-cluster:
9+ kind create cluster --name oauth2-proxy --config kind-cluster.yaml
10+ make setup-dns
11+ make setup-ingress
12+
13+.PHONY: setup-ingress
14+setup-ingress:
15+ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml
16+ kubectl --namespace ingress-nginx rollout status --timeout 5m deployment/ingress-nginx-controller
17+
18+# default Pod CIDR is 10.244.0.0/16 https://github.com/kubernetes-sigs/kind/blob/a6e8108025bc7a9440beedb8ef7714aec84fe87e/pkg/apis/config/v1alpha4/default.go#L52
19+# what makes cluster host IP equal to 10.244.0.1
20+# thus we add dex.localtest.me and oauth2-proxy.localtest.me stub hosts pointing to this IP
21+# NOT NEEDED IN REAL LIFE!
22+.PHONY: setup-dns
23+setup-dns:
24+ kubectl apply -f custom-dns.yaml
25+ kubectl -n kube-system rollout restart deployment/coredns
26+ kubectl -n kube-system rollout status --timeout 5m deployment/coredns
27+
28+.PHONY: delete-cluster
29+delete-cluster:
30+ kind delete cluster --name oauth2-proxy
31+
32+.PHONY: deploy
33+deploy:
34+ kubectl apply -f oauth2-proxy-example-full.yaml
35+ kubectl rollout status --timeout 5m deployment/oauth2-proxy-example-oauth2-proxy-sample
36+ kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-httpbin
37+ kubectl rollout status --timeout 1m deployment/oauth2-proxy-example-hello-world
38+
39+.PHONY: undeploy
40+undeploy:
41+ kubectl delete -f oauth2-proxy-example-full.yaml
42+
43+######################
44+###### HELM CMDs #####
45+######################
46+.PHONY: helm-init
47+helm-init:
48+ helm dep update
49+
50+# unpacking is useful to be able to explore underlying helm charts
51+.PHONY: helm-unpack
52+helm-unpack:
53+ cd charts; for f in *.tgz; do tar -zxf "$$f"; done
54+
55+.PHONY: helm-deploy
56+helm-deploy: helm-init
57+ helm upgrade --wait --debug --install --render-subchart-notes oauth2-proxy-example .
58+
59+.PHONY: helm-undeploy
60+helm-undeploy:
61+ helm del oauth2-proxy-example
62+
63+# creates K8S manifest from helm chart
64+.PHONY: helm-create-manifest
65+helm-create-manifest: helm-init
66+ echo "# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!" > oauth2-proxy-example-full.yaml
67+ helm template --namespace default oauth2-proxy-example . >> oauth2-proxy-example-full.yaml
contrib/local-environment/kubernetes/README.mdnew file+24
@@ -0,0 +1,24 @@
1+# Kubernetes example
2+Based on [kind](https://kind.sigs.k8s.io) as a local Kubernetes cluster.
3+
4+## Quick start
5+
6+Before you start:
7+
8+_Required_
9+* install [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
10+* install [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl/)
11+
12+_Optional_
13+* install [helm 3](https://helm.sh/docs/intro/quickstart/#install-helm).
14+
15+Then:
16+
17+* `make create-cluster`
18+* `make deploy` OR `make helm-deploy` for helm
19+
20+Visit http://httpbin.localtest.me or http://hello-world.localtest.me/
21+
22+## Uninstall
23+
24+* `make delete-cluster`
contrib/local-environment/kubernetes/custom-dns.yamlnew file+30
@@ -0,0 +1,30 @@
1+apiVersion: v1
2+data:
3+ Corefile: |
4+ .:53 {
5+ errors
6+ health {
7+ lameduck 5s
8+ }
9+ ready
10+ kubernetes cluster.local in-addr.arpa ip6.arpa {
11+ pods insecure
12+ fallthrough in-addr.arpa ip6.arpa
13+ ttl 30
14+ }
15+ prometheus :9153
16+ forward . /etc/resolv.conf
17+ cache 30
18+ loop
19+ reload
20+ loadbalance
21+ hosts {
22+ 10.244.0.1 dex.localtest.me
23+ 10.244.0.1 oauth2-proxy.localtest.me
24+ fallthrough
25+ }
26+ }
27+kind: ConfigMap
28+metadata:
29+ name: coredns
30+ namespace: kube-system
contrib/local-environment/kubernetes/kind-cluster.yamlnew file+17
@@ -0,0 +1,17 @@
1+kind: Cluster
2+apiVersion: kind.x-k8s.io/v1alpha4
3+nodes:
4+ - role: control-plane
5+ kubeadmConfigPatches:
6+ - |
7+ kind: InitConfiguration
8+ nodeRegistration:
9+ kubeletExtraArgs:
10+ node-labels: "ingress-ready=true"
11+ extraPortMappings:
12+ - containerPort: 80
13+ hostPort: 80
14+ protocol: TCP
15+ - containerPort: 443
16+ hostPort: 443
17+ protocol: TCP
contrib/local-environment/kubernetes/oauth2-proxy-example-full.yamlnew file+564
@@ -0,0 +1,564 @@
1+# WARNING: This file is auto-generated by 'make helm-create-manifest'! DO NOT EDIT MANUALLY!
2+---
3+# Source: kubernetes/charts/dex/templates/serviceaccount.yaml
4+apiVersion: v1
5+kind: ServiceAccount
6+metadata:
7+ labels:
8+ app.kubernetes.io/name: dex
9+ helm.sh/chart: dex-2.11.0
10+ app.kubernetes.io/instance: oauth2-proxy-example
11+ app.kubernetes.io/version: "2.23.0"
12+ app.kubernetes.io/managed-by: Helm
13+ name: oauth2-proxy-example-dex
14+---
15+# Source: kubernetes/charts/hello-world/templates/serviceaccount.yaml
16+apiVersion: v1
17+kind: ServiceAccount
18+metadata:
19+ name: oauth2-proxy-example-hello-world
20+ labels:
21+ helm.sh/chart: hello-world-1.0.1
22+ app.kubernetes.io/name: hello-world
23+ app.kubernetes.io/instance: oauth2-proxy-example
24+ app.kubernetes.io/version: "1.0.0"
25+ app.kubernetes.io/managed-by: Helm
26+---
27+# Source: kubernetes/charts/httpbin/templates/serviceaccount.yaml
28+apiVersion: v1
29+kind: ServiceAccount
30+metadata:
31+ name: oauth2-proxy-example-httpbin
32+ labels:
33+ helm.sh/chart: httpbin-1.0.1
34+ app.kubernetes.io/name: httpbin
35+ app.kubernetes.io/instance: oauth2-proxy-example
36+ app.kubernetes.io/version: "latest"
37+ app.kubernetes.io/managed-by: Helm
38+---
39+# Source: kubernetes/charts/oauth2-proxy/templates/serviceaccount.yaml
40+apiVersion: v1
41+kind: ServiceAccount
42+metadata:
43+ labels:
44+ app: oauth2-proxy-sample
45+ chart: oauth2-proxy-3.1.0
46+ release: oauth2-proxy-example
47+ heritage: Helm
48+ name: oauth2-proxy-example-oauth2-proxy-sample
49+---
50+# Source: kubernetes/charts/dex/templates/secret.yaml
51+apiVersion: v1
52+kind: Secret
53+metadata:
54+ labels:
55+ app.kubernetes.io/name: dex
56+ helm.sh/chart: dex-2.11.0
57+ app.kubernetes.io/instance: oauth2-proxy-example
58+ app.kubernetes.io/version: "2.23.0"
59+ app.kubernetes.io/managed-by: Helm
60+ name: oauth2-proxy-example-dex
61+stringData:
62+ config.yaml: |-
63+ issuer: http://dex.localtest.me
64+ storage:
65+ config:
66+ inCluster: true
67+ type: kubernetes
68+ logger:
69+ level: debug
70+ web:
71+ http: 0.0.0.0:5556
72+ oauth2:
73+ alwaysShowLoginScreen: false
74+ skipApprovalScreen: true
75+ staticClients:
76+ - id: oauth2-proxy
77+ name: OAuth2 Proxy
78+ redirectURIs:
79+ - http://oauth2-proxy.localtest.me/oauth2/callback
80+ secret: b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK
81+ enablePasswordDB: true
82+ staticPasswords:
83+ - email: admin@example.com
84+ hash: $2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W
85+ userID: 08a8684b-db88-4b73-90a9-3cd1661f5466
86+ username: admin
87+ expiry:
88+ idTokens: 1h
89+ signingKeys: 4h
90+---
91+# Source: kubernetes/charts/oauth2-proxy/templates/configmap.yaml
92+apiVersion: v1
93+kind: ConfigMap
94+metadata:
95+ labels:
96+ app: oauth2-proxy-sample
97+ chart: oauth2-proxy-3.1.0
98+ heritage: Helm
99+ release: oauth2-proxy-example
100+ name: oauth2-proxy-example-oauth2-proxy-sample
101+data:
102+ oauth2_proxy.cfg: "cookie_secret=\"OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w=\"\ncookie_domain=\".localtest.me\"\nwhitelist_domains=[\".localtest.me\"]\n# only users with this domain will be let in\nemail_domains=[\"example.com\"]\n\nclient_id=\"oauth2-proxy\"\nclient_secret=\"b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK\"\ncookie_secure=\"false\"\n\nredirect_url=\"http://oauth2-proxy.localtest.me/oauth2/callback\"\n\n# we don't want to proxy anything so pick a non-existent directory\nupstreams = [ \"file:///dev/null\" ]\n\n# return authenticated user to nginx\nset_xauthrequest = true\n# using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate\n# login_url, redeem_url, and oidc_jwks_url\nprovider=\"oidc\"\noidc_issuer_url=\"http://dex.localtest.me\""
103+---
104+# Source: kubernetes/charts/dex/templates/clusterrole.yaml
105+apiVersion: rbac.authorization.k8s.io/v1
106+kind: ClusterRole
107+metadata:
108+ labels:
109+ app.kubernetes.io/name: dex
110+ helm.sh/chart: dex-2.11.0
111+ app.kubernetes.io/instance: oauth2-proxy-example
112+ app.kubernetes.io/version: "2.23.0"
113+ app.kubernetes.io/managed-by: Helm
114+ name: oauth2-proxy-example-dex
115+rules:
116+- apiGroups: ["dex.coreos.com"] # API group created by dex
117+ resources: ["*"]
118+ verbs: ["*"]
119+- apiGroups: ["apiextensions.k8s.io"]
120+ resources: ["customresourcedefinitions"]
121+ verbs: ["create"] # To manage its own resources, dex must be able to create customresourcedefinitions
122+---
123+# Source: kubernetes/charts/dex/templates/clusterrolebinding.yaml
124+apiVersion: rbac.authorization.k8s.io/v1
125+kind: ClusterRoleBinding
126+metadata:
127+ labels:
128+ app.kubernetes.io/name: dex
129+ helm.sh/chart: dex-2.11.0
130+ app.kubernetes.io/instance: oauth2-proxy-example
131+ app.kubernetes.io/version: "2.23.0"
132+ app.kubernetes.io/managed-by: Helm
133+ name: oauth2-proxy-example-dex
134+roleRef:
135+ apiGroup: rbac.authorization.k8s.io
136+ kind: ClusterRole
137+ name: oauth2-proxy-example-dex
138+subjects:
139+ - kind: ServiceAccount
140+ name: oauth2-proxy-example-dex
141+ namespace: default
142+---
143+# Source: kubernetes/charts/dex/templates/service.yaml
144+apiVersion: v1
145+kind: Service
146+metadata:
147+ name: oauth2-proxy-example-dex
148+ labels:
149+ app.kubernetes.io/name: dex
150+ helm.sh/chart: dex-2.11.0
151+ app.kubernetes.io/instance: oauth2-proxy-example
152+ app.kubernetes.io/version: "2.23.0"
153+ app.kubernetes.io/managed-by: Helm
154+spec:
155+ type: ClusterIP
156+ sessionAffinity: None
157+ ports:
158+ - name: http
159+ targetPort: http
160+ port: 32000
161+ selector:
162+ app.kubernetes.io/name: dex
163+ app.kubernetes.io/instance: oauth2-proxy-example
164+---
165+# Source: kubernetes/charts/hello-world/templates/service.yaml
166+apiVersion: v1
167+kind: Service
168+metadata:
169+ name: oauth2-proxy-example-hello-world
170+ labels:
171+ helm.sh/chart: hello-world-1.0.1
172+ app.kubernetes.io/name: hello-world
173+ app.kubernetes.io/instance: oauth2-proxy-example
174+ app.kubernetes.io/version: "1.0.0"
175+ app.kubernetes.io/managed-by: Helm
176+spec:
177+ type: ClusterIP
178+ ports:
179+ - port: 9080
180+ targetPort: http
181+ protocol: TCP
182+ name: http
183+ selector:
184+ app.kubernetes.io/name: hello-world
185+ app.kubernetes.io/instance: oauth2-proxy-example
186+---
187+# Source: kubernetes/charts/httpbin/templates/service.yaml
188+apiVersion: v1
189+kind: Service
190+metadata:
191+ name: oauth2-proxy-example-httpbin
192+ labels:
193+ helm.sh/chart: httpbin-1.0.1
194+ app.kubernetes.io/name: httpbin
195+ app.kubernetes.io/instance: oauth2-proxy-example
196+ app.kubernetes.io/version: "latest"
197+ app.kubernetes.io/managed-by: Helm
198+spec:
199+ type: ClusterIP
200+ ports:
201+ - port: 80
202+ targetPort: http
203+ protocol: TCP
204+ name: http
205+ selector:
206+ app.kubernetes.io/name: httpbin
207+ app.kubernetes.io/instance: oauth2-proxy-example
208+---
209+# Source: kubernetes/charts/oauth2-proxy/templates/service.yaml
210+apiVersion: v1
211+kind: Service
212+metadata:
213+ labels:
214+ app: oauth2-proxy-sample
215+ chart: oauth2-proxy-3.1.0
216+ release: oauth2-proxy-example
217+ heritage: Helm
218+ name: oauth2-proxy-example-oauth2-proxy-sample
219+spec:
220+ type: ClusterIP
221+ ports:
222+ - port: 80
223+ targetPort: http
224+ protocol: TCP
225+ name: http
226+ selector:
227+ app: oauth2-proxy-sample
228+ release: oauth2-proxy-example
229+---
230+# Source: kubernetes/charts/dex/templates/deployment.yaml
231+apiVersion: apps/v1
232+kind: Deployment
233+metadata:
234+ name: oauth2-proxy-example-dex
235+ labels:
236+ app.kubernetes.io/name: dex
237+ helm.sh/chart: dex-2.11.0
238+ app.kubernetes.io/instance: oauth2-proxy-example
239+ app.kubernetes.io/version: "2.23.0"
240+ app.kubernetes.io/managed-by: Helm
241+ app.kubernetes.io/component: dex
242+spec:
243+ replicas: 1
244+ strategy:
245+ rollingUpdate:
246+ maxSurge: 0
247+ maxUnavailable: 1
248+ type: RollingUpdate
249+ selector:
250+ matchLabels:
251+ app.kubernetes.io/name: dex
252+ app.kubernetes.io/instance: oauth2-proxy-example
253+ app.kubernetes.io/component: dex
254+ template:
255+ metadata:
256+ labels:
257+ app.kubernetes.io/name: dex
258+ app.kubernetes.io/instance: oauth2-proxy-example
259+ app.kubernetes.io/component: dex
260+ annotations:
261+ checksum/config: 185f32cfabdf4f7467868dc301d4bd33e68951e12eddeb69f23ebc1d0f91ba28
262+ spec:
263+ serviceAccountName: oauth2-proxy-example-dex
264+ nodeSelector:
265+ {}
266+ containers:
267+ - name: main
268+ image: "quay.io/dexidp/dex:v2.23.0"
269+ imagePullPolicy: IfNotPresent
270+ command:
271+ - /usr/local/bin/dex
272+ - serve
273+ - /etc/dex/cfg/config.yaml
274+ resources:
275+ null
276+ ports:
277+ - name: http
278+ containerPort: 5556
279+ protocol: TCP
280+ livenessProbe:
281+ httpGet:
282+ path: /healthz
283+ port: http
284+ initialDelaySeconds: 1
285+ periodSeconds: 10
286+ timeoutSeconds: 1
287+ failureThreshold: 1
288+ readinessProbe:
289+ httpGet:
290+ path: /healthz
291+ port: http
292+ initialDelaySeconds: 1
293+ periodSeconds: 10
294+ timeoutSeconds: 1
295+ failureThreshold: 1
296+ env:
297+ []
298+ volumeMounts:
299+ - mountPath: /etc/dex/cfg
300+ name: config
301+ volumes:
302+ - secret:
303+ defaultMode: 420
304+ items:
305+ - key: config.yaml
306+ path: config.yaml
307+ secretName: oauth2-proxy-example-dex
308+ name: config
309+---
310+# Source: kubernetes/charts/hello-world/templates/deployment.yaml
311+apiVersion: apps/v1
312+kind: Deployment
313+metadata:
314+ name: oauth2-proxy-example-hello-world
315+ labels:
316+ helm.sh/chart: hello-world-1.0.1
317+ app.kubernetes.io/name: hello-world
318+ app.kubernetes.io/instance: oauth2-proxy-example
319+ app.kubernetes.io/version: "1.0.0"
320+ app.kubernetes.io/managed-by: Helm
321+spec:
322+ replicas: 1
323+ selector:
324+ matchLabels:
325+ app.kubernetes.io/name: hello-world
326+ app.kubernetes.io/instance: oauth2-proxy-example
327+ template:
328+ metadata:
329+ labels:
330+ app.kubernetes.io/name: hello-world
331+ app.kubernetes.io/instance: oauth2-proxy-example
332+ spec:
333+ serviceAccountName: oauth2-proxy-example-hello-world
334+ securityContext:
335+ {}
336+ containers:
337+ - name: hello-world
338+ securityContext:
339+ {}
340+ image: "conservis/hello-world:1.0.0"
341+ imagePullPolicy: IfNotPresent
342+ ports:
343+ - name: http
344+ containerPort: 9080
345+ protocol: TCP
346+ livenessProbe:
347+ httpGet:
348+ path: /
349+ port: http
350+ readinessProbe:
351+ httpGet:
352+ path: /
353+ port: http
354+ resources:
355+ {}
356+---
357+# Source: kubernetes/charts/httpbin/templates/deployment.yaml
358+apiVersion: apps/v1
359+kind: Deployment
360+metadata:
361+ name: oauth2-proxy-example-httpbin
362+ labels:
363+ helm.sh/chart: httpbin-1.0.1
364+ app.kubernetes.io/name: httpbin
365+ app.kubernetes.io/instance: oauth2-proxy-example
366+ app.kubernetes.io/version: "latest"
367+ app.kubernetes.io/managed-by: Helm
368+spec:
369+ replicas: 1
370+ selector:
371+ matchLabels:
372+ app.kubernetes.io/name: httpbin
373+ app.kubernetes.io/instance: oauth2-proxy-example
374+ template:
375+ metadata:
376+ labels:
377+ app.kubernetes.io/name: httpbin
378+ app.kubernetes.io/instance: oauth2-proxy-example
379+ spec:
380+ serviceAccountName: oauth2-proxy-example-httpbin
381+ securityContext:
382+ {}
383+ containers:
384+ - name: httpbin
385+ securityContext:
386+ {}
387+ image: "kennethreitz/httpbin:latest"
388+ imagePullPolicy: IfNotPresent
389+ ports:
390+ - name: http
391+ containerPort: 80
392+ protocol: TCP
393+ livenessProbe:
394+ httpGet:
395+ path: /
396+ port: http
397+ readinessProbe:
398+ httpGet:
399+ path: /
400+ port: http
401+ resources:
402+ {}
403+---
404+# Source: kubernetes/charts/oauth2-proxy/templates/deployment.yaml
405+apiVersion: apps/v1
406+kind: Deployment
407+metadata:
408+ labels:
409+ app: oauth2-proxy-sample
410+ chart: oauth2-proxy-3.1.0
411+ heritage: Helm
412+ release: oauth2-proxy-example
413+ name: oauth2-proxy-example-oauth2-proxy-sample
414+spec:
415+ replicas: 1
416+ selector:
417+ matchLabels:
418+ app: oauth2-proxy-sample
419+ release: oauth2-proxy-example
420+ template:
421+ metadata:
422+ annotations:
423+ checksum/config: 5d8892a7b1d9eb03f9d59b787ce339b374fa2be51991e4e7533cb0a541984fac
424+ checksum/config-emails: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
425+ checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
426+ checksum/google-secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
427+ labels:
428+ app: oauth2-proxy-sample
429+ release: "oauth2-proxy-example"
430+ spec:
431+ serviceAccountName: oauth2-proxy-example-oauth2-proxy-sample
432+ containers:
433+ - name: oauth2-proxy
434+ image: "quay.io/pusher/oauth2_proxy:v5.1.0"
435+ imagePullPolicy: IfNotPresent
436+ args:
437+ - --http-address=0.0.0.0:4180
438+ - --config=/etc/oauth2_proxy/oauth2_proxy.cfg
439+ ports:
440+ - containerPort: 4180
441+ name: http
442+ protocol: TCP
443+ livenessProbe:
444+ httpGet:
445+ path: /ping
446+ port: http
447+ scheme: HTTP
448+ initialDelaySeconds: 0
449+ timeoutSeconds: 1
450+ readinessProbe:
451+ httpGet:
452+ path: /ping
453+ port: http
454+ scheme: HTTP
455+ initialDelaySeconds: 0
456+ timeoutSeconds: 1
457+ successThreshold: 1
458+ periodSeconds: 10
459+ resources:
460+ {}
461+ volumeMounts:
462+ - mountPath: /etc/oauth2_proxy
463+ name: configmain
464+ volumes:
465+ - configMap:
466+ defaultMode: 420
467+ name: oauth2-proxy-example-oauth2-proxy-sample
468+ name: configmain
469+ tolerations:
470+ []
471+---
472+# Source: kubernetes/charts/dex/templates/ingress.yaml
473+apiVersion: extensions/v1beta1
474+kind: Ingress
475+metadata:
476+ name: oauth2-proxy-example-dex
477+ labels:
478+ app.kubernetes.io/name: dex
479+ helm.sh/chart: dex-2.11.0
480+ app.kubernetes.io/instance: oauth2-proxy-example
481+ app.kubernetes.io/version: "2.23.0"
482+ app.kubernetes.io/managed-by: Helm
483+spec:
484+ rules:
485+ - host: "dex.localtest.me"
486+ http:
487+ paths:
488+ - path: /
489+ backend:
490+ serviceName: oauth2-proxy-example-dex
491+ servicePort: 32000
492+---
493+# Source: kubernetes/charts/hello-world/templates/ingress.yaml
494+apiVersion: networking.k8s.io/v1beta1
495+kind: Ingress
496+metadata:
497+ name: oauth2-proxy-example-hello-world
498+ labels:
499+ helm.sh/chart: hello-world-1.0.1
500+ app.kubernetes.io/name: hello-world
501+ app.kubernetes.io/instance: oauth2-proxy-example
502+ app.kubernetes.io/version: "1.0.0"
503+ app.kubernetes.io/managed-by: Helm
504+ annotations:
505+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
506+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
507+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
508+spec:
509+ rules:
510+ - host: hello-world.localtest.me
511+ http:
512+ paths:
513+ - path: /
514+ backend:
515+ serviceName: oauth2-proxy-example-hello-world
516+ servicePort: 9080
517+---
518+# Source: kubernetes/charts/httpbin/templates/ingress.yaml
519+apiVersion: networking.k8s.io/v1beta1
520+kind: Ingress
521+metadata:
522+ name: oauth2-proxy-example-httpbin
523+ labels:
524+ helm.sh/chart: httpbin-1.0.1
525+ app.kubernetes.io/name: httpbin
526+ app.kubernetes.io/instance: oauth2-proxy-example
527+ app.kubernetes.io/version: "latest"
528+ app.kubernetes.io/managed-by: Helm
529+ annotations:
530+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
531+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
532+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
533+spec:
534+ rules:
535+ - host: httpbin.localtest.me
536+ http:
537+ paths:
538+ - path: /
539+ backend:
540+ serviceName: oauth2-proxy-example-httpbin
541+ servicePort: 80
542+---
543+# Source: kubernetes/charts/oauth2-proxy/templates/ingress.yaml
544+apiVersion: extensions/v1beta1
545+kind: Ingress
546+metadata:
547+ labels:
548+ app: oauth2-proxy-sample
549+ chart: oauth2-proxy-3.1.0
550+ heritage: Helm
551+ release: oauth2-proxy-example
552+ name: oauth2-proxy-example-oauth2-proxy-sample
553+ annotations:
554+ nginx.ingress.kubernetes.io/server-snippet: |
555+ large_client_header_buffers 4 32k;
556+spec:
557+ rules:
558+ - host: oauth2-proxy.localtest.me
559+ http:
560+ paths:
561+ - path: /
562+ backend:
563+ serviceName: oauth2-proxy-example-oauth2-proxy-sample
564+ servicePort: 80
contrib/local-environment/kubernetes/values.yamlnew file+91
@@ -0,0 +1,91 @@
1+dex:
2+ ingress:
3+ enabled: true
4+ hosts:
5+ - dex.localtest.me
6+ grpc: false
7+ certs:
8+ grpc:
9+ create: false
10+ web:
11+ create: false
12+
13+ config:
14+ issuer: http://dex.localtest.me
15+ expiry:
16+ signingKeys: "4h"
17+ idTokens: "1h"
18+ staticClients:
19+ - id: oauth2-proxy
20+ redirectURIs:
21+ # These redirect URI points to the `--redirect-url` for OAuth2 proxy.
22+ - 'http://oauth2-proxy.localtest.me/oauth2/callback'
23+ name: 'OAuth2 Proxy'
24+ secret: "b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
25+ staticPasswords:
26+ - email: "admin@example.com"
27+ # bcrypt hash of the string "password"
28+ hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
29+ username: "admin"
30+ userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
31+
32+oauth2-proxy:
33+ nameOverride: oauth2-proxy-sample
34+ ingress:
35+ enabled: true
36+ hosts:
37+ - oauth2-proxy.localtest.me
38+ annotations:
39+ nginx.ingress.kubernetes.io/server-snippet: |
40+ large_client_header_buffers 4 32k;
41+ # pick up client_id and client_secret from configFile as opposed to helm .Values.config.clientID and .Values.config.clientSecret
42+ proxyVarsAsSecrets: false
43+ config:
44+ configFile: |-
45+ cookie_secret="OQINaROshtE9TcZkNAm-5Zs2Pv3xaWytBmc5W7sPX7w="
46+ cookie_domain=".localtest.me"
47+ whitelist_domains=[".localtest.me"]
48+ # only users with this domain will be let in
49+ email_domains=["example.com"]
50+
51+ client_id="oauth2-proxy"
52+ client_secret="b2F1dGgyLXByb3h5LWNsaWVudC1zZWNyZXQK"
53+ cookie_secure="false"
54+
55+ redirect_url="http://oauth2-proxy.localtest.me/oauth2/callback"
56+
57+ # we don't want to proxy anything so pick a non-existent directory
58+ upstreams = [ "file:///dev/null" ]
59+
60+ # return authenticated user to nginx
61+ set_xauthrequest = true
62+ # using http://dex.localtest.me/.well-known/openid-configuration oauth2-proxy will populate
63+ # login_url, redeem_url, and oidc_jwks_url
64+ provider="oidc"
65+ oidc_issuer_url="http://dex.localtest.me"
66+
67+httpbin:
68+ ingress:
69+ enabled: true
70+ hosts:
71+ - httpbin.localtest.me
72+ annotations:
73+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
74+ # That's what will be used in REAL LIFE
75+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
76+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
77+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
78+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email
79+
80+hello-world:
81+ ingress:
82+ enabled: true
83+ hosts:
84+ - hello-world.localtest.me
85+ annotations:
86+ nginx.ingress.kubernetes.io/auth-signin: http://oauth2-proxy.localtest.me/oauth2/start
87+ # That's what will be used in REAL LIFE
88+ #nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy.localtest.me/oauth2/auth
89+ # but because of https://github.com/kubernetes/ingress-nginx/issues/3665
90+ nginx.ingress.kubernetes.io/auth-url: http://oauth2-proxy-example-oauth2-proxy-sample.default.svc.cluster.local/oauth2/auth
91+ nginx.ingress.kubernetes.io/auth-response-headers: X-Auth-Request-User,X-Auth-Request-Email