79 lines
2.9 KiB
YAML
Executable File
79 lines
2.9 KiB
YAML
Executable File
---
|
|
- name: Validate Dex deployment configuration
|
|
ansible.builtin.assert:
|
|
that:
|
|
- dex_issuer is match('^https://[^/@]+')
|
|
- dex_hostname is match('^[a-z0-9][a-z0-9.-]*[a-z0-9]$')
|
|
- dex_postgres_password | length > 0
|
|
- dex_ldap_bind_password | length > 0
|
|
- not (dex_ldap_insecure_no_ssl | bool and dex_ldap_start_tls | bool)
|
|
- not dex_postgres_manage or dex_postgres_chart_version | length > 0
|
|
- not dex_postgres_manage or dex_postgres_admin_password | length > 0
|
|
- not dex_matrix_client_enabled or matrix_dex_oidc_client_secret | default('') | length > 0
|
|
fail_msg: Configure database/LDAP credentials, client secrets and explicit database chart version if managing PostgreSQL.
|
|
no_log: true
|
|
|
|
- name: Validate explicit OIDC clients
|
|
ansible.builtin.assert:
|
|
that:
|
|
- item.id | default('') | length > 0
|
|
- item.name | default('') | length > 0
|
|
- item.redirectURIs | default([]) | length > 0
|
|
- item.public | default(false) or ((item.secret | default('') | length > 0) != (item.secretEnv | default('') | length > 0))
|
|
fail_msg: Every confidential client needs an ID, name, exact callback URI and either a secret or secretEnv, but not both.
|
|
loop: "{{ dex_static_clients }}"
|
|
no_log: true
|
|
|
|
- name: Reject duplicate explicit client IDs
|
|
ansible.builtin.assert:
|
|
that:
|
|
- dex_static_clients | map(attribute='id') | unique | length == dex_static_clients | length
|
|
no_log: true
|
|
|
|
- name: Ensure Dex namespace
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: "{{ dex_namespace }}"
|
|
|
|
- name: Register Dex Helm repository
|
|
kubernetes.core.helm_repository:
|
|
name: dex
|
|
repo_url: https://charts.dexidp.io
|
|
|
|
- name: Manage PostgreSQL only when explicitly requested
|
|
ansible.builtin.include_tasks: postgres.yml
|
|
when: dex_postgres_manage | bool
|
|
|
|
- name: Deploy Catppuccin theme assets
|
|
kubernetes.core.k8s:
|
|
state: present
|
|
definition:
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: "{{ dex_theme_configmap_name }}"
|
|
namespace: "{{ dex_namespace }}"
|
|
data:
|
|
styles.css: "{{ lookup('ansible.builtin.file', role_path ~ '/files/styles.css') }}"
|
|
logo.svg: "{{ lookup('ansible.builtin.file', role_path ~ '/files/logo.svg') }}"
|
|
when: dex_theme_enabled | bool
|
|
|
|
- name: Deploy Dex using its existing Helm release
|
|
kubernetes.core.helm:
|
|
name: "{{ dex_release_name }}"
|
|
chart_ref: dex/dex
|
|
chart_version: "{{ dex_chart_version }}"
|
|
release_namespace: "{{ dex_namespace }}"
|
|
create_namespace: true
|
|
update_repo_cache: true
|
|
reset_values: true
|
|
wait: true
|
|
timeout: "{{ dex_wait_timeout }}"
|
|
values: "{{ lookup('ansible.builtin.template', 'values.yml.j2') | from_yaml }}"
|
|
no_log: true
|
|
diff: false
|