141 lines
4.4 KiB
Django/Jinja
Executable File
141 lines
4.4 KiB
Django/Jinja
Executable File
replicaCount: 1
|
|
image:
|
|
tag: {{ dex_image_tag | to_json }}
|
|
imagePullSecrets: {{ dex_image_pull_secrets | to_json }}
|
|
rbac:
|
|
create: false
|
|
resources: {{ dex_resources | to_json }}
|
|
securityContext:
|
|
runAsNonRoot: false
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
podAnnotations:
|
|
theme/revision: {{ (lookup('ansible.builtin.file', role_path ~ '/files/styles.css') ~ lookup('ansible.builtin.file', role_path ~ '/files/logo.svg') ~ (dex_theme_enabled | string) ~ dex_env_secret_name ~ dex_ca_secret_name) | hash('sha256') | to_json }}
|
|
{% if dex_env_secret_name %}
|
|
envFrom:
|
|
- secretRef:
|
|
name: {{ dex_env_secret_name | to_json }}
|
|
{% endif %}
|
|
config:
|
|
issuer: {{ dex_issuer | to_json }}
|
|
logger:
|
|
level: info
|
|
format: json
|
|
{% if dex_theme_enabled %}
|
|
frontend:
|
|
issuer: {{ dex_brand_name | to_json }}
|
|
dir: /srv/dex/web
|
|
theme: light
|
|
logoURL: theme/logo.svg
|
|
{% endif %}
|
|
storage:
|
|
type: postgres
|
|
config:
|
|
host: {{ dex_postgres_host | to_json }}
|
|
port: {{ dex_postgres_port }}
|
|
database: {{ dex_postgres_database | to_json }}
|
|
user: {{ dex_postgres_user | to_json }}
|
|
password: {{ dex_postgres_password | to_json }}
|
|
ssl:
|
|
mode: {{ dex_postgres_ssl_mode | to_json }}
|
|
staticClients:{% if not dex_matrix_client_enabled and not dex_static_clients %} []{% endif %}
|
|
|
|
{% if dex_matrix_client_enabled %}
|
|
- id: {{ matrix_dex_oidc_client_id | to_json }}
|
|
name: Matrix Auth Service
|
|
secret: {{ matrix_dex_oidc_client_secret | to_json }}
|
|
redirectURIs: {{ dex_matrix_redirect_uris | to_json }}
|
|
{% endif %}
|
|
{% for client in dex_static_clients %}
|
|
- {{ client | to_json }}
|
|
{% endfor %}
|
|
connectors:
|
|
- type: ldap
|
|
id: {{ dex_ldap_connector_id | to_json }}
|
|
name: {{ dex_ldap_connector_name | to_json }}
|
|
config:
|
|
host: {{ dex_ldap_host | to_json }}
|
|
insecureNoSSL: {{ dex_ldap_insecure_no_ssl | bool | to_json }}
|
|
startTLS: {{ dex_ldap_start_tls | bool | to_json }}
|
|
insecureSkipVerify: false
|
|
{% if dex_ldap_root_ca %}
|
|
rootCA: {{ dex_ldap_root_ca | to_json }}
|
|
{% endif %}
|
|
bindDN: {{ dex_ldap_bind_dn | to_json }}
|
|
bindPW: {{ dex_ldap_bind_password | to_json }}
|
|
userSearch:
|
|
baseDN: {{ dex_ldap_user_base_dn | to_json }}
|
|
filter: {{ dex_ldap_user_filter | to_json }}
|
|
username: uid
|
|
idAttr: {{ dex_ldap_id_attribute | to_json }}
|
|
emailAttr: mail
|
|
nameAttr: {{ dex_ldap_name_attribute | to_json }}
|
|
preferredUsernameAttr: uid
|
|
groupSearch:
|
|
baseDN: {{ dex_ldap_group_base_dn | to_json }}
|
|
filter: {{ dex_ldap_group_filter | to_json }}
|
|
userMatchers:
|
|
- userAttr: {{ dex_ldap_group_user_attribute | to_json }}
|
|
groupAttr: uniqueMember
|
|
nameAttr: cn
|
|
{% for connector in dex_additional_connectors %}
|
|
- {{ connector | to_json }}
|
|
{% endfor %}
|
|
volumes:
|
|
# The official entrypoint renders its config into /tmp before starting Dex.
|
|
- name: dex-tmp
|
|
emptyDir:
|
|
medium: Memory
|
|
sizeLimit: 16Mi
|
|
{% if dex_theme_enabled %}
|
|
- name: theme
|
|
configMap:
|
|
name: {{ dex_theme_configmap_name }}
|
|
{% endif %}
|
|
{% if dex_ca_secret_name %}
|
|
- name: ca
|
|
secret:
|
|
secretName: {{ dex_ca_secret_name }}
|
|
{% endif %}
|
|
{% for volume in dex_extra_volumes %}
|
|
- {{ volume | to_json }}
|
|
{% endfor %}
|
|
volumeMounts:
|
|
- name: dex-tmp
|
|
mountPath: /tmp
|
|
{% if dex_theme_enabled %}
|
|
- name: theme
|
|
mountPath: /srv/dex/web/themes/light/styles.css
|
|
subPath: styles.css
|
|
readOnly: true
|
|
- name: theme
|
|
mountPath: /srv/dex/web/themes/light/logo.svg
|
|
subPath: logo.svg
|
|
readOnly: true
|
|
{% endif %}
|
|
{% if dex_ca_secret_name %}
|
|
- name: ca
|
|
mountPath: /etc/dex-ca
|
|
readOnly: true
|
|
{% endif %}
|
|
{% for mount in dex_extra_volume_mounts %}
|
|
- {{ mount | to_json }}
|
|
{% endfor %}
|
|
ingress:
|
|
enabled: true
|
|
className: {{ dex_ingress_class | to_json }}
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: {{ dex_cluster_issuer | to_json }}
|
|
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
|
nginx.ingress.kubernetes.io/enable-access-log: "false"
|
|
hosts:
|
|
- host: {{ dex_hostname }}
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts: [{{ dex_hostname }}]
|
|
secretName: {{ dex_tls_secret_name }}
|