temporary fix to cleanup auth forward (#422)

* temporary fix to cleanup auth forward

* actually: its crd based to begin with!

* update tests

* actually fix tests

.tools/tests/charts/common-test_spec.rb

@@ -983,7 +983,8 @@ class Test < ChartTest
 
       it 'HTTP-ingressRoute+selfsigned+forwardAuth is evaluated is evaluated ' do
         expectedHostString = 'Host(`hostname`) && PathPrefix(`/`)'
-        expectedName = 'common-test-test1-auth-forward'
+        expectedName1 = 'common-test-test1-auth-forward'
+        expectedName2 = 'common-test-test1-auth-forward@kubernetescrd'
         values = {
           ingress: {
             test1: {
@@ -1008,8 +1009,8 @@ class Test < ChartTest
         refute_nil(resource('IngressRoute'))
         jq('.spec.tls.domains[0].main', resource('IngressRoute')).must_equal  values[:ingress][:test1][:hosts][0][:host]
         jq('.spec.tls.secretName', resource('IngressRoute')).must_equal nil
-        jq('.metadata.name', resource('Middleware')).must_equal  expectedName
+        jq('.metadata.name', resource('Middleware')).must_equal  expectedName1
-        jq('.spec.routes[0].middlewares[1].name', resource('IngressRoute')).must_equal  expectedName
+        jq('.spec.routes[0].middlewares[1].name', resource('IngressRoute')).must_equal  expectedName2
       end
     end
 

library/common/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 kubeVersion: ">=1.16.0-0"
 name: common
-version: 3.5.2
+version: 3.5.3
 # upstream_version:
 appVersion: none
 description: Function library for TrueCharts

library/common/templates/_ingress.tpl

@@ -30,11 +30,6 @@ of the main Ingress and any additionalIngresses.
         {{- include "common.classes.ingress" $ -}}
         {{ end -}}
 
-        {{- if $ingressValues.authForwardURL -}}
-        {{- print ("---") | nindent 0 -}}
-        {{- include "common.classes.ingress.authForward" $ }}
-        {{ end -}}
-
         {{- if eq $ingressValues.certType "ixcert" -}}
         {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
         {{- print ("---") | nindent 0 -}}
@@ -74,11 +69,6 @@ of the main Ingress and any additionalIngresses.
         {{- include "common.classes.ingress" $ -}}
         {{ end -}}
 
-        {{- if $ingressValues.authForwardURL -}}
-        {{- print ("---") | nindent 0 -}}
-        {{- include "common.classes.ingress.authForward" $ }}
-        {{ end -}}
-
         {{- if eq $ingressValues.certType "ixcert" -}}
         {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
         {{- print ("---") | nindent 0 -}}
@@ -121,11 +111,6 @@ of the main Ingress and any additionalIngresses.
         {{- print ("---") | nindent 0 -}}
         {{- include "common.classes.externalService" $ }}
 
-        {{- if $ingressValues.authForwardURL -}}
-        {{- print ("---") | nindent 0 -}}
-        {{- include "common.classes.ingress.authForward" $ }}
-        {{ end -}}
-
         {{- if eq $ingressValues.certType "ixcert" -}}
         {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}}
         {{- print ("---") | nindent 0 -}}

library/common/templates/classes/ingress/_authForward.tpl

@@ -1,30 +0,0 @@
-{{/*
-Renders the additional authForward objects from ingress
-*/}}
-{{- define "common.classes.ingress.authForward" -}}
-{{- $authForwardName := include "common.names.fullname" . -}}
-{{- $values := .Values -}}
-{{- if hasKey . "ObjectValues" -}}
-  {{- with .ObjectValues.ingress -}}
-    {{- $values = . -}}
-  {{- end -}}
-{{ end -}}
-{{- if hasKey $values "nameSuffix" -}}
-  {{- $authForwardName = printf "%v-%v" $authForwardName $values.nameSuffix -}}
-{{ end -}}
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: {{ $authForwardName }}-auth-forward
-spec:
-  forwardAuth:
-    address: {{ $values.authForwardURL | quote }}
-    tls:
-      insecureSkipVerify: true
-    trustForwardHeader: true
-    authResponseHeaders:
-      - Remote-User
-      - Remote-Groups
-      - Remote-Name
-      - Remote-Email
-{{- end }}

library/common/templates/classes/ingress/_ingress.tpl

@@ -14,6 +14,7 @@ within the common library.
   {{- end -}}
 {{ end -}}
 
+
 {{- if hasKey $values "nameSuffix" -}}
   {{- $ingressName = printf "%v-%v" $ingressName $values.nameSuffix -}}
   {{- if and ( $.Values.services ) ( not $values.servicePort ) }}
@@ -52,7 +53,7 @@ metadata:
     traefik.ingress.kubernetes.io/service.serversscheme: https
     {{- end }}
     traefik.ingress.kubernetes.io/router.entrypoints: {{ $values.entrypoint | default "websecure" }}
-    traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd{{ if $values.authForwardURL }},{{ $ingressName }}-auth-forward{{ end }}
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd{{ if $values.authForwardURL }},{{ $ingressName }}-auth-forward@kubernetescrd{{ end }}
     {{- with $values.annotations }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
@@ -115,4 +116,26 @@ spec:
               servicePort: {{ $svcPort }}
             {{- end }}
   {{- end }}
+
+{{- if $values.authForwardURL }}
+
+---
+
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $ingressName }}-auth-forward
+spec:
+  forwardAuth:
+    address: {{ $values.authForwardURL | quote }}
+    tls:
+      insecureSkipVerify: true
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email
+{{- end }}
+
 {{- end }}

library/common/templates/classes/ingress/_ingressRoute.tpl

@@ -81,7 +81,7 @@ spec:
     middlewares:
       - name: traefik-middlewares-chain-public@kubernetescrd
       {{- if $values.authForwardURL }}
-      - name: "{{ $ingressName }}-auth-forward"
+      - name: "{{ $ingressName }}-auth-forward@kubernetescrd"
       {{- end }}
   {{- end }}
 
@@ -102,4 +102,24 @@ spec:
 {{- end }}
 {{- end }}
 
+{{- if $values.authForwardURL }}
+---
+
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ $ingressName }}-auth-forward
+spec:
+  forwardAuth:
+    address: {{ $values.authForwardURL | quote }}
+    tls:
+      insecureSkipVerify: true
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email
+
+{{- end }}
 {{- end }}