diff --git a/charts/incubator/traefik-forward-auth/Chart.yaml b/charts/incubator/traefik-forward-auth/Chart.yaml index ad452d0923e..b4936ead040 100644 --- a/charts/incubator/traefik-forward-auth/Chart.yaml +++ b/charts/incubator/traefik-forward-auth/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 kubeVersion: ">=1.16.0-0" name: traefik-forward-auth -version: 0.1.3 +version: 0.2.0 appVersion: "latest" description: A minimal forward authentication service that provides OAuth/SSO login and authentication for the traefik reverse proxy/load balancer. An example for a typical setup is included in the source (docs/how-to.md). type: application @@ -21,7 +21,7 @@ sources: dependencies: - name: common repository: https://library-charts.truecharts.org - version: 11.1.2 + version: 14.0.1 maintainers: - email: info@truecharts.org name: TrueCharts diff --git a/charts/incubator/traefik-forward-auth/questions.yaml b/charts/incubator/traefik-forward-auth/questions.yaml index a8b233e8d1e..efca959d5d8 100644 --- a/charts/incubator/traefik-forward-auth/questions.yaml +++ b/charts/incubator/traefik-forward-auth/questions.yaml @@ -3,14 +3,13 @@ questions: # Include{global} # Include{workload} # Include{workloadDeployment} - # Include{replicas1} # Include{podSpec} # Include{containerMain} # Include{containerBasic} # Include{containerAdvanced} - -# Include{controllerExpert} +# Include{containerConfig} +# Include{podOptions} - variable: tfaAppOptions group: App Configuration label: Application Options @@ -274,20 +273,14 @@ questions: description: Optional resource indicator. schema: type: string -# Include{fixedEnv} -# Include{containerConfig} # Include{serviceRoot} - - variable: main - label: "Main Service" - description: "The Primary service on which the healthcheck runs, often the webUI" - schema: - type: dict - attrs: -# Include{serviceSelector} +# Include{serviceMain} +# Include{serviceSelectorLoadBalancer} # Include{serviceSelectorExtras} - variable: main label: "Main Service Port Configuration" schema: + additional_attrs: true type: dict attrs: - variable: port @@ -297,94 +290,31 @@ questions: type: int default: 4181 required: true - - variable: advanced - label: "Show Advanced settings" - schema: - type: boolean - default: false - show_subquestions_if: true - subquestions: - - variable: enabled - label: "Enable the port" - schema: - type: boolean - default: true - - variable: protocol - label: "Port Type" - schema: - type: string - default: "HTTP" - enum: - - value: HTTP - description: "HTTP" - - value: "HTTPS" - description: "HTTPS" - - value: TCP - description: "TCP" - - value: "UDP" - description: "UDP" - - variable: nodePort - label: "Node Port (Optional)" - description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" - schema: - type: int - min: 9000 - max: 65535 - - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" - schema: - type: int - default: 4181 # Include{serviceExpertRoot} # Include{serviceExpert} # Include{serviceList} +# Include{persistenceRoot} + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: +# Include{persistenceBasic} +# Include{persistenceList} # Include{ingressRoot} - variable: main label: "Main Ingress" schema: + additional_attrs: true type: dict attrs: # Include{ingressDefault} # Include{ingressTLS} # Include{ingressTraefik} # Include{ingressAdvanced} -# Include{ingressExpert} # Include{ingressList} - - variable: advancedSecurity - label: "Show Advanced Security Settings" - group: "Security and Permissions" - schema: - type: boolean - default: false - show_subquestions_if: true - subquestions: - - variable: securityContext - label: "Security Context" - schema: - type: dict - attrs: - - variable: privileged - label: "Privileged mode" - schema: - type: boolean - default: false - - variable: readOnlyRootFilesystem - label: "ReadOnly Root Filesystem" - schema: - type: boolean - default: true - - variable: allowPrivilegeEscalation - label: "Allow Privilege Escalation" - schema: - type: boolean - default: false - - variable: runAsNonRoot - label: "runAsNonRoot" - schema: - type: boolean - default: true -# Include{securityContextAdvanced} # Include{securityContextRoot} - variable: runAsUser label: "runAsUser" @@ -394,7 +324,7 @@ questions: default: 568 - variable: runAsGroup label: "runAsGroup" - description: "The groupID of the user running the application" + description: "The groupID this App of the user running the application" schema: type: int default: 568 @@ -407,11 +337,10 @@ questions: schema: type: int default: 568 - # Include{resources} # Include{advanced} # Include{addons} # Include{codeserver} # Include{netshoot} -# Include{promtail} # Include{vpn} +# Include{documentation} diff --git a/charts/incubator/traefik-forward-auth/templates/_secret.tpl b/charts/incubator/traefik-forward-auth/templates/_secret.tpl deleted file mode 100644 index d950139c6d8..00000000000 --- a/charts/incubator/traefik-forward-auth/templates/_secret.tpl +++ /dev/null @@ -1,57 +0,0 @@ -{{/* Define the secret */}} -{{- define "tfa.secret" -}} - -{{- $googleSecretName := printf "%s-google-secret" (include "tc.common.names.fullname" .) }} -{{- $oidcSecretName := printf "%s-oidc-secret" (include "tc.common.names.fullname" .) }} -{{- $oauthSecretName := printf "%s-oauth2-secret" (include "tc.common.names.fullname" .) }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $googleSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_GOOGLE_CLIENT_ID: {{ .Values.tfaGoogleOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_GOOGLE_CLIENT_SECRET: {{ .Values.tfaGoogleOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_GOOGLE_PROMPT: {{ .Values.tfaGoogleOptions.prompt | trimAll "\"" | b64enc }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $oidcSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_OIDC_ISSUER_URL: {{ .Values.tfaOidcOptions.issuerUrl | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_CLIENT_ID: {{ .Values.tfaOidcOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_CLIENT_SECRET: {{ .Values.tfaOidcOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_RESOURCE: {{ .Values.tfaOidcOptions.resource | trimAll "\"" | b64enc }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $oauthSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_GENERIC_OAUTH_AUTH_URL: {{ .Values.tfaOauthOptions.authUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_TOKEN_URL: {{ .Values.tfaOauthOptions.tokenUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_USER_URL: {{ .Values.tfaOauthOptions.userUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_CLIENT_ID: {{ .Values.tfaOauthOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET: {{ .Values.tfaOauthOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_TOKEN_STYLE: {{ .Values.tfaOauthOptions.tokenStyle | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_RESOURCE: {{ .Values.tfaOauthOptions.resource | trimAll "\"" | b64enc }} - ---- - -{{- end }} diff --git a/charts/incubator/traefik-forward-auth/templates/_secrets.tpl b/charts/incubator/traefik-forward-auth/templates/_secrets.tpl new file mode 100644 index 00000000000..22172aed6ba --- /dev/null +++ b/charts/incubator/traefik-forward-auth/templates/_secrets.tpl @@ -0,0 +1,20 @@ +{{/* Define the secret */}} +{{- define "tfa.secrets" -}} + +enabled: true +data: + PROVIDERS_GOOGLE_CLIENT_ID: {{ .Values.tfaGoogleOptions.clientId | trimAll "\"" }} + PROVIDERS_GOOGLE_CLIENT_SECRET: {{ .Values.tfaGoogleOptions.clientSecret | trimAll "\"" }} + PROVIDERS_GOOGLE_PROMPT: {{ .Values.tfaGoogleOptions.prompt | trimAll "\"" }} + PROVIDERS_OIDC_ISSUER_URL: {{ .Values.tfaOidcOptions.issuerUrl | trimAll "\"" }} + PROVIDERS_OIDC_CLIENT_ID: {{ .Values.tfaOidcOptions.clientId | trimAll "\"" }} + PROVIDERS_OIDC_CLIENT_SECRET: {{ .Values.tfaOidcOptions.clientSecret | trimAll "\"" }} + PROVIDERS_OIDC_RESOURCE: {{ .Values.tfaOidcOptions.resource | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_AUTH_URL: {{ .Values.tfaOauthOptions.authUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_TOKEN_URL: {{ .Values.tfaOauthOptions.tokenUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_USER_URL: {{ .Values.tfaOauthOptions.userUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_CLIENT_ID: {{ .Values.tfaOauthOptions.clientId | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET: {{ .Values.tfaOauthOptions.clientSecret | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_TOKEN_STYLE: {{ .Values.tfaOauthOptions.tokenStyle | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_RESOURCE: {{ .Values.tfaOauthOptions.resource | trimAll "\"" }} +{{- end }} diff --git a/charts/incubator/traefik-forward-auth/templates/common.yaml b/charts/incubator/traefik-forward-auth/templates/common.yaml index dd59166b203..153372b7eff 100644 --- a/charts/incubator/traefik-forward-auth/templates/common.yaml +++ b/charts/incubator/traefik-forward-auth/templates/common.yaml @@ -1,13 +1,17 @@ {{/* Make sure all variables are set properly */}} -{{- include "tc.common.loader.init" . }} +{{- include "tc.v1.common.loader.init" . }} {{/* Render secret */}} -{{- include "tfa.secret" . }} +{{- $secret := include "tfa.secrets" . | fromYaml -}} +{{- if $secret -}} + {{- $_ := set .Values.secret "tfa-secrets" $secret -}} +{{- end -}} +{{/* Render arguments */}} {{- $tplArgs := (include "tfa.args" . | fromYaml) }} {{- $_ := set .Values "tplArgs" $tplArgs -}} -{{- $args := concat .Values.args .Values.tplArgs.args }} -{{- $_ := set .Values "args" $args -}} +{{- $mergedArgs := concat $.Values.workload.main.podSpec.containers.main.args .Values.tplArgs.args }} +{{- $_ := set $.Values.workload.main.podSpec.containers.main "args" $mergedArgs -}} {{/* Render the templates */}} -{{ include "tc.common.loader.apply" . }} +{{ include "tc.v1.common.loader.apply" . }} diff --git a/charts/incubator/traefik-forward-auth/values.yaml b/charts/incubator/traefik-forward-auth/values.yaml index 498d6dd70e9..d8ced1a75bd 100644 --- a/charts/incubator/traefik-forward-auth/values.yaml +++ b/charts/incubator/traefik-forward-auth/values.yaml @@ -3,13 +3,15 @@ image: pullPolicy: IfNotPresent tag: latest@sha256:edd7eb812cb38e59d32b5a00398b57a78506db2390cbe295f5df590a38a5d44e -envFrom: - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-google-secret' - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-oidc-secret' - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-oauth2-secret' +workload: + main: + podSpec: + containers: + main: + args: [] + envFrom: + - secretRef: + name: tfa-secrets service: main: