From a07048c445569e4d330763767e9ac5194abd9385 Mon Sep 17 00:00:00 2001 From: Csaba Engedi Date: Sun, 10 Sep 2023 10:15:19 +0200 Subject: [PATCH] Uplift traefik-forward-auth to new library (#12400) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reworked values, secrets and questions to work with the new standard chart library. **Description** Uplifted traefik-forward-auth to work with the new library. **โš™๏ธ Type of change** - [ ] โš™๏ธ Feature/App addition - [ ] ๐Ÿช› Bugfix - [ ] โš ๏ธ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [x] ๐Ÿ”ƒ Refactor of current code **๐Ÿงช How Has This Been Tested?** Generated the app and deployed on my own SCALE instance. **๐Ÿ“ƒ Notes:** Existing installations might have to be reinstalled. **โœ”๏ธ Checklist:** - [x] โš–๏ธ My code follows the style guidelines of this project - [x] ๐Ÿ‘€ I have performed a self-review of my own code - [x] #๏ธโƒฃ I have commented my code, particularly in hard-to-understand areas - [x] ๐Ÿ“„ I have made corresponding changes to the documentation - [x] โš ๏ธ My changes generate no new warnings - [x] ๐Ÿงช I have added tests to this description that prove my fix is effective or that my feature works - [x] โฌ†๏ธ I increased versions for any altered app according to semantic versioning **โž• App addition** If this PR is an app addition please make sure you have done the following. - [ ] ๐Ÿชž I have opened a PR on [truecharts/containers](https://github.com/truecharts/containers) adding the container to TrueCharts mirror repo. - [ ] ๐Ÿ–ผ๏ธ I have added an icon in the Chart's root directory called `icon.png` --- _Please don't blindly check all the boxes. Read them and only check those that apply. Those checkboxes are there for the reviewer to see what is this all about and the status of this PR with a quick glance._ --- .../incubator/traefik-forward-auth/Chart.yaml | 4 +- .../traefik-forward-auth/questions.yaml | 107 +++--------------- .../templates/_secret.tpl | 57 ---------- .../templates/_secrets.tpl | 20 ++++ .../templates/common.yaml | 14 ++- .../traefik-forward-auth/values.yaml | 16 +-- 6 files changed, 58 insertions(+), 160 deletions(-) delete mode 100644 charts/incubator/traefik-forward-auth/templates/_secret.tpl create mode 100644 charts/incubator/traefik-forward-auth/templates/_secrets.tpl diff --git a/charts/incubator/traefik-forward-auth/Chart.yaml b/charts/incubator/traefik-forward-auth/Chart.yaml index ad452d0923e..b4936ead040 100644 --- a/charts/incubator/traefik-forward-auth/Chart.yaml +++ b/charts/incubator/traefik-forward-auth/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 kubeVersion: ">=1.16.0-0" name: traefik-forward-auth -version: 0.1.3 +version: 0.2.0 appVersion: "latest" description: A minimal forward authentication service that provides OAuth/SSO login and authentication for the traefik reverse proxy/load balancer. An example for a typical setup is included in the source (docs/how-to.md). type: application @@ -21,7 +21,7 @@ sources: dependencies: - name: common repository: https://library-charts.truecharts.org - version: 11.1.2 + version: 14.0.1 maintainers: - email: info@truecharts.org name: TrueCharts diff --git a/charts/incubator/traefik-forward-auth/questions.yaml b/charts/incubator/traefik-forward-auth/questions.yaml index a8b233e8d1e..efca959d5d8 100644 --- a/charts/incubator/traefik-forward-auth/questions.yaml +++ b/charts/incubator/traefik-forward-auth/questions.yaml @@ -3,14 +3,13 @@ questions: # Include{global} # Include{workload} # Include{workloadDeployment} - # Include{replicas1} # Include{podSpec} # Include{containerMain} # Include{containerBasic} # Include{containerAdvanced} - -# Include{controllerExpert} +# Include{containerConfig} +# Include{podOptions} - variable: tfaAppOptions group: App Configuration label: Application Options @@ -274,20 +273,14 @@ questions: description: Optional resource indicator. schema: type: string -# Include{fixedEnv} -# Include{containerConfig} # Include{serviceRoot} - - variable: main - label: "Main Service" - description: "The Primary service on which the healthcheck runs, often the webUI" - schema: - type: dict - attrs: -# Include{serviceSelector} +# Include{serviceMain} +# Include{serviceSelectorLoadBalancer} # Include{serviceSelectorExtras} - variable: main label: "Main Service Port Configuration" schema: + additional_attrs: true type: dict attrs: - variable: port @@ -297,94 +290,31 @@ questions: type: int default: 4181 required: true - - variable: advanced - label: "Show Advanced settings" - schema: - type: boolean - default: false - show_subquestions_if: true - subquestions: - - variable: enabled - label: "Enable the port" - schema: - type: boolean - default: true - - variable: protocol - label: "Port Type" - schema: - type: string - default: "HTTP" - enum: - - value: HTTP - description: "HTTP" - - value: "HTTPS" - description: "HTTPS" - - value: TCP - description: "TCP" - - value: "UDP" - description: "UDP" - - variable: nodePort - label: "Node Port (Optional)" - description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" - schema: - type: int - min: 9000 - max: 65535 - - variable: targetPort - label: "Target Port" - description: "The internal(!) port on the container the Application runs on" - schema: - type: int - default: 4181 # Include{serviceExpertRoot} # Include{serviceExpert} # Include{serviceList} +# Include{persistenceRoot} + - variable: config + label: "App Config Storage" + description: "Stores the Application Configuration." + schema: + additional_attrs: true + type: dict + attrs: +# Include{persistenceBasic} +# Include{persistenceList} # Include{ingressRoot} - variable: main label: "Main Ingress" schema: + additional_attrs: true type: dict attrs: # Include{ingressDefault} # Include{ingressTLS} # Include{ingressTraefik} # Include{ingressAdvanced} -# Include{ingressExpert} # Include{ingressList} - - variable: advancedSecurity - label: "Show Advanced Security Settings" - group: "Security and Permissions" - schema: - type: boolean - default: false - show_subquestions_if: true - subquestions: - - variable: securityContext - label: "Security Context" - schema: - type: dict - attrs: - - variable: privileged - label: "Privileged mode" - schema: - type: boolean - default: false - - variable: readOnlyRootFilesystem - label: "ReadOnly Root Filesystem" - schema: - type: boolean - default: true - - variable: allowPrivilegeEscalation - label: "Allow Privilege Escalation" - schema: - type: boolean - default: false - - variable: runAsNonRoot - label: "runAsNonRoot" - schema: - type: boolean - default: true -# Include{securityContextAdvanced} # Include{securityContextRoot} - variable: runAsUser label: "runAsUser" @@ -394,7 +324,7 @@ questions: default: 568 - variable: runAsGroup label: "runAsGroup" - description: "The groupID of the user running the application" + description: "The groupID this App of the user running the application" schema: type: int default: 568 @@ -407,11 +337,10 @@ questions: schema: type: int default: 568 - # Include{resources} # Include{advanced} # Include{addons} # Include{codeserver} # Include{netshoot} -# Include{promtail} # Include{vpn} +# Include{documentation} diff --git a/charts/incubator/traefik-forward-auth/templates/_secret.tpl b/charts/incubator/traefik-forward-auth/templates/_secret.tpl deleted file mode 100644 index d950139c6d8..00000000000 --- a/charts/incubator/traefik-forward-auth/templates/_secret.tpl +++ /dev/null @@ -1,57 +0,0 @@ -{{/* Define the secret */}} -{{- define "tfa.secret" -}} - -{{- $googleSecretName := printf "%s-google-secret" (include "tc.common.names.fullname" .) }} -{{- $oidcSecretName := printf "%s-oidc-secret" (include "tc.common.names.fullname" .) }} -{{- $oauthSecretName := printf "%s-oauth2-secret" (include "tc.common.names.fullname" .) }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $googleSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_GOOGLE_CLIENT_ID: {{ .Values.tfaGoogleOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_GOOGLE_CLIENT_SECRET: {{ .Values.tfaGoogleOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_GOOGLE_PROMPT: {{ .Values.tfaGoogleOptions.prompt | trimAll "\"" | b64enc }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $oidcSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_OIDC_ISSUER_URL: {{ .Values.tfaOidcOptions.issuerUrl | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_CLIENT_ID: {{ .Values.tfaOidcOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_CLIENT_SECRET: {{ .Values.tfaOidcOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_OIDC_RESOURCE: {{ .Values.tfaOidcOptions.resource | trimAll "\"" | b64enc }} - ---- - -apiVersion: v1 -kind: Secret -type: Opaque -metadata: - name: {{ $oauthSecretName }} - labels: - {{- include "tc.common.labels" . | nindent 4 }} -data: - PROVIDERS_GENERIC_OAUTH_AUTH_URL: {{ .Values.tfaOauthOptions.authUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_TOKEN_URL: {{ .Values.tfaOauthOptions.tokenUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_USER_URL: {{ .Values.tfaOauthOptions.userUrl | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_CLIENT_ID: {{ .Values.tfaOauthOptions.clientId | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET: {{ .Values.tfaOauthOptions.clientSecret | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_TOKEN_STYLE: {{ .Values.tfaOauthOptions.tokenStyle | trimAll "\"" | b64enc }} - PROVIDERS_GENERIC_OAUTH_RESOURCE: {{ .Values.tfaOauthOptions.resource | trimAll "\"" | b64enc }} - ---- - -{{- end }} diff --git a/charts/incubator/traefik-forward-auth/templates/_secrets.tpl b/charts/incubator/traefik-forward-auth/templates/_secrets.tpl new file mode 100644 index 00000000000..22172aed6ba --- /dev/null +++ b/charts/incubator/traefik-forward-auth/templates/_secrets.tpl @@ -0,0 +1,20 @@ +{{/* Define the secret */}} +{{- define "tfa.secrets" -}} + +enabled: true +data: + PROVIDERS_GOOGLE_CLIENT_ID: {{ .Values.tfaGoogleOptions.clientId | trimAll "\"" }} + PROVIDERS_GOOGLE_CLIENT_SECRET: {{ .Values.tfaGoogleOptions.clientSecret | trimAll "\"" }} + PROVIDERS_GOOGLE_PROMPT: {{ .Values.tfaGoogleOptions.prompt | trimAll "\"" }} + PROVIDERS_OIDC_ISSUER_URL: {{ .Values.tfaOidcOptions.issuerUrl | trimAll "\"" }} + PROVIDERS_OIDC_CLIENT_ID: {{ .Values.tfaOidcOptions.clientId | trimAll "\"" }} + PROVIDERS_OIDC_CLIENT_SECRET: {{ .Values.tfaOidcOptions.clientSecret | trimAll "\"" }} + PROVIDERS_OIDC_RESOURCE: {{ .Values.tfaOidcOptions.resource | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_AUTH_URL: {{ .Values.tfaOauthOptions.authUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_TOKEN_URL: {{ .Values.tfaOauthOptions.tokenUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_USER_URL: {{ .Values.tfaOauthOptions.userUrl | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_CLIENT_ID: {{ .Values.tfaOauthOptions.clientId | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_CLIENT_SECRET: {{ .Values.tfaOauthOptions.clientSecret | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_TOKEN_STYLE: {{ .Values.tfaOauthOptions.tokenStyle | trimAll "\"" }} + PROVIDERS_GENERIC_OAUTH_RESOURCE: {{ .Values.tfaOauthOptions.resource | trimAll "\"" }} +{{- end }} diff --git a/charts/incubator/traefik-forward-auth/templates/common.yaml b/charts/incubator/traefik-forward-auth/templates/common.yaml index dd59166b203..153372b7eff 100644 --- a/charts/incubator/traefik-forward-auth/templates/common.yaml +++ b/charts/incubator/traefik-forward-auth/templates/common.yaml @@ -1,13 +1,17 @@ {{/* Make sure all variables are set properly */}} -{{- include "tc.common.loader.init" . }} +{{- include "tc.v1.common.loader.init" . }} {{/* Render secret */}} -{{- include "tfa.secret" . }} +{{- $secret := include "tfa.secrets" . | fromYaml -}} +{{- if $secret -}} + {{- $_ := set .Values.secret "tfa-secrets" $secret -}} +{{- end -}} +{{/* Render arguments */}} {{- $tplArgs := (include "tfa.args" . | fromYaml) }} {{- $_ := set .Values "tplArgs" $tplArgs -}} -{{- $args := concat .Values.args .Values.tplArgs.args }} -{{- $_ := set .Values "args" $args -}} +{{- $mergedArgs := concat $.Values.workload.main.podSpec.containers.main.args .Values.tplArgs.args }} +{{- $_ := set $.Values.workload.main.podSpec.containers.main "args" $mergedArgs -}} {{/* Render the templates */}} -{{ include "tc.common.loader.apply" . }} +{{ include "tc.v1.common.loader.apply" . }} diff --git a/charts/incubator/traefik-forward-auth/values.yaml b/charts/incubator/traefik-forward-auth/values.yaml index 498d6dd70e9..d8ced1a75bd 100644 --- a/charts/incubator/traefik-forward-auth/values.yaml +++ b/charts/incubator/traefik-forward-auth/values.yaml @@ -3,13 +3,15 @@ image: pullPolicy: IfNotPresent tag: latest@sha256:edd7eb812cb38e59d32b5a00398b57a78506db2390cbe295f5df590a38a5d44e -envFrom: - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-google-secret' - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-oidc-secret' - - secretRef: - name: '{{ include "tc.common.names.fullname" . }}-oauth2-secret' +workload: + main: + podSpec: + containers: + main: + args: [] + envFrom: + - secretRef: + name: tfa-secrets service: main: