{{`{{ .StatusCode }}`}}
338 | 339 | 340 | ``` 341 | 342 | ## Multi whitelist-domain configuration 343 | You must use the config.configFile section for a multi-whitelist-domain configuration for one Oauth2-proxy instance. 344 | 345 | It will be overwriting the `/etc/oauth2_proxy/oauth2_proxy.cfg` [configuration file](https://oauth2-proxy.github.io/oauth2-proxy/configuration/overview#config-file). 346 | In this example, Google provider is used, but you can find all other provider configurations here [oauth_provider](https://oauth2-proxy.github.io/oauth2-proxy/configuration/providers/). 347 | 348 | ``` 349 | config: 350 | ... 351 | clientID="$YOUR_GOOGLE_CLIENT_ID" 352 | clientSecret="$YOUR_GOOGLE_CLIENT_SECRET" 353 | cookieSecret="$YOUR_COOKIE_SECRET" 354 | configFile: | 355 | ... 356 | email_domains = [ "*" ] 357 | upstreams = [ "file:///dev/null" ] 358 | cookie_secure = "false" 359 | cookie_domains = [ ".domain.com", ".example.io" ] 360 | whitelist_domains = [ ".domain.com", ".example.io"] 361 | provider = "google" 362 | ``` 363 | 364 | ## Route requests to sidecar container 365 | You can route requests to a sidecar container first by setting the `service.targetPort` variable. The possible values for the targetPort field of a Kubernetes Service can be either a port number or the name of a port defined in the pod. By default, the service's `targetPort` value equals to `httpSchema`'s. 366 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/default-values.yaml: -------------------------------------------------------------------------------- 1 | # Leave this file empty to ensure that CI runs builds against the default configuration in values.yaml. 2 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/extra-args-as-dict-values.yaml: -------------------------------------------------------------------------------- 1 | extraArgs: 2 | pass-authorization-header: "true" 3 | request-logging: "true" 4 | allowed-role: client_id:client_role 5 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/extra-args-as-list-values.yaml: -------------------------------------------------------------------------------- 1 | extraArgs: 2 | - "--pass-authorization-header=true" 3 | - "--request-logging=true" 4 | - --allowed-role=client_id:client_role_A 5 | - --allowed-role=client_id_B:client_role_C 6 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/extra-env-tpl-values.yaml: -------------------------------------------------------------------------------- 1 | tplValue: "This is a test value for the template function" 2 | extraEnv: 3 | - name: TEST_ENV_VAR_1 4 | value: test_value_1 5 | - name: TEST_ENV_VAR_2 6 | value: '{{ .Values.tplValue }}' 7 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/extra-init-container.yaml: -------------------------------------------------------------------------------- 1 | extraInitContainers: 2 | - name: extra-init-container 3 | image: busybox 4 | command: 5 | - sh 6 | - -c 7 | - echo "Hello World!" 8 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/horizontal-pod-autoscaling-values.yaml: -------------------------------------------------------------------------------- 1 | # Enables Horizontal Pod Autoscaler and removes replica count in deployment 2 | autoscaling: 3 | enabled: true 4 | annotations: 5 | test-annotations/test: "true" 6 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/ingress-extra-paths-values.yaml: -------------------------------------------------------------------------------- 1 | ingress: 2 | enabled: true 3 | path: / 4 | pathType: ImplementationSpecific 5 | hosts: 6 | - chart-example.local 7 | extraPaths: 8 | - path: /* 9 | pathType: ImplementationSpecific 10 | backend: 11 | service: 12 | name: ssl-redirect 13 | port: 14 | name: use-annotation 15 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/pdb-values.yaml: -------------------------------------------------------------------------------- 1 | replicaCount: 2 # Enables PodDisruptionBudget which is disabled when replicaCount is 1 2 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/pod-security-context-values.yaml: -------------------------------------------------------------------------------- 1 | # Allocate a FSGroup that owns the pod’s volumes via podSecurityContext 2 | --- 3 | podSecurityContext: 4 | fsGroup: 2000 5 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/redis-sentinel-array-values.yaml: -------------------------------------------------------------------------------- 1 | sessionStorage: 2 | type: redis 3 | redis: 4 | clientType: sentinel 5 | sentinel: 6 | password: "foo" 7 | masterName: "mymaster" 8 | connectionUrls: 9 | - "redis://oauth2-proxy-redis:26379" 10 | - "redis://oauth2-proxy-redis:26379" 11 | redis: 12 | # provision an instance of the redis sub-chart 13 | enabled: true 14 | fullnameOverride: oauth2-proxy-redis 15 | architecture: replication 16 | sentinel: 17 | enabled: true 18 | masterSet: mymaster 19 | global: 20 | redis: 21 | password: "foo" 22 | initContainers: 23 | waitForRedis: 24 | enabled: true 25 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/redis-sentinel-comma-values.yaml: -------------------------------------------------------------------------------- 1 | sessionStorage: 2 | type: redis 3 | redis: 4 | clientType: sentinel 5 | sentinel: 6 | password: "foo" 7 | masterName: "mymaster" 8 | connectionUrls: "redis://oauth2-proxy-redis:26379,redis://oauth2-proxy-redis:26379" 9 | redis: 10 | # provision an instance of the redis sub-chart 11 | enabled: true 12 | fullnameOverride: oauth2-proxy-redis 13 | architecture: replication 14 | sentinel: 15 | enabled: true 16 | masterSet: mymaster 17 | global: 18 | redis: 19 | password: "foo" 20 | initContainers: 21 | waitForRedis: 22 | enabled: true 23 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/redis-standalone-values.yaml: -------------------------------------------------------------------------------- 1 | sessionStorage: 2 | type: redis 3 | redis: 4 | clientType: "standalone" 5 | password: "foo" 6 | redis: 7 | # provision an instance of the redis sub-chart 8 | enabled: true 9 | architecture: standalone 10 | global: 11 | redis: 12 | password: "foo" 13 | initContainers: 14 | waitForRedis: 15 | enabled: true 16 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/servicemonitor-values.yaml: -------------------------------------------------------------------------------- 1 | metrics: 2 | enabled: true 3 | serviceMonitor: 4 | enabled: true 5 | annotations: 6 | key: value 7 | metricRelabelings: 8 | - action: keep 9 | regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' 10 | sourceLabels: [__name__] 11 | 12 | relabelings: 13 | - sourceLabels: [__meta_kubernetes_pod_node_name] 14 | separator: ; 15 | regex: ^(.*)$ 16 | targetLabel: nodename 17 | replacement: $1 18 | action: replace 19 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/ci/tpl-values.yaml: -------------------------------------------------------------------------------- 1 | extraEnv: 2 | - name: TEST_ENV_VAR_2 3 | value: '{{ $.Release.Name }}' 4 | ingress: 5 | enabled: true 6 | hosts: 7 | - "{{ $.Release.Name }}.local" 8 | tls: 9 | - hosts: 10 | - "{{ $.Release.Name }}.local" 11 | annotations: 12 | test-annotations/test: "{{ $.Release.Name }}" 13 | oauth2-proxy: 14 | checkDeprecation: false 15 | config: 16 | clientSecret: '{{ $.Release.Name }}' 17 | configFile: | 18 | oidc_issuer_url = "https://{{ $.Release.Name }}/dex" 19 | 20 | pass_authorization_header: "true" 21 | 22 | extraArgs: 23 | pass-authorization-header: "{{ $.Values.pass_authorization_header }}" 24 | 25 | extraVolumes: 26 | - name: "{{ $.Release.Name }}-secret" 27 | secret: 28 | secretName: "{{ .Release.Name }}-secret" 29 | items: 30 | - key: secret 31 | path: secret 32 | 33 | authenticatedEmailsFile: 34 | annotations: 35 | test-annotations/test: "{{ $.Release.Name }}" 36 | 37 | config: 38 | annotations: 39 | test-annotations/test: "{{ $.Release.Name }}" 40 | 41 | deploymentAnnotations: 42 | test-annotations/test: "{{ $.Release.Name }}" 43 | 44 | autoscaling: 45 | annotations: 46 | test-annotations/test: "{{ $.Release.Name }}" 47 | 48 | alphaConfig: 49 | annotations: 50 | test-annotations/test: "{{ $.Release.Name }}" 51 | 52 | service: 53 | annotations: 54 | test-annotations/test: "{{ $.Release.Name }}" 55 | 56 | serviceAccount: 57 | annotations: 58 | test-annotations/test: "{{ $.Release.Name }}" 59 | 60 | serviceMonitor: 61 | annotations: 62 | test-annotations/test: "{{ $.Release.Name }}" 63 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/scripts/check-redis.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | RETRY_INTERVAL=5 # Interval between retries in seconds 4 | elapsed=0 # Elapsed time 5 | 6 | check_redis() { 7 | host=$1 8 | port=$2 9 | while [ $elapsed -lt $TOTAL_RETRY_TIME ]; do 10 | echo "Checking Redis at $host:$port... Elapsed time: ${elapsed}s" 11 | if nc -z -w1 $TIMEOUT $host $port > /dev/null 2>&1; then 12 | echo "Redis is up at $host:$port!" 13 | return 0 14 | else 15 | echo "Redis is down at $host:$port. Retrying in $RETRY_INTERVAL seconds." 16 | sleep $RETRY_INTERVAL 17 | elapsed=$((elapsed + RETRY_INTERVAL)) 18 | fi 19 | done 20 | echo "Failed to connect to Redis at $host:$port after $TOTAL_RETRY_TIME seconds." 21 | return 1 22 | } 23 | 24 | # For parsing and checking connections 25 | parse_and_check() { 26 | url=$1 27 | 28 | # Strip either redis:// or rediss:// 29 | if [[ $url == rediss://* ]]; then 30 | clean_url=${url#rediss://} 31 | echo "Using secure Rediss connection..." 32 | else 33 | clean_url=${url#redis://} 34 | echo "Using standard Redis connection..." 35 | fi 36 | 37 | host=$(echo $clean_url | cut -d':' -f1) 38 | port=$(echo $clean_url | cut -d':' -f2) 39 | check_redis $host $port 40 | } 41 | 42 | # Main 43 | if [ -n "$OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS" ]; then 44 | echo "Checking Redis in cluster mode..." 45 | echo "$OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS" | tr ',' '\n' | while read -r addr; do 46 | parse_and_check $addr || exit 1 47 | done 48 | elif [ -n "$OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS" ]; then 49 | echo "Checking Redis in sentinel mode..." 50 | echo "$OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS" | tr ',' '\n' | while read -r addr; do 51 | parse_and_check $addr || exit 1 52 | done 53 | elif [ -n "$OAUTH2_PROXY_REDIS_CONNECTION_URL" ]; then 54 | echo "Checking standalone Redis..." 55 | parse_and_check "$OAUTH2_PROXY_REDIS_CONNECTION_URL" || exit 1 56 | else 57 | echo "Redis configuration not specified." 58 | exit 1 59 | fi 60 | 61 | echo "Redis check completed." 62 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/NOTES.txt: -------------------------------------------------------------------------------- 1 | To verify that oauth2-proxy has started, run: 2 | 3 | kubectl --namespace={{ template "oauth2-proxy.namespace" $ }} get pods -l "app={{ template "oauth2-proxy.name" . }}" 4 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/_capabilities.tpl: -------------------------------------------------------------------------------- 1 | {{/* 2 | Returns the appropriate apiVersion for podDisruptionBudget object. 3 | */}} 4 | {{- define "capabilities.podDisruptionBudget.apiVersion" -}} 5 | {{- if semverCompare ">=1.21-0" ( .Values.kubeVersion | default .Capabilities.KubeVersion.Version ) -}} 6 | {{- print "policy/v1" -}} 7 | {{- else -}} 8 | {{- print "policy/v1beta1" -}} 9 | {{- end -}} 10 | {{- end -}} 11 | 12 | {{/* 13 | Return the appropriate apiVersion for ingress object. 14 | */}} 15 | {{- define "capabilities.ingress.apiVersion" -}} 16 | {{- if semverCompare "<1.14-0" ( .Values.kubeVersion | default .Capabilities.KubeVersion.Version ) -}} 17 | {{- print "extensions/v1beta1" -}} 18 | {{- else if semverCompare "<1.19-0" ( .Values.kubeVersion | default .Capabilities.KubeVersion.Version ) -}} 19 | {{- print "networking.k8s.io/v1beta1" -}} 20 | {{- else -}} 21 | {{- print "networking.k8s.io/v1" -}} 22 | {{- end -}} 23 | {{- end -}} 24 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/_helpers.tpl: -------------------------------------------------------------------------------- 1 | {{/* vim: set filetype=mustache: */}} 2 | {{/* 3 | Expand the name of the chart. 4 | */}} 5 | {{- define "oauth2-proxy.name" -}} 6 | {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} 7 | {{- end -}} 8 | 9 | {{/* 10 | Create a default fully qualified app name. 11 | We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). 12 | If release name contains chart name it will be used as a full name. 13 | */}} 14 | {{- define "oauth2-proxy.fullname" -}} 15 | {{- if .Values.fullnameOverride -}} 16 | {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} 17 | {{- else -}} 18 | {{- $name := default .Chart.Name .Values.nameOverride -}} 19 | {{- if contains $name .Release.Name -}} 20 | {{- .Release.Name | trunc 63 | trimSuffix "-" -}} 21 | {{- else -}} 22 | {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} 23 | {{- end -}} 24 | {{- end -}} 25 | {{- end -}} 26 | 27 | {{/* 28 | Create chart name and version as used by the chart label. 29 | */}} 30 | {{- define "oauth2-proxy.chart" -}} 31 | {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} 32 | {{- end -}} 33 | 34 | {{/* 35 | Generate basic labels 36 | */}} 37 | {{- define "oauth2-proxy.labels" }} 38 | helm.sh/chart: {{ include "oauth2-proxy.chart" . }} 39 | app.kubernetes.io/managed-by: {{ .Release.Service }} 40 | app.kubernetes.io/component: authentication-proxy 41 | app.kubernetes.io/part-of: {{ template "oauth2-proxy.name" . }} 42 | {{- include "oauth2-proxy.selectorLabels" . }} 43 | {{- if .Chart.AppVersion }} 44 | app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} 45 | {{- end }} 46 | {{- if .Values.customLabels }} 47 | {{ toYaml .Values.customLabels }} 48 | {{- end }} 49 | {{- end }} 50 | 51 | {{/* 52 | Selector labels 53 | */}} 54 | {{- define "oauth2-proxy.selectorLabels" }} 55 | app.kubernetes.io/name: {{ include "oauth2-proxy.name" . }} 56 | app.kubernetes.io/instance: {{ .Release.Name }} 57 | {{- end }} 58 | 59 | {{/* 60 | Get the secret name. 61 | */}} 62 | {{- define "oauth2-proxy.secretName" -}} 63 | {{- if .Values.config.existingSecret -}} 64 | {{- printf "%s" .Values.config.existingSecret -}} 65 | {{- else -}} 66 | {{- printf "%s" (include "oauth2-proxy.fullname" .) -}} 67 | {{- end -}} 68 | {{- end -}} 69 | 70 | {{/* 71 | Create the name of the service account to use 72 | */}} 73 | {{- define "oauth2-proxy.serviceAccountName" -}} 74 | {{- if .Values.serviceAccount.enabled -}} 75 | {{ default (include "oauth2-proxy.fullname" .) .Values.serviceAccount.name }} 76 | {{- else -}} 77 | {{ default "default" .Values.serviceAccount.name }} 78 | {{- end -}} 79 | {{- end -}} 80 | 81 | {{/* 82 | Allow the release namespace to be overridden for multi-namespace deployments in combined charts 83 | */}} 84 | {{- define "oauth2-proxy.namespace" -}} 85 | {{- if .Values.namespaceOverride -}} 86 | {{- .Values.namespaceOverride -}} 87 | {{- else -}} 88 | {{- .Release.Namespace -}} 89 | {{- end -}} 90 | {{- end -}} 91 | 92 | {{/* 93 | Redis subcharts fullname 94 | */}} 95 | {{- define "oauth2-proxy.redis.fullname" -}} 96 | {{- if .Values.redis.enabled -}} 97 | {{- include "common.names.fullname" (dict "Chart" (dict "Name" "redis") "Release" .Release "Values" .Values.redis) -}} 98 | {{- else -}} 99 | {{ fail "attempting to use redis subcharts fullname, even though the subchart is not enabled. This will lead to misconfiguration" }} 100 | {{- end -}} 101 | {{- end -}} 102 | 103 | {{/* 104 | Compute the redis url if not set explicitly. 105 | */}} 106 | {{- define "oauth2-proxy.redis.StandaloneUrl" -}} 107 | {{- if .Values.sessionStorage.redis.standalone.connectionUrl -}} 108 | {{ .Values.sessionStorage.redis.standalone.connectionUrl }} 109 | {{- else if .Values.redis.enabled -}} 110 | {{- printf "redis://%s-master:%.0f" (include "oauth2-proxy.redis.fullname" .) .Values.redis.master.service.ports.redis -}} 111 | {{- else -}} 112 | {{ fail "please set sessionStorage.redis.standalone.connectionUrl or enable the redis subchart via redis.enabled" }} 113 | {{- end -}} 114 | {{- end -}} 115 | 116 | {{/* 117 | Returns the version 118 | */}} 119 | {{- define "oauth2-proxy.version" -}} 120 | {{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }} 121 | {{- end -}} 122 | 123 | {{/* 124 | Returns the kubectl version 125 | Workaround for EKS https://github.com/aws/eks-distro/issues/1128 126 | */}} 127 | {{- define "kubectl.version" -}} 128 | {{- if .Values.initContainers.waitForRedis.kubectlVersion -}} 129 | {{ .Values.initContainers.waitForRedis.kubectlVersion }} 130 | {{- else -}} 131 | {{- printf "%s.%s" .Capabilities.KubeVersion.Major (.Capabilities.KubeVersion.Minor | replace "+" "") -}} 132 | {{- end -}} 133 | {{- end -}} 134 | 135 | {{- define "oauth2-proxy.alpha-config" -}} 136 | --- 137 | server: 138 | BindAddress: '0.0.0.0:4180' 139 | {{- if .Values.alphaConfig.serverConfigData }} 140 | {{- toYaml .Values.alphaConfig.serverConfigData | nindent 2 }} 141 | {{- end }} 142 | {{- if .Values.metrics.enabled }} 143 | metricsServer: 144 | BindAddress: '0.0.0.0:44180' 145 | {{- if .Values.alphaConfig.metricsConfigData }} 146 | {{- toYaml .Values.alphaConfig.metricsConfigData | nindent 2 }} 147 | {{- end }} 148 | {{- end }} 149 | {{- if .Values.alphaConfig.configData }} 150 | {{- toYaml .Values.alphaConfig.configData | nindent 0 }} 151 | {{- end }} 152 | {{- if .Values.alphaConfig.configFile }} 153 | {{- tpl .Values.alphaConfig.configFile $ | nindent 0 }} 154 | {{- end }} 155 | {{- end -}} 156 | 157 | {{- define "oauth2-proxy.secrets" -}} 158 | cookie-secret: {{ tpl .Values.config.cookieSecret $ | b64enc | quote }} 159 | client-secret: {{ tpl .Values.config.clientSecret $ | b64enc | quote }} 160 | client-id: {{ tpl .Values.config.clientID $ | b64enc | quote }} 161 | {{- end -}} 162 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/_ingress.tpl: -------------------------------------------------------------------------------- 1 | {{/* 2 | Returns `true` if the API `ingressClassName` field is supported and `false` otherwise 3 | */}} 4 | {{- define "ingress.supportsIngressClassName" -}} 5 | {{- if ( semverCompare "<1.18-0" ( .Values.kubeVersion | default .Capabilities.KubeVersion.Version ) ) -}} 6 | {{- print "false" -}} 7 | {{- else -}} 8 | {{- print "true" -}} 9 | {{- end -}} 10 | {{- end -}} 11 | 12 | {{/* 13 | Returns `true` if the API `pathType` field is supported and `false` otherwise 14 | */}} 15 | {{- define "ingress.supportsPathType" -}} 16 | {{- if ( semverCompare "<1.18-0" ( .Values.kubeVersion | default .Capabilities.KubeVersion.Version ) ) -}} 17 | {{- print "false" -}} 18 | {{- else -}} 19 | {{- print "true" -}} 20 | {{- end -}} 21 | {{- end -}} 22 | 23 | {{/* 24 | Returns the appropriate ingress `backend` fields depending on the Kubernetes API version. 25 | e.g.: `{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}` 26 | Where the dict must contain the following entries: 27 | - `serviceName` {String} - Name of an existing service backend 28 | - `servicePort` {String|Number} - Port name or port number of the service. 29 | - `context` {Dict} - (Parent) Context for the template evaluation required for the API version detection. 30 | */}} 31 | {{- define "ingress.backend" -}} 32 | {{- $apiVersion := ( include "capabilities.ingress.apiVersion" .context ) -}} 33 | {{- if or ( eq $apiVersion "extensions/v1beta1" ) ( eq $apiVersion "networking.k8s.io/v1beta1" ) -}} 34 | serviceName: {{ .serviceName }} 35 | servicePort: {{ .servicePort }} 36 | {{- else -}} 37 | service: 38 | name: {{ .serviceName }} 39 | port: 40 | {{- if typeIs "string" .servicePort }} 41 | name: {{ .servicePort }} 42 | {{- else if or ( typeIs "int" .servicePort ) ( typeIs "float64" .servicePort ) }} 43 | number: {{ .servicePort }} 44 | {{- end }} 45 | {{- end -}} 46 | {{- end -}} 47 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/configmap-authenticated-emails-file.yaml: -------------------------------------------------------------------------------- 1 | {{- if .Values.authenticatedEmailsFile.enabled }} 2 | {{- if and (.Values.authenticatedEmailsFile.restricted_access) (eq .Values.authenticatedEmailsFile.persistence "configmap") }} 3 | apiVersion: v1 4 | kind: ConfigMap 5 | metadata: 6 | labels: 7 | app: {{ template "oauth2-proxy.name" . }} 8 | {{- include "oauth2-proxy.labels" . | indent 4 }} 9 | {{- with .Values.authenticatedEmailsFile.annotations }} 10 | annotations: 11 | {{ tpl ( toYaml . ) $ | indent 4 }} 12 | {{- end }} 13 | name: {{ template "oauth2-proxy.fullname" . }}-accesslist 14 | namespace: {{ template "oauth2-proxy.namespace" $ }} 15 | data: 16 | {{ default "restricted_user_access" .Values.authenticatedEmailsFile.restrictedUserAccessKey }}: {{ .Values.authenticatedEmailsFile.restricted_access | quote }} 17 | {{- end }} 18 | {{- end }} 19 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/configmap-wait-for-redis.yaml: -------------------------------------------------------------------------------- 1 | {{- if and .Values.redis.enabled .Values.initContainers.waitForRedis.enabled }} 2 | apiVersion: v1 3 | kind: ConfigMap 4 | metadata: 5 | labels: 6 | app: {{ template "oauth2-proxy.name" . }} 7 | {{- include "oauth2-proxy.labels" . | indent 4 }} 8 | name: {{ template "oauth2-proxy.fullname" . }}-wait-for-redis 9 | namespace: {{ template "oauth2-proxy.namespace" $ }} 10 | data: 11 | check-redis.sh: | 12 | {{ .Files.Get "scripts/check-redis.sh" | indent 4 }} 13 | {{- end }} 14 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/configmap.yaml: -------------------------------------------------------------------------------- 1 | {{- if not .Values.config.existingConfig }} 2 | {{- if .Values.config.configFile }} 3 | apiVersion: v1 4 | kind: ConfigMap 5 | metadata: 6 | {{- with .Values.config.annotations }} 7 | annotations: 8 | {{ tpl ( toYaml . ) $ | indent 4 }} 9 | {{- end }} 10 | labels: 11 | app: {{ template "oauth2-proxy.name" . }} 12 | {{- include "oauth2-proxy.labels" . | indent 4 }} 13 | name: {{ template "oauth2-proxy.fullname" . }} 14 | namespace: {{ template "oauth2-proxy.namespace" $ }} 15 | data: 16 | oauth2_proxy.cfg: {{ tpl .Values.config.configFile $ | quote }} 17 | {{- end }} 18 | {{- end }} 19 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: apps/v1 2 | kind: Deployment 3 | metadata: 4 | labels: 5 | app: {{ template "oauth2-proxy.name" . }} 6 | {{- include "oauth2-proxy.labels" . | indent 4 }} 7 | {{- with .Values.deploymentAnnotations }} 8 | annotations: 9 | {{ tpl ( toYaml . ) $ | indent 4 }} 10 | {{- end }} 11 | name: {{ template "oauth2-proxy.fullname" . }} 12 | namespace: {{ template "oauth2-proxy.namespace" $ }} 13 | spec: 14 | {{- if not .Values.autoscaling.enabled }} 15 | replicas: {{ .Values.replicaCount }} 16 | {{- end }} 17 | revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} 18 | {{- with .Values.strategy }} 19 | strategy: 20 | {{ toYaml . | nindent 4 }} 21 | {{- end }} 22 | selector: 23 | matchLabels: 24 | {{- include "oauth2-proxy.selectorLabels" . | indent 6 }} 25 | template: 26 | metadata: 27 | annotations: 28 | {{- if .Values.config.configFile }} 29 | checksum/config: {{ tpl .Values.config.configFile $ | sha256sum }} 30 | {{- end }} 31 | {{- if .Values.alphaConfig.enabled }} 32 | checksum/alpha-config: {{ include "oauth2-proxy.alpha-config" . | sha256sum }} 33 | {{- end }} 34 | {{- if .Values.authenticatedEmailsFile.enabled }} 35 | checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }} 36 | {{- end }} 37 | checksum/secret: {{ include "oauth2-proxy.secrets" . | sha256sum }} 38 | checksum/google-secret: {{ include (print $.Template.BasePath "/google-secret.yaml") . | sha256sum }} 39 | checksum/redis-secret: {{ include (print $.Template.BasePath "/redis-secret.yaml") . | sha256sum }} 40 | {{- if .Values.htpasswdFile.enabled }} 41 | checksum/htpasswd: {{ toYaml .Values.htpasswdFile.entries | sha256sum }} 42 | {{- end }} 43 | {{- if .Values.podAnnotations }} 44 | {{ toYaml .Values.podAnnotations | indent 8 }} 45 | {{- end }} 46 | labels: 47 | app: {{ template "oauth2-proxy.name" . }} 48 | {{- include "oauth2-proxy.labels" . | indent 8 }} 49 | {{- if .Values.podLabels }} 50 | {{ toYaml .Values.podLabels | indent 8 }} 51 | {{- end }} 52 | spec: 53 | {{- if .Values.priorityClassName }} 54 | priorityClassName: "{{ .Values.priorityClassName }}" 55 | {{- end }} 56 | {{- with .Values.podSecurityContext }} 57 | securityContext: 58 | {{- toYaml . | nindent 8 }} 59 | {{- end }} 60 | serviceAccountName: {{ template "oauth2-proxy.serviceAccountName" . }} 61 | enableServiceLinks: {{ .Values.enableServiceLinks }} 62 | automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} 63 | {{- if .Values.hostAliases }} 64 | hostAliases: 65 | {{ toYaml .Values.hostAliases | nindent 8}} 66 | {{- end }} 67 | {{- if or (and .Values.redis.enabled .Values.initContainers.waitForRedis.enabled) .Values.extraInitContainers }} 68 | initContainers: 69 | {{- if .Values.extraInitContainers }} 70 | {{- toYaml .Values.extraInitContainers | nindent 6 }} 71 | {{- end }} 72 | {{- if and .Values.redis.enabled .Values.initContainers.waitForRedis.enabled }} 73 | - name: wait-for-redis 74 | image: "{{ .Values.initContainers.waitForRedis.image.repository }}:{{ .Values.initContainers.waitForRedis.image.tag }}" 75 | imagePullPolicy: {{ .Values.initContainers.waitForRedis.image.pullPolicy }} 76 | command: ["/bin/sh", "-c", "/scripts/check-redis.sh"] 77 | env: 78 | - name: TOTAL_RETRY_TIME 79 | value: "{{ .Values.initContainers.waitForRedis.timeout }}" 80 | {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }} 81 | - name: OAUTH2_PROXY_REDIS_CONNECTION_URL 82 | value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }} 83 | {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }} 84 | - name: OAUTH2_PROXY_REDIS_USE_CLUSTER 85 | value: "true" 86 | - name: OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS 87 | value: {{ join "," .Values.sessionStorage.redis.cluster.connectionUrls }} 88 | {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "sentinel" }} 89 | - name: OAUTH2_PROXY_REDIS_USE_SENTINEL 90 | value: "true" 91 | - name: OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS 92 | value: {{ join "," .Values.sessionStorage.redis.sentinel.connectionUrls }} 93 | {{- end }} 94 | {{- if .Values.initContainers.waitForRedis.securityContext.enabled }} 95 | {{- $securityContext := unset .Values.initContainers.waitForRedis.securityContext "enabled" }} 96 | securityContext: 97 | {{- toYaml $securityContext | nindent 10 }} 98 | {{- end }} 99 | resources: 100 | {{- toYaml .Values.initContainers.waitForRedis.resources | nindent 10 }} 101 | volumeMounts: 102 | - name: redis-script 103 | mountPath: /scripts 104 | {{- end }} 105 | {{- end }} 106 | {{- if .Values.terminationGracePeriodSeconds }} 107 | terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} 108 | {{- end }} 109 | containers: 110 | - name: {{ .Chart.Name }} 111 | image: "{{ .Values.image.repository }}:{{ include "oauth2-proxy.version" . }}" 112 | imagePullPolicy: {{ .Values.image.pullPolicy }} 113 | {{- if .Values.image.command }} 114 | command: 115 | {{- range .Values.image.command }} 116 | - {{ . | quote }} 117 | {{- end }} 118 | {{- end }} 119 | args: 120 | {{- if .Values.alphaConfig.enabled }} 121 | - --alpha-config=/etc/oauth2_proxy/oauth2_proxy.yml 122 | {{- else }} 123 | - --http-address=0.0.0.0:4180 124 | - --https-address=0.0.0.0:4443 125 | {{- if .Values.metrics.enabled }} 126 | - --metrics-address=0.0.0.0:44180 127 | {{- end }} 128 | {{- end }} 129 | {{- if .Values.config.cookieName }} 130 | - --cookie-name={{ .Values.config.cookieName }} 131 | {{- end }} 132 | {{- if kindIs "map" .Values.extraArgs }} 133 | {{- range $key, $value := .Values.extraArgs }} 134 | {{- if not (kindIs "invalid" $value) }} 135 | - --{{ $key }}={{ tpl ($value | toString) $ }} 136 | {{- else }} 137 | - --{{ $key }} 138 | {{- end }} 139 | {{- end }} 140 | {{- end }} 141 | {{- if kindIs "slice" .Values.extraArgs }} 142 | {{- with .Values.extraArgs }} 143 | {{- toYaml . | nindent 10 }} 144 | {{- end }} 145 | {{- end }} 146 | {{- if or .Values.config.existingConfig .Values.config.configFile }} 147 | - --config=/etc/oauth2_proxy/oauth2_proxy.cfg 148 | {{- end }} 149 | {{- if .Values.authenticatedEmailsFile.enabled }} 150 | {{- if .Values.authenticatedEmailsFile.template }} 151 | - --authenticated-emails-file=/etc/oauth2-proxy/{{ .Values.authenticatedEmailsFile.template }} 152 | {{- else }} 153 | - --authenticated-emails-file=/etc/oauth2-proxy/{{ template "oauth2-proxy.fullname" . }}-accesslist 154 | {{- end }} 155 | {{- end }} 156 | {{- with .Values.config.google }} 157 | {{- if and .adminEmail (or .serviceAccountJson .existingSecret .useApplicationDefaultCredentials) }} 158 | - --google-admin-email={{ .adminEmail }} 159 | {{- if .useApplicationDefaultCredentials }} 160 | - --google-use-application-default-credentials=true 161 | {{- else }} 162 | - --google-service-account-json=/google/service-account.json 163 | {{- end }} 164 | {{- if .targetPrincipal }} 165 | - --google-target-principal={{ .targetPrincipal }} 166 | {{- end }} 167 | {{- end }} 168 | {{- if .groups }} 169 | {{- range $group := .groups }} 170 | - --google-group={{ $group }} 171 | {{- end }} 172 | {{- end }} 173 | {{- end }} 174 | {{- if .Values.htpasswdFile.enabled }} 175 | - --htpasswd-file=/etc/oauth2_proxy/htpasswd/users.txt 176 | {{- end }} 177 | {{- if .Values.lifecycle }} 178 | lifecycle: 179 | {{ toYaml .Values.lifecycle | indent 10 }} 180 | {{- end }} 181 | env: 182 | {{- if .Values.proxyVarsAsSecrets }} 183 | - name: OAUTH2_PROXY_CLIENT_ID 184 | valueFrom: 185 | secretKeyRef: 186 | name: {{ template "oauth2-proxy.secretName" . }} 187 | key: client-id 188 | - name: OAUTH2_PROXY_CLIENT_SECRET 189 | valueFrom: 190 | secretKeyRef: 191 | name: {{ template "oauth2-proxy.secretName" . }} 192 | key: client-secret 193 | - name: OAUTH2_PROXY_COOKIE_SECRET 194 | valueFrom: 195 | secretKeyRef: 196 | name: {{ template "oauth2-proxy.secretName" . }} 197 | key: cookie-secret 198 | {{- end }} 199 | {{- if eq (default "cookie" .Values.sessionStorage.type) "redis" }} 200 | - name: OAUTH2_PROXY_SESSION_STORE_TYPE 201 | value: "redis" 202 | {{- if or .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.password (and .Values.redis.enabled (.Values.redis.auth).enabled )}} 203 | - name: OAUTH2_PROXY_REDIS_PASSWORD 204 | valueFrom: 205 | secretKeyRef: 206 | {{- if .Values.sessionStorage.redis.existingSecret }} 207 | name: {{ .Values.sessionStorage.redis.existingSecret }} 208 | {{- else if .Values.sessionStorage.redis.password }} 209 | name: {{ template "oauth2-proxy.fullname" . }}-redis-access 210 | {{- else }} 211 | name: {{ include "oauth2-proxy.redis.fullname" . }} 212 | {{- end }} 213 | key: {{ .Values.sessionStorage.redis.passwordKey }} 214 | {{- end }} 215 | {{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }} 216 | - name: OAUTH2_PROXY_REDIS_CONNECTION_URL 217 | value: {{ include "oauth2-proxy.redis.StandaloneUrl" . }} 218 | {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }} 219 | - name: OAUTH2_PROXY_REDIS_USE_CLUSTER 220 | value: "true" 221 | - name: OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS 222 | value: {{ join "," .Values.sessionStorage.redis.cluster.connectionUrls }} 223 | {{- else if eq (default "" .Values.sessionStorage.redis.clientType) "sentinel" }} 224 | - name: OAUTH2_PROXY_REDIS_USE_SENTINEL 225 | value: "true" 226 | - name: OAUTH2_PROXY_REDIS_SENTINEL_MASTER_NAME 227 | value: {{ .Values.sessionStorage.redis.sentinel.masterName }} 228 | - name: OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS 229 | value: {{ join "," .Values.sessionStorage.redis.sentinel.connectionUrls }} 230 | {{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.sentinel.password }} 231 | - name: OAUTH2_PROXY_REDIS_SENTINEL_PASSWORD 232 | valueFrom: 233 | secretKeyRef: 234 | {{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret }} 235 | name: {{ .Values.sessionStorage.redis.sentinel.existingSecret | default .Values.sessionStorage.redis.existingSecret }} 236 | {{- else }} 237 | name: {{ template "oauth2-proxy.fullname" . }}-redis-access 238 | {{- end }} 239 | key: {{ .Values.sessionStorage.redis.sentinel.passwordKey }} 240 | {{- end }} 241 | {{- end }} 242 | {{- end }} 243 | {{- if .Values.extraEnv }} 244 | {{ tpl (toYaml .Values.extraEnv) . | indent 8 }} 245 | {{- end }} 246 | {{- if .Values.envFrom }} 247 | envFrom: 248 | {{ tpl (toYaml .Values.envFrom) . | indent 8 }} 249 | {{- end }} 250 | ports: 251 | {{- if .Values.containerPort }} 252 | - containerPort: {{ .Values.containerPort }} 253 | {{- else if (and (eq .Values.httpScheme "http") (empty .Values.containerPort)) }} 254 | - containerPort: 4180 255 | {{- else if (and (eq .Values.httpScheme "https") (empty .Values.containerPort)) }} 256 | - containerPort: 4443 257 | {{- else }} 258 | {{- end}} 259 | name: {{ .Values.httpScheme }} 260 | protocol: TCP 261 | {{- if .Values.metrics.enabled }} 262 | - containerPort: 44180 263 | protocol: TCP 264 | name: metrics 265 | {{- end }} 266 | {{- if .Values.livenessProbe.enabled }} 267 | livenessProbe: 268 | httpGet: 269 | path: /ping 270 | port: {{ .Values.httpScheme }} 271 | scheme: {{ .Values.httpScheme | upper }} 272 | initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }} 273 | timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }} 274 | {{- end }} 275 | {{- if .Values.readinessProbe.enabled }} 276 | readinessProbe: 277 | httpGet: 278 | path: {{ if gt (include "oauth2-proxy.version" .) "7.4.0" }}/ready{{ else }}/ping{{ end }} 279 | port: {{ .Values.httpScheme }} 280 | scheme: {{ .Values.httpScheme | upper }} 281 | initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} 282 | timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} 283 | successThreshold: {{ .Values.readinessProbe.successThreshold }} 284 | periodSeconds: {{ .Values.readinessProbe.periodSeconds }} 285 | {{- end }} 286 | resources: 287 | {{ toYaml .Values.resources | indent 10 }} 288 | volumeMounts: 289 | {{- with .Values.config.google }} 290 | {{- if and .adminEmail (or .serviceAccountJson .existingSecret) }} 291 | - name: google-secret 292 | mountPath: /google 293 | readOnly: true 294 | {{- end }} 295 | {{- end }} 296 | {{- if or .Values.config.existingConfig .Values.config.configFile }} 297 | - mountPath: /etc/oauth2_proxy/oauth2_proxy.cfg 298 | name: configmain 299 | subPath: oauth2_proxy.cfg 300 | {{- end }} 301 | {{- if .Values.alphaConfig.enabled }} 302 | - mountPath: /etc/oauth2_proxy/oauth2_proxy.yml 303 | name: configalpha 304 | subPath: oauth2_proxy.yml 305 | {{- end }} 306 | {{- if .Values.authenticatedEmailsFile.enabled }} 307 | - mountPath: /etc/oauth2-proxy 308 | name: configaccesslist 309 | readOnly: true 310 | {{- end }} 311 | {{- if .Values.htpasswdFile.enabled }} 312 | - mountPath: /etc/oauth2_proxy/htpasswd 313 | name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file 314 | readOnly: true 315 | {{- end }} 316 | {{- if ne (len .Values.extraVolumeMounts) 0 }} 317 | {{ toYaml .Values.extraVolumeMounts | indent 8 }} 318 | {{- end }} 319 | {{- if .Values.securityContext.enabled }} 320 | {{- $securityContext := unset .Values.securityContext "enabled" }} 321 | securityContext: 322 | {{- toYaml $securityContext | nindent 10 }} 323 | {{- end }} 324 | {{- if .Values.extraContainers }} 325 | {{- toYaml .Values.extraContainers | nindent 6 }} 326 | {{- end }} 327 | volumes: 328 | {{- with .Values.config.google }} 329 | {{- if and .adminEmail (or .serviceAccountJson .existingSecret) }} 330 | - name: google-secret 331 | secret: 332 | secretName: {{ if .existingSecret }}{{ .existingSecret }}{{ else }} {{ template "oauth2-proxy.secretName" $ }}-google{{ end }} 333 | {{- end }} 334 | {{- end }} 335 | 336 | {{- if .Values.htpasswdFile.enabled }} 337 | - name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file 338 | secret: 339 | secretName: {{ if .Values.htpasswdFile.existingSecret }}{{ .Values.htpasswdFile.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-htpasswd-file {{ end }} 340 | {{- end }} 341 | 342 | {{- if and (.Values.authenticatedEmailsFile.enabled) (eq .Values.authenticatedEmailsFile.persistence "secret") }} 343 | - name: configaccesslist 344 | secret: 345 | items: 346 | - key: {{ default "restricted_user_access" .Values.authenticatedEmailsFile.restrictedUserAccessKey }} 347 | {{- if .Values.authenticatedEmailsFile.template }} 348 | path: {{ .Values.authenticatedEmailsFile.template }} 349 | {{- else }} 350 | path: {{ template "oauth2-proxy.fullname" . }}-accesslist 351 | {{- end }} 352 | {{- if .Values.authenticatedEmailsFile.template }} 353 | secretName: {{ .Values.authenticatedEmailsFile.template }} 354 | {{- else }} 355 | secretName: {{ template "oauth2-proxy.fullname" . }}-accesslist 356 | {{- end }} 357 | {{- end }} 358 | {{- if and .Values.redis.enabled .Values.initContainers.waitForRedis.enabled }} 359 | - name: redis-script 360 | configMap: 361 | name: {{ template "oauth2-proxy.fullname" . }}-wait-for-redis 362 | defaultMode: 0775 363 | {{- end }} 364 | {{- if or .Values.config.existingConfig .Values.config.configFile }} 365 | - configMap: 366 | defaultMode: 420 367 | name: {{ if .Values.config.existingConfig }}{{ .Values.config.existingConfig }}{{ else }}{{ template "oauth2-proxy.fullname" . }}{{ end }} 368 | name: configmain 369 | {{- end }} 370 | {{- if .Values.alphaConfig.enabled }} 371 | {{- if .Values.alphaConfig.existingConfig }} 372 | - configMap: 373 | defaultMode: 420 374 | name: {{ .Values.alphaConfig.existingConfig }} 375 | name: configalpha 376 | {{- else }} 377 | - secret: 378 | defaultMode: 420 379 | secretName: {{ if .Values.alphaConfig.existingSecret }}{{ .Values.alphaConfig.existingSecret }}{{ else }}{{ template "oauth2-proxy.fullname" . }}-alpha{{ end }} 380 | name: configalpha 381 | {{- end }} 382 | {{- end }} 383 | {{- if ne (len .Values.extraVolumes) 0 }} 384 | {{ tpl (toYaml .Values.extraVolumes) . | indent 6 }} 385 | {{- end }} 386 | {{- if and (.Values.authenticatedEmailsFile.enabled) (eq .Values.authenticatedEmailsFile.persistence "configmap") }} 387 | - configMap: 388 | {{- if .Values.authenticatedEmailsFile.template }} 389 | name: {{ .Values.authenticatedEmailsFile.template }} 390 | {{- else }} 391 | name: {{ template "oauth2-proxy.fullname" . }}-accesslist 392 | {{- end }} 393 | items: 394 | - key: {{ default "restricted_user_access" .Values.authenticatedEmailsFile.restrictedUserAccessKey }} 395 | {{- if .Values.authenticatedEmailsFile.template }} 396 | path: {{ .Values.authenticatedEmailsFile.template }} 397 | {{- else }} 398 | path: {{ template "oauth2-proxy.fullname" . }}-accesslist 399 | {{- end }} 400 | name: configaccesslist 401 | {{- end }} 402 | 403 | {{- with (.Values.imagePullSecrets | default .Values.global.imagePullSecrets) }} 404 | imagePullSecrets: 405 | {{- toYaml . | nindent 8 }} 406 | {{- end }} 407 | {{- with .Values.affinity }} 408 | affinity: 409 | {{- toYaml . | nindent 8 }} 410 | {{- end }} 411 | {{- with .Values.nodeSelector }} 412 | nodeSelector: 413 | {{- toYaml . | nindent 8 }} 414 | {{- end }} 415 | {{- with .Values.tolerations }} 416 | tolerations: 417 | {{- toYaml . | nindent 8 }} 418 | {{- end }} 419 | {{- with .Values.topologySpreadConstraints }} 420 | topologySpreadConstraints: 421 | {{- toYaml . | nindent 8 }} 422 | {{- end }} 423 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/deprecation.yaml: -------------------------------------------------------------------------------- 1 | {{- if .Values.checkDeprecation }} 2 | {{- if .Values.service.port }} 3 | {{ fail "`service.port` does no longer exist. It has been renamed to `service.portNumber`" }} 4 | {{- end }} 5 | {{- if eq ( include "capabilities.ingress.apiVersion" . ) "networking.k8s.io/v1" -}} 6 | {{- range .Values.ingress.extraPaths }} 7 | {{- if or (.backend.serviceName) (.backend.servicePort) }} 8 | {{ fail "Please update the format of your `ingress.extraPaths` to the new ingress apiVersion `networking.k8s.io/v1` format" }} 9 | {{- end }} 10 | {{- end }} 11 | {{- end }} 12 | {{- end }} 13 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/extra-manifests.yaml: -------------------------------------------------------------------------------- 1 | {{ range .Values.extraObjects }} 2 | --- 3 | {{ tpl (toYaml .) $ }} 4 | {{ end }} 5 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/google-secret.yaml: -------------------------------------------------------------------------------- 1 | {{- if and .Values.config.google (and (not .Values.config.google.existingSecret) (not .Values.config.google.useApplicationDefaultCredentials)) }} 2 | apiVersion: v1 3 | kind: Secret 4 | metadata: 5 | labels: 6 | app: {{ template "oauth2-proxy.name" . }} 7 | {{- include "oauth2-proxy.labels" . | indent 4 }} 8 | name: {{ template "oauth2-proxy.fullname" . }}-google 9 | namespace: {{ template "oauth2-proxy.namespace" $ }} 10 | type: Opaque 11 | data: 12 | service-account.json: {{ .Values.config.google.serviceAccountJson | b64enc | quote }} 13 | {{- end -}} 14 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/hpa.yaml: -------------------------------------------------------------------------------- 1 | {{- if .Values.autoscaling.enabled }} 2 | apiVersion: autoscaling/v2 3 | kind: HorizontalPodAutoscaler 4 | metadata: 5 | labels: 6 | app: {{ template "oauth2-proxy.name" . }} 7 | {{- include "oauth2-proxy.labels" . | indent 4 }} 8 | {{- with .Values.autoscaling.annotations }} 9 | annotations: 10 | {{ tpl ( toYaml . ) $ | indent 8 }} 11 | {{- end }} 12 | name: {{ template "oauth2-proxy.fullname" . }} 13 | namespace: {{ template "oauth2-proxy.namespace" $ }} 14 | spec: 15 | scaleTargetRef: 16 | apiVersion: apps/v1 17 | kind: Deployment 18 | name: {{ template "oauth2-proxy.fullname" . }} 19 | minReplicas: {{ .Values.autoscaling.minReplicas }} 20 | maxReplicas: {{ .Values.autoscaling.maxReplicas }} 21 | metrics: 22 | {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} 23 | - type: Resource 24 | resource: 25 | name: memory 26 | target: 27 | type: Utilization 28 | averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} 29 | {{- end }} 30 | {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} 31 | - type: Resource 32 | resource: 33 | name: cpu 34 | target: 35 | type: Utilization 36 | averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} 37 | {{- end }} 38 | {{- end }} 39 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/ingress.yaml: -------------------------------------------------------------------------------- 1 | {{- if .Values.ingress.enabled -}} 2 | {{- $serviceName := include "oauth2-proxy.fullname" . -}} 3 | {{- $servicePort := .Values.service.portNumber -}} 4 | {{- $ingressPath := .Values.ingress.path -}} 5 | {{- $ingressPathType := .Values.ingress.pathType -}} 6 | {{- $extraPaths := .Values.ingress.extraPaths -}} 7 | apiVersion: {{ include "capabilities.ingress.apiVersion" . }} 8 | kind: Ingress 9 | metadata: 10 | labels: 11 | app: {{ template "oauth2-proxy.name" . }} 12 | {{- include "oauth2-proxy.labels" . | indent 4 }} 13 | {{- if .Values.ingress.labels }} 14 | {{ toYaml .Values.ingress.labels | indent 4 }} 15 | {{- end }} 16 | name: {{ template "oauth2-proxy.fullname" . }} 17 | namespace: {{ template "oauth2-proxy.namespace" $ }} 18 | {{- with .Values.ingress.annotations }} 19 | annotations: 20 | {{ tpl ( toYaml . ) $ | indent 4 }} 21 | {{- end }} 22 | spec: 23 | {{- if and .Values.ingress.className ( eq "true" ( include "ingress.supportsIngressClassName" . ) ) }} 24 | ingressClassName: {{ .Values.ingress.className | quote }} 25 | {{- end }} 26 | rules: 27 | {{- range $host := .Values.ingress.hosts }} 28 | - host: {{ tpl $host $ | quote }} 29 | http: 30 | paths: 31 | {{- if $extraPaths }} 32 | {{ toYaml $extraPaths | indent 10 }} 33 | {{- end }} 34 | - path: {{ $ingressPath }} 35 | {{- if eq "true" ( include "ingress.supportsPathType" $ ) }} 36 | pathType: {{ $ingressPathType }} 37 | {{- end }} 38 | backend: {{- include "ingress.backend" ( dict "serviceName" $serviceName "servicePort" $servicePort "context" $ ) | nindent 14 }} 39 | {{- end -}} 40 | {{- if .Values.ingress.tls }} 41 | tls: 42 | {{ tpl (toYaml .Values.ingress.tls) $ | indent 4 }} 43 | {{- end -}} 44 | {{- end -}} 45 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/poddisruptionbudget.yaml: -------------------------------------------------------------------------------- 1 | {{- if and .Values.podDisruptionBudget.enabled (gt (.Values.replicaCount | int) 1) }} 2 | apiVersion: {{ include "capabilities.podDisruptionBudget.apiVersion" . }} 3 | kind: PodDisruptionBudget 4 | metadata: 5 | labels: 6 | app: {{ template "oauth2-proxy.name" . }} 7 | {{- include "oauth2-proxy.labels" . | indent 4 }} 8 | name: {{ template "oauth2-proxy.fullname" . }} 9 | namespace: {{ template "oauth2-proxy.namespace" $ }} 10 | spec: 11 | selector: 12 | matchLabels: 13 | {{- include "oauth2-proxy.selectorLabels" . | indent 6 }} 14 | minAvailable: {{ .Values.podDisruptionBudget.minAvailable }} 15 | {{- end }} 16 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/redis-secret.yaml: -------------------------------------------------------------------------------- 1 | {{- $name := include "oauth2-proxy.name" . -}} 2 | {{- $fullName := include "oauth2-proxy.fullname" . -}} 3 | {{- $labels := include "oauth2-proxy.labels" . -}} 4 | {{- with .Values.sessionStorage }} 5 | {{- if and (eq .type "redis") (not .redis.existingSecret) (or .redis.password .redis.sentinel.password) }} 6 | apiVersion: v1 7 | kind: Secret 8 | metadata: 9 | labels: 10 | app: {{ $name }} 11 | {{- $labels | indent 4 }} 12 | name: {{ $fullName }}-redis-access 13 | namespace: {{ template "oauth2-proxy.namespace" $ }} 14 | type: Opaque 15 | data: 16 | {{- if and .redis.password (not .redis.existingSecret) }} 17 | {{ .redis.passwordKey }}: {{ .redis.password | b64enc | quote }} 18 | {{- end }} 19 | {{- if and .redis.sentinel.password (not .redis.sentinel.existingSecret) (ne .redis.sentinel.passwordKey .redis.passwordKey) }} 20 | {{ .redis.sentinel.passwordKey }}: {{ .redis.sentinel.password | b64enc | quote }} 21 | {{- end }} 22 | {{- end }} 23 | {{- end }} 24 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/secret-alpha.yaml: -------------------------------------------------------------------------------- 1 | {{- 2 | if and 3 | .Values.alphaConfig.enabled 4 | (not .Values.alphaConfig.existingConfig) 5 | (not .Values.alphaConfig.existingSecret) 6 | }} 7 | apiVersion: v1 8 | kind: Secret 9 | metadata: 10 | {{- with .Values.alphaConfig.annotations }} 11 | annotations: 12 | {{ tpl ( toYaml . ) $ | indent 4 }} 13 | {{- end }} 14 | labels: 15 | app: {{ template "oauth2-proxy.name" . }} 16 | {{- include "oauth2-proxy.labels" . | indent 4 }} 17 | name: {{ template "oauth2-proxy.fullname" . }}-alpha 18 | namespace: {{ template "oauth2-proxy.namespace" $ }} 19 | data: 20 | oauth2_proxy.yml: {{ include "oauth2-proxy.alpha-config" . | b64enc | quote }} 21 | {{- end }} 22 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/secret-authenticated-emails-file.yaml: -------------------------------------------------------------------------------- 1 | {{- if .Values.authenticatedEmailsFile.enabled }} 2 | {{- if and (.Values.authenticatedEmailsFile.restricted_access) (eq .Values.authenticatedEmailsFile.persistence "secret") }} 3 | apiVersion: v1 4 | kind: Secret 5 | type: Opaque 6 | metadata: 7 | labels: 8 | app: {{ template "oauth2-proxy.name" . }} 9 | {{- include "oauth2-proxy.labels" . | indent 4 }} 10 | {{- with .Values.authenticatedEmailsFile.annotations }} 11 | annotations: 12 | {{ tpl ( toYaml . ) $ | indent 4 }} 13 | {{- end }} 14 | name: {{ template "oauth2-proxy.fullname" . }}-accesslist 15 | namespace: {{ template "oauth2-proxy.namespace" $ }} 16 | data: 17 | {{ default "restricted_user_access" .Values.authenticatedEmailsFile.restrictedUserAccessKey }}: {{ .Values.authenticatedEmailsFile.restricted_access | b64enc }} 18 | {{- end }} 19 | {{- end }} 20 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/secret-htpasswd-file.yaml: -------------------------------------------------------------------------------- 1 | {{- if and .Values.htpasswdFile.enabled (not .Values.htpasswdFile.existingSecret) }} 2 | apiVersion: v1 3 | kind: Secret 4 | metadata: 5 | labels: 6 | app: {{ template "oauth2-proxy.name" . }} 7 | {{- include "oauth2-proxy.labels" . | indent 4 }} 8 | name: {{ template "oauth2-proxy.fullname" . }}-htpasswd-file 9 | namespace: {{ template "oauth2-proxy.namespace" $ }} 10 | type: Opaque 11 | stringData: 12 | users.txt: |- 13 | {{- range $entries := .Values.htpasswdFile.entries }} 14 | {{ $entries }} 15 | {{- end -}} 16 | {{- end }} 17 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/secret.yaml: -------------------------------------------------------------------------------- 1 | {{- if and (not .Values.config.existingSecret) (.Values.proxyVarsAsSecrets) }} 2 | apiVersion: v1 3 | kind: Secret 4 | metadata: 5 | {{- with .Values.config.annotations }} 6 | annotations: 7 | {{ tpl ( toYaml . ) $ | indent 4 }} 8 | {{- end }} 9 | labels: 10 | app: {{ template "oauth2-proxy.name" . }} 11 | {{- include "oauth2-proxy.labels" . | indent 4 }} 12 | name: {{ template "oauth2-proxy.fullname" . }} 13 | namespace: {{ template "oauth2-proxy.namespace" $ }} 14 | type: Opaque 15 | data: 16 | {{- include "oauth2-proxy.secrets" . | nindent 2 }} 17 | {{- end -}} 18 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/service.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: Service 3 | metadata: 4 | labels: 5 | app: {{ template "oauth2-proxy.name" . }} 6 | {{- include "oauth2-proxy.labels" . | indent 4 }} 7 | name: {{ template "oauth2-proxy.fullname" . }} 8 | namespace: {{ template "oauth2-proxy.namespace" $ }} 9 | {{- with .Values.service.annotations }} 10 | annotations: 11 | {{ tpl ( toYaml . ) $ | indent 4 }} 12 | {{- end }} 13 | spec: 14 | {{- if (or (eq .Values.service.type "ClusterIP") (empty .Values.service.type)) }} 15 | type: ClusterIP 16 | {{- if .Values.service.clusterIP }} 17 | clusterIP: {{ .Values.service.clusterIP }} 18 | {{end}} 19 | {{- else if eq .Values.service.type "LoadBalancer" }} 20 | type: {{ .Values.service.type }} 21 | {{- if .Values.service.loadBalancerIP }} 22 | loadBalancerIP: {{ .Values.service.loadBalancerIP }} 23 | {{- end }} 24 | {{- if .Values.service.loadBalancerSourceRanges }} 25 | loadBalancerSourceRanges: 26 | {{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }} 27 | {{- end -}} 28 | {{- else }} 29 | type: {{ .Values.service.type }} 30 | {{- end }} 31 | {{- if .Values.service.externalTrafficPolicy }} 32 | externalTrafficPolicy: {{ .Values.service.externalTrafficPolicy }} 33 | {{- end }} 34 | {{- if .Values.service.internalTrafficPolicy }} 35 | internalTrafficPolicy: {{ .Values.service.internalTrafficPolicy }} 36 | {{- end }} 37 | ports: 38 | - port: {{ .Values.service.portNumber }} 39 | targetPort: {{ .Values.service.targetPort | default .Values.httpScheme }} 40 | {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }} 41 | nodePort: {{ .Values.service.nodePort }} 42 | {{- end }} 43 | protocol: TCP 44 | {{- with .Values.service.appProtocol }} 45 | appProtocol: {{ . }} 46 | {{- end }} 47 | name: {{ .Values.httpScheme }} 48 | {{- if and .Values.metrics.enabled .Values.metrics.port }} 49 | - port: {{ .Values.metrics.port }} 50 | protocol: TCP 51 | {{- with .Values.metrics.service.appProtocol }} 52 | appProtocol: {{ . }} 53 | {{- end }} 54 | targetPort: metrics 55 | {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.metrics.nodePort))) }} 56 | nodePort: {{ .Values.metrics.nodePort }} 57 | {{- end }} 58 | name: metrics 59 | {{- end }} 60 | selector: 61 | {{- include "oauth2-proxy.selectorLabels" . | indent 4 }} 62 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/serviceaccount.yaml: -------------------------------------------------------------------------------- 1 | {{- if or .Values.serviceAccount.enabled -}} 2 | {{- $fullName := include "oauth2-proxy.fullname" . -}} 3 | {{- $saName := include "oauth2-proxy.serviceAccountName" . -}} 4 | {{- $name := include "oauth2-proxy.name" . -}} 5 | {{- $namespace := include "oauth2-proxy.namespace" $ -}} 6 | {{- $labels := include "oauth2-proxy.labels" . -}} 7 | --- 8 | apiVersion: v1 9 | kind: ServiceAccount 10 | metadata: 11 | {{- with .Values.serviceAccount.annotations }} 12 | annotations: 13 | {{ tpl ( toYaml . ) $ | indent 4 }} 14 | {{- end }} 15 | labels: 16 | app: {{ $name }} 17 | {{- $labels | indent 4 }} 18 | name: {{ $saName }} 19 | namespace: {{ $namespace }} 20 | automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} 21 | {{- if and .Values.redis.enabled .Values.initContainers.waitForRedis.enabled }} 22 | --- 23 | kind: Role 24 | apiVersion: rbac.authorization.k8s.io/v1 25 | metadata: 26 | name: {{ $fullName }}-watch-redis 27 | namespace: {{ $namespace }} 28 | labels: 29 | app: {{ $name }} 30 | {{- $labels | nindent 4 }} 31 | rules: 32 | - apiGroups: 33 | - "" 34 | resources: 35 | - pods 36 | resourceNames: 37 | - "{{ include "oauth2-proxy.redis.fullname" . }}-master-0" 38 | verbs: 39 | - get 40 | - list 41 | - watch 42 | --- 43 | kind: RoleBinding 44 | apiVersion: rbac.authorization.k8s.io/v1 45 | metadata: 46 | name: {{ $saName }}-watch-redis 47 | namespace: {{ $namespace }} 48 | labels: 49 | app: {{ $name }} 50 | {{- $labels | nindent 4 }} 51 | subjects: 52 | - kind: ServiceAccount 53 | name: {{ $saName }} 54 | apiGroup: "" 55 | roleRef: 56 | kind: Role 57 | name: {{ $fullName }}-watch-redis 58 | apiGroup: "" 59 | {{- end -}} 60 | {{- end -}} 61 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/templates/servicemonitor.yaml: -------------------------------------------------------------------------------- 1 | {{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} 2 | apiVersion: monitoring.coreos.com/v1 3 | kind: ServiceMonitor 4 | metadata: 5 | {{- with .Values.metrics.serviceMonitor.annotations }} 6 | annotations: 7 | {{ tpl ( toYaml . ) $ | indent 4 }} 8 | {{- end }} 9 | name: {{ template "oauth2-proxy.fullname" . }} 10 | {{- if .Values.metrics.serviceMonitor.namespace }} 11 | namespace: {{ .Values.metrics.serviceMonitor.namespace }} 12 | {{- else }} 13 | namespace: {{ template "oauth2-proxy.namespace" $ }} 14 | {{- end }} 15 | labels: 16 | prometheus: {{ .Values.metrics.serviceMonitor.prometheusInstance }} 17 | app: {{ template "oauth2-proxy.name" . }} 18 | {{- include "oauth2-proxy.labels" . | indent 4 }} 19 | {{- if .Values.metrics.serviceMonitor.labels }} 20 | {{ toYaml .Values.metrics.serviceMonitor.labels | indent 4}} 21 | {{- end }} 22 | spec: 23 | jobLabel: {{ template "oauth2-proxy.fullname" . }} 24 | selector: 25 | matchLabels: 26 | {{- include "oauth2-proxy.selectorLabels" . | indent 6 }} 27 | namespaceSelector: 28 | matchNames: 29 | - {{ template "oauth2-proxy.namespace" $ }} 30 | endpoints: 31 | - port: metrics 32 | path: "/metrics" 33 | {{- with .Values.metrics.serviceMonitor.interval }} 34 | interval: {{ . }} 35 | {{- end }} 36 | {{- with .Values.metrics.serviceMonitor.scrapeTimeout }} 37 | scrapeTimeout: {{ . }} 38 | {{- end }} 39 | {{- with .Values.metrics.serviceMonitor.scheme }} 40 | scheme: {{ . }} 41 | {{- end }} 42 | {{- with .Values.metrics.serviceMonitor.bearerTokenFile }} 43 | bearerTokenFile: {{ . }} 44 | {{- end }} 45 | {{- with .Values.metrics.serviceMonitor.tlsConfig }} 46 | tlsConfig: 47 | {{- toYaml .| nindent 6 }} 48 | {{- end }} 49 | {{- with .Values.metrics.serviceMonitor.metricRelabelings }} 50 | metricRelabelings: 51 | {{- toYaml . | nindent 4 }} 52 | {{- end }} 53 | {{- with .Values.metrics.serviceMonitor.relabelings }} 54 | relabelings: 55 | {{- toYaml . | nindent 4 }} 56 | {{- end }} 57 | {{- end }} 58 | -------------------------------------------------------------------------------- /helm/oauth2-proxy/values.yaml: -------------------------------------------------------------------------------- 1 | global: {} 2 | # To help compatibility with other charts which use global.imagePullSecrets. 3 | # global: 4 | # imagePullSecrets: 5 | # - name: pullSecret1 6 | # - name: pullSecret2 7 | 8 | ## Override the deployment namespace 9 | ## 10 | namespaceOverride: "" 11 | 12 | # Force the target Kubernetes version (it uses Helm `.Capabilities` if not set). 13 | # This is especially useful for `helm template` as capabilities are always empty 14 | # due to the fact that it doesn't query an actual cluster 15 | kubeVersion: 16 | 17 | # Oauth client configuration specifics 18 | config: 19 | # Add config annotations 20 | annotations: {} 21 | # OAuth client ID 22 | clientID: "XXXXXXX" 23 | # OAuth client secret 24 | clientSecret: "XXXXXXXX" 25 | # Create a new secret with the following command 26 | # openssl rand -base64 32 | head -c 32 | base64 27 | # Use an existing secret for OAuth2 credentials (see secret.yaml for required fields) 28 | # Example: 29 | # existingSecret: secret 30 | cookieSecret: "XXXXXXXXXXXXXXXX" 31 | # The name of the cookie that oauth2-proxy will create 32 | # If left empty, it will default to the release name 33 | cookieName: "" 34 | google: {} 35 | # adminEmail: xxxx 36 | # useApplicationDefaultCredentials: true 37 | # targetPrincipal: xxxx 38 | # serviceAccountJson: xxxx 39 | # Alternatively, use an existing secret (see google-secret.yaml for required fields) 40 | # Example: 41 | # existingSecret: google-secret 42 | # groups: [] 43 | # Example: 44 | # - group1@example.com 45 | # - group2@example.com 46 | # Default configuration, to be overridden 47 | configFile: |- 48 | email_domains = [ "*" ] 49 | upstreams = [ "file:///dev/null" ] 50 | # Custom configuration file: oauth2_proxy.cfg 51 | # configFile: |- 52 | # pass_basic_auth = false 53 | # pass_access_token = true 54 | # Use an existing config map (see configmap.yaml for required fields) 55 | # Example: 56 | # existingConfig: config 57 | 58 | alphaConfig: 59 | enabled: false 60 | # Add config annotations 61 | annotations: {} 62 | # Arbitrary configuration data to append to the server section 63 | serverConfigData: {} 64 | # Arbitrary configuration data to append to the metrics section 65 | metricsConfigData: {} 66 | # Arbitrary configuration data to append 67 | configData: {} 68 | # Arbitrary configuration to append 69 | # This is treated as a Go template and rendered with the root context 70 | configFile: "" 71 | # Use an existing config map (see secret-alpha.yaml for required fields) 72 | existingConfig: ~ 73 | # Use an existing secret 74 | existingSecret: ~ 75 | 76 | image: 77 | repository: "quay.io/oauth2-proxy/oauth2-proxy" 78 | # appVersion is used by default 79 | tag: "" 80 | pullPolicy: "IfNotPresent" 81 | command: [] 82 | 83 | # Optionally specify an array of imagePullSecrets. 84 | # Secrets must be manually created in the namespace. 85 | # ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod 86 | imagePullSecrets: [] 87 | # - name: myRegistryKeySecretName 88 | 89 | # Set a custom containerPort if required. 90 | # This will default to 4180 if this value is not set and the httpScheme set to http 91 | # This will default to 4443 if this value is not set and the httpScheme set to https 92 | # containerPort: 4180 93 | 94 | extraArgs: {} 95 | extraEnv: [] 96 | 97 | envFrom: [] 98 | # Load environment variables from a ConfigMap(s) and/or Secret(s) 99 | # that already exists (created and managed by you). 100 | # ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables 101 | # 102 | # PS: Changes in these ConfigMaps or Secrets will not be automatically 103 | # detected and you must manually restart the relevant Pods after changes. 104 | # 105 | # - configMapRef: 106 | # name: special-config 107 | # - secretRef: 108 | # name: special-config-secret 109 | 110 | # -- Custom labels to add into metadata 111 | customLabels: {} 112 | 113 | # To authorize individual email addresses 114 | # That is part of extraArgs but since this needs special treatment we need to do a separate section 115 | authenticatedEmailsFile: 116 | enabled: false 117 | # Defines how the email addresses file will be projected, via a configmap or secret 118 | persistence: configmap 119 | # template is the name of the configmap what contains the email user list but has been configured without this chart. 120 | # It's a simpler way to maintain only one configmap (user list) instead changing it for each oauth2-proxy service. 121 | # Be aware the value name in the extern config map in data needs to be named to "restricted_user_access" or to the 122 | # provided value in restrictedUserAccessKey field. 123 | template: "" 124 | # The configmap/secret key under which the list of email access is stored 125 | # Defaults to "restricted_user_access" if not filled-in, but can be overridden to allow flexibility 126 | restrictedUserAccessKey: "" 127 | # One email per line 128 | # example: 129 | # restricted_access: |- 130 | # name1@domain 131 | # name2@domain 132 | # If you override the config with restricted_access it will configure a user list within this chart what takes care of the 133 | # config map resource. 134 | restricted_access: "" 135 | annotations: {} 136 | # helm.sh/resource-policy: keep 137 | 138 | service: 139 | type: ClusterIP 140 | # when service.type is ClusterIP ... 141 | # clusterIP: 192.0.2.20 142 | # when service.type is LoadBalancer ... 143 | # loadBalancerIP: 198.51.100.40 144 | # loadBalancerSourceRanges: 203.0.113.0/24 145 | # when service.type is NodePort ... 146 | # nodePort: 80 147 | portNumber: 80 148 | # Protocol set on the service 149 | appProtocol: http 150 | annotations: {} 151 | # foo.io/bar: "true" 152 | # configure externalTrafficPolicy 153 | externalTrafficPolicy: "" 154 | # configure internalTrafficPolicy 155 | internalTrafficPolicy: "" 156 | # configure service target port 157 | targetPort: "" 158 | 159 | ## Create or use ServiceAccount 160 | serviceAccount: 161 | ## Specifies whether a ServiceAccount should be created 162 | enabled: true 163 | ## The name of the ServiceAccount to use. 164 | ## If not set and create is true, a name is generated using the fullname template 165 | name: 166 | automountServiceAccountToken: true 167 | annotations: {} 168 | 169 | ingress: 170 | enabled: false 171 | # className: nginx 172 | path: / 173 | # Only used if API capabilities (networking.k8s.io/v1) allow it 174 | pathType: ImplementationSpecific 175 | # Used to create an Ingress record. 176 | # hosts: 177 | # - chart-example.local 178 | # Extra paths to prepend to every host configuration. This is useful when working with annotation based services. 179 | # Warning! The configuration is dependant on your current k8s API version capabilities (networking.k8s.io/v1) 180 | # extraPaths: 181 | # - path: /* 182 | # pathType: ImplementationSpecific 183 | # backend: 184 | # service: 185 | # name: ssl-redirect 186 | # port: 187 | # name: use-annotation 188 | labels: {} 189 | # annotations: 190 | # kubernetes.io/ingress.class: nginx 191 | # kubernetes.io/tls-acme: "true" 192 | # tls: 193 | # Secrets must be manually created in the namespace. 194 | # - secretName: chart-example-tls 195 | # hosts: 196 | # - chart-example.local 197 | 198 | resources: {} 199 | # limits: 200 | # cpu: 100m 201 | # memory: 300Mi 202 | # requests: 203 | # cpu: 100m 204 | # memory: 300Mi 205 | 206 | extraVolumes: [] 207 | # - name: ca-bundle-cert 208 | # secret: 209 | # secretName: