Skip to content

Commit 61f21f8

Browse files
IvoGomankengou
IvoGoman
and
kengou
authored
feat(service-proxy): secure endpoint with oauth2-proxy (#628)
* feat(service-proxy): secure endpoint with oauth2-proxy * fix(actions): pr build cleanup filter * fix: whitespace, domains, cookie-csrf * fix: remove quotation * rename ingress host * hide oauth2proxy behind a feature toggle --------- Co-authored-by: David Gogl <1381862+kengou@users.noreply.github.com>
1 parent aa45c3e commit 61f21f8

File tree

9 files changed

+188
-5
lines changed

9 files changed

+188
-5
lines changed

‎.github/workflows/ci-pr-build.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
- labeled
77
- closed
88
- unlabeled
9+
- synchronize
910

1011
env:
1112
REGISTRY: ghcr.io
@@ -108,6 +109,6 @@ jobs:
108109
uses: dataaxiom/ghcr-cleanup-action@v1
109110
with:
110111
tags: ${{ env.PR_NUMBER }}-pr
111-
packages: ${{ github.repository }}/charts/*
112+
packages: ${{ github.event.repository.name }}/charts/*
112113
expand-packages: true
113114
token: ${{ secrets.CLOUDOPERATOR_REPO_WRITE_DELETE_TOKEN }}

‎service-proxy/charts/1.0.0/service-proxy/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ type: application
1818
# This is the chart version. This version number should be incremented each time you make changes
1919
# to the chart and its templates, including the app version.
2020
# Versions are expected to follow Semantic Versioning (https://semver.org/)
21-
version: 1.0.2
21+
version: 1.1.0
2222

2323
# This is the version number of the application being deployed. This version number should be
2424
# incremented each time you make changes to the application. Versions are not expected to

‎service-proxy/charts/1.0.0/service-proxy/ci/test-values.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
global:
4+
greenhouse:
5+
organizationName: demo
6+
domain: demo.cloud.tld
7+
8+
oauth2proxy:
9+
issuerURL: https://idp.tld
10+
clientIDRef:
11+
secret: "client-secret"
12+
key: clientid
13+
clientSecretRef:
14+
secret: "client-secret"
15+
key: clientsecret
16+
cookieSecretRef:
17+
secret: "cookie-secret"
18+
key: "cookie"

‎service-proxy/charts/1.0.0/service-proxy/templates/_helpers.tpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,14 @@ If release name contains chart name it will be used as a full name.
2323
{{- end }}
2424
{{- end }}
2525

26+
{{/*
27+
Create a default fully qualified app name.
28+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
29+
*/}}
30+
{{- define "oauth2-proxy.fullname" -}}
31+
{{- printf "%s-%s" .Release.Name "oauth2-proxy" | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
2634
{{/*
2735
Create chart name and version as used by the chart label.
2836
*/}}
@@ -60,3 +68,4 @@ Create the name of the service account to use
6068
{{- default "default" .Values.serviceAccount.name }}
6169
{{- end }}
6270
{{- end }}
71+

‎service-proxy/charts/1.0.0/service-proxy/templates/ingress.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,17 +14,22 @@ metadata:
1414
{{- with .Values.ingress.annotations }}
1515
annotations:
1616
{{- toYaml . | nindent 4 }}
17+
{{- if $.Values.oauth2proxy.enabled }}
18+
nginx.ingress.kubernetes.io/auth-signin: https://auth-proxy.{{ required ".domain missing" $.Values.domain }}/oauth2/start
19+
nginx.ingress.kubernetes.io/auth-url: https://auth-proxy.{{ required ".domain missing" $.Values.domain }}/oauth2/auth
20+
nginx.ingress.kubernetes.io/service-upstream: "true"
21+
{{- end }}
1722
{{- end }}
1823
spec:
1924
{{- if .Values.ingress.className }}
2025
ingressClassName: {{ .Values.ingress.className }}
2126
{{- end }}
2227
tls:
2328
- hosts:
24-
- "*.{{ required ".domain missing" .Values.domain }}"
29+
- "*.{{ required ".domain missing" $.Values.domain }}"
2530
secretName: {{ $fullName }}-tls
2631
rules:
27-
- host: "*.{{ required ".domain missing" .Values.domain }}"
32+
- host: "*.{{ required ".domain missing" $.Values.domain }}"
2833
http:
2934
paths:
3035
- path: /
@@ -33,4 +38,4 @@ spec:
3338
service:
3439
name: {{ $fullName }}
3540
port:
36-
number: {{ $svcPort }}
41+
number: {{ $svcPort }}

‎service-proxy/charts/1.0.0/service-proxy/templates/oauth2-proxy-deployment.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
{{- if .Values.oauth2proxy.enabled }}
5+
apiVersion: apps/v1
6+
kind: Deployment
7+
metadata:
8+
labels:
9+
k8s-app: oauth2-proxy
10+
name: {{ include "oauth2-proxy.fullname" . }}
11+
spec:
12+
replicas: {{ .Values.replicas | default 1 }}
13+
selector:
14+
matchLabels:
15+
k8s-app: oauth2-proxy
16+
template:
17+
metadata:
18+
labels:
19+
k8s-app: oauth2-proxy
20+
spec:
21+
containers:
22+
- args:
23+
- --provider=oidc
24+
- --email-domain=*
25+
- --provider-display-name={{ .Values.oauth2proxy.providerDisplayName | default ( printf "%s %s" .Values.global.greenhouse.organizationName "OIDC Provider") }}
26+
- --upstream=file:///dev/null
27+
- --http-address=0.0.0.0:4180
28+
- --redirect-url=oauth2/callback
29+
- --oidc-issuer-url={{ required "oauth2proxy.issuerURL" .Values.oauth2proxy.issuerURL }}
30+
- --scope=openid email
31+
- --pass-user-headers=true
32+
- --set-xauthrequest=true
33+
- --whitelist-domain={{ required ".domain missing" $.Values.domain | trimPrefix $.Values.global.greenhouse.organizationName }}
34+
- --cookie-name={{ .Values.oauth2proxy.cookieName | default "_oauth2_proxy" }}
35+
- --cookie-domain={{ required ".domain missing" $.Values.domain | trimPrefix $.Values.global.greenhouse.organizationName }}
36+
- --cookie-expire={{ .Values.oauth2proxy.cookieExpire | default "12h0m0s" }}
37+
- --oidc-email-claim=email
38+
- --cookie-csrf-per-request=true
39+
- --cookie-csrf-expire=5m
40+
env:
41+
- name: OAUTH2_PROXY_CLIENT_ID
42+
valueFrom:
43+
secretKeyRef:
44+
name: {{ required "oauth2proxy.clientIDRef.secret" .Values.oauth2proxy.clientIDRef.secret }}
45+
key: {{ required "oauth2proxy.clientIDRef.key" .Values.oauth2proxy.clientIDRef.key }}
46+
- name: OAUTH2_PROXY_CLIENT_SECRET
47+
valueFrom:
48+
secretKeyRef:
49+
name: {{ required "oauth2proxy.clientSecretRef.secret" .Values.oauth2proxy.clientSecretRef.secret }}
50+
key: {{ required "oauth2proxy.clientIDRef.key" .Values.oauth2proxy.clientSecretRef.key }}
51+
- name: OAUTH2_PROXY_COOKIE_SECRET
52+
valueFrom:
53+
secretKeyRef:
54+
name: {{ required "oauth2proxy.cookieSecretRef.secret" .Values.oauth2proxy.cookieSecretRef.secret }}
55+
key: {{ required "oauth2proxy.cookieSecretRef.key" .Values.oauth2proxy.cookieSecretRef.key }}
56+
image: {{ required "oauth2proxy.image.registry" .Values.oauth2proxy.image.registry }}/{{ required "oauth2proxy.image.repository" .Values.oauth2proxy.image.repository }}:{{ required "oauth2proxy.image.version" .Values.oauth2proxy.image.version }}
57+
imagePullPolicy: IfNotPresent
58+
lifecycle:
59+
preStop:
60+
exec:
61+
command:
62+
- /bin/sh
63+
- -c
64+
- sleep 30
65+
livenessProbe:
66+
failureThreshold: 3
67+
httpGet:
68+
path: /ping
69+
port: 4180
70+
scheme: HTTP
71+
initialDelaySeconds: 60
72+
periodSeconds: 60
73+
successThreshold: 1
74+
timeoutSeconds: 10
75+
name: oauth2-proxy
76+
ports:
77+
- containerPort: 4180
78+
protocol: TCP
79+
resources: {}
80+
terminationMessagePath: /dev/termination-log
81+
terminationMessagePolicy: File
82+
dnsPolicy: ClusterFirst
83+
restartPolicy: Always
84+
schedulerName: default-scheduler
85+
securityContext:
86+
runAsUser: 0
87+
terminationGracePeriodSeconds: 30
88+
{{- end }}

‎service-proxy/charts/1.0.0/service-proxy/templates/oauth2-proxy-ingress.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
{{- if .Values.oauth2proxy.enabled }}
5+
{{- $fullName := include "oauth2-proxy.fullname" . }}
6+
apiVersion: networking.k8s.io/v1
7+
kind: Ingress
8+
metadata:
9+
{{- with .Values.ingress.annotations }}
10+
annotations:
11+
{{- toYaml . | nindent 4 }}
12+
ingress.kubernetes.io/proxy-buffer-size: 8k
13+
ingress.kubernetes.io/ssl-redirect: "true"
14+
{{- end }}
15+
name: {{ $fullName }}
16+
spec:
17+
ingressClassName: nginx
18+
rules:
19+
- host: auth-proxy.{{ required ".domain missing" $.Values.domain }}
20+
http:
21+
paths:
22+
- backend:
23+
service:
24+
name: oauth2-proxy
25+
port:
26+
number: 4180
27+
path: /oauth2
28+
pathType: Prefix
29+
tls:
30+
- hosts:
31+
- auth-proxy.{{ required ".domain missing" $.Values.domain }}
32+
secretName: {{ $fullName }}-tls
33+
{{- end }}

‎service-proxy/charts/1.0.0/service-proxy/templates/oauth2-proxy-service.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# SPDX-FileCopyrightText: 2024 SAP SE or an SAP affiliate company and Greenhouse contributors
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
{{- if .Values.oauth2proxy.enabled }}
5+
apiVersion: v1
6+
kind: Service
7+
metadata:
8+
labels:
9+
k8s-app: oauth2-proxy
10+
name: oauth2-proxy
11+
spec:
12+
internalTrafficPolicy: Cluster
13+
ports:
14+
- name: http
15+
port: 4180
16+
protocol: TCP
17+
targetPort: 4180
18+
selector:
19+
k8s-app: oauth2-proxy
20+
type: ClusterIP
21+
{{- end }}

‎service-proxy/charts/1.0.0/service-proxy/values.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,11 @@ ingress:
3737
annotations:
3838
kubernetes.io/tls-acme: "true"
3939
disco: "true"
40+
41+
oauth2proxy:
42+
enabled: false
43+
image:
44+
registry: "docker.io"
45+
repository: "bitnami/oauth2-proxy"
46+
version: "7.6.0"
47+
providerDisplayName: ""

0 commit comments

Comments
 (0)