Skip to content

Commit 308af8f

Browse files
tthvotthvo
committed
feat(envs): extra env configs for oauth2-proxy/openshift-oauth container
Extra configurations for pod-specific use cases can be defined with nested field 'config.extra.inPod.<pod-id>.<settings>, where: - pod-id: An abitrary identify for cryostat component pods. For example, 'main' is for the pod with cryostat core/main container. - settings: Common extra settings such as envVars and envSources.
1 parent baf8718 commit 308af8f

File tree

8 files changed

+712
-159
lines changed

8 files changed

+712
-159
lines changed

‎charts/cryostat/README.md‎

Lines changed: 39 additions & 25 deletions
Large diffs are not rendered by default.

‎charts/cryostat/templates/_oauth2Proxy.tpl‎

Lines changed: 36 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -10,29 +10,42 @@ Create OAuth2 Proxy container. Configurations defined in alpha_config.yaml
1010
- "--alpha-config=/etc/oauth2_proxy/alpha_config/alpha_config.yaml"
1111
imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
1212
env:
13-
- name: OAUTH2_PROXY_REDIRECT_URL
14-
value: "http://localhost:4180/oauth2/callback"
15-
- name: OAUTH2_PROXY_COOKIE_SECRET
16-
valueFrom:
17-
secretKeyRef:
18-
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
19-
key: COOKIE_SECRET
20-
optional: false
21-
- name: OAUTH2_PROXY_EMAIL_DOMAINS
22-
value: "*"
23-
{{- if .Values.authentication.basicAuth.enabled }}
24-
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
25-
value: write
26-
- name: OAUTH2_PROXY_HTPASSWD_FILE
27-
value: /etc/oauth2_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
28-
{{- end }}
29-
{{- if not .Values.authentication.basicAuth.enabled }}
30-
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
31-
value: ".*"
32-
{{- else }}
33-
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
34-
value: "^/health(/liveness)?$"
35-
{{- end }}
13+
- name: OAUTH2_PROXY_REDIRECT_URL
14+
value: "http://localhost:4180/oauth2/callback"
15+
- name: OAUTH2_PROXY_COOKIE_SECRET
16+
valueFrom:
17+
secretKeyRef:
18+
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
19+
key: COOKIE_SECRET
20+
optional: false
21+
- name: OAUTH2_PROXY_EMAIL_DOMAINS
22+
value: "*"
23+
{{- if .Values.authentication.basicAuth.enabled }}
24+
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
25+
value: write
26+
- name: OAUTH2_PROXY_HTPASSWD_FILE
27+
value: /etc/oauth2_proxy/basicauth/{{ .Values.authentication.basicAuth.filename }}
28+
{{- end }}
29+
{{- if not .Values.authentication.basicAuth.enabled }}
30+
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
31+
value: ".*"
32+
{{- else }}
33+
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
34+
value: "^/health(/liveness)?$"
35+
{{- end }}
36+
{{- with (.Values.oauth2Proxy.config.extra).envVars }}
37+
{{- toYaml . | nindent 2 }}
38+
{{- end }}
39+
{{- with (.Values.oauth2Proxy.config.extra).inPod.main.envVars }}
40+
{{- toYaml . | nindent 2 }}
41+
{{- end }}
42+
envFrom:
43+
{{- with (.Values.oauth2Proxy.config.extra).envSources }}
44+
{{- toYaml . | nindent 2 }}
45+
{{- end }}
46+
{{- with (.Values.oauth2Proxy.config.extra).inPod.main.envSources }}
47+
{{- toYaml . | nindent 2 }}
48+
{{- end }}
3649
ports:
3750
- containerPort: 4180
3851
name: http

‎charts/cryostat/templates/_openshiftOauthProxy.tpl‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,25 @@ Create OpenShift OAuth Proxy container.
77
{{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
88
image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
99
env:
10-
- name: COOKIE_SECRET
11-
valueFrom:
12-
secretKeyRef:
13-
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
14-
key: COOKIE_SECRET
15-
optional: false
10+
- name: COOKIE_SECRET
11+
valueFrom:
12+
secretKeyRef:
13+
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
14+
key: COOKIE_SECRET
15+
optional: false
16+
{{- with (.Values.openshiftOauthProxy.config.extra).envVars }}
17+
{{- toYaml . | nindent 2 }}
18+
{{- end }}
19+
{{- with (.Values.openshiftOauthProxy.config.extra).inPod.main.envVars }}
20+
{{- toYaml . | nindent 2 }}
21+
{{- end }}
22+
envFrom:
23+
{{- with (.Values.openshiftOauthProxy.config.extra).envSources }}
24+
{{- toYaml . | nindent 2 }}
25+
{{- end }}
26+
{{- with (.Values.openshiftOauthProxy.config.extra).inPod.main.envSources }}
27+
{{- toYaml . | nindent 2 }}
28+
{{- end }}
1629
args:
1730
- --skip-provider-button={{ not .Values.authentication.basicAuth.enabled }}
1831
- --pass-access-token=false

‎charts/cryostat/templates/_reports_authproxy.tpl‎

Lines changed: 103 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,25 @@
55
{{- toYaml .Values.openshiftOauthProxy.securityContext | nindent 4 }}
66
image: "{{ .Values.openshiftOauthProxy.image.repository }}:{{ .Values.openshiftOauthProxy.image.tag }}"
77
env:
8-
- name: COOKIE_SECRET
9-
valueFrom:
10-
secretKeyRef:
11-
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
12-
key: COOKIE_SECRET
13-
optional: false
8+
- name: COOKIE_SECRET
9+
valueFrom:
10+
secretKeyRef:
11+
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
12+
key: COOKIE_SECRET
13+
optional: false
14+
{{- with (.Values.openshiftOauthProxy.config.extra).envVars }}
15+
{{- toYaml . | nindent 2 }}
16+
{{- end }}
17+
{{- with (.Values.openshiftOauthProxy.config.extra).inPod.reports.envVars }}
18+
{{- toYaml . | nindent 2 }}
19+
{{- end }}
20+
envFrom:
21+
{{- with (.Values.openshiftOauthProxy.config.extra).envSources }}
22+
{{- toYaml . | nindent 2 }}
23+
{{- end }}
24+
{{- with (.Values.openshiftOauthProxy.config.extra).inPod.reports.envSources }}
25+
{{- toYaml . | nindent 2 }}
26+
{{- end }}
1427
args:
1528
- --pass-access-token=false
1629
- --pass-user-bearer-token=false
@@ -52,38 +65,51 @@
5265
image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
5366
imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
5467
env:
55-
- name: OAUTH2_PROXY_CLIENT_ID
56-
value: dummy
57-
- name: OAUTH2_PROXY_CLIENT_SECRET
58-
value: none
59-
- name: OAUTH2_PROXY_HTTP_ADDRESS
60-
value: 0.0.0.0:4180
61-
- name: OAUTH2_PROXY_HTTPS_ADDRESS
62-
value: :8443
63-
- name: OAUTH2_PROXY_TLS_CERT_FILE
64-
value: /etc/tls/private/cert
65-
- name: OAUTH2_PROXY_TLS_KEY_FILE
66-
value: /etc/tls/private/key
67-
- name: OAUTH2_PROXY_UPSTREAMS
68-
value: http://localhost:10001/
69-
- name: OAUTH2_PROXY_REDIRECT_URL
70-
value: "http://localhost:4180/oauth2/callback"
71-
- name: OAUTH2_PROXY_COOKIE_SECRET
72-
valueFrom:
73-
secretKeyRef:
74-
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
75-
key: COOKIE_SECRET
76-
optional: false
77-
- name: OAUTH2_PROXY_EMAIL_DOMAINS
78-
value: "*"
79-
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
80-
value: write
81-
- name: OAUTH2_PROXY_HTPASSWD_FILE
82-
value: /etc/oauth2_proxy/basicauth/htpasswd
83-
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
84-
value: "^/health$"
85-
- name: OAUTH2_PROXY_PROXY_WEBSOCKETS
86-
value: "false"
68+
- name: OAUTH2_PROXY_CLIENT_ID
69+
value: dummy
70+
- name: OAUTH2_PROXY_CLIENT_SECRET
71+
value: none
72+
- name: OAUTH2_PROXY_HTTP_ADDRESS
73+
value: 0.0.0.0:4180
74+
- name: OAUTH2_PROXY_HTTPS_ADDRESS
75+
value: :8443
76+
- name: OAUTH2_PROXY_TLS_CERT_FILE
77+
value: /etc/tls/private/cert
78+
- name: OAUTH2_PROXY_TLS_KEY_FILE
79+
value: /etc/tls/private/key
80+
- name: OAUTH2_PROXY_UPSTREAMS
81+
value: http://localhost:10001/
82+
- name: OAUTH2_PROXY_REDIRECT_URL
83+
value: "http://localhost:4180/oauth2/callback"
84+
- name: OAUTH2_PROXY_COOKIE_SECRET
85+
valueFrom:
86+
secretKeyRef:
87+
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
88+
key: COOKIE_SECRET
89+
optional: false
90+
- name: OAUTH2_PROXY_EMAIL_DOMAINS
91+
value: "*"
92+
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
93+
value: write
94+
- name: OAUTH2_PROXY_HTPASSWD_FILE
95+
value: /etc/oauth2_proxy/basicauth/htpasswd
96+
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
97+
value: "^/health$"
98+
- name: OAUTH2_PROXY_PROXY_WEBSOCKETS
99+
value: "false"
100+
{{- with (.Values.oauth2Proxy.config.extra).envVars }}
101+
{{- toYaml . | nindent 2 }}
102+
{{- end }}
103+
{{- with (.Values.oauth2Proxy.config.extra).inPod.reports.envVars }}
104+
{{- toYaml . | nindent 2 }}
105+
{{- end }}
106+
envFrom:
107+
{{- with (.Values.oauth2Proxy.config.extra).envSources }}
108+
{{- toYaml . | nindent 2 }}
109+
{{- end }}
110+
{{- with (.Values.oauth2Proxy.config.extra).inPod.reports.envSources }}
111+
{{- toYaml . | nindent 2 }}
112+
{{- end }}
87113
ports:
88114
- containerPort: 4180
89115
name: http
@@ -108,32 +134,45 @@
108134
image: "{{ (.Values.oauth2Proxy).image.repository }}:{{ (.Values.oauth2Proxy).image.tag }}"
109135
imagePullPolicy: {{ (.Values.oauth2Proxy).image.pullPolicy }}
110136
env:
111-
- name: OAUTH2_PROXY_CLIENT_ID
112-
value: dummy
113-
- name: OAUTH2_PROXY_CLIENT_SECRET
114-
value: none
115-
- name: OAUTH2_PROXY_HTTP_ADDRESS
116-
value: 0.0.0.0:4180
117-
- name: OAUTH2_PROXY_UPSTREAMS
118-
value: http://localhost:10001/
119-
- name: OAUTH2_PROXY_REDIRECT_URL
120-
value: "http://localhost:4180/oauth2/callback"
121-
- name: OAUTH2_PROXY_COOKIE_SECRET
122-
valueFrom:
123-
secretKeyRef:
124-
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
125-
key: COOKIE_SECRET
126-
optional: false
127-
- name: OAUTH2_PROXY_EMAIL_DOMAINS
128-
value: "*"
129-
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
130-
value: write
131-
- name: OAUTH2_PROXY_HTPASSWD_FILE
132-
value: /etc/oauth2_proxy/basicauth/htpasswd
133-
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
134-
value: "^/health$"
135-
- name: OAUTH2_PROXY_PROXY_WEBSOCKETS
136-
value: "false"
137+
- name: OAUTH2_PROXY_CLIENT_ID
138+
value: dummy
139+
- name: OAUTH2_PROXY_CLIENT_SECRET
140+
value: none
141+
- name: OAUTH2_PROXY_HTTP_ADDRESS
142+
value: 0.0.0.0:4180
143+
- name: OAUTH2_PROXY_UPSTREAMS
144+
value: http://localhost:10001/
145+
- name: OAUTH2_PROXY_REDIRECT_URL
146+
value: "http://localhost:4180/oauth2/callback"
147+
- name: OAUTH2_PROXY_COOKIE_SECRET
148+
valueFrom:
149+
secretKeyRef:
150+
name: {{ default (printf "%s-cookie-secret" .Release.Name) .Values.authentication.cookieSecretName }}
151+
key: COOKIE_SECRET
152+
optional: false
153+
- name: OAUTH2_PROXY_EMAIL_DOMAINS
154+
value: "*"
155+
- name: OAUTH2_PROXY_HTPASSWD_USER_GROUP
156+
value: write
157+
- name: OAUTH2_PROXY_HTPASSWD_FILE
158+
value: /etc/oauth2_proxy/basicauth/htpasswd
159+
- name: OAUTH2_PROXY_SKIP_AUTH_ROUTES
160+
value: "^/health$"
161+
- name: OAUTH2_PROXY_PROXY_WEBSOCKETS
162+
value: "false"
163+
{{- with (.Values.oauth2Proxy.config.extra).envVars }}
164+
{{- toYaml . | nindent 2 }}
165+
{{- end }}
166+
{{- with (.Values.oauth2Proxy.config.extra).inPod.reports.envVars }}
167+
{{- toYaml . | nindent 2 }}
168+
{{- end }}
169+
envFrom:
170+
{{- with (.Values.oauth2Proxy.config.extra).envSources }}
171+
{{- toYaml . | nindent 2 }}
172+
{{- end }}
173+
{{- with (.Values.oauth2Proxy.config.extra).inPod.reports.envSources }}
174+
{{- toYaml . | nindent 2 }}
175+
{{- end }}
137176
ports:
138177
- containerPort: 4180
139178
name: http

0 commit comments

Comments
 (0)