Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.

Commit 5922abb

Browse files
jetstack-botjetstack-bot
authored
Merge pull request #97 from mhrabovcin/mh/chart
Add helm chart
2 parents feb9915 + 2bcde68 commit 5922abb

16 files changed

+582
-1
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ flow](https://storage.googleapis.com/kube-oidc-proxy/diagram-d9623e38a6cd3b585b4
3636
## Tutorial
3737

3838
Directions on how to deploy OIDC authentication with multi-cluster can be found
39-
[here.](./demo/README.md)
39+
[here.](./demo/README.md) or there is a [helm chart](./deploy/charts/kube-oidc-proxy/README.md).
4040

4141
### Quickstart
4242

‎deploy/charts/kube-oidc-proxy/.helmignore

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj
22+
.vscode/

‎deploy/charts/kube-oidc-proxy/Chart.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
appVersion: "v0.1.1"
3+
description: A Helm chart for kube-oidc-proxy
4+
home: https://github.com/jetstack/kube-oidc-proxy
5+
name: kube-oidc-proxy
6+
version: 0.1.0
7+
maintainers:
8+
- name: mhrabovcin

‎deploy/charts/kube-oidc-proxy/README.md

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
# kube-oidc-proxy helm chart
2+
3+
This is a `helm` chart that installs [`kube-oidc-proxy`](https://github.com/jetstack/kube-oidc-proxy/).
4+
This helm chart cannot be installed out of the box without providing own
5+
configuration.
6+
7+
This helm chart is based on example configuration provided in `kube-oidc-proxy`
8+
[repository](https://github.com/jetstack/kube-oidc-proxy/blob/182fa79a7854bd33f3827d89e222e10c57c4aed5/demo/yaml/kube-oidc-proxy.yaml).
9+
10+
Minimal required configuration is `oidc` section of `value.yaml` file.
11+
12+
```yaml
13+
oidc:
14+
clientId: my-client
15+
issuerUrl: https://accounts.google.com
16+
usernameClaim: email
17+
```
18+
19+
When a custom root CA certificate is required it should be added as PEM encoded
20+
text value:
21+
22+
```yaml
23+
oidc:
24+
caPEM: |
25+
-----BEGIN CERTIFICATE-----
26+
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG
27+
A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv
28+
b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw
29+
MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i
30+
YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT
31+
aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ
32+
jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp
33+
xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz8kHp
34+
1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
35+
snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJ
36+
U26Qzns3dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N8
37+
9iFo7+ryUp9/k5DPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8E
38+
BTADAQH/MB0GA1UdDgQWBBRge2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0B
39+
AQUFAAOCAQEA1nPnfE920I2/7LqivjTFKDK1fPxsnCwrvQmeU79rXqoRSLblCKOz
40+
yj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY776BQVvnGCv04zcQLcFGUl5gE
41+
38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9LhJIZJrglfCm7ymP
42+
AbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr+WymXUad
43+
DKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
44+
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
45+
-----END CERTIFICATE-----
46+
```
47+
48+
This minimal configuration gives a cluster internal IP address that can be used
49+
with `kubectl` to authenticate requests to Kubernetes API server.
50+
51+
The service can be exposed via ingress controller and give access to external
52+
clients. Example of exposing via ingress controller.
53+
54+
```yaml
55+
ingress:
56+
enabled: true
57+
annotations:
58+
kubernetes.io/ingress.class: traefik
59+
traefik.ingress.kubernetes.io/rule-type: PathPrefixStrip
60+
hosts:
61+
- host: ""
62+
paths:
63+
- /oidc-proxy
64+
```
65+
66+
By default the helm chart will create self-signed TLS certificate for `kube-oidc-proxy`
67+
service. It is possible to provide secret name that contains TLS artifacts for
68+
service. The secret must be of `kubernetes.io/tls` type.
69+
70+
```yaml
71+
tls:
72+
secretName: my-tls-secret-with-key-and-cert
73+
```

‎deploy/charts/kube-oidc-proxy/templates/NOTES.txt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
1. Get the application URL by running these commands:
2+
{{- if .Values.ingress.enabled }}
3+
{{- range $host := .Values.ingress.hosts }}
4+
{{- range .paths }}
5+
http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
6+
{{- end }}
7+
{{- end }}
8+
{{- else if contains "NodePort" .Values.service.type }}
9+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "kube-oidc-proxy.fullname" . }})
10+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
11+
echo http://$NODE_IP:$NODE_PORT
12+
{{- else if contains "LoadBalancer" .Values.service.type }}
13+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
14+
You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "kube-oidc-proxy.fullname" . }}'
15+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "kube-oidc-proxy.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
16+
echo http://$SERVICE_IP:{{ .Values.service.port }}
17+
{{- else if contains "ClusterIP" .Values.service.type }}
18+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "kube-oidc-proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
19+
echo "Visit http://127.0.0.1:8080 to use your application"
20+
kubectl port-forward $POD_NAME 8080:80
21+
{{- end }}

‎deploy/charts/kube-oidc-proxy/templates/_helpers.tpl

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "kube-oidc-proxy.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "kube-oidc-proxy.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "kube-oidc-proxy.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "kube-oidc-proxy.labels" -}}
38+
app.kubernetes.io/name: {{ include "kube-oidc-proxy.name" . }}
39+
helm.sh/chart: {{ include "kube-oidc-proxy.chart" . }}
40+
app.kubernetes.io/instance: {{ .Release.Name }}
41+
{{- if .Chart.AppVersion }}
42+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
43+
{{- end }}
44+
app.kubernetes.io/managed-by: {{ .Release.Service }}
45+
{{- end -}}
46+
47+
{{/*
48+
Required claims serialized to CLI argument
49+
*/}}
50+
{{- define "requiredClaims" -}}
51+
{{- if .Values.oidc.requiredClaims -}}
52+
{{- $local := (list) -}}
53+
{{- range $k, $v := .Values.oidc.requiredClaims -}}
54+
{{- $local = (printf "%s=%s" $k $v | append $local) -}}
55+
{{- end -}}
56+
{{ join "," $local }}
57+
{{- end -}}
58+
{{- end -}}

‎deploy/charts/kube-oidc-proxy/templates/clusterrole.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
kind: ClusterRole
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
labels:
5+
{{ include "kube-oidc-proxy.labels" . | indent 4 }}
6+
name: {{ include "kube-oidc-proxy.fullname" . }}
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- "users"
12+
- "groups"
13+
- "serviceaccounts"
14+
verbs:
15+
- "impersonate"
16+
- apiGroups:
17+
- "authentication.k8s.io"
18+
resources:
19+
- "userextras/scopes"
20+
verbs:
21+
- "impersonate"

‎deploy/charts/kube-oidc-proxy/templates/clusterrolebinding.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
kind: ClusterRoleBinding
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
metadata:
4+
labels:
5+
{{ include "kube-oidc-proxy.labels" . | indent 4 }}
6+
name: {{ include "kube-oidc-proxy.fullname" . }}
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: ClusterRole
10+
name: {{ include "kube-oidc-proxy.fullname" . }}
11+
subjects:
12+
- kind: ServiceAccount
13+
name: {{ include "kube-oidc-proxy.fullname" . }}
14+
namespace: {{ .Release.Namespace }}

0 commit comments

Comments
 (0)