Merge pull request #35 from jetstack/yaml-example

Adds helpful kube-oidc-proxy deployment yamls

Author: jetstack-bot

demo/gencreds.sh

@@ -28,7 +28,7 @@ spec:
         app: kube-oidc-proxy
     spec:
       containers:
-      - image: gcr.io/jetstack-josh/kube-oidc-proxy
+      - image: quay.io/jetstack/kube-oidc-proxy
         ports:
         - containerPort: 443
         - containerPort: 8080
@@ -109,7 +109,27 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: cluster-admin
+  name: kube-oidc-proxy
 subjects:
 - kind: User
   name: system:serviceaccount:kube-oidc-proxy:default
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kube-oidc-proxy
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - "users"
+  - "groups"
+  - "serviceaccounts"
+  verbs:
+  - "impersonate"
+- apiGroups:
+  - "authentication.k8s.io"
+  resources:
+  - "userextras/scopes"
+  verbs:
+  - "impersonate"

demo/openssl.cnf

@@ -1,7 +1,7 @@
 apiVersion: v1
 data:
-  tls.crt: SERVING_TLS_CERT
-  tls.key: SERVING_TLS_KEY
+  tls.crt: {{ SERVING_TLS_CERT }}
+  tls.key: {{ SERVING_TLS_KEY }}
 kind: Secret
 metadata:
   name: kube-oidc-proxy-serving
@@ -10,10 +10,10 @@ type: kubernetes.io/tls
 ---
 apiVersion: v1
 data:
-  oidc.ca-pem:
-  oidc.issuer-url:
-  oidc.username-claim:
-  oidc.client-id:
+  oidc.ca-pem: {{ OIDC_CA }}
+  oidc.issuer-url: {{ OIDC_ISSUER_URL }}
+  oidc.username-claim: {{ OIDC_USERNAME_CLAIM }}
+  oidc.client-id: {{ OIDC_CLIENT_ID }}
 kind: Secret
 metadata:
   name: kube-oidc-proxy-config