Skip to content

Commit 9c0ad1c

Browse files
morarucostelmorarucostel
authored
Include the redis sub-chart dependency (#7)
* Design of including the redis sub-chart dependency * Changing the sessionStorage to a string input based * Adding redis deployment dep * Moving redis passwords to secret * Adding the redis secret resource * Adding new existingSecret documentation in README * Removing lint error * Update Chart.yaml Bumping up the chart version. * add ci test for redis standalone case * Changing the redis secret name due to ci clash
1 parent 3a98e77 commit 9c0ad1c

File tree

6 files changed

+110
-2
lines changed

6 files changed

+110
-2
lines changed

‎helm/oauth2-proxy/Chart.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: oauth2-proxy
2-
version: 3.2.7
3-
apiVersion: v1
2+
version: 3.2.8
3+
apiVersion: v2
44
appVersion: 5.1.0
55
home: https://oauth2-proxy.github.io/oauth2-proxy/
66
description: A reverse proxy that provides authentication with Google, Github or other providers
@@ -11,6 +11,13 @@ keywords:
1111
- authentication
1212
- google
1313
- github
14+
- redis
15+
dependencies:
16+
- name: redis
17+
version: ~10.6.0
18+
repository: https://charts.bitnami.com/bitnami
19+
alias: redis
20+
condition: redis.enabled
1421
sources:
1522
- https://github.com/oauth2-proxy/oauth2-proxy
1623
- https://github.com/oauth2-proxy/manifests

‎helm/oauth2-proxy/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,16 @@ Parameter | Description | Default
120120
`securityContext.enabled` | enable Kubernetes security context on container | `false`
121121
`securityContext.runAsNonRoot` | make sure that the container runs as a non-root user | `true`
122122
`proxyVarsAsSecrets` | choose between environment values or secrets for setting up OAUTH2_PROXY variables. When set to false, remember to add the variables OAUTH2_PROXY_CLIENT_ID, OAUTH2_PROXY_CLIENT_SECRET, OAUTH2_PROXY_COOKIE_SECRET in extraEnv | `true`
123+
`sessionStorage.type` | Session storage type which can be one of the following: cookie or redis | `cookie`
124+
`sessionStorage.redis.existingSecret` | existing Kubernetes secret to use for redis-password and redis-sentinel-password | `""`
125+
`sessionStorage.redis.password` | Redis password. Applicable for all Redis configurations | `nil`
126+
`sessionStorage.redis.clientType` | Allows the user to select which type of client will be used for redis instance. Possible options are: `sentinel`, `cluster` or `standalone` | `standalone`
127+
`sessionStorage.redis.standalone.connectionUrl` | URL of redis standalone server for redis session storage (e.g. redis://HOST[:PORT]) | `nil`
128+
`sessionStorage.redis.cluster.connectionUrls` | List of Redis cluster connection URLs (e.g. redis://HOST[:PORT]) | `[]`
129+
`sessionStorage.redis.sentinel.password` | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `sessionStorage.redis.password` | `nil`
130+
`sessionStorage.redis.sentinel.masterName` | Redis sentinel master name | `nil`
131+
`sessionStorage.redis.sentinel.connectionUrls` | List of Redis sentinel connection URLs (e.g. redis://HOST[:PORT]) | `[]`
132+
`redis.enabled` | Enable the redis subchart deployment | `false`
123133

124134

125135
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,

‎helm/oauth2-proxy/ci/redis-standalone-values.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
sessionStorage:
2+
type: redis
3+
redis:
4+
clientType: "standalone"
5+
standalone:
6+
connectionUrl: "redis://oauth2-proxy-redis-master:6379"
7+
redis:
8+
# provision an instance of the redis sub-chart
9+
enabled: true

‎helm/oauth2-proxy/templates/deployment.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ spec:
2020
checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }}
2121
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
2222
checksum/google-secret: {{ include (print $.Template.BasePath "/google-secret.yaml") . | sha256sum }}
23+
checksum/redis-secret: {{ include (print $.Template.BasePath "/redis-secret.yaml") . | sha256sum }}
2324
{{- if .Values.htpasswdFile.enabled }}
2425
checksum/htpasswd: {{ include (print $.Template.BasePath "/configmap-htpasswd-file.yaml") . | sha256sum }}
2526
{{- end }}
@@ -91,6 +92,40 @@ spec:
9192
name: {{ template "oauth2-proxy.secretName" . }}
9293
key: cookie-secret
9394
{{- end }}
95+
{{- if eq (default "cookie" .Values.sessionStorage.type) "redis" }}
96+
- name: OAUTH2_PROXY_SESSION_STORE_TYPE
97+
value: "redis"
98+
{{- if .Values.sessionStorage.redis.password }}
99+
- name: OAUTH2_PROXY_REDIS_PASSWORD
100+
valueFrom:
101+
secretKeyRef:
102+
name: {{ template "oauth2-proxy.fullname" . }}-redis-access
103+
key: redis-password
104+
{{- end }}
105+
{{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
106+
- name: OAUTH2_PROXY_REDIS_CONNECTION_URL
107+
value: {{ .Values.sessionStorage.redis.standalone.connectionUrl }}
108+
{{- else if eq (default "" .Values.sessionStorage.redis.clientType) "cluster" }}
109+
- name: OAUTH2_PROXY_REDIS_USE_CLUSTER
110+
value: "true"
111+
- name: OAUTH2_PROXY_REDIS_CLUSTER_CONNECTION_URLS
112+
value: {{ .Values.sessionStorage.redis.cluster.connectionUrls }}
113+
{{- else if eq (default "" .Values.sessionStorage.redis.clientType) "sentinel" }}
114+
- name: OAUTH2_PROXY_REDIS_USE_SENTINEL
115+
value: "true"
116+
- name: OAUTH2_PROXY_REDIS_SENTINEL_MASTER_NAME
117+
value: {{ .Values.sessionStorage.redis.sentinel.masterName }}
118+
- name: OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS
119+
value: {{ .Values.sessionStorage.redis.sentinel.connectionUrls }}
120+
{{- if .Values.sessionStorage.redis.sentinel.password }}
121+
- name: OAUTH2_PROXY_REDIS_SENTINEL_PASSWORD
122+
valueFrom:
123+
secretKeyRef:
124+
name: {{ if .Values.sessionStorage.redis.existingSecret }} {{ .Values.sessionStorage.redis.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-redis-access{{ end }}
125+
key: redis-sentinel-password
126+
{{- end }}
127+
{{- end }}
128+
{{- end }}
94129
{{- if .Values.extraEnv }}
95130
{{ toYaml .Values.extraEnv | indent 8 }}
96131
{{- end }}

‎helm/oauth2-proxy/templates/redis-secret.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if and (eq .Values.sessionStorage.type "redis") (not .Values.sessionStorage.redis.existingSecret) }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
labels:
6+
app: {{ template "oauth2-proxy.name" . }}
7+
chart: {{ template "oauth2-proxy.chart" . }}
8+
heritage: {{ .Release.Service }}
9+
release: {{ .Release.Name }}
10+
name: {{ template "oauth2-proxy.fullname" . }}-redis-access
11+
type: Opaque
12+
data:
13+
redis-password: {{ .Values.sessionStorage.redis.password | b64enc | quote }}
14+
redis-sentinel-password: {{ .Values.sessionStorage.redis.sentinel.password | b64enc | quote }}
15+
{{- end -}}

‎helm/oauth2-proxy/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,3 +186,35 @@ htpasswdFile:
186186
# example:
187187
# entries:
188188
# - testuser:{SHA}EWhzdhgoYJWy0z2gyzhRYlN9DSiv
189+
190+
# Configure the session storage type, between cookie and redis
191+
sessionStorage:
192+
# Can be one of the supported session storage cookie/redis
193+
type: cookie
194+
redis:
195+
# Secret name that holds the redis-password and redis-sentinel-password values
196+
existingSecret: ""
197+
password: ""
198+
# Can be one of sentinel/cluster/standalone
199+
clientType: "standalone"
200+
standalone:
201+
connectionUrl: ""
202+
cluster:
203+
# connectionUrls: ["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]
204+
connectionUrls: []
205+
sentinel:
206+
password: ""
207+
masterName: ""
208+
# connectionUrls: ["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]
209+
connectionUrls: []
210+
211+
# Enables and configure the automatic deployment of the redis subchart
212+
redis:
213+
# provision an instance of the redis sub-chart
214+
enabled: false
215+
# Redis specific helm chart settings, please see:
216+
# https://github.com/bitnami/charts/tree/master/bitnami/redis#parameters
217+
# redisPort: 6379
218+
# cluster:
219+
# enabled: false
220+
# slaveCount: 1

0 commit comments

Comments
 (0)