Skip to content

Commit c24b966

Browse files
endakellyendakelly
authored
Merge branch 'main' into ek-patch-1
2 parents a0890c9 + 8c39083 commit c24b966

File tree

11 files changed

+91
-41
lines changed

11 files changed

+91
-41
lines changed

‎.github/workflows/lint-test.yaml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,25 @@ jobs:
77
runs-on: ubuntu-latest
88
steps:
99
- name: Checkout
10-
uses: actions/checkout@v2
10+
uses: actions/checkout@v3
1111
with:
1212
fetch-depth: 0
1313

1414
- name: Set up Helm
15-
uses: azure/setup-helm@v1
15+
uses: azure/setup-helm@v3
1616
with:
17-
version: v3.4.1
17+
version: v3.10.3
1818

1919
# Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
2020
# yamllint (https://github.com/adrienverge/yamllint) which require Python
2121
- name: Set up Python
22-
uses: actions/setup-python@v2
22+
uses: actions/setup-python@v4
2323
with:
24-
python-version: 3.7
24+
python-version: '3.9'
25+
check-latest: true
2526

2627
- name: Set up chart-testing
27-
uses: helm/chart-testing-action@v2.1.0
28+
uses: helm/chart-testing-action@v2
2829

2930
- name: Run chart-testing (list-changed)
3031
id: list-changed
@@ -38,12 +39,14 @@ jobs:
3839
run: ct lint --config ct.yaml
3940

4041
- name: Create kind cluster
41-
uses: helm/kind-action@v1.2.0
42+
uses: helm/kind-action@v1
4243
if: steps.list-changed.outputs.changed == 'true'
4344

4445
- name: Install Prometheus Operator CRDs
4546
id: prom
4647
run: kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.54.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
48+
if: steps.list-changed.outputs.changed == 'true'
4749

4850
- name: Run chart-testing (install)
4951
run: ct install --config ct.yaml
52+
if: steps.list-changed.outputs.changed == 'true'

‎.github/workflows/release.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Checkout
13-
uses: actions/checkout@v2
13+
uses: actions/checkout@v3
1414
with:
1515
fetch-depth: 0
1616

@@ -20,16 +20,16 @@ jobs:
2020
git config user.email "[email protected]"
2121
2222
- name: Install Helm
23-
uses: azure/setup-helm@v1
23+
uses: azure/setup-helm@v3
2424
with:
25-
version: v3.4.1
25+
version: v3.10.3
2626

2727
- name: Add Helm repositories
2828
run: |
2929
helm repo add bitnami https://charts.bitnami.com/bitnami
3030
3131
- name: Run chart-releaser
32-
uses: helm/chart-releaser-action@v1.1.0
32+
uses: helm/chart-releaser-action@v1
3333
with:
3434
charts_dir: helm
3535
env:

‎artifacthub-repo.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,5 @@ owners:
88
- name: NickMeves
99
email: [email protected]
1010
- name: tlawrie
11+
- name: pierluigilenoci
12+
email: [email protected]

‎helm/oauth2-proxy/Chart.lock‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
dependencies:
22
- name: redis
33
repository: https://charts.bitnami.com/bitnami
4-
version: 16.4.0
5-
digest: sha256:a6a2b7e848cc6c48dc175d8e6aa23651385f8d317f33bbb4fea97db822c3d445
6-
generated: "2022-02-10T12:48:38.7766769+01:00"
4+
version: 16.13.2
5+
digest: sha256:6fc589816ba4670d6f38cc724cba9b728d10a041a2cef4425a62c22f9a1aa5f6
6+
generated: "2022-12-20T18:22:05.758522+01:00"

‎helm/oauth2-proxy/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: oauth2-proxy
22
version: 6.6.2
33
apiVersion: v2
4-
appVersion: 7.3.0
4+
appVersion: 7.4.0
55
home: https://oauth2-proxy.github.io/oauth2-proxy/
66
description: A reverse proxy that provides authentication with Google, Github or other providers
77
keywords:
@@ -14,7 +14,7 @@ keywords:
1414
- redis
1515
dependencies:
1616
- name: redis
17-
version: ~16.4.0
17+
version: ~16.13.2
1818
repository: https://charts.bitnami.com/bitnami
1919
alias: redis
2020
condition: redis.enabled

‎helm/oauth2-proxy/README.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ Parameter | Description | Default
107107
`alphaConfig.serverConfigData` | Arbitrary configuration data to append to the server section | `{}`
108108
`alphaConfig.metricsConfigData` | Arbitrary configuration data to append to the metrics section | `{}`
109109
`alphaConfig.configData` | Arbitrary configuration data to append | `{}`
110-
`alphaConfig.existingConfig` | existing Kubernetes configmap to use for the alpha configuration file. See [config template](https://github.com/oauth2-proxy/manifests/blob/master/helm/oauth2-proxy/templates/configmap-alpha.yaml) for the required values | `nil`
110+
`alphaConfig.existingConfig` | existing Kubernetes configmap to use for the alpha configuration file. See [config template](https://github.com/oauth2-proxy/manifests/blob/master/helm/oauth2-proxy/templates/configmap-alpha.yaml) for the required values | `nil`
111111
`customLabels` | Custom labels to add into metadata | `{}` |
112112
`config.google.adminEmail` | user impersonated by the google service account | `""`
113113
`config.google.serviceAccountJson` | google service account json contents | `""`
@@ -127,7 +127,7 @@ Parameter | Description | Default
127127
`httpScheme` | `http` or `https`. `name` used for port on the deployment. `httpGet` port `name` and `scheme` used for `liveness`- and `readinessProbes`. `name` and `targetPort` used for the service. | `http`
128128
`image.pullPolicy` | Image pull policy | `IfNotPresent`
129129
`image.repository` | Image repository | `quay.io/oauth2-proxy/oauth2-proxy`
130-
`image.tag` | Image tag | `v7.3.0`
130+
`image.tag` | Image tag | `""` (defaults to appVersion)
131131
`imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods)
132132
`ingress.enabled` | Enable Ingress | `false`
133133
`ingress.className` | name referencing IngressClass | `nil`
@@ -156,10 +156,12 @@ Parameter | Description | Default
156156
`replicaCount` | desired number of pods | `1`
157157
`resources` | pod resource requests & limits | `{}`
158158
`service.portNumber` | port number for the service | `80`
159+
`service.appProtocol` | application protocol on the port of the service | `http`
159160
`service.type` | type of service | `ClusterIP`
160161
`service.clusterIP` | cluster ip address | `nil`
161162
`service.loadBalancerIP` | ip of load balancer | `nil`
162163
`service.loadBalancerSourceRanges` | allowed source ranges in load balancer | `nil`
164+
`service.nodePort` | external port number for the service when service.type is `NodePort` | `nil`
163165
`serviceAccount.enabled` | create a service account | `true`
164166
`serviceAccount.name` | the service account name | ``
165167
`serviceAccount.annotations` | (optional) annotations for the service account | `{}`
@@ -168,19 +170,24 @@ Parameter | Description | Default
168170
`securityContext.runAsNonRoot` | make sure that the container runs as a non-root user | `true`
169171
`proxyVarsAsSecrets` | choose between environment values or secrets for setting up OAUTH2_PROXY variables. When set to false, remember to add the variables OAUTH2_PROXY_CLIENT_ID, OAUTH2_PROXY_CLIENT_SECRET, OAUTH2_PROXY_COOKIE_SECRET in extraEnv | `true`
170172
`sessionStorage.type` | Session storage type which can be one of the following: cookie or redis | `cookie`
171-
`sessionStorage.redis.existingSecret` | existing Kubernetes secret to use for redis-password and redis-sentinel-password | `""`
173+
`sessionStorage.redis.existingSecret` | Name of the Kubernetes secret containing the redis & redis sentinel password values (see also `sessionStorage.redis.passwordKey`) | `""`
172174
`sessionStorage.redis.password` | Redis password. Applicable for all Redis configurations. Taken from redis subchart secret if not set. sessionStorage.redis.existingSecret takes precedence | `nil`
175+
`sessionStorage.redis.passwordKey` | Key of the Kubernetes secret data containing the redis password value | `redis-password`
173176
`sessionStorage.redis.clientType` | Allows the user to select which type of client will be used for redis instance. Possible options are: `sentinel`, `cluster` or `standalone` | `standalone`
174-
`sessionStorage.redis.standalone.connectionUrl` | URL of redis standalone server for redis session storage (e.g. redis://HOST[:PORT]). Automatically generated if not set. | `""`
175-
`sessionStorage.redis.cluster.connectionUrls` | List of Redis cluster connection URLs (e.g. redis://HOST[:PORT]) | `[]`
177+
`sessionStorage.redis.standalone.connectionUrl` | URL of redis standalone server for redis session storage (e.g. `redis://HOST[:PORT]`). Automatically generated if not set. | `""`
178+
`sessionStorage.redis.cluster.connectionUrls` | List of Redis cluster connection URLs (e.g. `["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]`) | `[]`
179+
`sessionStorage.redis.sentinel.existingSecret` | Name of the Kubernetes secret containing the redis sentinel password value (see also `sessionStorage.redis.sentinel.passwordKey`). Default: `sessionStorage.redis.existingSecret` | `""`
176180
`sessionStorage.redis.sentinel.password` | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `sessionStorage.redis.password` | `nil`
181+
`sessionStorage.redis.sentinel.passwordKey` | Key of the Kubernetes secret data containing the redis sentinel password value | `redis-sentinel-password`
177182
`sessionStorage.redis.sentinel.masterName` | Redis sentinel master name | `nil`
178-
`sessionStorage.redis.sentinel.connectionUrls` | List of Redis sentinel connection URLs (e.g. redis://HOST[:PORT]) | `[]`
183+
`sessionStorage.redis.sentinel.connectionUrls` | List of Redis sentinel connection URLs (e.g. `["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]`) | `[]`
179184
`topologySpreadConstraints` | List of pod topology spread constraints | `[]`
180185
`redis.enabled` | Enable the redis subchart deployment | `false`
181186
`checkDeprecation` | Enable deprecation checks | `true`
182187
`metrics.enabled` | Enable Prometheus metrics endpoint | `true`
183188
`metrics.port` | Serve Prometheus metrics on this port | `44180`
189+
`metrics.nodePort` | External port for the metrics when service.type is `NodePort` | `nil`
190+
`metrics.service.appProtocol` | application protocol of the metrics port in the service | `http`
184191
`metrics.servicemonitor.enabled` | Enable Prometheus Operator ServiceMonitor | `false`
185192
`metrics.servicemonitor.namespace` | Define the namespace where to deploy the ServiceMonitor resource | `""`
186193
`metrics.servicemonitor.prometheusInstance` | Prometheus Instance definition | `default`

‎helm/oauth2-proxy/templates/NOTES.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
To verify that oauth2-proxy has started, run:
22

3-
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth2-proxy.fullname" . }}"
3+
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth2-proxy.name" . }}"

‎helm/oauth2-proxy/templates/deployment.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ spec:
1818
metadata:
1919
annotations:
2020
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
21+
{{- if .Values.alphaConfig.enabled }}
22+
checksum/alpha-config: {{ include (print $.Template.BasePath "/configmap-alpha.yaml") . | sha256sum }}
23+
{{- end }}
2124
checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }}
2225
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
2326
checksum/google-secret: {{ include (print $.Template.BasePath "/google-secret.yaml") . | sha256sum }}
@@ -52,13 +55,14 @@ spec:
5255
{{- end }}
5356
containers:
5457
- name: {{ .Chart.Name }}
55-
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
58+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
5659
imagePullPolicy: {{ .Values.image.pullPolicy }}
5760
args:
5861
{{- if .Values.alphaConfig.enabled }}
5962
- --alpha-config=/etc/oauth2_proxy/oauth2_proxy.yml
6063
{{- else }}
6164
- --http-address=0.0.0.0:4180
65+
- --https-address=0.0.0.0:4443
6266
{{- if .Values.metrics.enabled }}
6367
- --metrics-address=0.0.0.0:44180
6468
{{- end }}
@@ -129,7 +133,7 @@ spec:
129133
{{- else }}
130134
name: {{ include "oauth2-proxy.redis.fullname" . }}
131135
{{- end }}
132-
key: redis-password
136+
key: {{ .Values.sessionStorage.redis.passwordKey }}
133137
{{- end }}
134138
{{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
135139
- name: OAUTH2_PROXY_REDIS_CONNECTION_URL
@@ -146,12 +150,16 @@ spec:
146150
value: {{ .Values.sessionStorage.redis.sentinel.masterName }}
147151
- name: OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS
148152
value: {{ .Values.sessionStorage.redis.sentinel.connectionUrls }}
149-
{{- if .Values.sessionStorage.redis.sentinel.password }}
153+
{{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.sentinel.password }}
150154
- name: OAUTH2_PROXY_REDIS_SENTINEL_PASSWORD
151155
valueFrom:
152156
secretKeyRef:
153-
name: {{ if .Values.sessionStorage.redis.existingSecret }} {{ .Values.sessionStorage.redis.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-redis-access{{ end }}
154-
key: redis-sentinel-password
157+
{{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret }}
158+
name: {{ .Values.sessionStorage.redis.sentinel.existingSecret | default .Values.sessionStorage.redis.existingSecret }}
159+
{{- else }}
160+
name: {{ template "oauth2-proxy.fullname" . }}-redis-access
161+
{{- end }}
162+
key: {{ .Values.sessionStorage.redis.sentinel.passwordKey }}
155163
{{- end }}
156164
{{- end }}
157165
{{- end }}
@@ -164,7 +172,7 @@ spec:
164172
{{- else if (and (eq .Values.httpScheme "http") (empty .Values.containerPort)) }}
165173
- containerPort: 4180
166174
{{- else if (and (eq .Values.httpScheme "https") (empty .Values.containerPort)) }}
167-
- containerPort: 443
175+
- containerPort: 4443
168176
{{- else }}
169177
{{- end}}
170178
name: {{ .Values.httpScheme }}
@@ -314,4 +322,3 @@ spec:
314322
topologySpreadConstraints:
315323
{{- toYaml . | nindent 8 }}
316324
{{- end }}
317-

‎helm/oauth2-proxy/templates/redis-secret.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ metadata:
1212
name: {{ $fullName }}-redis-access
1313
type: Opaque
1414
data:
15-
{{- with .redis.password }}
16-
redis-password: {{ . | b64enc | quote }}
15+
{{- if and .redis.password (not .redis.existingSecret) }}
16+
{{ .redis.passwordKey }}: {{ .redis.password | b64enc | quote }}
1717
{{- end }}
18-
{{- with .redis.sentinel.password }}
19-
redis-sentinel-password: {{ . | b64enc | quote }}
18+
{{- if and .redis.sentinel.password (not .redis.sentinel.existingSecret) (ne .redis.sentinel.passwordKey .redis.passwordKey) }}
19+
{{ .redis.sentinel.passwordKey }}: {{ .redis.sentinel.password | b64enc | quote }}
2020
{{- end }}
2121
{{- end }}
2222
{{- end }}

‎helm/oauth2-proxy/templates/service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,24 @@ spec:
3030
ports:
3131
- port: {{ .Values.service.portNumber }}
3232
targetPort: {{ .Values.httpScheme }}
33+
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
34+
nodePort: {{ .Values.service.nodePort }}
35+
{{- end }}
3336
protocol: TCP
37+
{{- with .Values.service.appProtocol }}
38+
appProtocol: {{ . }}
39+
{{- end }}
3440
name: {{ .Values.httpScheme }}
3541
{{- if and .Values.metrics.enabled .Values.metrics.port }}
3642
- port: {{ .Values.metrics.port }}
3743
protocol: TCP
44+
{{- with .Values.metrics.service.appProtocol }}
45+
appProtocol: {{ . }}
46+
{{- end }}
3847
targetPort: metrics
48+
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.metrics.nodePort))) }}
49+
nodePort: {{ .Values.metrics.nodePort }}
50+
{{- end }}
3951
name: metrics
4052
{{- end }}
4153
selector:

0 commit comments

Comments
 (0)