Skip to content

Commit f49870b

Browse files
pierluigilenocipierluigilenoci
authored
Merge branch 'main' into feature/add-extraArgs-documentation
2 parents a515705 + 1483b29 commit f49870b

File tree

11 files changed

+112
-39
lines changed

11 files changed

+112
-39
lines changed

‎.github/workflows/lint-test.yaml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,25 @@ jobs:
77
runs-on: ubuntu-latest
88
steps:
99
- name: Checkout
10-
uses: actions/checkout@v2
10+
uses: actions/checkout@v3
1111
with:
1212
fetch-depth: 0
1313

1414
- name: Set up Helm
15-
uses: azure/setup-helm@v1
15+
uses: azure/setup-helm@v3
1616
with:
17-
version: v3.4.1
17+
version: v3.10.3
1818

1919
# Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and
2020
# yamllint (https://github.com/adrienverge/yamllint) which require Python
2121
- name: Set up Python
22-
uses: actions/setup-python@v2
22+
uses: actions/setup-python@v4
2323
with:
24-
python-version: 3.7
24+
python-version: '3.9'
25+
check-latest: true
2526

2627
- name: Set up chart-testing
27-
uses: helm/chart-testing-action@v2.1.0
28+
uses: helm/chart-testing-action@v2
2829

2930
- name: Run chart-testing (list-changed)
3031
id: list-changed
@@ -38,12 +39,14 @@ jobs:
3839
run: ct lint --config ct.yaml
3940

4041
- name: Create kind cluster
41-
uses: helm/kind-action@v1.2.0
42+
uses: helm/kind-action@v1
4243
if: steps.list-changed.outputs.changed == 'true'
4344

4445
- name: Install Prometheus Operator CRDs
4546
id: prom
4647
run: kubectl apply --server-side -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.54.0/example/prometheus-operator-crd/monitoring.coreos.com_servicemonitors.yaml
48+
if: steps.list-changed.outputs.changed == 'true'
4749

4850
- name: Run chart-testing (install)
4951
run: ct install --config ct.yaml
52+
if: steps.list-changed.outputs.changed == 'true'

‎.github/workflows/release.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
runs-on: ubuntu-latest
1111
steps:
1212
- name: Checkout
13-
uses: actions/checkout@v2
13+
uses: actions/checkout@v3
1414
with:
1515
fetch-depth: 0
1616

@@ -20,16 +20,16 @@ jobs:
2020
git config user.email "[email protected]"
2121
2222
- name: Install Helm
23-
uses: azure/setup-helm@v1
23+
uses: azure/setup-helm@v3
2424
with:
25-
version: v3.4.1
25+
version: v3.10.3
2626

2727
- name: Add Helm repositories
2828
run: |
2929
helm repo add bitnami https://charts.bitnami.com/bitnami
3030
3131
- name: Run chart-releaser
32-
uses: helm/chart-releaser-action@v1.1.0
32+
uses: helm/chart-releaser-action@v1
3333
with:
3434
charts_dir: helm
3535
env:

‎artifacthub-repo.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,5 @@ owners:
88
- name: NickMeves
99
email: [email protected]
1010
- name: tlawrie
11+
- name: pierluigilenoci
12+
email: [email protected]

‎helm/oauth2-proxy/Chart.lock‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
dependencies:
22
- name: redis
33
repository: https://charts.bitnami.com/bitnami
4-
version: 16.4.0
5-
digest: sha256:a6a2b7e848cc6c48dc175d8e6aa23651385f8d317f33bbb4fea97db822c3d445
6-
generated: "2022-02-10T12:48:38.7766769+01:00"
4+
version: 16.13.2
5+
digest: sha256:6fc589816ba4670d6f38cc724cba9b728d10a041a2cef4425a62c22f9a1aa5f6
6+
generated: "2022-12-20T18:22:05.758522+01:00"

‎helm/oauth2-proxy/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: oauth2-proxy
22
version: 6.7.1
33
apiVersion: v2
4-
appVersion: 7.3.0
4+
appVersion: 7.4.0
55
home: https://oauth2-proxy.github.io/oauth2-proxy/
66
description: A reverse proxy that provides authentication with Google, Github or other providers
77
keywords:
@@ -14,7 +14,7 @@ keywords:
1414
- redis
1515
dependencies:
1616
- name: redis
17-
version: ~16.4.0
17+
version: ~16.13.2
1818
repository: https://charts.bitnami.com/bitnami
1919
alias: redis
2020
condition: redis.enabled

‎helm/oauth2-proxy/README.md‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -107,12 +107,13 @@ Parameter | Description | Default
107107
`alphaConfig.serverConfigData` | Arbitrary configuration data to append to the server section | `{}`
108108
`alphaConfig.metricsConfigData` | Arbitrary configuration data to append to the metrics section | `{}`
109109
`alphaConfig.configData` | Arbitrary configuration data to append | `{}`
110-
`alphaConfig.existingConfig` | existing Kubernetes configmap to use for the alpha configuration file. See [config template](https://github.com/oauth2-proxy/manifests/blob/master/helm/oauth2-proxy/templates/configmap-alpha.yaml) for the required values | `nil`
110+
`alphaConfig.existingConfig` | existing Kubernetes configmap to use for the alpha configuration file. See [config template](https://github.com/oauth2-proxy/manifests/blob/master/helm/oauth2-proxy/templates/configmap-alpha.yaml) for the required values | `nil`
111111
`customLabels` | Custom labels to add into metadata | `{}` |
112112
`config.google.adminEmail` | user impersonated by the google service account | `""`
113113
`config.google.serviceAccountJson` | google service account json contents | `""`
114114
`config.google.existingConfig` | existing Kubernetes configmap to use for the service account file. See [google secret template](https://github.com/oauth2-proxy/manifests/blob/master/helm/oauth2-proxy/templates/google-secret.yaml) for the required values | `nil`
115115
`config.google.groups` | restrict logins to members of these google groups | `[]`
116+
`containerPort` | used to customise port on the deployment | `""`
116117
`extraArgs` | key:value list of extra arguments to give the binary | `{}`
117118
`extraEnv` | key:value list of extra environment variables to give the binary | `[]`
118119
`extraVolumes` | list of extra volumes | `[]`
@@ -126,7 +127,7 @@ Parameter | Description | Default
126127
`httpScheme` | `http` or `https`. `name` used for port on the deployment. `httpGet` port `name` and `scheme` used for `liveness`- and `readinessProbes`. `name` and `targetPort` used for the service. | `http`
127128
`image.pullPolicy` | Image pull policy | `IfNotPresent`
128129
`image.repository` | Image repository | `quay.io/oauth2-proxy/oauth2-proxy`
129-
`image.tag` | Image tag | `v7.3.0`
130+
`image.tag` | Image tag | `""` (defaults to appVersion)
130131
`imagePullSecrets` | Specify image pull secrets | `nil` (does not add image pull secrets to deployed pods)
131132
`ingress.enabled` | Enable Ingress | `false`
132133
`ingress.className` | name referencing IngressClass | `nil`
@@ -155,10 +156,12 @@ Parameter | Description | Default
155156
`replicaCount` | desired number of pods | `1`
156157
`resources` | pod resource requests & limits | `{}`
157158
`service.portNumber` | port number for the service | `80`
159+
`service.appProtocol` | application protocol on the port of the service | `http`
158160
`service.type` | type of service | `ClusterIP`
159161
`service.clusterIP` | cluster ip address | `nil`
160162
`service.loadBalancerIP` | ip of load balancer | `nil`
161163
`service.loadBalancerSourceRanges` | allowed source ranges in load balancer | `nil`
164+
`service.nodePort` | external port number for the service when service.type is `NodePort` | `nil`
162165
`serviceAccount.enabled` | create a service account | `true`
163166
`serviceAccount.name` | the service account name | ``
164167
`serviceAccount.annotations` | (optional) annotations for the service account | `{}`
@@ -167,18 +170,24 @@ Parameter | Description | Default
167170
`securityContext.runAsNonRoot` | make sure that the container runs as a non-root user | `true`
168171
`proxyVarsAsSecrets` | choose between environment values or secrets for setting up OAUTH2_PROXY variables. When set to false, remember to add the variables OAUTH2_PROXY_CLIENT_ID, OAUTH2_PROXY_CLIENT_SECRET, OAUTH2_PROXY_COOKIE_SECRET in extraEnv | `true`
169172
`sessionStorage.type` | Session storage type which can be one of the following: cookie or redis | `cookie`
170-
`sessionStorage.redis.existingSecret` | existing Kubernetes secret to use for redis-password and redis-sentinel-password | `""`
173+
`sessionStorage.redis.existingSecret` | Name of the Kubernetes secret containing the redis & redis sentinel password values (see also `sessionStorage.redis.passwordKey`) | `""`
171174
`sessionStorage.redis.password` | Redis password. Applicable for all Redis configurations. Taken from redis subchart secret if not set. sessionStorage.redis.existingSecret takes precedence | `nil`
175+
`sessionStorage.redis.passwordKey` | Key of the Kubernetes secret data containing the redis password value | `redis-password`
172176
`sessionStorage.redis.clientType` | Allows the user to select which type of client will be used for redis instance. Possible options are: `sentinel`, `cluster` or `standalone` | `standalone`
173-
`sessionStorage.redis.standalone.connectionUrl` | URL of redis standalone server for redis session storage (e.g. redis://HOST[:PORT]). Automatically generated if not set. | `""`
174-
`sessionStorage.redis.cluster.connectionUrls` | List of Redis cluster connection URLs (e.g. redis://HOST[:PORT]) | `[]`
177+
`sessionStorage.redis.standalone.connectionUrl` | URL of redis standalone server for redis session storage (e.g. `redis://HOST[:PORT]`). Automatically generated if not set. | `""`
178+
`sessionStorage.redis.cluster.connectionUrls` | List of Redis cluster connection URLs (e.g. `["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]`) | `[]`
179+
`sessionStorage.redis.sentinel.existingSecret` | Name of the Kubernetes secret containing the redis sentinel password value (see also `sessionStorage.redis.sentinel.passwordKey`). Default: `sessionStorage.redis.existingSecret` | `""`
175180
`sessionStorage.redis.sentinel.password` | Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `sessionStorage.redis.password` | `nil`
181+
`sessionStorage.redis.sentinel.passwordKey` | Key of the Kubernetes secret data containing the redis sentinel password value | `redis-sentinel-password`
176182
`sessionStorage.redis.sentinel.masterName` | Redis sentinel master name | `nil`
177-
`sessionStorage.redis.sentinel.connectionUrls` | List of Redis sentinel connection URLs (e.g. redis://HOST[:PORT]) | `[]`
183+
`sessionStorage.redis.sentinel.connectionUrls` | List of Redis sentinel connection URLs (e.g. `["redis://127.0.0.1:8000", "redis://127.0.0.1:8000"]`) | `[]`
184+
`topologySpreadConstraints` | List of pod topology spread constraints | `[]`
178185
`redis.enabled` | Enable the redis subchart deployment | `false`
179186
`checkDeprecation` | Enable deprecation checks | `true`
180187
`metrics.enabled` | Enable Prometheus metrics endpoint | `true`
181188
`metrics.port` | Serve Prometheus metrics on this port | `44180`
189+
`metrics.nodePort` | External port for the metrics when service.type is `NodePort` | `nil`
190+
`metrics.service.appProtocol` | application protocol of the metrics port in the service | `http`
182191
`metrics.servicemonitor.enabled` | Enable Prometheus Operator ServiceMonitor | `false`
183192
`metrics.servicemonitor.namespace` | Define the namespace where to deploy the ServiceMonitor resource | `""`
184193
`metrics.servicemonitor.prometheusInstance` | Prometheus Instance definition | `default`

‎helm/oauth2-proxy/templates/NOTES.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
To verify that oauth2-proxy has started, run:
22

3-
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth2-proxy.fullname" . }}"
3+
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "oauth2-proxy.name" . }}"

‎helm/oauth2-proxy/templates/deployment.yaml‎

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@ spec:
1818
metadata:
1919
annotations:
2020
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
21+
{{- if .Values.alphaConfig.enabled }}
22+
checksum/alpha-config: {{ include (print $.Template.BasePath "/configmap-alpha.yaml") . | sha256sum }}
23+
{{- end }}
2124
checksum/config-emails: {{ include (print $.Template.BasePath "/configmap-authenticated-emails-file.yaml") . | sha256sum }}
2225
checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
2326
checksum/google-secret: {{ include (print $.Template.BasePath "/google-secret.yaml") . | sha256sum }}
@@ -52,13 +55,14 @@ spec:
5255
{{- end }}
5356
containers:
5457
- name: {{ .Chart.Name }}
55-
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
58+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "v%s" .Chart.AppVersion) }}"
5659
imagePullPolicy: {{ .Values.image.pullPolicy }}
5760
args:
5861
{{- if .Values.alphaConfig.enabled }}
5962
- --alpha-config=/etc/oauth2_proxy/oauth2_proxy.yml
6063
{{- else }}
6164
- --http-address=0.0.0.0:4180
65+
- --https-address=0.0.0.0:4443
6266
{{- if .Values.metrics.enabled }}
6367
- --metrics-address=0.0.0.0:44180
6468
{{- end }}
@@ -129,7 +133,7 @@ spec:
129133
{{- else }}
130134
name: {{ include "oauth2-proxy.redis.fullname" . }}
131135
{{- end }}
132-
key: redis-password
136+
key: {{ .Values.sessionStorage.redis.passwordKey }}
133137
{{- end }}
134138
{{- if eq (default "" .Values.sessionStorage.redis.clientType) "standalone" }}
135139
- name: OAUTH2_PROXY_REDIS_CONNECTION_URL
@@ -146,20 +150,31 @@ spec:
146150
value: {{ .Values.sessionStorage.redis.sentinel.masterName }}
147151
- name: OAUTH2_PROXY_REDIS_SENTINEL_CONNECTION_URLS
148152
value: {{ .Values.sessionStorage.redis.sentinel.connectionUrls }}
149-
{{- if .Values.sessionStorage.redis.sentinel.password }}
153+
{{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret .Values.sessionStorage.redis.sentinel.password }}
150154
- name: OAUTH2_PROXY_REDIS_SENTINEL_PASSWORD
151155
valueFrom:
152156
secretKeyRef:
153-
name: {{ if .Values.sessionStorage.redis.existingSecret }} {{ .Values.sessionStorage.redis.existingSecret }}{{ else }} {{ template "oauth2-proxy.fullname" . }}-redis-access{{ end }}
154-
key: redis-sentinel-password
157+
{{- if or .Values.sessionStorage.redis.sentinel.existingSecret .Values.sessionStorage.redis.existingSecret }}
158+
name: {{ .Values.sessionStorage.redis.sentinel.existingSecret | default .Values.sessionStorage.redis.existingSecret }}
159+
{{- else }}
160+
name: {{ template "oauth2-proxy.fullname" . }}-redis-access
161+
{{- end }}
162+
key: {{ .Values.sessionStorage.redis.sentinel.passwordKey }}
155163
{{- end }}
156164
{{- end }}
157165
{{- end }}
158166
{{- if .Values.extraEnv }}
159167
{{ tpl (toYaml .Values.extraEnv) . | indent 8 }}
160168
{{- end }}
161169
ports:
170+
{{- if .Values.containerPort }}
171+
- containerPort: {{ .Values.containerPort }}
172+
{{- else if (and (eq .Values.httpScheme "http") (empty .Values.containerPort)) }}
162173
- containerPort: 4180
174+
{{- else if (and (eq .Values.httpScheme "https") (empty .Values.containerPort)) }}
175+
- containerPort: 4443
176+
{{- else }}
177+
{{- end}}
163178
name: {{ .Values.httpScheme }}
164179
protocol: TCP
165180
{{- if .Values.metrics.enabled }}
@@ -303,3 +318,7 @@ spec:
303318
{{- end }}
304319
tolerations:
305320
{{ toYaml .Values.tolerations | indent 8 }}
321+
{{- with .Values.topologySpreadConstraints }}
322+
topologySpreadConstraints:
323+
{{- toYaml . | nindent 8 }}
324+
{{- end }}

‎helm/oauth2-proxy/templates/redis-secret.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,11 @@ metadata:
1212
name: {{ $fullName }}-redis-access
1313
type: Opaque
1414
data:
15-
{{- with .redis.password }}
16-
redis-password: {{ . | b64enc | quote }}
15+
{{- if and .redis.password (not .redis.existingSecret) }}
16+
{{ .redis.passwordKey }}: {{ .redis.password | b64enc | quote }}
1717
{{- end }}
18-
{{- with .redis.sentinel.password }}
19-
redis-sentinel-password: {{ . | b64enc | quote }}
18+
{{- if and .redis.sentinel.password (not .redis.sentinel.existingSecret) (ne .redis.sentinel.passwordKey .redis.passwordKey) }}
19+
{{ .redis.sentinel.passwordKey }}: {{ .redis.sentinel.password | b64enc | quote }}
2020
{{- end }}
2121
{{- end }}
2222
{{- end }}

‎helm/oauth2-proxy/templates/service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,24 @@ spec:
3030
ports:
3131
- port: {{ .Values.service.portNumber }}
3232
targetPort: {{ .Values.httpScheme }}
33+
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
34+
nodePort: {{ .Values.service.nodePort }}
35+
{{- end }}
3336
protocol: TCP
37+
{{- with .Values.service.appProtocol }}
38+
appProtocol: {{ . }}
39+
{{- end }}
3440
name: {{ .Values.httpScheme }}
3541
{{- if and .Values.metrics.enabled .Values.metrics.port }}
3642
- port: {{ .Values.metrics.port }}
3743
protocol: TCP
44+
{{- with .Values.metrics.service.appProtocol }}
45+
appProtocol: {{ . }}
46+
{{- end }}
3847
targetPort: metrics
48+
{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.metrics.nodePort))) }}
49+
nodePort: {{ .Values.metrics.nodePort }}
50+
{{- end }}
3951
name: metrics
4052
{{- end }}
4153
selector:

0 commit comments

Comments
 (0)