Skip to content

Commit 5a506cf

Browse files
cedricvecedricve
authored
Merge pull request #1 from kerberos-io/feature/add-support-for-oauth2-proxy
Feature/add support for oauth2 proxy
2 parents 3478d42 + ea3c96b commit 5a506cf

File tree

6 files changed

+152
-21
lines changed

6 files changed

+152
-21
lines changed

‎.github/workflows/pr-description.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Autofill PR description
2+
3+
on: pull_request
4+
5+
jobs:
6+
openai-pr-description:
7+
runs-on: ubuntu-22.04
8+
9+
steps:
10+
- uses: actions/checkout@v4
11+
- name: Autofill PR description if empty using OpenAI
12+
uses: cedricve/azureopenai-pr-description@master
13+
with:
14+
github_token: ${{ secrets.TOKEN }}
15+
openai_api_key: ${{ secrets.OPENAI_API_KEY }}
16+
azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
17+
azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
18+
azure_openai_version: ${{ secrets.AZURE_OPENAI_VERSION }}
19+
overwrite_description: true

‎charts/hub/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ type: application
1616
# This is the chart version. This version number should be incremented each time you make changes
1717
# to the chart and its templates, including the app version.
1818
# Versions are expected to follow Semantic Versioning (https://semver.org/)
19-
version: 0.56.0
19+
version: 0.57.0
2020

2121
# This is the version number of the application being deployed. This version number should be
2222
# incremented each time you make changes to the application. Versions are not expected to

‎charts/hub/templates/kerberos-hub/hub-api.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,7 @@ spec:
140140
- name: READ_ONLY
141141
value: "{{ .Values.readonly }}"
142142
- name: SUPPORT_ENABLED
143-
value: "{{ .Values.kerberoshub.support }}"
143+
value: "{{ .Values.kerberoshub.support.enabled }}"
144144
- name: CLOUD_API_URL
145145
value: "{{ .Values.kerberoshub.api.url }}"
146146
- name: API_URL

‎charts/hub/templates/kerberos-hub/hub-frontend.yaml

+36
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ metadata:
2323
name: hub-frontend-ingress
2424
annotations:
2525
kubernetes.io/ingress.class: {{ .Values.ingress }}
26+
{{ if .Values.kerberoshub.oauth2Proxy.enabled }}
27+
nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
28+
nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
29+
{{- end }}
2630
{{- if eq .Values.ingress "nginx" }}
2731
kubernetes.io/tls-acme: "true"
2832
nginx.ingress.kubernetes.io/ssl-redirect: "true"
@@ -99,6 +103,38 @@ spec:
99103
servicePort: 80
100104
{{- end }}
101105
{{ end }}
106+
{{- if .Values.kerberoshub.oauth2Proxy.enabled -}}
107+
---
108+
apiVersion: networking.k8s.io/v1
109+
kind: Ingress
110+
metadata:
111+
name: oauth2-proxy
112+
namespace: kube-system
113+
annotations:
114+
kubernetes.io/ingress.class: {{ .Values.ingress }}
115+
{{- if eq .Values.ingress "nginx" }}
116+
cert-manager.io/cluster-issuer: letsencrypt-prod
117+
kubernetes.io/tls-acme: "true"
118+
nginx.ingress.kubernetes.io/ssl-redirect: "true"
119+
{{- end }}
120+
spec:
121+
ingressClassName: nginx
122+
rules:
123+
- host: {{ .Values.kerberoshub.frontend.url }}
124+
http:
125+
paths:
126+
- path: /oauth2
127+
pathType: Prefix
128+
backend:
129+
service:
130+
name: oauth2-proxy
131+
port:
132+
number: 4180
133+
tls:
134+
- hosts:
135+
- {{ .Values.kerberoshub.frontend.url }}
136+
secretName: oauth2-proxy-tls
137+
{{- end -}}
102138
---
103139
apiVersion: apps/v1
104140
kind: Deployment

‎charts/hub/templates/kerberos-hub/hub-oauth2-proxy.yaml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{{- if .Values.kerberoshub.oauth2Proxy.enabled -}}
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
labels:
6+
k8s-app: oauth2-proxy
7+
name: oauth2-proxy
8+
namespace: kube-system
9+
spec:
10+
replicas: 1
11+
selector:
12+
matchLabels:
13+
k8s-app: oauth2-proxy
14+
template:
15+
metadata:
16+
labels:
17+
k8s-app: oauth2-proxy
18+
spec:
19+
containers:
20+
- args:
21+
- --provider=github
22+
- --email-domain=*
23+
- --upstream=file:///dev/null
24+
- --http-address=0.0.0.0:4180
25+
env:
26+
- name: OAUTH2_PROXY_CLIENT_ID
27+
value: "{{ .Values.kerberoshub.oauth2Proxy.clientId }}"
28+
- name: OAUTH2_PROXY_CLIENT_SECRET
29+
value: "{{ .Values.kerberoshub.oauth2Proxy.clientSecret }}"
30+
- name: OAUTH2_PROXY_COOKIE_SECRET
31+
value: "{{ .Values.kerberoshub.oauth2Proxy.cookieSecret }}"
32+
- name: OAUTH2_PROXY_GITHUB_ORG
33+
value: "{{ .Values.kerberoshub.oauth2Proxy.githubOrg }}"
34+
- name: OAUTH2_PROXY_GITHUB_TEAM
35+
value: "{{ .Values.kerberoshub.oauth2Proxy.githubTeam }}"
36+
image: quay.io/oauth2-proxy/oauth2-proxy:latest
37+
imagePullPolicy: Always
38+
name: oauth2-proxy
39+
ports:
40+
- containerPort: 4180
41+
protocol: TCP
42+
resources:
43+
limits:
44+
cpu: 100m
45+
memory: 50Mi
46+
requests:
47+
cpu: 100m
48+
memory: 50Mi
49+
---
50+
apiVersion: v1
51+
kind: Service
52+
metadata:
53+
labels:
54+
k8s-app: oauth2-proxy
55+
name: oauth2-proxy
56+
namespace: kube-system
57+
spec:
58+
ports:
59+
- name: http
60+
port: 4180
61+
protocol: TCP
62+
targetPort: 4180
63+
selector:
64+
k8s-app: oauth2-proxy
65+
{{- end -}}

‎charts/hub/values.yaml

+30-19
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ licenseServer:
1919
# - name: regcred
2020

2121
# Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'.
22-
# Set to 'true' if this is a private deployment.
22+
# Change the environment to 'staging' or 'acceptance' will add a banner on the
23+
# front-end, to indicate the environment.
2324
environment: "production"
2425

2526
# Set to 'true' if this is a private deployment.
@@ -65,17 +66,17 @@ queueName: "kcloud-event-queue" # This is the topic to which all events are send
6566
# RabbitMQ can be installed in the same cluster using a helm chart, or you can
6667
# use a service on cloud provider like AWS, GCP, Azure, etc.
6768
rabbitmq:
68-
host: "rabbitmq.rabbitmq:5672" # can be internal dns name or external
69+
host: "<rabbitmq.rabbitmq:5672>" # can be internal dns name or external
6970
#host: "amqps://b-xxx-xxx-xxx-xxx-xxx.mq.eu-central-1.amazonaws.com:5671"
70-
username: "yourusername"
71-
password: "yourpassword"
71+
username: "<yourusername>"
72+
password: "<yourpassword>"
7273
exchange: ""
7374

7475
# If you already have a Kafka cluster you might use this instead of RabbitMQ.
7576
kafka:
76-
broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
77-
username: "yourusername"
78-
password: "yourpassword"
77+
broker: "<kafka1.yourdomain.com:9094>" # can be internal dns name or external
78+
username: "<yourusername>"
79+
password: "<yourpassword>"
7980
mechanism: "PLAIN"
8081
security: "SASL_PLAINTEXT"
8182

@@ -150,8 +151,6 @@ email:
150151
# Kerberos hub properly working.
151152

152153
kerberoshub:
153-
# Enables the support environment.
154-
support: false
155154
api:
156155
repository: kerberos/hub-api
157156
pullPolicy: IfNotPresent
@@ -178,37 +177,37 @@ kerberoshub:
178177
#legacyUrl: "api.legacy.yourdomain.com"
179178

180179
# MFA issuer name
181-
mfaIssuer: "Kerberos.io"
180+
mfaIssuer: "<yourdomain.com>"
182181

183182
# Admin API's are made available for automation of Kerberos Hub.
184183
# To access those API's (e.g. creation of owner users), an API key needs to be provided.
185-
apiKey: "a-random-admin-api-key"
184+
apiKey: "<a-random-admin-api-key>"
186185

187186
## Certificates
188187
tls:
189188
- hosts:
190-
- "api.yourdomain.com"
189+
- "<api.yourdomain.com>"
191190
secretName: kerberoshub-api
192191
#- hosts:
193192
# - "api.legacy.yourdomain.com"
194193
# secretName: kerberoshub-api-legacy
195194
- hosts:
196-
- "admin.api.yourdomain.com"
195+
- "<admin.api.yourdomain.com>"
197196
secretName: kerberoshub-admin
198197
language: "english"
199198
fallbackLanguage: "english"
200199
# Legacy (reseller) it is possible to link to AWS S3 and IAM (however Kerberos Vault is now the recommended option).
201200
# This is primarily used for creation of subscriptions, and not needed if you are using mainly Kerberos Vault.
202201
aws:
203-
region: "xxx"
204-
bucket: "xxx"
205-
accessKey: "xxx"
206-
secretKey: "xxx"
202+
region: "<xxx>"
203+
bucket: "<xxx>"
204+
accessKey: "<xxx>"
205+
secretKey: "<xxx>"
207206
stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed.
208-
privateKey: "xxx"
207+
privateKey: "<xxx>"
209208
slack: # Slack is used in the api, to send logs to a specific Slack channel.
210209
enabled: "true"
211-
hook: "yourslackhook" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ
210+
hook: "<yourslackhook>" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ
212211
username: "Kerberos Hub" # The slack username
213212
elasticsearch: # Logs of the kerberos hub will be send to an elastic search cluster.
214213
enabled: "false"
@@ -347,6 +346,18 @@ kerberoshub:
347346
navigationLinkTitle5: ""
348347
navigationLinkUrl5: ""
349348

349+
support:
350+
enabled: false
351+
352+
oauth2Proxy:
353+
enabled: false
354+
github:
355+
clientId: "<github-client-id>"
356+
clientSecret: "<github-client-secret>"
357+
cookieSecret: "<generate-a-random-cookie-secret>"
358+
organization: "<github-organization>"
359+
team: "<github-team>"
360+
350361
cleanup:
351362
repository: kerberos/hub-cleanup
352363
pullPolicy: IfNotPresent

0 commit comments

Comments
 (0)