-
Notifications
You must be signed in to change notification settings - Fork 131
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
charts: Provide 3 options for oidc configuration
Now users have 3 different way they can set oidc configuration - Directly set values of respective config.oidc.clientID and others which inject them into ENV variable, to be used by args. - Use external i.e. already created secret with the same keys as args. - Use config.oidc.secret.create functionality to create secret and have them dynamically loaded into the headlamp deployment. Fixes: #1897 Signed-off-by: Kautilya Tripathi <ktripathi@microsoft.com>
- Loading branch information
Showing
15 changed files
with
725 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
153 changes: 153 additions & 0 deletions
153
charts/headlamp/tests/expected_templates/oidc-create-secret.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,153 @@ | ||
| --- | ||
| # Source: headlamp/templates/serviceaccount.yaml | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: headlamp | ||
| labels: | ||
| helm.sh/chart: headlamp-0.21.0 | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| app.kubernetes.io/version: "0.23.2" | ||
| app.kubernetes.io/managed-by: Helm | ||
| --- | ||
| # Source: headlamp/templates/secret.yaml | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| metadata: | ||
| name: oidc | ||
| type: Opaque | ||
| data: | ||
| clientID: "dGVzdENsaWVudElk" | ||
| clientSecret: "dGVzdENsaWVudFNlY3JldA==" | ||
| issuerURL: "dGVzdElzc3VlclVSTA==" | ||
| scopes: "dGVzdFNjb3Bl" | ||
| --- | ||
| # Source: headlamp/templates/clusterrolebinding.yaml | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRoleBinding | ||
| metadata: | ||
| name: headlamp-admin | ||
| labels: | ||
| helm.sh/chart: headlamp-0.21.0 | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| app.kubernetes.io/version: "0.23.2" | ||
| app.kubernetes.io/managed-by: Helm | ||
| roleRef: | ||
| apiGroup: rbac.authorization.k8s.io | ||
| kind: ClusterRole | ||
| name: cluster-admin | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: headlamp | ||
| namespace: default | ||
| --- | ||
| # Source: headlamp/templates/service.yaml | ||
| apiVersion: v1 | ||
| kind: Service | ||
| metadata: | ||
| name: headlamp | ||
| labels: | ||
| helm.sh/chart: headlamp-0.21.0 | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| app.kubernetes.io/version: "0.23.2" | ||
| app.kubernetes.io/managed-by: Helm | ||
| spec: | ||
| type: ClusterIP | ||
| ports: | ||
| - port: 80 | ||
| targetPort: http | ||
| protocol: TCP | ||
| name: http | ||
| selector: | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| --- | ||
| # Source: headlamp/templates/deployment.yaml | ||
| # This block of code is used to extract the values from the env. | ||
| # This is done to check if the values are non-empty and if they are, they are used in the deployment.yaml. | ||
|
|
||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: headlamp | ||
| labels: | ||
| helm.sh/chart: headlamp-0.21.0 | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| app.kubernetes.io/version: "0.23.2" | ||
| app.kubernetes.io/managed-by: Helm | ||
| spec: | ||
| replicas: 1 | ||
| selector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| template: | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/name: headlamp | ||
| app.kubernetes.io/instance: headlamp | ||
| spec: | ||
| serviceAccountName: headlamp | ||
| securityContext: | ||
| {} | ||
| containers: | ||
| - name: headlamp | ||
| securityContext: | ||
| privileged: false | ||
| runAsGroup: 101 | ||
| runAsNonRoot: true | ||
| runAsUser: 100 | ||
| image: "ghcr.io/headlamp-k8s/headlamp:v0.23.2" | ||
| imagePullPolicy: IfNotPresent | ||
|
|
||
| env: | ||
| - name: OIDC_CLIENT_ID | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: oidc | ||
| key: clientID | ||
| - name: OIDC_CLIENT_SECRET | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: oidc | ||
| key: clientSecret | ||
| - name: OIDC_ISSUER_URL | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: oidc | ||
| key: issuerURL | ||
| - name: OIDC_SCOPES | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: oidc | ||
| key: scopes | ||
| args: | ||
| - "-in-cluster" | ||
| - "-plugins-dir=/headlamp/plugins" | ||
| # Check if externalSecret is disabled | ||
| # Check if clientID is non empty either from env or oidc.config | ||
| - "-oidc-client-id=$(OIDC_CLIENT_ID)" | ||
| # Check if clientSecret is non empty either from env or oidc.config | ||
| - "-oidc-client-secret=$(OIDC_CLIENT_SECRET)" | ||
| # Check if issuerURL is non empty either from env or oidc.config | ||
| - "-oidc-idp-issuer-url=$(OIDC_ISSUER_URL)" | ||
| # Check if scopes are non empty either from env or oidc.config | ||
| - "-oidc-scopes=$(OIDC_SCOPES)" | ||
| ports: | ||
| - name: http | ||
| containerPort: 4466 | ||
| protocol: TCP | ||
| livenessProbe: | ||
| httpGet: | ||
| path: "/" | ||
| port: http | ||
| readinessProbe: | ||
| httpGet: | ||
| path: "/" | ||
| port: http | ||
| resources: | ||
| {} |
Oops, something went wrong.