Skip to content
Snippets Groups Projects
Verified Commit 2c05cf65 authored by Sheogorath's avatar Sheogorath :european_castle:
Browse files

feat(longhorn): Switch to shared oauth2-proxy definition

parent 3013dee3
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
clusters/k8s01/longhorn/kustomization.yaml
+ 2
− 0
View file @ 2c05cf65
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
namespace: longhong-system
resources: resources:
- backup.yaml - backup.yaml
- certificate.yaml - certificate.yaml
- ../../../shared/applications/oauth2-proxy.yaml
- oauth2.yaml - oauth2.yaml
- ingress.yaml - ingress.yaml
clusters/k8s01/longhorn/oauth2.yaml
+ 7
− 188
View file @ 2c05cf65
apiVersion: source.toolkit.fluxcd.io/v1beta1 apiVersion: v1
kind: HelmRepository kind: Secret
metadata: metadata:
name: oauth2-proxy name: oauth2-proxy-override-values
namespace: longhorn-system stringData:
spec: values-overrides.yaml: ENC[AES256_GCM,data:v3yCAr4tuo+YyZ2G04h+qEFjgJGszGzTPeW8WwhSXnuPDH9n+75weBGNoLAq3kV7EJXaFhBwCvZ15x8J8G0BcNJhXjhkeU3M5DsAhCG8EzxwQrRT9xoWKpoof49n2uK8CXMBJu2cO+ZTJInkHEK8RHWDqvbTRJcOhkp4TfCC6ZXrE882O6L77v9WNnIcxbSXk+H6RoDmhR3WNdq73e79YcujZCl8uEwD2NDy4UX+GbUMvQnpIZphwvKrzY9HeUPJ8PJIksDtKAbXbDDOMlGwL41iH0dmhD/8SUdMbDfaWk718IMMaydsIbwWSngGz65Wds4XfkEmIjk1AloHG9LzBjM0YhUQexl8xrEOWHrasGblkmDy8r4SK2IrfPBccFKN6ttm6NilWdOMSl3sgKzxnCAURLAHmkmzUIkdSAZ0UR1QKGpOtkNrnaDOgJGhU5JiS67t01I1P2WZVAeFR0i21v2gALmVFyW/mX1msygwHsYH6XsZMhlA0tQYfc6fsZRXVBrN5bvnbbW6HqPsV+FknPwwhgBSehKPQ2fxvaYdme1AKIICjhpxo2DGL06nYfba933tWvSwnpro0K7cnad4mkEBjw7l7KzlAHweKtLm2WUi8Dx1wbzuNvgL5XxORTmrctwQ/W9Ja7ZDD9QD9/BT8S7AHNyt,iv:zKXcxVw0inkPgWDbW6ut1sd8R2eSo7lBxm0uEeKlrkc=,tag:Mon9G4JR1JbFnyq5RQZaqQ==,type:str]
interval: 30m
url: https://oauth2-proxy.github.io/manifests
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
azure_kv: [] azure_kv: []
hc_vault: [] hc_vault: []
age: [] age: []
lastmodified: "2023-09-09T23:03:59Z" lastmodified: "2023-09-15T23:37:13Z"
mac: ENC[AES256_GCM,data:eMaMKg/uAx3EyGMaXb5h67f+BYqzTn/G6Dk/cpwQxnzU/lTFNU+3sO8hs2YmoZa6J6eUR9zTUn2JFOxc4tA5u+Tymf0G1CLB+L6FGunbUu2cnwKocHe7rDBI08Ej1QhonkTvETUR45ljNhAaxP6JHyv32bRabGoj6uj7DVIhA9E=,iv:oha2BVKDPrug9B00mzoSLB+Jfq4TPomXbrnl43L10gA=,tag:9+bk+puCmmFgVusjqAoukQ==,type:str] mac: ENC[AES256_GCM,data:i9X4itqYf9epkOo4X19ashvfbyW19bMFb9DW8N8S0mPcwrcSovHTdDVfZnEn6WdZRnGiOi9B5EyFdNAvQkAE1kjkz5T3DEZM6ZpGJ4E3p6xvBd7SArcKgOD21ZWEA6xWPYNoxr7zyok93yeHr5HNokH8xz4wfYL767JkXwKKwPU=,iv:ckpW7R5x6+wzyNoK8dkIQhAMTtECDmQemZvHxMyIc9Y=,tag:TE85lIv+jKbd67W5hAe8qA==,type:str]
pgp:
- created_at: "2022-01-22T04:06:16Z"
enc: |-
-----BEGIN PGP MESSAGE-----
wcFMA7kpg2bgzVHcARAAgt+09YMPbbkGkg+/VgMgvxC4YDoQxlcklv3OfrS29yHF
27d8LBexyRYUTqkKhxyFJl+1dOqoE+o2uZjg9J/WSNR4MIBMm4Whn9rly4hoyk1W
BSKqZxt/POdP7ZtZ1Ke3hrZiV4UlDDAagToxrSWG4suXr45i0wUGICbNakrlEB9P
7Ub7nM6aIWjyRJpqPhtJaaq1EWsj/+2NagXOMi0cWjj4wzEy+KZMC3lMVM3db/zw
KDxsZWfK2/gRc7qqQWrmKB5bqQPhKVwUExrzKofExaSozXq9c694mmThVyR2SFc9
OvNLlqLpeRfBpoY9F19Wz0YhQRUxfPdYgV0ZqngxIYzx2+2DqCz1fkW/hIcMLyj9
LBNUTHXcRP9O3ZWWx0flnjcE8Cyz4qmMq9hf0iEWtZb1cO0v5Z6+lYo9ThQvcPCp
DMuZ2l65Sfto56y84j8FPshOS6Heo97mwbO/BmOZYnQ4RtGFc9KlFtLBMyRZfqEo
b6O77YyzCcKYOdgrXjEORxvUq2ftHxTQFBdYUHO2Rpf0tyrZwUYnIWBXnB5fOp/y
HjWzl8ZpQxhJQubiqteEovYdtv+1ionPBLZkzzx3EDbNvSroQijENSkQhyl7QbMj
XURIII47j0yda/kZ4mupPz4isY4kEi/AtwCI+tumI0c7gH7iew/kjoQcgyTVMOLS
5gFZuhZ6ixAXhDms0RKfYq6iKAzXxslg0qcYAOcjwqq5u+cQJTfSrLjivxNs2cIo
M/5BCddS+GzLSTCNYStLfOfkFGlrOccM7I8Fzy3PYhtc9eLwlSI/AA==
=c/3x
-----END PGP MESSAGE-----
fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601
- created_at: "2022-01-22T04:06:16Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMA4oYbIHZIrAPARAAyGLyK65vBqTfe/5iFAuaaWg9sWRTAfnGnDEgxAPdp4EQ
yKOT9AyRLes5yRtSz8ugRVjvQd/B9bj+VE7MosFarpjw5ckzRKjSHpanzPqGGWjI
2Ce9gbSljx7AhmXujK+TRhf4PbliopQWdStNWZ08p17UG2G0UiNPgun0ocHxUqVN
46iUl51aL5ElZUmA3bfcwpYu6lCiDCEvlrX+7ZSsKEYcg1VQ+oi0XTxfEugSFX1N
4QjkSHfFYWCqt5IOB2+G5HCZfwD3n3a9tTjpehnTfC61Dn3r4tAVunD3dDaVvqNK
GOJJvvykUOGrszIInJbXd3Bvp/HGm5jp5eLiMo1GQeG7XxIuiIDV41AkAEEv5nYW
fpkeW/a+2NI/TzM3PsOOxEmghuG4k5lnpYwrEcp/s3OmYwDRLvSQRD9rIjw33VnU
WhgfsjwqlqLbyUTwssn8ztEUvoVXQ/lmsFJ2xrzBuWV4tSOUMX+jpA1bhJ1QCcOd
vR/fMH2ZMppho7bnUUVjFGtRZWLAh4OPdCZ4fTkWpUbrFE9HBP1rcPxe7DqzDlbl
tb5yfNLvHGWh/Myqm7CP04qIlWGyDT4UonAWFmPLt6mWXf6DrlOl8n+iAZbX7d+c
w8y/mAapNcTZZHG/+M5hq0anS9mZ65yR3X2znn8ErNot8alJBcOdulM2aDrwk9HU
aAEJAhDKMKsgECqiT3WYb8AVOHFk0O/CCKDFBTt+S+Bbjeb2vqBE8uRNMECpZPU9
NSZGFfj97fyI1At7TgVko8Ae/2w0xdb80g/81/kVuTNTm/0z60RqOooENSxfGRJ9
PNNoVr/LwxMQ
=e2fo
-----END PGP MESSAGE-----
fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07
encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$
version: 3.7.3
---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: oauth2-proxy
namespace: longhorn-system
spec:
releaseName: oauth2-proxy
chart:
spec:
chart: oauth2-proxy
sourceRef:
kind: HelmRepository
name: oauth2-proxy
namespace: longhorn-system
version: 6.17.0
interval: 5m
install:
remediation:
retries: 5
values:
config:
clientID: longhorn-k8s01
clientSecret: ENC[AES256_GCM,data:hGfscOgZeVwAukvtEJcqeDyBKJWgo11bV1Pn5FdUBu4=,iv:OR8Bj9QoSrjtb1DYhlS/oinpMg0oC5mBvbLQ6IL2aIQ=,tag:fhuUu05+8gfZhR7blTD4qw==,type:str]
cookieSecret: ENC[AES256_GCM,data:2peh/VSESdjO5HFMyCjw1an1/oLwjKY2wS0l4ZTXZHoSCgMOtEaeYTKBWQ==,iv:PBoklIo3LhvLloXUWP5IEtQ46VfJJE7EbXO+LdGD/ks=,tag:csWZ0NRhKJxH9yFA3PssWQ==,type:str]
extraArgs:
provider: keycloak-oidc
provider-display-name: SI-Auth
redirect-url: ENC[AES256_GCM,data:FCaKxnv3UEbCcBkWk+6Qem/Bwdd2h0RviKwuUPZ35ZJUCC1O05AR0pgCkaURWjLxHn4=,iv:ADAtIlkM7CnwtD0isMjh6y227BhquetlaBOYVXWVP2U=,tag:BcXUOGFSRa/JotXdRG1nwQ==,type:str]
oidc-issuer-url: ENC[AES256_GCM,data:lcMt0EiZJPca/5iwNp4Ged6qchqzkuKAXOiyJNR99jfJPRwBjMp3JJJmvfhdU+dU1/VFqMgk3w==,iv:0avQixtcn6Mr87AcloKhIVAIcp08eQk9Ud80CjMRfB4=,tag:uGVgCeeqOoD7ZxhDHvfQmQ==,type:str]
allowed-role: longhorn-k8s01:admin
whitelist-domain: ENC[AES256_GCM,data:tER85lGPEwqvByG9pvXJ8vGJTbkreDZaRmI=,iv:bUFq8MLCBUYzr2fM4xLODnhcVTFHaXPau/LB65tmkzA=,tag:NXCEUy086V8PXfiUSzaLQA==,type:str]
scope: openid email profile
replicaCount: 2
securityContext:
enabled: true
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app: oauth2-proxy
topologyKey: kubernetes.io/hostname
ingress:
enabled: true
path: /oauth2
pathType: Prefix
hosts:
- ENC[AES256_GCM,data:VhU9/0sbRKqZXpGthx853xcs3dp1ARGoZsY=,iv:HOl7P+fRc9RBIBz6ePN2SDACw0sp6ohYibJBTTKs45A=,tag:7Z69NLpCoejkgHw6z0HFbQ==,type:str]
tls:
- hosts:
- ENC[AES256_GCM,data:kk4S9M6wN7TVyOz7Uw3kvcHi83O7M4vzew4=,iv:VrJrdBqbF+H19W5G/NRAA07QCdjhiHB3tU5vSbFjFZs=,tag:NOKBd+yoliO5uwdqX2UdQQ==,type:str]
secretName: ingress-longhorn-tls
resources:
limits:
cpu: 200m
memory: 100Mi
requests:
cpu: 100m
memory: 25Mi
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2023-09-09T23:03:59Z"
mac: ENC[AES256_GCM,data:eMaMKg/uAx3EyGMaXb5h67f+BYqzTn/G6Dk/cpwQxnzU/lTFNU+3sO8hs2YmoZa6J6eUR9zTUn2JFOxc4tA5u+Tymf0G1CLB+L6FGunbUu2cnwKocHe7rDBI08Ej1QhonkTvETUR45ljNhAaxP6JHyv32bRabGoj6uj7DVIhA9E=,iv:oha2BVKDPrug9B00mzoSLB+Jfq4TPomXbrnl43L10gA=,tag:9+bk+puCmmFgVusjqAoukQ==,type:str]
pgp:
- created_at: "2022-01-22T04:06:16Z"
enc: |-
-----BEGIN PGP MESSAGE-----
wcFMA7kpg2bgzVHcARAAgt+09YMPbbkGkg+/VgMgvxC4YDoQxlcklv3OfrS29yHF
27d8LBexyRYUTqkKhxyFJl+1dOqoE+o2uZjg9J/WSNR4MIBMm4Whn9rly4hoyk1W
BSKqZxt/POdP7ZtZ1Ke3hrZiV4UlDDAagToxrSWG4suXr45i0wUGICbNakrlEB9P
7Ub7nM6aIWjyRJpqPhtJaaq1EWsj/+2NagXOMi0cWjj4wzEy+KZMC3lMVM3db/zw
KDxsZWfK2/gRc7qqQWrmKB5bqQPhKVwUExrzKofExaSozXq9c694mmThVyR2SFc9
OvNLlqLpeRfBpoY9F19Wz0YhQRUxfPdYgV0ZqngxIYzx2+2DqCz1fkW/hIcMLyj9
LBNUTHXcRP9O3ZWWx0flnjcE8Cyz4qmMq9hf0iEWtZb1cO0v5Z6+lYo9ThQvcPCp
DMuZ2l65Sfto56y84j8FPshOS6Heo97mwbO/BmOZYnQ4RtGFc9KlFtLBMyRZfqEo
b6O77YyzCcKYOdgrXjEORxvUq2ftHxTQFBdYUHO2Rpf0tyrZwUYnIWBXnB5fOp/y
HjWzl8ZpQxhJQubiqteEovYdtv+1ionPBLZkzzx3EDbNvSroQijENSkQhyl7QbMj
XURIII47j0yda/kZ4mupPz4isY4kEi/AtwCI+tumI0c7gH7iew/kjoQcgyTVMOLS
5gFZuhZ6ixAXhDms0RKfYq6iKAzXxslg0qcYAOcjwqq5u+cQJTfSrLjivxNs2cIo
M/5BCddS+GzLSTCNYStLfOfkFGlrOccM7I8Fzy3PYhtc9eLwlSI/AA==
=c/3x
-----END PGP MESSAGE-----
fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601
- created_at: "2022-01-22T04:06:16Z"
enc: |
-----BEGIN PGP MESSAGE-----
hQIMA4oYbIHZIrAPARAAyGLyK65vBqTfe/5iFAuaaWg9sWRTAfnGnDEgxAPdp4EQ
yKOT9AyRLes5yRtSz8ugRVjvQd/B9bj+VE7MosFarpjw5ckzRKjSHpanzPqGGWjI
2Ce9gbSljx7AhmXujK+TRhf4PbliopQWdStNWZ08p17UG2G0UiNPgun0ocHxUqVN
46iUl51aL5ElZUmA3bfcwpYu6lCiDCEvlrX+7ZSsKEYcg1VQ+oi0XTxfEugSFX1N
4QjkSHfFYWCqt5IOB2+G5HCZfwD3n3a9tTjpehnTfC61Dn3r4tAVunD3dDaVvqNK
GOJJvvykUOGrszIInJbXd3Bvp/HGm5jp5eLiMo1GQeG7XxIuiIDV41AkAEEv5nYW
fpkeW/a+2NI/TzM3PsOOxEmghuG4k5lnpYwrEcp/s3OmYwDRLvSQRD9rIjw33VnU
WhgfsjwqlqLbyUTwssn8ztEUvoVXQ/lmsFJ2xrzBuWV4tSOUMX+jpA1bhJ1QCcOd
vR/fMH2ZMppho7bnUUVjFGtRZWLAh4OPdCZ4fTkWpUbrFE9HBP1rcPxe7DqzDlbl
tb5yfNLvHGWh/Myqm7CP04qIlWGyDT4UonAWFmPLt6mWXf6DrlOl8n+iAZbX7d+c
w8y/mAapNcTZZHG/+M5hq0anS9mZ65yR3X2znn8ErNot8alJBcOdulM2aDrwk9HU
aAEJAhDKMKsgECqiT3WYb8AVOHFk0O/CCKDFBTt+S+Bbjeb2vqBE8uRNMECpZPU9
NSZGFfj97fyI1At7TgVko8Ae/2w0xdb80g/81/kVuTNTm/0z60RqOooENSxfGRJ9
PNNoVr/LwxMQ
=e2fo
-----END PGP MESSAGE-----
fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07
encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$
version: 3.7.3
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-ingress-to-oauth2
namespace: longhorn-system
spec:
podSelector:
matchLabels:
app: oauth2-proxy
ingress:
- from:
- namespaceSelector:
matchLabels:
ingress.shivering-isles.com/network-access-required: "true"
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: []
lastmodified: "2023-09-09T23:03:59Z"
mac: ENC[AES256_GCM,data:eMaMKg/uAx3EyGMaXb5h67f+BYqzTn/G6Dk/cpwQxnzU/lTFNU+3sO8hs2YmoZa6J6eUR9zTUn2JFOxc4tA5u+Tymf0G1CLB+L6FGunbUu2cnwKocHe7rDBI08Ej1QhonkTvETUR45ljNhAaxP6JHyv32bRabGoj6uj7DVIhA9E=,iv:oha2BVKDPrug9B00mzoSLB+Jfq4TPomXbrnl43L10gA=,tag:9+bk+puCmmFgVusjqAoukQ==,type:str]
pgp: pgp:
- created_at: "2022-01-22T04:06:16Z" - created_at: "2022-01-22T04:06:16Z"
enc: |- enc: |-
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment