From 3013dee38a39f3cbd7a070f7d272372a08403535 Mon Sep 17 00:00:00 2001 From: Sheogorath <sheogorath@shivering-isles.com> Date: Sat, 16 Sep 2023 01:29:47 +0200 Subject: [PATCH] feat(oauth2-proxy): First experiment with abstracting to shared module --- apps/k8s01/forecastle/kustomization.yaml | 1 + apps/k8s01/forecastle/oauth2.yaml | 196 +------------ shared/applications/oauth2-proxy.yaml | 348 +++++++++++++++++++++++ 3 files changed, 356 insertions(+), 189 deletions(-) create mode 100644 shared/applications/oauth2-proxy.yaml diff --git a/apps/k8s01/forecastle/kustomization.yaml b/apps/k8s01/forecastle/kustomization.yaml index b170f1a9a..e22854b47 100644 --- a/apps/k8s01/forecastle/kustomization.yaml +++ b/apps/k8s01/forecastle/kustomization.yaml @@ -5,6 +5,7 @@ resources: - ../../base/forecastle - certificate.yaml - forecastle-values.yaml + - ../../../shared/applications/oauth2-proxy.yaml - oauth2.yaml - pdb.yaml - slo.yaml diff --git a/apps/k8s01/forecastle/oauth2.yaml b/apps/k8s01/forecastle/oauth2.yaml index 579e0e09b..c7abd69df 100644 --- a/apps/k8s01/forecastle/oauth2.yaml +++ b/apps/k8s01/forecastle/oauth2.yaml @@ -1,199 +1,17 @@ -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository +apiVersion: v1 +kind: Secret metadata: - name: oauth2-proxy - namespace: forecastle -spec: - interval: 30m - url: https://oauth2-proxy.github.io/manifests + name: oauth2-proxy-override-values +stringData: + values-overrides.yaml: ENC[AES256_GCM,data:lySxEejdRiHPIEjNj2DS1pJtyC5zMVyiC8xCwYjixfsO5Bp4hYhjKn4RuFKqT3nCSwGvz9e99L4TMQi8vbi92FDVahglwXYME2t4t2j2OKOdX2pYtlWb7ijMRmHqeI7efwJ8ObFTWUDL6ILFp5hJi6j67CnbGooVDyqUYJTdVKjugnZ49JwEdH6InjUGwckvu6T4JXaKebdt0yK73aQ0xDe1yk8t9PWCwObBuYM+xze4mXKSSUQzfQJs5Q2B/D6LaJxlkLFxXbpGCdKJO2EBjxN8cAzjsFDX+CzCS9d1JkUNoekSoF6MhM7bH1VjCbRhcNC5kLC+G1TRhyauS3qb5ceoOjWtuJGbJgM68uDjydpWYXpRZ1sVbyh5RiLgTyqXZmXhdu6B8NcdvdiZx7efndcF37T/QfWd3sXtSYTJiEMDIzIBRL2MtHdDfrS6wWCR1cxvCswskATzVWRN4nkhfv9pzFU3HoJUshdF11OQvzYd650RYUkKjv4jkQULhLxrXzEl8riwcX46+m7FOnS0f1zvPbyKAGB8gsAaz9u9Q0Xx5wDkuaK2a1Jy6g45PBFBFwwHZWpZRaywUAlNYo4anUs+uv4U8nASod9FjbM=,iv:qE0clIeQjvlI/4sW9cLXcf/zItaxJaMy/Qfh2GJGDwk=,tag:c/IUpPaMsVWnfBCyu3ay0w==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] age: [] - lastmodified: "2023-09-11T07:40:32Z" - mac: ENC[AES256_GCM,data:oytgFyb3mPvn0+lbs4ZP53SgMJlPpc5Afscn5emlpF5P4SPl44skDxyn6df2BaR2bRcaY+Q8+BlLOk27er4eZLUQ6JVZxeLJOeGdIobAqQkvi+8loW61D/GeCSV86zA1+M4aQCgXPUVnLnn5Az+5jH25etiRe24mWJT1jb45fj8=,iv:qEb7RirCKxXNmZFei3B1hRMnP4hetEOaC0K+nw9Guv0=,tag:Fx7XnzYSwoMHeQX+1VptPQ==,type:str] - pgp: - - created_at: "2022-01-22T04:06:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - wcFMA7kpg2bgzVHcARAAgt+09YMPbbkGkg+/VgMgvxC4YDoQxlcklv3OfrS29yHF - 27d8LBexyRYUTqkKhxyFJl+1dOqoE+o2uZjg9J/WSNR4MIBMm4Whn9rly4hoyk1W - BSKqZxt/POdP7ZtZ1Ke3hrZiV4UlDDAagToxrSWG4suXr45i0wUGICbNakrlEB9P - 7Ub7nM6aIWjyRJpqPhtJaaq1EWsj/+2NagXOMi0cWjj4wzEy+KZMC3lMVM3db/zw - KDxsZWfK2/gRc7qqQWrmKB5bqQPhKVwUExrzKofExaSozXq9c694mmThVyR2SFc9 - OvNLlqLpeRfBpoY9F19Wz0YhQRUxfPdYgV0ZqngxIYzx2+2DqCz1fkW/hIcMLyj9 - LBNUTHXcRP9O3ZWWx0flnjcE8Cyz4qmMq9hf0iEWtZb1cO0v5Z6+lYo9ThQvcPCp - DMuZ2l65Sfto56y84j8FPshOS6Heo97mwbO/BmOZYnQ4RtGFc9KlFtLBMyRZfqEo - b6O77YyzCcKYOdgrXjEORxvUq2ftHxTQFBdYUHO2Rpf0tyrZwUYnIWBXnB5fOp/y - HjWzl8ZpQxhJQubiqteEovYdtv+1ionPBLZkzzx3EDbNvSroQijENSkQhyl7QbMj - XURIII47j0yda/kZ4mupPz4isY4kEi/AtwCI+tumI0c7gH7iew/kjoQcgyTVMOLS - 5gFZuhZ6ixAXhDms0RKfYq6iKAzXxslg0qcYAOcjwqq5u+cQJTfSrLjivxNs2cIo - M/5BCddS+GzLSTCNYStLfOfkFGlrOccM7I8Fzy3PYhtc9eLwlSI/AA== - =c/3x - -----END PGP MESSAGE----- - fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 - - created_at: "2022-01-22T04:06:16Z" - enc: | - -----BEGIN PGP MESSAGE----- - - hQIMA4oYbIHZIrAPARAAyGLyK65vBqTfe/5iFAuaaWg9sWRTAfnGnDEgxAPdp4EQ - yKOT9AyRLes5yRtSz8ugRVjvQd/B9bj+VE7MosFarpjw5ckzRKjSHpanzPqGGWjI - 2Ce9gbSljx7AhmXujK+TRhf4PbliopQWdStNWZ08p17UG2G0UiNPgun0ocHxUqVN - 46iUl51aL5ElZUmA3bfcwpYu6lCiDCEvlrX+7ZSsKEYcg1VQ+oi0XTxfEugSFX1N - 4QjkSHfFYWCqt5IOB2+G5HCZfwD3n3a9tTjpehnTfC61Dn3r4tAVunD3dDaVvqNK - GOJJvvykUOGrszIInJbXd3Bvp/HGm5jp5eLiMo1GQeG7XxIuiIDV41AkAEEv5nYW - fpkeW/a+2NI/TzM3PsOOxEmghuG4k5lnpYwrEcp/s3OmYwDRLvSQRD9rIjw33VnU - WhgfsjwqlqLbyUTwssn8ztEUvoVXQ/lmsFJ2xrzBuWV4tSOUMX+jpA1bhJ1QCcOd - vR/fMH2ZMppho7bnUUVjFGtRZWLAh4OPdCZ4fTkWpUbrFE9HBP1rcPxe7DqzDlbl - tb5yfNLvHGWh/Myqm7CP04qIlWGyDT4UonAWFmPLt6mWXf6DrlOl8n+iAZbX7d+c - w8y/mAapNcTZZHG/+M5hq0anS9mZ65yR3X2znn8ErNot8alJBcOdulM2aDrwk9HU - aAEJAhDKMKsgECqiT3WYb8AVOHFk0O/CCKDFBTt+S+Bbjeb2vqBE8uRNMECpZPU9 - NSZGFfj97fyI1At7TgVko8Ae/2w0xdb80g/81/kVuTNTm/0z60RqOooENSxfGRJ9 - PNNoVr/LwxMQ - =e2fo - -----END PGP MESSAGE----- - fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 - encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$ - version: 3.7.3 ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: oauth2-proxy - namespace: forecastle -spec: - serviceAccountName: flux-reconciler - releaseName: oauth2-proxy - chart: - spec: - chart: oauth2-proxy - sourceRef: - kind: HelmRepository - name: oauth2-proxy - namespace: forecastle - version: 6.17.0 - interval: 5m - install: - remediation: - retries: 5 - values: - config: - clientID: apps-k8s01 - clientSecret: ENC[AES256_GCM,data:9C1MAc0KEsZmo4+uWY3ktVUGh5tayObvBRtsqJ00luk=,iv:GjQKxVsjMSVLWjUwnUteqInkECn/R3U9+evzJcpGcxY=,tag:EK9hkesXxMuaolQG3jdPjQ==,type:str] - cookieSecret: ENC[AES256_GCM,data:s9i5XebZ373eCpa075bZ/xb9Egq0v7A2BSKAgTF6YHs/bG2f3tT6IGGmJa4=,iv:1STc1smpQoHEjLBYQGaFueDn/o+FXCQ8pnTsxbEAZMc=,tag:PvDOn3IGWhEQfaQadVWsxg==,type:str] - extraArgs: - provider: keycloak-oidc - provider-display-name: SI-Auth - oidc-issuer-url: ENC[AES256_GCM,data:CUky0W47wOOJmY7EpNrb486hs5l5DjxkaOrzT1OOOWIYcW9bdw9Xgg7FcABOxwcMO4Vn/okDZQ==,iv:lpiXwA9KSjT9nSFeXaBiijJWkAm5FKfCtmU3XvnMPDU=,tag:cN17VOD6bUz1MQHbOQ5Hwg==,type:str] - allowed-role: apps-k8s01:user - whitelist-domain: ENC[AES256_GCM,data:ZttZ3akgaGWlRzKGK1HB4yo7GTIAoS+l,iv:mO4DOpJWfYOpuiaD5I+bV68AGw54l4C/vzqbhadaGxs=,tag:iik7NCC3Q9vppLkIqRTALQ==,type:str] - silence-ping-logging: "true" - scope: openid email profile - replicaCount: 2 - securityContext: - enabled: true - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchLabels: - app: oauth2-proxy - topologyKey: kubernetes.io/hostname - ingress: - enabled: true - path: /oauth2 - pathType: Prefix - hosts: - - ENC[AES256_GCM,data:FMv0ovoCb5UVkPcjLy51vD/nO+mQ73N1,iv:P7eHhbC5aS97Q+22g2JCckC4iFfmdHfG72Upre/UJj0=,tag:6FJ+3GszEiTUpsw1HbPHdg==,type:str] - tls: - - hosts: - - ENC[AES256_GCM,data:7a3KPopTgX3Fp+srgY+4PfqLLJUsa4O1,iv:OOUHpcx5TGfIFQOl6+jrHegg/8kKb63DL+y9BPy/PFw=,tag:dojoWv1QwFfmWD+Xqscfhg==,type:str] - secretName: ingress-forecastle-tls - resources: - limits: - cpu: 200m - memory: 100Mi - requests: - cpu: 100m - memory: 25Mi -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: [] - lastmodified: "2023-09-11T07:40:32Z" - mac: ENC[AES256_GCM,data:oytgFyb3mPvn0+lbs4ZP53SgMJlPpc5Afscn5emlpF5P4SPl44skDxyn6df2BaR2bRcaY+Q8+BlLOk27er4eZLUQ6JVZxeLJOeGdIobAqQkvi+8loW61D/GeCSV86zA1+M4aQCgXPUVnLnn5Az+5jH25etiRe24mWJT1jb45fj8=,iv:qEb7RirCKxXNmZFei3B1hRMnP4hetEOaC0K+nw9Guv0=,tag:Fx7XnzYSwoMHeQX+1VptPQ==,type:str] - pgp: - - created_at: "2022-01-22T04:06:16Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - wcFMA7kpg2bgzVHcARAAgt+09YMPbbkGkg+/VgMgvxC4YDoQxlcklv3OfrS29yHF - 27d8LBexyRYUTqkKhxyFJl+1dOqoE+o2uZjg9J/WSNR4MIBMm4Whn9rly4hoyk1W - BSKqZxt/POdP7ZtZ1Ke3hrZiV4UlDDAagToxrSWG4suXr45i0wUGICbNakrlEB9P - 7Ub7nM6aIWjyRJpqPhtJaaq1EWsj/+2NagXOMi0cWjj4wzEy+KZMC3lMVM3db/zw - KDxsZWfK2/gRc7qqQWrmKB5bqQPhKVwUExrzKofExaSozXq9c694mmThVyR2SFc9 - OvNLlqLpeRfBpoY9F19Wz0YhQRUxfPdYgV0ZqngxIYzx2+2DqCz1fkW/hIcMLyj9 - LBNUTHXcRP9O3ZWWx0flnjcE8Cyz4qmMq9hf0iEWtZb1cO0v5Z6+lYo9ThQvcPCp - DMuZ2l65Sfto56y84j8FPshOS6Heo97mwbO/BmOZYnQ4RtGFc9KlFtLBMyRZfqEo - b6O77YyzCcKYOdgrXjEORxvUq2ftHxTQFBdYUHO2Rpf0tyrZwUYnIWBXnB5fOp/y - HjWzl8ZpQxhJQubiqteEovYdtv+1ionPBLZkzzx3EDbNvSroQijENSkQhyl7QbMj - XURIII47j0yda/kZ4mupPz4isY4kEi/AtwCI+tumI0c7gH7iew/kjoQcgyTVMOLS - 5gFZuhZ6ixAXhDms0RKfYq6iKAzXxslg0qcYAOcjwqq5u+cQJTfSrLjivxNs2cIo - M/5BCddS+GzLSTCNYStLfOfkFGlrOccM7I8Fzy3PYhtc9eLwlSI/AA== - =c/3x - -----END PGP MESSAGE----- - fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 - - created_at: "2022-01-22T04:06:16Z" - enc: | - -----BEGIN PGP MESSAGE----- - - hQIMA4oYbIHZIrAPARAAyGLyK65vBqTfe/5iFAuaaWg9sWRTAfnGnDEgxAPdp4EQ - yKOT9AyRLes5yRtSz8ugRVjvQd/B9bj+VE7MosFarpjw5ckzRKjSHpanzPqGGWjI - 2Ce9gbSljx7AhmXujK+TRhf4PbliopQWdStNWZ08p17UG2G0UiNPgun0ocHxUqVN - 46iUl51aL5ElZUmA3bfcwpYu6lCiDCEvlrX+7ZSsKEYcg1VQ+oi0XTxfEugSFX1N - 4QjkSHfFYWCqt5IOB2+G5HCZfwD3n3a9tTjpehnTfC61Dn3r4tAVunD3dDaVvqNK - GOJJvvykUOGrszIInJbXd3Bvp/HGm5jp5eLiMo1GQeG7XxIuiIDV41AkAEEv5nYW - fpkeW/a+2NI/TzM3PsOOxEmghuG4k5lnpYwrEcp/s3OmYwDRLvSQRD9rIjw33VnU - WhgfsjwqlqLbyUTwssn8ztEUvoVXQ/lmsFJ2xrzBuWV4tSOUMX+jpA1bhJ1QCcOd - vR/fMH2ZMppho7bnUUVjFGtRZWLAh4OPdCZ4fTkWpUbrFE9HBP1rcPxe7DqzDlbl - tb5yfNLvHGWh/Myqm7CP04qIlWGyDT4UonAWFmPLt6mWXf6DrlOl8n+iAZbX7d+c - w8y/mAapNcTZZHG/+M5hq0anS9mZ65yR3X2znn8ErNot8alJBcOdulM2aDrwk9HU - aAEJAhDKMKsgECqiT3WYb8AVOHFk0O/CCKDFBTt+S+Bbjeb2vqBE8uRNMECpZPU9 - NSZGFfj97fyI1At7TgVko8Ae/2w0xdb80g/81/kVuTNTm/0z60RqOooENSxfGRJ9 - PNNoVr/LwxMQ - =e2fo - -----END PGP MESSAGE----- - fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 - encrypted_regex: ^(data|stringData|email|dnsZones?|dnsNames?|hosts?|tang|externalURL|.*-secret|.*-url|.*Secret|.*-domain)$ - version: 3.7.3 ---- -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: allow-ingress-to-oauth2 - namespace: monitoring-system -spec: - podSelector: - matchLabels: - app: oauth2-proxy - ingress: - - from: - - namespaceSelector: - matchLabels: - ingress.shivering-isles.com/network-access-required: "true" -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: [] - lastmodified: "2023-09-11T07:40:32Z" - mac: ENC[AES256_GCM,data:oytgFyb3mPvn0+lbs4ZP53SgMJlPpc5Afscn5emlpF5P4SPl44skDxyn6df2BaR2bRcaY+Q8+BlLOk27er4eZLUQ6JVZxeLJOeGdIobAqQkvi+8loW61D/GeCSV86zA1+M4aQCgXPUVnLnn5Az+5jH25etiRe24mWJT1jb45fj8=,iv:qEb7RirCKxXNmZFei3B1hRMnP4hetEOaC0K+nw9Guv0=,tag:Fx7XnzYSwoMHeQX+1VptPQ==,type:str] + lastmodified: "2023-09-15T23:21:41Z" + mac: ENC[AES256_GCM,data:5g9AKl2x1GZzgP4sfYlgdyUOdUWE8+Q0fKqJnsq4AfQRd6uyj5ltJ9ONNkwBkVI9pPV+KbNjMefVmbguvdnInEyF6Z2mJInC0jlVgFXtDi9NWkmvKgLavXcKz/HTKtGVu6LSveVYGwhYSNsUzBHIhcL8Q3ud/7IRshMw6PT01Hc=,iv:PkAmfM1YtP5fIa9uwnys0wULsBpfvID3sxEsT5e7ApE=,tag:7zjd8xtNsK/WRi5awB0SSQ==,type:str] pgp: - created_at: "2022-01-22T04:06:16Z" enc: |- diff --git a/shared/applications/oauth2-proxy.yaml b/shared/applications/oauth2-proxy.yaml new file mode 100644 index 000000000..a38f2736a --- /dev/null +++ b/shared/applications/oauth2-proxy.yaml @@ -0,0 +1,348 @@ +apiVersion: source.toolkit.fluxcd.io/v1beta1 +kind: HelmRepository +metadata: + name: oauth2-proxy +spec: + interval: 30m + url: https://oauth2-proxy.github.io/manifests +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2023-09-15T23:29:01Z" + mac: ENC[AES256_GCM,data:BZWJOzZhbJ7hXWucybSHvooDPCqO112sz1UBpa/EW1u3/y4UUMbOWpg7EAbfQ9gidOJXFcWrlrK5wskZiVBonirU1yztYK5UIb03rn7aOBxCabBzYUIS8V4G/zN+T+ktvETMtqk9bUV/ydEWaHaiBBg6UzT5JHLZ2Du8COb6FMQ=,iv:JBGeeXaBKMc7dDNhekYuuSbDgDW/Opxi4AdGA8I1Iig=,tag:Hko4Qo1ENNAlP9fPwNEHuA==,type:str] + pgp: + - created_at: "2023-09-15T23:29:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7kpg2bgzVHcARAAgGVeYuM9thxx2dmUKDdhaIW4Tf2HOTxMPdDEEewnDnBe + 2CiZagHIALoXoRK6BbJGx3SBgerUTq+gWcPl4IY55k/G0mZND0MmsZSEr5eOBUJP + 6wyFt0CknqmvGzUNlkMQZaitZj0U0SCWe6USyqxbnuY+Dg5mq1YdaGFgxf4FgMsi + y5XmDCz2BVVfN0rrtby6mvSPKRHWT3La6WAT53BYrGDWYZEY/8JaCcNQtaCRdwuJ + LdfbK3Sm9qf2u23Xc3N2RJBl69DosMxj68VuaDyBOxSpIOJ+C6jPjp6mq9VrkZhL + czp+dGYOeRZ/Db+FECqzL57u7MQoDYD3kp5SqaMSLyuWKQ2u+NaMh6uL4tXHD9Db + HYOuMqg/+xGlHmwnRa05PYw1GxL6Yg4s1dJ6kztpLBM1rZ7zCTiaJfcVCrX/NnIe + aOHy5kEqPyWuzUluWLlqqcUo0lxl30v24wCgalO//LxXlMseDgTTKAIR6YCacajq + tQv61cdkSl0pAnd9QQxdMmWN+ilTKufQusx691sYqlg9cT08QcvIBVjN5VrkC4Ne + IemVkzS1Y7YPDT3sCkBd0a3ukKtvAtKvJgv89Vyd7/TkBw4yddd1Qlv2cVqzkMly + LByyDrekEwezt+ZDnMAqx+sGjKU7DPZzGrtYvNFcBbp27Pu1+0gZ8gzeF+7Np6LS + UQF22MsSv2aUL/TWrrVqPVq3ZTN6YVVem5eGc3DdS2drVy1n6nmQzhuzRAn0zwbY + 0r/AarORhtWgGKGGlj4LqoYG7370VlntYSBJRgbzSN5i0Q== + =8lbc + -----END PGP MESSAGE----- + fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 + - created_at: "2023-09-15T23:29:01Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMA4oYbIHZIrAPARAAgg/34ov1i+F8yhrJpGXXHkcAjcGOoJGkEhAAZud2Vfxn + kKzGsq7eN8Soutw2WPVcKMYsHU66Wwo3tpv8JU5M9Wx3KCN9CFG1aZS9wqkfT98K + XT5U5Iuj6HjWQhxZg9NEghoAElOZNtBPfkme5Ox7ofdIGY+n5ZqCQvsBT3ppNAKa + 29+oUmlJSzN785KU8Jvo5IW3ZEdq2IaMiud54CiPCCXjaic+ZlVyLUEoBEwSuJvh + QfV58zpr0rnsNVQynESTYD6GAgqFm3vAoIjxqUMpn28uHyXTY0laITIkRKlJp9oX + 7OND/Ejaabkaj7KMY1M56LS3Hah7KYQChAZedBVz+HW6LZnyctNkoqQQdDle9muI + WIZeqMCjQPT3i+ICIvLF836qRoY1HhBhcaPVzM/0SxWBSDtQWAE92DrubTedL04a + U995m2L4nfP83K4XpQ2NQw0QYzdBQkQBLFc2UA37wlpT753jHLOuNGttGhn0JTfq + OEM+g8IvkzIrpnCqeYPcN2KYkulU041yXdZMtf1b79cwSfY/McbS590TJRoRlZM7 + 6xNzRHJiAsImQVQgpLJ7kpwc/ZuJLli0HI3qoFHexEUXl8gQxeoUl/pm7r0kLSRq + qVP4dcp2bl968QFR7ysGm0WgiBFIxqefY1QW4aKTeh321nsVKahuIlOPtId6gzbU + aAEJAhBYjD03zuePGzct0+RrAn3dbtQrNwLhC72avGv6tViq0UVUwVj6jKmrmU9K + HqyPkyjrxXUkDcAUM4SPHjNUYjOKlXgzo0c68ESzcH3ow3Ed80G67QzAFgEKEGhB + rwA9xuFUSTeH + =yh5v + -----END PGP MESSAGE----- + fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 + encrypted_regex: ^(stringData)$ + version: 3.7.3 +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: oauth2-proxy +spec: + serviceAccountName: flux-reconciler + releaseName: oauth2-proxy + chart: + spec: + chart: oauth2-proxy + sourceRef: + kind: HelmRepository + name: oauth2-proxy + # renovate: datasource=helm depName=oauth2-proxy registryUrl=https://oauth2-proxy.github.io/manifests + version: 6.17.0 + interval: 5m + install: + remediation: + retries: 5 + upgrade: + remediation: + retries: 5 + valuesFrom: + - kind: ConfigMap + name: oauth2-proxy-base-values + valuesKey: values.yaml + - kind: Secret + name: oauth2-proxy-common-values + valuesKey: values.yaml + - kind: Secret + name: oauth2-proxy-override-values + valuesKey: values-overrides.yaml +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2023-09-15T23:29:01Z" + mac: ENC[AES256_GCM,data:BZWJOzZhbJ7hXWucybSHvooDPCqO112sz1UBpa/EW1u3/y4UUMbOWpg7EAbfQ9gidOJXFcWrlrK5wskZiVBonirU1yztYK5UIb03rn7aOBxCabBzYUIS8V4G/zN+T+ktvETMtqk9bUV/ydEWaHaiBBg6UzT5JHLZ2Du8COb6FMQ=,iv:JBGeeXaBKMc7dDNhekYuuSbDgDW/Opxi4AdGA8I1Iig=,tag:Hko4Qo1ENNAlP9fPwNEHuA==,type:str] + pgp: + - created_at: "2023-09-15T23:29:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7kpg2bgzVHcARAAgGVeYuM9thxx2dmUKDdhaIW4Tf2HOTxMPdDEEewnDnBe + 2CiZagHIALoXoRK6BbJGx3SBgerUTq+gWcPl4IY55k/G0mZND0MmsZSEr5eOBUJP + 6wyFt0CknqmvGzUNlkMQZaitZj0U0SCWe6USyqxbnuY+Dg5mq1YdaGFgxf4FgMsi + y5XmDCz2BVVfN0rrtby6mvSPKRHWT3La6WAT53BYrGDWYZEY/8JaCcNQtaCRdwuJ + LdfbK3Sm9qf2u23Xc3N2RJBl69DosMxj68VuaDyBOxSpIOJ+C6jPjp6mq9VrkZhL + czp+dGYOeRZ/Db+FECqzL57u7MQoDYD3kp5SqaMSLyuWKQ2u+NaMh6uL4tXHD9Db + HYOuMqg/+xGlHmwnRa05PYw1GxL6Yg4s1dJ6kztpLBM1rZ7zCTiaJfcVCrX/NnIe + aOHy5kEqPyWuzUluWLlqqcUo0lxl30v24wCgalO//LxXlMseDgTTKAIR6YCacajq + tQv61cdkSl0pAnd9QQxdMmWN+ilTKufQusx691sYqlg9cT08QcvIBVjN5VrkC4Ne + IemVkzS1Y7YPDT3sCkBd0a3ukKtvAtKvJgv89Vyd7/TkBw4yddd1Qlv2cVqzkMly + LByyDrekEwezt+ZDnMAqx+sGjKU7DPZzGrtYvNFcBbp27Pu1+0gZ8gzeF+7Np6LS + UQF22MsSv2aUL/TWrrVqPVq3ZTN6YVVem5eGc3DdS2drVy1n6nmQzhuzRAn0zwbY + 0r/AarORhtWgGKGGlj4LqoYG7370VlntYSBJRgbzSN5i0Q== + =8lbc + -----END PGP MESSAGE----- + fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 + - created_at: "2023-09-15T23:29:01Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMA4oYbIHZIrAPARAAgg/34ov1i+F8yhrJpGXXHkcAjcGOoJGkEhAAZud2Vfxn + kKzGsq7eN8Soutw2WPVcKMYsHU66Wwo3tpv8JU5M9Wx3KCN9CFG1aZS9wqkfT98K + XT5U5Iuj6HjWQhxZg9NEghoAElOZNtBPfkme5Ox7ofdIGY+n5ZqCQvsBT3ppNAKa + 29+oUmlJSzN785KU8Jvo5IW3ZEdq2IaMiud54CiPCCXjaic+ZlVyLUEoBEwSuJvh + QfV58zpr0rnsNVQynESTYD6GAgqFm3vAoIjxqUMpn28uHyXTY0laITIkRKlJp9oX + 7OND/Ejaabkaj7KMY1M56LS3Hah7KYQChAZedBVz+HW6LZnyctNkoqQQdDle9muI + WIZeqMCjQPT3i+ICIvLF836qRoY1HhBhcaPVzM/0SxWBSDtQWAE92DrubTedL04a + U995m2L4nfP83K4XpQ2NQw0QYzdBQkQBLFc2UA37wlpT753jHLOuNGttGhn0JTfq + OEM+g8IvkzIrpnCqeYPcN2KYkulU041yXdZMtf1b79cwSfY/McbS590TJRoRlZM7 + 6xNzRHJiAsImQVQgpLJ7kpwc/ZuJLli0HI3qoFHexEUXl8gQxeoUl/pm7r0kLSRq + qVP4dcp2bl968QFR7ysGm0WgiBFIxqefY1QW4aKTeh321nsVKahuIlOPtId6gzbU + aAEJAhBYjD03zuePGzct0+RrAn3dbtQrNwLhC72avGv6tViq0UVUwVj6jKmrmU9K + HqyPkyjrxXUkDcAUM4SPHjNUYjOKlXgzo0c68ESzcH3ow3Ed80G67QzAFgEKEGhB + rwA9xuFUSTeH + =yh5v + -----END PGP MESSAGE----- + fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 + encrypted_regex: ^(stringData)$ + version: 3.7.3 +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: oauth2-proxy-base-values +data: + values.yaml: | + extraArgs: + silence-ping-logging: "true" + scope: openid email profile + replicaCount: 2 + securityContext: + enabled: true + affinity: + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + app: oauth2-proxy + topologyKey: kubernetes.io/hostname + resources: + limits: + cpu: 200m + memory: 100Mi + requests: + cpu: 100m + memory: 25Mi +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2023-09-15T23:29:01Z" + mac: ENC[AES256_GCM,data:BZWJOzZhbJ7hXWucybSHvooDPCqO112sz1UBpa/EW1u3/y4UUMbOWpg7EAbfQ9gidOJXFcWrlrK5wskZiVBonirU1yztYK5UIb03rn7aOBxCabBzYUIS8V4G/zN+T+ktvETMtqk9bUV/ydEWaHaiBBg6UzT5JHLZ2Du8COb6FMQ=,iv:JBGeeXaBKMc7dDNhekYuuSbDgDW/Opxi4AdGA8I1Iig=,tag:Hko4Qo1ENNAlP9fPwNEHuA==,type:str] + pgp: + - created_at: "2023-09-15T23:29:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7kpg2bgzVHcARAAgGVeYuM9thxx2dmUKDdhaIW4Tf2HOTxMPdDEEewnDnBe + 2CiZagHIALoXoRK6BbJGx3SBgerUTq+gWcPl4IY55k/G0mZND0MmsZSEr5eOBUJP + 6wyFt0CknqmvGzUNlkMQZaitZj0U0SCWe6USyqxbnuY+Dg5mq1YdaGFgxf4FgMsi + y5XmDCz2BVVfN0rrtby6mvSPKRHWT3La6WAT53BYrGDWYZEY/8JaCcNQtaCRdwuJ + LdfbK3Sm9qf2u23Xc3N2RJBl69DosMxj68VuaDyBOxSpIOJ+C6jPjp6mq9VrkZhL + czp+dGYOeRZ/Db+FECqzL57u7MQoDYD3kp5SqaMSLyuWKQ2u+NaMh6uL4tXHD9Db + HYOuMqg/+xGlHmwnRa05PYw1GxL6Yg4s1dJ6kztpLBM1rZ7zCTiaJfcVCrX/NnIe + aOHy5kEqPyWuzUluWLlqqcUo0lxl30v24wCgalO//LxXlMseDgTTKAIR6YCacajq + tQv61cdkSl0pAnd9QQxdMmWN+ilTKufQusx691sYqlg9cT08QcvIBVjN5VrkC4Ne + IemVkzS1Y7YPDT3sCkBd0a3ukKtvAtKvJgv89Vyd7/TkBw4yddd1Qlv2cVqzkMly + LByyDrekEwezt+ZDnMAqx+sGjKU7DPZzGrtYvNFcBbp27Pu1+0gZ8gzeF+7Np6LS + UQF22MsSv2aUL/TWrrVqPVq3ZTN6YVVem5eGc3DdS2drVy1n6nmQzhuzRAn0zwbY + 0r/AarORhtWgGKGGlj4LqoYG7370VlntYSBJRgbzSN5i0Q== + =8lbc + -----END PGP MESSAGE----- + fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 + - created_at: "2023-09-15T23:29:01Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMA4oYbIHZIrAPARAAgg/34ov1i+F8yhrJpGXXHkcAjcGOoJGkEhAAZud2Vfxn + kKzGsq7eN8Soutw2WPVcKMYsHU66Wwo3tpv8JU5M9Wx3KCN9CFG1aZS9wqkfT98K + XT5U5Iuj6HjWQhxZg9NEghoAElOZNtBPfkme5Ox7ofdIGY+n5ZqCQvsBT3ppNAKa + 29+oUmlJSzN785KU8Jvo5IW3ZEdq2IaMiud54CiPCCXjaic+ZlVyLUEoBEwSuJvh + QfV58zpr0rnsNVQynESTYD6GAgqFm3vAoIjxqUMpn28uHyXTY0laITIkRKlJp9oX + 7OND/Ejaabkaj7KMY1M56LS3Hah7KYQChAZedBVz+HW6LZnyctNkoqQQdDle9muI + WIZeqMCjQPT3i+ICIvLF836qRoY1HhBhcaPVzM/0SxWBSDtQWAE92DrubTedL04a + U995m2L4nfP83K4XpQ2NQw0QYzdBQkQBLFc2UA37wlpT753jHLOuNGttGhn0JTfq + OEM+g8IvkzIrpnCqeYPcN2KYkulU041yXdZMtf1b79cwSfY/McbS590TJRoRlZM7 + 6xNzRHJiAsImQVQgpLJ7kpwc/ZuJLli0HI3qoFHexEUXl8gQxeoUl/pm7r0kLSRq + qVP4dcp2bl968QFR7ysGm0WgiBFIxqefY1QW4aKTeh321nsVKahuIlOPtId6gzbU + aAEJAhBYjD03zuePGzct0+RrAn3dbtQrNwLhC72avGv6tViq0UVUwVj6jKmrmU9K + HqyPkyjrxXUkDcAUM4SPHjNUYjOKlXgzo0c68ESzcH3ow3Ed80G67QzAFgEKEGhB + rwA9xuFUSTeH + =yh5v + -----END PGP MESSAGE----- + fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 + encrypted_regex: ^(stringData)$ + version: 3.7.3 +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-ingress-to-oauth2 +spec: + podSelector: + matchLabels: + app: oauth2-proxy + ingress: + - from: + - namespaceSelector: + matchLabels: + ingress.shivering-isles.com/network-access-required: "true" +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2023-09-15T23:29:01Z" + mac: ENC[AES256_GCM,data:BZWJOzZhbJ7hXWucybSHvooDPCqO112sz1UBpa/EW1u3/y4UUMbOWpg7EAbfQ9gidOJXFcWrlrK5wskZiVBonirU1yztYK5UIb03rn7aOBxCabBzYUIS8V4G/zN+T+ktvETMtqk9bUV/ydEWaHaiBBg6UzT5JHLZ2Du8COb6FMQ=,iv:JBGeeXaBKMc7dDNhekYuuSbDgDW/Opxi4AdGA8I1Iig=,tag:Hko4Qo1ENNAlP9fPwNEHuA==,type:str] + pgp: + - created_at: "2023-09-15T23:29:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7kpg2bgzVHcARAAgGVeYuM9thxx2dmUKDdhaIW4Tf2HOTxMPdDEEewnDnBe + 2CiZagHIALoXoRK6BbJGx3SBgerUTq+gWcPl4IY55k/G0mZND0MmsZSEr5eOBUJP + 6wyFt0CknqmvGzUNlkMQZaitZj0U0SCWe6USyqxbnuY+Dg5mq1YdaGFgxf4FgMsi + y5XmDCz2BVVfN0rrtby6mvSPKRHWT3La6WAT53BYrGDWYZEY/8JaCcNQtaCRdwuJ + LdfbK3Sm9qf2u23Xc3N2RJBl69DosMxj68VuaDyBOxSpIOJ+C6jPjp6mq9VrkZhL + czp+dGYOeRZ/Db+FECqzL57u7MQoDYD3kp5SqaMSLyuWKQ2u+NaMh6uL4tXHD9Db + HYOuMqg/+xGlHmwnRa05PYw1GxL6Yg4s1dJ6kztpLBM1rZ7zCTiaJfcVCrX/NnIe + aOHy5kEqPyWuzUluWLlqqcUo0lxl30v24wCgalO//LxXlMseDgTTKAIR6YCacajq + tQv61cdkSl0pAnd9QQxdMmWN+ilTKufQusx691sYqlg9cT08QcvIBVjN5VrkC4Ne + IemVkzS1Y7YPDT3sCkBd0a3ukKtvAtKvJgv89Vyd7/TkBw4yddd1Qlv2cVqzkMly + LByyDrekEwezt+ZDnMAqx+sGjKU7DPZzGrtYvNFcBbp27Pu1+0gZ8gzeF+7Np6LS + UQF22MsSv2aUL/TWrrVqPVq3ZTN6YVVem5eGc3DdS2drVy1n6nmQzhuzRAn0zwbY + 0r/AarORhtWgGKGGlj4LqoYG7370VlntYSBJRgbzSN5i0Q== + =8lbc + -----END PGP MESSAGE----- + fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 + - created_at: "2023-09-15T23:29:01Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMA4oYbIHZIrAPARAAgg/34ov1i+F8yhrJpGXXHkcAjcGOoJGkEhAAZud2Vfxn + kKzGsq7eN8Soutw2WPVcKMYsHU66Wwo3tpv8JU5M9Wx3KCN9CFG1aZS9wqkfT98K + XT5U5Iuj6HjWQhxZg9NEghoAElOZNtBPfkme5Ox7ofdIGY+n5ZqCQvsBT3ppNAKa + 29+oUmlJSzN785KU8Jvo5IW3ZEdq2IaMiud54CiPCCXjaic+ZlVyLUEoBEwSuJvh + QfV58zpr0rnsNVQynESTYD6GAgqFm3vAoIjxqUMpn28uHyXTY0laITIkRKlJp9oX + 7OND/Ejaabkaj7KMY1M56LS3Hah7KYQChAZedBVz+HW6LZnyctNkoqQQdDle9muI + WIZeqMCjQPT3i+ICIvLF836qRoY1HhBhcaPVzM/0SxWBSDtQWAE92DrubTedL04a + U995m2L4nfP83K4XpQ2NQw0QYzdBQkQBLFc2UA37wlpT753jHLOuNGttGhn0JTfq + OEM+g8IvkzIrpnCqeYPcN2KYkulU041yXdZMtf1b79cwSfY/McbS590TJRoRlZM7 + 6xNzRHJiAsImQVQgpLJ7kpwc/ZuJLli0HI3qoFHexEUXl8gQxeoUl/pm7r0kLSRq + qVP4dcp2bl968QFR7ysGm0WgiBFIxqefY1QW4aKTeh321nsVKahuIlOPtId6gzbU + aAEJAhBYjD03zuePGzct0+RrAn3dbtQrNwLhC72avGv6tViq0UVUwVj6jKmrmU9K + HqyPkyjrxXUkDcAUM4SPHjNUYjOKlXgzo0c68ESzcH3ow3Ed80G67QzAFgEKEGhB + rwA9xuFUSTeH + =yh5v + -----END PGP MESSAGE----- + fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 + encrypted_regex: ^(stringData)$ + version: 3.7.3 +--- +apiVersion: v1 +kind: Secret +metadata: + name: oauth2-proxy-common-values +stringData: + values.yaml: ENC[AES256_GCM,data:XR3/6yd1/vrS7xu+UlRPQY+OAo/57Yk6JZImYv0JjsEtuzaHkMALOFKAvYoDlkeEfktfJry8e1PDwfR95gYUS83d0b1Az/dV1v1mgVe3c2yieRo1517i1eQnWWDrZpvSMsppYDDDcth7Dg6vn6OaQt+E93xAdZjcK6aGuNBqnIYpJejE6ArB4jT+FDFO8GpNAQ==,iv:eiPFvdj4qLg+s9t0DmUYpW96m5lG7aFDWM2qXoYzNB8=,tag:XuFoJAWmGcU8q+iRlcsThg==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: [] + lastmodified: "2023-09-15T23:29:01Z" + mac: ENC[AES256_GCM,data:BZWJOzZhbJ7hXWucybSHvooDPCqO112sz1UBpa/EW1u3/y4UUMbOWpg7EAbfQ9gidOJXFcWrlrK5wskZiVBonirU1yztYK5UIb03rn7aOBxCabBzYUIS8V4G/zN+T+ktvETMtqk9bUV/ydEWaHaiBBg6UzT5JHLZ2Du8COb6FMQ=,iv:JBGeeXaBKMc7dDNhekYuuSbDgDW/Opxi4AdGA8I1Iig=,tag:Hko4Qo1ENNAlP9fPwNEHuA==,type:str] + pgp: + - created_at: "2023-09-15T23:29:01Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + wcFMA7kpg2bgzVHcARAAgGVeYuM9thxx2dmUKDdhaIW4Tf2HOTxMPdDEEewnDnBe + 2CiZagHIALoXoRK6BbJGx3SBgerUTq+gWcPl4IY55k/G0mZND0MmsZSEr5eOBUJP + 6wyFt0CknqmvGzUNlkMQZaitZj0U0SCWe6USyqxbnuY+Dg5mq1YdaGFgxf4FgMsi + y5XmDCz2BVVfN0rrtby6mvSPKRHWT3La6WAT53BYrGDWYZEY/8JaCcNQtaCRdwuJ + LdfbK3Sm9qf2u23Xc3N2RJBl69DosMxj68VuaDyBOxSpIOJ+C6jPjp6mq9VrkZhL + czp+dGYOeRZ/Db+FECqzL57u7MQoDYD3kp5SqaMSLyuWKQ2u+NaMh6uL4tXHD9Db + HYOuMqg/+xGlHmwnRa05PYw1GxL6Yg4s1dJ6kztpLBM1rZ7zCTiaJfcVCrX/NnIe + aOHy5kEqPyWuzUluWLlqqcUo0lxl30v24wCgalO//LxXlMseDgTTKAIR6YCacajq + tQv61cdkSl0pAnd9QQxdMmWN+ilTKufQusx691sYqlg9cT08QcvIBVjN5VrkC4Ne + IemVkzS1Y7YPDT3sCkBd0a3ukKtvAtKvJgv89Vyd7/TkBw4yddd1Qlv2cVqzkMly + LByyDrekEwezt+ZDnMAqx+sGjKU7DPZzGrtYvNFcBbp27Pu1+0gZ8gzeF+7Np6LS + UQF22MsSv2aUL/TWrrVqPVq3ZTN6YVVem5eGc3DdS2drVy1n6nmQzhuzRAn0zwbY + 0r/AarORhtWgGKGGlj4LqoYG7370VlntYSBJRgbzSN5i0Q== + =8lbc + -----END PGP MESSAGE----- + fp: 286791FB6648539775DB31B8FCB98C2A3EC6F601 + - created_at: "2023-09-15T23:29:01Z" + enc: | + -----BEGIN PGP MESSAGE----- + + hQIMA4oYbIHZIrAPARAAgg/34ov1i+F8yhrJpGXXHkcAjcGOoJGkEhAAZud2Vfxn + kKzGsq7eN8Soutw2WPVcKMYsHU66Wwo3tpv8JU5M9Wx3KCN9CFG1aZS9wqkfT98K + XT5U5Iuj6HjWQhxZg9NEghoAElOZNtBPfkme5Ox7ofdIGY+n5ZqCQvsBT3ppNAKa + 29+oUmlJSzN785KU8Jvo5IW3ZEdq2IaMiud54CiPCCXjaic+ZlVyLUEoBEwSuJvh + QfV58zpr0rnsNVQynESTYD6GAgqFm3vAoIjxqUMpn28uHyXTY0laITIkRKlJp9oX + 7OND/Ejaabkaj7KMY1M56LS3Hah7KYQChAZedBVz+HW6LZnyctNkoqQQdDle9muI + WIZeqMCjQPT3i+ICIvLF836qRoY1HhBhcaPVzM/0SxWBSDtQWAE92DrubTedL04a + U995m2L4nfP83K4XpQ2NQw0QYzdBQkQBLFc2UA37wlpT753jHLOuNGttGhn0JTfq + OEM+g8IvkzIrpnCqeYPcN2KYkulU041yXdZMtf1b79cwSfY/McbS590TJRoRlZM7 + 6xNzRHJiAsImQVQgpLJ7kpwc/ZuJLli0HI3qoFHexEUXl8gQxeoUl/pm7r0kLSRq + qVP4dcp2bl968QFR7ysGm0WgiBFIxqefY1QW4aKTeh321nsVKahuIlOPtId6gzbU + aAEJAhBYjD03zuePGzct0+RrAn3dbtQrNwLhC72avGv6tViq0UVUwVj6jKmrmU9K + HqyPkyjrxXUkDcAUM4SPHjNUYjOKlXgzo0c68ESzcH3ow3Ed80G67QzAFgEKEGhB + rwA9xuFUSTeH + =yh5v + -----END PGP MESSAGE----- + fp: B137EE1549DFAF960DD1E2B15147025FB9F09E07 + encrypted_regex: ^(stringData)$ + version: 3.7.3 -- GitLab