Skip to content

Commit 904b991

Browse files
weltekiwelteki
committed
Initial auth proxy chart
Signed-off-by: Han Verstraete (OpenFaaS Ltd) <[email protected]>
1 parent 5b75fd7 commit 904b991

File tree

9 files changed

+302
-0
lines changed

9 files changed

+302
-0
lines changed

‎chart/auth-proxy/.helmignore

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj
22+
.vscode/

‎chart/auth-proxy/Chart.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
description: OpenFaaS Authentication Proxy
3+
name: auth-proxy
4+
version: 0.0.1
5+
sources:
6+
- https://github.com/openfaas/faas-netes
7+
home: https://www.openfaas.com
8+
icon: https://raw.githubusercontent.com/openfaas/media/master/OpenFaaS_logo_stacked_opaque.png
9+
keywords:
10+
- functions
11+
- serverless
12+
- faas
13+
maintainers:
14+
- name: alexellis
15+
email: [email protected]
16+
- name: welteki
17+
email: [email protected]

‎chart/auth-proxy/templates/_helpers.tpl

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "connector.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "connector.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "connector.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "connector.labels" -}}
38+
helm.sh/chart: {{ include "connector.chart" . }}
39+
app.kubernetes.io/name: {{ include "connector.name" . }}
40+
app.kubernetes.io/instance: {{ .Release.Name }}
41+
app.kubernetes.io/component: auth-proxy
42+
app.kubernetes.io/part-of: openfaas
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- end -}}

‎chart/auth-proxy/templates/deployment.yaml

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
labels:
5+
# Original Helm labels v
6+
app: {{ template "connector.name" . }}
7+
component: auth-proxy
8+
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
9+
heritage: {{ .Release.Service }}
10+
release: {{ .Release.Name }}
11+
{{- include "connector.labels" . | nindent 4 }}
12+
name: {{ template "connector.fullname" . }}
13+
namespace: {{ .Release.Namespace | quote }}
14+
spec:
15+
replicas: 1
16+
selector:
17+
matchLabels:
18+
app: {{ template "connector.name" . }}
19+
name: {{ template "connector.name" . }}
20+
component: auth-proxy
21+
template:
22+
metadata:
23+
labels:
24+
app: {{ template "connector.name" . }}
25+
name: {{ template "connector.name" . }}
26+
component: auth-proxy
27+
spec:
28+
{{- if .Values.accessTokenSecret }}
29+
serviceAccountName: {{ template "connector.fullname" . }}
30+
{{- end }}
31+
volumes:
32+
- name: license
33+
secret:
34+
secretName: openfaas-license
35+
{{- if .Values.accessTokenSecret }}
36+
- name: openfaas-token
37+
projected:
38+
sources:
39+
- serviceAccountToken:
40+
path: openfaas-token
41+
expirationSeconds: 7200
42+
audience: {{ .Values.gatewayURL }}
43+
- name: access-token-secret
44+
secret:
45+
secretName: {{ .Values.accessTokenSecret }}
46+
{{- end }}
47+
{{- if .Values.iam.loginIssuer.clientSecret }}
48+
- name: oauth-client-secret
49+
secret:
50+
secretName: {{ .Values.iam.loginIssuer.clientSecret }}
51+
{{- end }}
52+
containers:
53+
- name: auth-proxy
54+
image: {{ .Values.image }}
55+
command:
56+
- "/usr/bin/proxy"
57+
- "-license-file=/var/secrets/license/license"
58+
env:
59+
- name: "public_url"
60+
value: {{ .Values.url | quote }}
61+
- name: gateway_url
62+
value: {{ .Values.gatewayURL | quote }}
63+
- name: "debug"
64+
value: "{{ .Values.logs.debug }}"
65+
- name: "log_encoding"
66+
value: "{{ .Values.logs.format }}"
67+
{{- if .Values.iam.systemIssuer.url }}
68+
- name: system_issuer
69+
value: {{ .Values.iam.systemIssuer.url }}
70+
{{- end }}
71+
{{- if .Values.iam.loginIssuer.url }}
72+
- name: login_issuer
73+
value: {{ .Values.iam.loginIssuer.url }}
74+
- name: login_issuer_client_id
75+
value: {{ .Values.iam.loginIssuer.clientId }}
76+
{{- end }}
77+
resources:
78+
{{- .Values.resources | toYaml | nindent 12 }}
79+
volumeMounts:
80+
- name: license
81+
readOnly: true
82+
mountPath: "/var/secrets/license"
83+
{{- if .Values.accessTokenSecret }}
84+
- name: openfaas-token
85+
readOnly: true
86+
mountPath: /var/secrets/tokens
87+
- name: access-token-secret
88+
readOnly: true
89+
mountPath: /var/secrets/access_token
90+
{{- end }}
91+
{{- if .Values.iam.loginIssuer.clientSecret }}
92+
- name: oauth-client-secret
93+
readOnly: true
94+
mountPath: /var/secrets/oauth
95+
{{- end }}
96+
ports:
97+
- name: http
98+
containerPort: 8080
99+
protocol: TCP
100+
{{- with .Values.nodeSelector }}
101+
nodeSelector:
102+
{{ toYaml . | indent 8 }}
103+
{{- end }}
104+
{{- with .Values.affinity }}
105+
affinity:
106+
{{ toYaml . | indent 8 }}
107+
{{- end }}
108+
{{- with .Values.tolerations }}
109+
tolerations:
110+
{{ toYaml . | indent 8 }}
111+
{{- end }}

‎chart/auth-proxy/templates/policy.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{- if .Values.accessTokenSecret }}
2+
apiVersion: iam.openfaas.com/v1
3+
kind: Policy
4+
metadata:
5+
name: {{ template "connector.fullname" . }}
6+
namespace: openfaas
7+
labels:
8+
{{- include "connector.labels" . | nindent 4 }}
9+
spec:
10+
statement:
11+
- sid: 1-invoke
12+
action:
13+
- Function:Invoke
14+
effect: Allow
15+
resource:
16+
{{- toYaml .Values.iam.resource | nindent 6 }}
17+
{{- end }}

‎chart/auth-proxy/templates/role.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if .Values.accessTokenSecret }}
2+
apiVersion: iam.openfaas.com/v1
3+
kind: Role
4+
metadata:
5+
name: {{ template "connector.fullname" . }}
6+
namespace: openfaas
7+
labels:
8+
{{- include "connector.labels" . | nindent 4 }}
9+
spec:
10+
policy:
11+
- {{ template "connector.fullname" . }}
12+
principal:
13+
jwt:sub:
14+
- "system:serviceaccount:{{ .Release.Namespace }}:{{ template "connector.fullname" . }}"
15+
condition:
16+
StringEqual:
17+
jwt:iss:
18+
- {{.Values.iam.kubernetesIssuer.url}}
19+
{{- end }}

‎chart/auth-proxy/templates/service.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: auth-proxy
5+
namespace: {{ .Release.Namespace | quote }}
6+
labels:
7+
app: {{ template "connector.name" . }}
8+
chart: {{ .Chart.Name }}-{{ .Chart.Version }}
9+
component: auth-proxy
10+
heritage: {{ .Release.Service }}
11+
release: {{ .Release.Name }}
12+
spec:
13+
type: ClusterIP
14+
ports:
15+
- port: 8080
16+
name: http
17+
protocol: TCP
18+
targetPort: http
19+
selector:
20+
app: auth-proxy

‎chart/auth-proxy/templates/serviceaccount.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- if .Values.accessTokenSecret }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ template "connector.fullname" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
labels:
8+
{{- include "connector.labels" . | nindent 4 }}
9+
{{- end }}

‎chart/auth-proxy/values.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
image: docker.io/welteki/auth-proxy:v0.0.1-2-gf65feb9
2+
3+
url: "https://auth-proxy.example.com"
4+
5+
gatewayURL: http://gateway.openfaas.svc.cluster.local:8080
6+
7+
accessTokenSecret: ""
8+
9+
iam:
10+
# URL for the OpenFaaS system components issuer.
11+
# This is usually the public url of the gateway.
12+
systemIssuer:
13+
url: "http://gateway.openfaas.svc.cluster.local:8080"
14+
# URL for the Kubernetes service account issuer.
15+
kubernetesIssuer:
16+
url: https://kubernetes.default.svc.cluster.local
17+
# Use same configuration as the dashboardIssuer in the OpenFaaS chart
18+
loginIssuer:
19+
url: ""
20+
clientId: ""
21+
clientSecret: ""
22+
# Function resources the auth-proxy should be allow to invoke.
23+
resource: ["*"]
24+
25+
26+
resources:
27+
requests:
28+
memory: "64Mi"
29+
cpu: "100m"
30+
# limits:
31+
# memory: "256Mi"
32+
33+
nodeSelector: {}
34+
35+
tolerations: []
36+
37+
affinity: {}
38+
39+
logs:
40+
# Log debug messages
41+
debug: false
42+
# Set the log format, supports console or json
43+
format: "console"

0 commit comments

Comments
 (0)