panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Simple ingress support (#48)

Browse Source 
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2023-10-30 22:16:17 +00:00
committed by GitHub
co-authored by Faisal Memon
parent b354413f62
commit ed23d8b714
20 changed files with 158 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-oidc-discovery-provider/README.md
+4 -3
View File
@@ -98,8 +98,10 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `ingress.className` | Ingress class name | `""` |
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
| `ingress.annotations` | Annotations for ingress object | `{}` |
| `ingress.hosts` | Host paths for ingress object | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
| `tests.hostAliases` | List of host aliases for testing | `[]` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
| `tests.tls.customCA` | Custom CA value for tests | `""` |
@@ -128,4 +130,3 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml
+1 -1
View File
@@ -18,5 +18,5 @@ metadata:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+8 -4
View File
@@ -1,4 +1,8 @@
{{ $values := merge .Values }}
{{- $values := merge .Values }}
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
{{- if gt (len .Values.ingress.hosts) 0 }}
{{- $host = (index .Values.ingress.hosts 0).host }}
{{- end }}
apiVersion: v1
kind: Pod
metadata:
@@ -36,9 +40,9 @@ spec:
command: ['curl']
{{- if dig "tests" "tls" "enabled" false $values }}
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration']
{{- else }}
args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration']
{{- end }}
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
volumeMounts:
@@ -46,7 +50,7 @@ spec:
mountPath: /ca
{{- end }}
{{- else }}
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
{{- end }}
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml
+14 -7
View File
@@ -250,13 +250,20 @@ ingress:
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
## @param ingress.hosts [array] Host paths for ingress object
hosts:
- host: oidc-discovery.example.org
paths:
- path: /
pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
host: "oidc-discovery"
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
tlsSecret: ""
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
hosts: []
# - host: oidc-discovery.example.org
# paths:
# - path: /
# pathType: Prefix
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
tls: []
# - secretName: chart-example-tls
# hosts: