forked from k-space/kube
passmower: Cleanup
This commit is contained in:
parent
f8cd93aa9c
commit
1fa0577ce4
1
passmower/.gitignore
vendored
Normal file
1
passmower/.gitignore
vendored
Normal file
@ -0,0 +1 @@
|
|||||||
|
application.yaml
|
||||||
@ -1,3 +1,30 @@
|
|||||||
|
# Passmower
|
||||||
|
|
||||||
|
Passmower provides magic login link based OIDC provider for all hackerspace services.
|
||||||
|
The link is sent via e-mail and Slack bot.
|
||||||
|
Passmower replaces previously used Samba (Active Directory) and
|
||||||
|
[Authelia](https://www.authelia.com/) combo as it provides Kubernetes native
|
||||||
|
declarative user and application management,
|
||||||
|
automatic OIDC secret provisioning within the cluster,
|
||||||
|
and more.
|
||||||
|
|
||||||
|
For official documentation refer to
|
||||||
|
[github.com/passmower/passmower](https://github.com/passmower/passmower)
|
||||||
|
|
||||||
|
|
||||||
|
# For users
|
||||||
|
|
||||||
|
To login and list the applications enrolled with Passmower visit
|
||||||
|
[auth.k-space.ee](https://auth.k-space.ee/)
|
||||||
|
|
||||||
|
To add applications refer to the [official docs](https://github.com/passmower/passmower?tab=readme-ov-file#application-enrollment)
|
||||||
|
|
||||||
|
For good examples refer to [Grafana](https://git.k-space.ee/k-space/kube/src/branch/master/grafana/application.yml)
|
||||||
|
|
||||||
|
# For administrators
|
||||||
|
|
||||||
|
Passmower was deployed with Helm chart:
|
||||||
|
|
||||||
```
|
```
|
||||||
helm template --include-crds -n passmower passmower ../passmower/ -f passmower/values.yaml > passmower/application.yaml
|
helm template --include-crds -n passmower passmower ../passmower/ -f passmower/values.yaml > passmower/application.yaml
|
||||||
```
|
```
|
||||||
@ -1,3 +1,4 @@
|
|||||||
|
---
|
||||||
apiVersion: traefik.io/v1alpha1
|
apiVersion: traefik.io/v1alpha1
|
||||||
kind: Middleware
|
kind: Middleware
|
||||||
metadata:
|
metadata:
|
||||||
@ -16,10 +17,10 @@ spec:
|
|||||||
entryPoints:
|
entryPoints:
|
||||||
- websecure
|
- websecure
|
||||||
routes:
|
routes:
|
||||||
- match: Host(`auth2.k-space.ee`)
|
- match: Host(`auth2.k-space.ee`)
|
||||||
kind: Rule
|
kind: Rule
|
||||||
middlewares:
|
middlewares:
|
||||||
- name: auth2-redirect
|
- name: auth2-redirect
|
||||||
services:
|
services:
|
||||||
- kind: TraefikService
|
- kind: TraefikService
|
||||||
name: api@internal
|
name: api@internal
|
||||||
|
|||||||
@ -1,659 +0,0 @@
|
|||||||
---
|
|
||||||
# Source: passmower/templates/serviceaccount.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/crds.yaml
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: oidcusers.codemowers.cloud
|
|
||||||
spec:
|
|
||||||
group: codemowers.cloud
|
|
||||||
names:
|
|
||||||
plural: oidcusers
|
|
||||||
singular: oidcuser
|
|
||||||
kind: OIDCUser
|
|
||||||
listKind: OIDCUserList
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1beta1
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- spec
|
|
||||||
properties:
|
|
||||||
github:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
company:
|
|
||||||
type: string
|
|
||||||
email:
|
|
||||||
type: string
|
|
||||||
emails:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
email:
|
|
||||||
type: string
|
|
||||||
primary:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
groups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
prefix:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- github.com
|
|
||||||
id:
|
|
||||||
type: integer
|
|
||||||
login:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
passmower:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
company:
|
|
||||||
type: string
|
|
||||||
email:
|
|
||||||
type: string
|
|
||||||
groups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
prefix:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
slack:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
id:
|
|
||||||
type: string
|
|
||||||
spec:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- type
|
|
||||||
properties:
|
|
||||||
companyEmail:
|
|
||||||
type: string
|
|
||||||
email:
|
|
||||||
type: string
|
|
||||||
groups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
prefix:
|
|
||||||
type: string
|
|
||||||
type:
|
|
||||||
type: string
|
|
||||||
default: person
|
|
||||||
enum:
|
|
||||||
- person
|
|
||||||
- org
|
|
||||||
- service
|
|
||||||
- banned
|
|
||||||
- group
|
|
||||||
status:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
x-kubernetes-embedded-resource: true
|
|
||||||
emails:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
groups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
prefix:
|
|
||||||
type: string
|
|
||||||
primaryEmail:
|
|
||||||
type: string
|
|
||||||
profile:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
company:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
slackId:
|
|
||||||
type: string
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
additionalPrinterColumns:
|
|
||||||
- name: Type
|
|
||||||
type: string
|
|
||||||
jsonPath: .spec.type
|
|
||||||
- name: Name
|
|
||||||
type: string
|
|
||||||
jsonPath: .status.profile.name
|
|
||||||
- name: Display e-mail
|
|
||||||
type: string
|
|
||||||
jsonPath: .status.primaryEmail
|
|
||||||
- name: Upstream IdP e-mail
|
|
||||||
type: string
|
|
||||||
jsonPath: .spec.github.emails[?(@.primary==true)].email
|
|
||||||
- name: GH ID
|
|
||||||
type: string
|
|
||||||
jsonPath: .spec.github.id
|
|
||||||
- name: Groups
|
|
||||||
type: string
|
|
||||||
jsonPath: .status.groups
|
|
||||||
conversion:
|
|
||||||
strategy: None
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/crds.yaml
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: oidcclients.codemowers.cloud
|
|
||||||
spec:
|
|
||||||
group: codemowers.cloud
|
|
||||||
names:
|
|
||||||
plural: oidcclients
|
|
||||||
singular: oidcclient
|
|
||||||
kind: OIDCClient
|
|
||||||
listKind: OIDCClientList
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1beta1
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- spec
|
|
||||||
properties:
|
|
||||||
spec:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- redirectUris
|
|
||||||
- grantTypes
|
|
||||||
- responseTypes
|
|
||||||
properties:
|
|
||||||
allowedCORSOrigins:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
allowedGroups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
availableScopes:
|
|
||||||
type: array
|
|
||||||
default:
|
|
||||||
- openid
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- openid
|
|
||||||
- profile
|
|
||||||
- offline_access
|
|
||||||
displayName:
|
|
||||||
type: string
|
|
||||||
grantTypes:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- implicit
|
|
||||||
- authorization_code
|
|
||||||
- refresh_token
|
|
||||||
idTokenSignedResponseAlg:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- PS256
|
|
||||||
- RS256
|
|
||||||
- ES256
|
|
||||||
overrideIncomingScopes:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
pkce:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
redirectUris:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
responseTypes:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- code id_token
|
|
||||||
- code
|
|
||||||
- id_token
|
|
||||||
- none
|
|
||||||
secretMetadata:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
annotations:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
labels:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
secretRefreshPod:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
x-kubernetes-embedded-resource: true
|
|
||||||
tokenEndpointAuthMethod:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- client_secret_basic
|
|
||||||
- client_secret_jwt
|
|
||||||
- client_secret_post
|
|
||||||
- private_key_jwt
|
|
||||||
- none
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
status:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
x-kubernetes-embedded-resource: true
|
|
||||||
instance:
|
|
||||||
type: string
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
additionalPrinterColumns:
|
|
||||||
- name: Instance
|
|
||||||
type: string
|
|
||||||
description: Passmower deployment which manages this client
|
|
||||||
jsonPath: .status.instance
|
|
||||||
- name: Uris
|
|
||||||
type: string
|
|
||||||
description: Redirect URLs configured for this client
|
|
||||||
jsonPath: .spec.redirectUris
|
|
||||||
- name: Allowed groups
|
|
||||||
type: string
|
|
||||||
description: Groups allowed to this client
|
|
||||||
jsonPath: .spec.allowedGroups
|
|
||||||
conversion:
|
|
||||||
strategy: None
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/crds.yaml
|
|
||||||
apiVersion: apiextensions.k8s.io/v1
|
|
||||||
kind: CustomResourceDefinition
|
|
||||||
metadata:
|
|
||||||
name: oidcmiddlewareclients.codemowers.cloud
|
|
||||||
spec:
|
|
||||||
group: codemowers.cloud
|
|
||||||
names:
|
|
||||||
plural: oidcmiddlewareclients
|
|
||||||
singular: oidcmiddlewareclient
|
|
||||||
kind: OIDCMiddlewareClient
|
|
||||||
listKind: OIDCMiddlewareClientList
|
|
||||||
scope: Namespaced
|
|
||||||
versions:
|
|
||||||
- name: v1beta1
|
|
||||||
served: true
|
|
||||||
storage: true
|
|
||||||
schema:
|
|
||||||
openAPIV3Schema:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- spec
|
|
||||||
properties:
|
|
||||||
spec:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
allowedGroups:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
displayName:
|
|
||||||
type: string
|
|
||||||
headerMapping:
|
|
||||||
type: object
|
|
||||||
default:
|
|
||||||
email: Remote-Email
|
|
||||||
groups: Remote-Groups
|
|
||||||
name: Remote-Name
|
|
||||||
user: Remote-User
|
|
||||||
properties:
|
|
||||||
email:
|
|
||||||
type: string
|
|
||||||
groups:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
user:
|
|
||||||
type: string
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
status:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
conditions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
x-kubernetes-preserve-unknown-fields: true
|
|
||||||
x-kubernetes-embedded-resource: true
|
|
||||||
instance:
|
|
||||||
type: string
|
|
||||||
subresources:
|
|
||||||
status: {}
|
|
||||||
additionalPrinterColumns:
|
|
||||||
- name: Instance
|
|
||||||
type: string
|
|
||||||
description: Passmower deployment which manages this client
|
|
||||||
jsonPath: .status.instance
|
|
||||||
- name: Uri
|
|
||||||
type: string
|
|
||||||
description: URL configured for this client
|
|
||||||
jsonPath: .spec.uri
|
|
||||||
- name: Allowed groups
|
|
||||||
type: string
|
|
||||||
description: Groups allowed to this client
|
|
||||||
jsonPath: .spec.allowedGroups
|
|
||||||
conversion:
|
|
||||||
strategy: None
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/serviceaccount.yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
rules:
|
|
||||||
- verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
apiGroups:
|
|
||||||
- codemowers.cloud
|
|
||||||
resources:
|
|
||||||
- oidcusers
|
|
||||||
- oidcusers/status
|
|
||||||
- oidcclients
|
|
||||||
- oidcclients/status
|
|
||||||
- oidcmiddlewareclients
|
|
||||||
- oidcmiddlewareclients/status
|
|
||||||
- verbs:
|
|
||||||
- get
|
|
||||||
- create
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
apiGroups:
|
|
||||||
- ''
|
|
||||||
resources:
|
|
||||||
- secrets
|
|
||||||
- verbs:
|
|
||||||
- create
|
|
||||||
apiGroups:
|
|
||||||
- ''
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
- verbs:
|
|
||||||
- get
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
- delete
|
|
||||||
apiGroups:
|
|
||||||
- traefik.io
|
|
||||||
resources:
|
|
||||||
- middlewares
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/serviceaccount.yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: passmower
|
|
||||||
namespace: passmower
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: passmower
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/service.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
targetPort: http
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
replicas: 3
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
spec:
|
|
||||||
serviceAccountName: passmower
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
containers:
|
|
||||||
- name: passmower
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
image: "passmower/passmower:develop"
|
|
||||||
imagePullPolicy: Always
|
|
||||||
ports:
|
|
||||||
- containerPort: 3000
|
|
||||||
name: http
|
|
||||||
- containerPort: 9090
|
|
||||||
name: metrics
|
|
||||||
env:
|
|
||||||
- name: ISSUER_URL
|
|
||||||
value: https://auth.k-space.ee/
|
|
||||||
- name: DEPLOYMENT_NAME
|
|
||||||
value: passmower
|
|
||||||
- name: GROUP_PREFIX
|
|
||||||
value: "k-space"
|
|
||||||
- name: ADMIN_GROUP
|
|
||||||
value: "k-space:onboarding"
|
|
||||||
- name: REQUIRED_GROUP
|
|
||||||
value: ""
|
|
||||||
- name: GITHUB_ORGANIZATION
|
|
||||||
value: "codemowers"
|
|
||||||
- name: ENROLL_USERS
|
|
||||||
value: "false"
|
|
||||||
- name: NAMESPACE_SELECTOR
|
|
||||||
value: "*"
|
|
||||||
- name: PREFERRED_EMAIL_DOMAIN
|
|
||||||
value: "k-space.ee"
|
|
||||||
- name: REQUIRE_CUSTOM_USERNAME
|
|
||||||
value: "true"
|
|
||||||
- name: NORMALIZE_EMAIL_ADDRESSES
|
|
||||||
value: "true"
|
|
||||||
- name: REDIS_URI
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: dragonfly-auth
|
|
||||||
key: REDIS_URI
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: oidc-keys
|
|
||||||
- secretRef:
|
|
||||||
name: email-credentials
|
|
||||||
- secretRef:
|
|
||||||
name: github-client
|
|
||||||
- secretRef:
|
|
||||||
name: slack-client
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /.well-known/openid-configuration
|
|
||||||
port: 3000
|
|
||||||
httpHeaders:
|
|
||||||
- name: x-forwarded-for # suppress oidc-provider warning
|
|
||||||
value: https://auth.k-space.ee/
|
|
||||||
- name: x-forwarded-proto # suppress oidc-provider warning
|
|
||||||
value: https
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /health
|
|
||||||
port: 9090
|
|
||||||
httpHeaders:
|
|
||||||
- name: x-forwarded-for # suppress oidc-provider warning
|
|
||||||
value: https://auth.k-space.ee/
|
|
||||||
- name: x-forwarded-proto # suppress oidc-provider warning
|
|
||||||
value: https
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 3
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /app/tos
|
|
||||||
name: tos
|
|
||||||
- mountPath: /app/approval
|
|
||||||
name: approval
|
|
||||||
- mountPath: /app/src/views/custom/emails
|
|
||||||
name: email-templates
|
|
||||||
resources:
|
|
||||||
{}
|
|
||||||
volumes:
|
|
||||||
- name: tos
|
|
||||||
configMap:
|
|
||||||
name: passmower-tos
|
|
||||||
- name: approval
|
|
||||||
configMap:
|
|
||||||
name: passmower-approval
|
|
||||||
- name: email-templates
|
|
||||||
configMap:
|
|
||||||
name: passmower-email-templates
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/deployment.yaml
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
name: passmower-key-manager
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
spec:
|
|
||||||
serviceAccountName: passmower
|
|
||||||
containers:
|
|
||||||
- name: oidc-key-manager
|
|
||||||
image: "passmower/passmower:develop"
|
|
||||||
command: [ '/app/node_modules/.bin/key-manager', 'initialize', '-c', 'cluster' ]
|
|
||||||
restartPolicy: Never
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/ingress.yaml
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: passmower
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: passmower-0.1.0
|
|
||||||
app.kubernetes.io/name: passmower
|
|
||||||
app.kubernetes.io/instance: passmower
|
|
||||||
app.kubernetes.io/version: "0.1.0"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
annotations:
|
|
||||||
external-dns.alpha.kubernetes.io/hostname: auth.k-space.ee,auth2.k-space.ee
|
|
||||||
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
|
||||||
kubernetes.io/ingress.class: traefik
|
|
||||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
||||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
||||||
spec:
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "*.k-space.ee"
|
|
||||||
secretName:
|
|
||||||
rules:
|
|
||||||
- host: "auth.k-space.ee"
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: "/"
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: passmower
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
---
|
|
||||||
# Source: passmower/templates/texts.yaml
|
|
||||||
---
|
|
||||||
@ -1,3 +1,4 @@
|
|||||||
|
# yamllint disable rule:line-length
|
||||||
---
|
---
|
||||||
apiVersion: codemowers.cloud/v1beta1
|
apiVersion: codemowers.cloud/v1beta1
|
||||||
kind: OIDCMiddlewareClient
|
kind: OIDCMiddlewareClient
|
||||||
@ -144,43 +145,43 @@ metadata:
|
|||||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
spec:
|
spec:
|
||||||
rules:
|
rules:
|
||||||
- host: proxmox.k-space.ee
|
- host: proxmox.k-space.ee
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: /
|
path: /
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: whoami
|
name: whoami
|
||||||
port:
|
port:
|
||||||
number: 80
|
number: 80
|
||||||
- host: pve.k-space.ee
|
- host: pve.k-space.ee
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve1
|
name: pve1
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve8
|
name: pve8
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve9
|
name: pve9
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "*.k-space.ee"
|
- "*.k-space.ee"
|
||||||
---
|
---
|
||||||
apiVersion: traefik.io/v1alpha1
|
apiVersion: traefik.io/v1alpha1
|
||||||
kind: Middleware
|
kind: Middleware
|
||||||
@ -200,13 +201,13 @@ spec:
|
|||||||
entryPoints:
|
entryPoints:
|
||||||
- websecure
|
- websecure
|
||||||
routes:
|
routes:
|
||||||
- match: Host(`proxmox.k-space.ee`)
|
- match: Host(`proxmox.k-space.ee`)
|
||||||
kind: Rule
|
kind: Rule
|
||||||
middlewares:
|
middlewares:
|
||||||
- name: proxmox-redirect
|
- name: proxmox-redirect
|
||||||
services: # Dirty workaround, service can't be empty
|
services: # Dirty workaround, service can't be empty
|
||||||
- kind: TraefikService
|
- kind: TraefikService
|
||||||
name: api@internal
|
name: api@internal
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -220,33 +221,33 @@ metadata:
|
|||||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
spec:
|
spec:
|
||||||
rules:
|
rules:
|
||||||
- host: pve-internal.k-space.ee
|
- host: pve-internal.k-space.ee
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve1
|
name: pve1
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve8
|
name: pve8
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: pve9
|
name: pve9
|
||||||
port:
|
port:
|
||||||
number: 8006
|
number: 8006
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "*.k-space.ee"
|
- "*.k-space.ee"
|
||||||
---
|
---
|
||||||
apiVersion: traefik.io/v1alpha1
|
apiVersion: traefik.io/v1alpha1
|
||||||
kind: Middleware
|
kind: Middleware
|
||||||
|
|||||||
@ -1,3 +1,4 @@
|
|||||||
|
# yamllint disable rule:line-length
|
||||||
---
|
---
|
||||||
apiVersion: codemowers.cloud/v1beta1
|
apiVersion: codemowers.cloud/v1beta1
|
||||||
kind: OIDCMiddlewareClient
|
kind: OIDCMiddlewareClient
|
||||||
@ -38,16 +39,16 @@ metadata:
|
|||||||
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
||||||
spec:
|
spec:
|
||||||
rules:
|
rules:
|
||||||
- host: prusa.k-space.ee
|
- host: prusa.k-space.ee
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: prusa
|
name: prusa
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "*.k-space.ee"
|
- "*.k-space.ee"
|
||||||
|
|||||||
@ -1,3 +1,4 @@
|
|||||||
|
# yamllint disable rule:line-length
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
|
|||||||
@ -1,3 +1,5 @@
|
|||||||
|
# yamllint disable rule:line-length
|
||||||
|
---
|
||||||
nameOverride: ""
|
nameOverride: ""
|
||||||
fullnameOverride: ""
|
fullnameOverride: ""
|
||||||
|
|
||||||
@ -5,7 +7,7 @@ passmower:
|
|||||||
# Hostname on which Passmower will be deployed to. Will be used as ingress host.
|
# Hostname on which Passmower will be deployed to. Will be used as ingress host.
|
||||||
host: "auth.k-space.ee"
|
host: "auth.k-space.ee"
|
||||||
# Local groups will be created with given prefix.
|
# Local groups will be created with given prefix.
|
||||||
group_prefix: 'k-space'
|
group_prefix: 'k-space'
|
||||||
# Local or remote group which members will automatically become admins.
|
# Local or remote group which members will automatically become admins.
|
||||||
admin_group: 'k-space:onboarding'
|
admin_group: 'k-space:onboarding'
|
||||||
# If set, require all users to be member of the given local or remote group.
|
# If set, require all users to be member of the given local or remote group.
|
||||||
@ -17,7 +19,7 @@ passmower:
|
|||||||
# Comma-separated, wildcard enabled namespace selector to select, in which namespaces Passmower looks for client CRDs.
|
# Comma-separated, wildcard enabled namespace selector to select, in which namespaces Passmower looks for client CRDs.
|
||||||
namespace_selector: "*"
|
namespace_selector: "*"
|
||||||
# Domain which will be preferred for determining primary emails.
|
# Domain which will be preferred for determining primary emails.
|
||||||
preferred_email_domain: 'k-space.ee'
|
preferred_email_domain: 'k-space.ee'
|
||||||
# Require users to set a custom username instead of system generated one. Will be used as OIDCUser CRD name and OIDC username claim.
|
# Require users to set a custom username instead of system generated one. Will be used as OIDCUser CRD name and OIDC username claim.
|
||||||
require_custom_username: true
|
require_custom_username: true
|
||||||
# Normalize incoming email addresses by removing aliases (e.g. username+alias@gmail.com) etc.
|
# Normalize incoming email addresses by removing aliases (e.g. username+alias@gmail.com) etc.
|
||||||
@ -69,14 +71,9 @@ ingress:
|
|||||||
traefik.ingress.kubernetes.io/router.tls: "true"
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
||||||
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
||||||
external-dns.alpha.kubernetes.io/hostname: auth.k-space.ee,auth2.k-space.ee
|
external-dns.alpha.kubernetes.io/hostname: auth.k-space.ee,auth2.k-space.ee
|
||||||
# kubernetes.io/ingress.class: nginx
|
|
||||||
# kubernetes.io/tls-acme: "true"
|
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "*.k-space.ee"
|
- "*.k-space.ee"
|
||||||
# - secretName: chart-example-tls
|
|
||||||
# hosts:
|
|
||||||
# - chart-example.local
|
|
||||||
|
|
||||||
image:
|
image:
|
||||||
repository: passmower/passmower
|
repository: passmower/passmower
|
||||||
@ -85,29 +82,12 @@ image:
|
|||||||
tag: "develop"
|
tag: "develop"
|
||||||
|
|
||||||
podSecurityContext: {}
|
podSecurityContext: {}
|
||||||
# fsGroup: 2000
|
|
||||||
|
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
# capabilities:
|
|
||||||
# drop:
|
|
||||||
# - ALL
|
|
||||||
# readOnlyRootFilesystem: true
|
|
||||||
# runAsNonRoot: true
|
|
||||||
# runAsUser: 1000
|
|
||||||
|
|
||||||
replicaCount: 3
|
replicaCount: 3
|
||||||
|
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
|
||||||
# choice for the user. This also increases chances charts run on environments with little
|
|
||||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
|
||||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
|
||||||
# limits:
|
|
||||||
# cpu: 100m
|
|
||||||
# memory: 128Mi
|
|
||||||
# requests:
|
|
||||||
# cpu: 100m
|
|
||||||
# memory: 128Mi
|
|
||||||
|
|
||||||
nodeSelector: {}
|
nodeSelector: {}
|
||||||
|
|
||||||
|
|||||||
@ -1,3 +1,4 @@
|
|||||||
|
# yamllint disable rule:line-length
|
||||||
---
|
---
|
||||||
apiVersion: codemowers.cloud/v1beta1
|
apiVersion: codemowers.cloud/v1beta1
|
||||||
kind: OIDCMiddlewareClient
|
kind: OIDCMiddlewareClient
|
||||||
@ -38,16 +39,16 @@ metadata:
|
|||||||
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
|
||||||
spec:
|
spec:
|
||||||
rules:
|
rules:
|
||||||
- host: voron.k-space.ee
|
- host: voron.k-space.ee
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- pathType: Prefix
|
- pathType: Prefix
|
||||||
path: "/"
|
path: "/"
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: voron
|
name: voron
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "*.k-space.ee"
|
- "*.k-space.ee"
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user