CadolesKube
/
sso-kustom
14
0
Fork 0
Code Issues 19 Pull Requests 2 Projects Releases Wiki Activity

wip: integrate hydra-sql in example environment

This commit is contained in:
wpetit 2024-04-04 11:52:57 +02:00
parent 546f31b2dd
commit 62ef2763de
18 changed files with 526 additions and 425 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
components/hydra-ldap/resources/deployment.yaml
View File

@ -17,34 +17,34 @@ spec:
app.kubernetes.io/version: "v1.2.2" app.kubernetes.io/version: "v1.2.2"
spec: spec:
containers: containers:
- name: werther - name: werther
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717 image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-ldap-env name: hydra-ldap-env
env: env:
- name: WERTHER_WEB_DIR - name: WERTHER_WEB_DIR
value: "/usr/share/werther/login/" value: "/usr/share/werther/login/"
- name: WERTHER_LDAP_BINDDN - name: WERTHER_LDAP_BINDDN
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-ldap-sc name: hydra-ldap-sc
key: WERTHER_LDAP_BINDDN key: WERTHER_LDAP_BINDDN
- name: WERTHER_LDAP_BINDPW - name: WERTHER_LDAP_BINDPW
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-ldap-sc name: hydra-ldap-sc
key: WERTHER_LDAP_BINDPW key: WERTHER_LDAP_BINDPW
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: hydra-ldap-http name: http
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
drop: drop:
- ALL - ALL
privileged: false privileged: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsNonRoot: true runAsNonRoot: true
runAsUser: 100 runAsUser: 100

4
components/hydra-ldap/resources/service.yaml
View File

@ -7,9 +7,9 @@ metadata:
spec: spec:
type: ClusterIP type: ClusterIP
ports: ports:
- name: hydra-ldap - name: http
port: 8080 port: 8080
targetPort: hydra-ldap-http targetPort: http
protocol: TCP protocol: TCP
selector: selector:
app.kubernetes.io/name: hydra-ldap app.kubernetes.io/name: hydra-ldap

162
components/hydra-oidc/resources/hydra-oidc-deployment.yaml
View File

@ -17,86 +17,86 @@ spec:
app.kubernetes.io/name: hydra-oidc app.kubernetes.io/name: hydra-oidc
spec: spec:
containers: containers:
- name: hydra-oidc-php-fpm - name: hydra-oidc-php-fpm
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6 image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
imagePullPolicy: Always imagePullPolicy: Always
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
command: command:
- sh - sh
- -c - -c
- test -f /etc/php81/php-fpm.d/www.conf - test -f /etc/php81/php-fpm.d/www.conf
livenessProbe: livenessProbe:
exec: exec:
command: command:
- php - php
- bin/console - bin/console
- -V - -V
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 30 periodSeconds: 30
env: env:
- name: PHP_FPM_LISTEN - name: PHP_FPM_LISTEN
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: PHP_MEMORY_LIMIT - name: PHP_MEMORY_LIMIT
value: 128m value: 128m
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
value: 128m value: 128m
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-oidc-env name: hydra-oidc-env
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
- name: hydra-oidc-caddy - name: hydra-oidc-caddy
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6 image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
imagePullPolicy: Always imagePullPolicy: Always
args: args:
[ [
"/usr/sbin/caddy", "/usr/sbin/caddy",
"run", "run",
"--adapter", "--adapter",
"caddyfile", "caddyfile",
"--config", "--config",
"/etc/caddy/Caddyfile", "/etc/caddy/Caddyfile",
] ]
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /healthy path: /healthy
port: 8080 port: 8080
initialDelaySeconds: 5 initialDelaySeconds: 5
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 10 periodSeconds: 10
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /healthy path: /healthy
port: 8080 port: 8080
initialDelaySeconds: 15 initialDelaySeconds: 15
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 15 periodSeconds: 15
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http name: http
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-oidc-env name: hydra-oidc-env
env: env:
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: CADDY_HTTPS_PORT - name: CADDY_HTTPS_PORT
value: "8443" value: "8443"
- name: CADDY_HTTP_PORT - name: CADDY_HTTP_PORT
value: "8080" value: "8080"
- name: CADDY_DATA_FS - name: CADDY_DATA_FS
value: "/tmp/caddy" value: "/tmp/caddy"
- name: CADDY_APP_ROOT_PUBLIC - name: CADDY_APP_ROOT_PUBLIC
value: "/app/public/" value: "/app/public/"
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
restartPolicy: Always restartPolicy: Always

6
components/hydra-oidc/resources/hydra-oidc-service.yaml
View File

@ -6,9 +6,9 @@ metadata:
name: hydra-oidc name: hydra-oidc
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
targetPort: http targetPort: http
selector: selector:
app.kubernetes.io/name: hydra-oidc app.kubernetes.io/name: hydra-oidc
status: status:

30
components/hydra-sql/files/hydra/sql.yaml Normal file
View File

@ -0,0 +1,30 @@
hydra:
apps:
- id: sql
title:
fr: Connexion SQL
en: Login SQL
description:
fr: Authentification avec SQL
en: Authentication with SQL
login_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGIN_URL)%"
consent_url: "%env(string:HYDRA_DISPATCHER_SQL_CONSENT_URL)%"
logout_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGOUT_URL)%"
attributes_rewrite_configuration:
uid:
rules:
- "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
email:
rules:
- "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
eduPersonAffiliation:
rules:
- "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
firewall:
rules:
email:
required: false
uid:
required: false
eduPersonAffiliation:
required: false

49
components/hydra-sql/kustomization.yaml
View File

@ -2,27 +2,38 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component kind: Component
resources: resources:
- ./resources/hydra-sql-service.yaml - ./resources/hydra-sql-service.yaml
- ./resources/hydra-sql-deployment.yaml - ./resources/hydra-sql-deployment.yaml
generatorOptions: generatorOptions:
labels: labels:
com.cadoles.forge.sso-kustom/session: redis com.cadoles.forge.sso-kustom/session: redis
configMapGenerator: configMapGenerator:
- name: hydra-sql-env - name: hydra-sql-env
literals: literals:
- ISSUER_URL="http://localhost:8000" - ISSUER_URL="http://localhost:8000"
- BASE_URL='http://localhost:8080' - BASE_URL='http://localhost:8080'
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin' - HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
- APP_LOCALES="fr,en" - APP_LOCALES="fr,en"
- HASH_ALGO_LEGACY="sha256, bcrypt" - HASH_ALGO_LEGACY="sha256, bcrypt"
- SECURITY_PATTERN="password,salt,pepper" - SECURITY_PATTERN="password,salt,pepper"
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql" - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
- DB_USER="makeMeASecret" - DB_USER="makeMeASecret"
- DB_PASSWORD="makeMeASecret" - DB_PASSWORD="makeMeASecret"
- REDIS_DSN="redis://redis:6379" - REDIS_DSN="redis://redis:6379"
- PEPPER="MakeMeABigSecret" - PEPPER="MakeMeABigSecret"
- name: sql-login-config - name: sql-login-config
files: files:
- ./files/sql_login.yaml - ./files/sql_login.yaml
- name: hydra-dispatcher-apps
behavior: merge
files:
- ./files/hydra/sql.yaml
patchesJson6902:
- target:
version: v1
kind: ConfigMap
name: hydra-dispatcher-env
path: patches/hydra-dispatcher-env.yaml

9
components/hydra-sql/patches/hydra-dispatcher-env.yaml Normal file
View File

@ -0,0 +1,9 @@
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
value: http://hydra-sql/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
value: http://hydra-sql/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
value: http://hydra-sql/logout

182
components/hydra-sql/resources/hydra-sql-deployment.yaml
View File

@ -17,98 +17,98 @@ spec:
app.kubernetes.io/name: hydra-sql app.kubernetes.io/name: hydra-sql
spec: spec:
containers: containers:
- name: hydra-sql-fpm - name: hydra-sql-fpm
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24 image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
imagePullPolicy: Always imagePullPolicy: Always
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
command: command:
- sh - sh
- -c - -c
- test -f /etc/php81/php-fpm.d/www.conf - test -f /etc/php81/php-fpm.d/www.conf
livenessProbe: livenessProbe:
exec: exec:
command: command:
- php - php
- bin/console - bin/console
- -V - -V
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 30 periodSeconds: 30
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-sql-env name: hydra-sql-env
env: env:
- name: PHP_FPM_LISTEN - name: PHP_FPM_LISTEN
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: PHP_MEMORY_LIMIT - name: PHP_MEMORY_LIMIT
value: 128m value: 128m
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
value: 128m value: 128m
- name: PHP_FPM_LOG_LEVEL - name: PHP_FPM_LOG_LEVEL
value: warning value: warning
volumeMounts: volumeMounts:
- name: sql-login-config - name: sql-login-config
mountPath: "/app/config/sql_login_configuration/sql_login.yaml" mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
subPath: "sql_login.yaml" subPath: "sql_login.yaml"
- name: hydra-sql-caddy - name: hydra-sql-caddy
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24 image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
imagePullPolicy: Always imagePullPolicy: Always
args: args:
[ [
"/usr/sbin/caddy", "/usr/sbin/caddy",
"run", "run",
"--adapter", "--adapter",
"caddyfile", "caddyfile",
"--config", "--config",
"/etc/caddy/Caddyfile", "/etc/caddy/Caddyfile",
] ]
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /health path: /health
port: 8080 port: 8080
initialDelaySeconds: 5 initialDelaySeconds: 5
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 10 periodSeconds: 10
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /health path: /health
port: 8080 port: 8080
initialDelaySeconds: 15 initialDelaySeconds: 15
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 15 periodSeconds: 15
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-sql-env name: hydra-sql-env
env: env:
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: CADDY_HTTPS_PORT - name: CADDY_HTTPS_PORT
value: "8443" value: "8443"
- name: CADDY_HTTP_PORT - name: CADDY_HTTP_PORT
value: "8080" value: "8080"
- name: CADDY_DATA_FS - name: CADDY_DATA_FS
value: "/tmp/caddy" value: "/tmp/caddy"
- name: CADDY_APP_ROOT_PUBLIC - name: CADDY_APP_ROOT_PUBLIC
value: "/app/public/" value: "/app/public/"
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http name: http
volumeMounts: volumeMounts:
- name: sql-login-config - name: sql-login-config
mountPath: "/app/config/sql_login_configuration/sql_login.yaml" mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
subPath: "sql_login.yaml" subPath: "sql_login.yaml"
volumes: volumes:
- name: sql-login-config - name: sql-login-config
configMap: configMap:

6
components/hydra-sql/resources/hydra-sql-service.yaml
View File

@ -6,9 +6,9 @@ metadata:
name: hydra-sql name: hydra-sql
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
targetPort: http targetPort: http
selector: selector:
app.kubernetes.io/name: hydra-sql app.kubernetes.io/name: hydra-sql
status: status:

24
components/oidc-test/resources/deployment.yaml
View File

@ -23,17 +23,17 @@ spec:
- containerPort: 8080 - containerPort: 8080
resources: {} resources: {}
envFrom: envFrom:
- configMapRef: - configMapRef:
name: oidc-test-env name: oidc-test-env
env: env:
- name: OIDC_CLIENT_ID - name: OIDC_CLIENT_ID
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: oidc-test-oauth2-client name: oidc-test-oauth2-client
key: client_id key: CLIENT_ID
- name: OIDC_CLIENT_SECRET - name: OIDC_CLIENT_SECRET
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: oidc-test-oauth2-client name: oidc-test-oauth2-client
key: client_secret key: CLIENT_SECRET
restartPolicy: Always restartPolicy: Always

36
examples/authenticated-app/README.md
View File

@ -8,35 +8,27 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
1. Créer un cluster avec `kind` 1. Créer un cluster avec `kind`
``` ```
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
``` ```
2. Déployer les opérateurs nécessaires au déploiement 2. Déployer les opérateurs nécessaires au déploiement
``` ```
kubectl apply -k ./examples/k8s/kind/cluster --server-side kubectl apply -k ./examples/k8s/kind/cluster --server-side
``` ```
3. Déployer l'application 3. Déployer l'application
```
kubectl apply -k ./examples/authenticated-app
```
**Note** Il est possible d'avoir l'erreur suivante:
``` ```
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1" kubectl apply -k ./examples/authenticated-app
``` ```
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts` 4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
``` ```
127.0.0.1 ssokustom 127.0.0.1 ssokustom
``` ```
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom 5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
@ -55,7 +47,7 @@ kind delete cluster -n sso-kustom-example
#### URL utiles #### URL utiles
|URL|Description| | URL | Description |
|---|-----------| | --------------------------------------------------- | ------------------------------------- |
|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth| | https://ssokustom/auth/saml/Shibboleth.sso/Session | Attributs de la session SP Shibboleth |
|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth| | https://ssokustom/auth/saml/Shibboleth.sso/Metadata | Métadonnées du SP Shibboleth |

7
examples/authenticated-app/kustomization.yaml
View File

@ -8,7 +8,7 @@ resources:
- ./resources/self-signed-issuer.yaml - ./resources/self-signed-issuer.yaml
- ./resources/port-forwarder.yaml - ./resources/port-forwarder.yaml
patchesJson6902: patches:
- target: - target:
version: v1 version: v1
kind: ConfigMap kind: ConfigMap
@ -39,3 +39,8 @@ patchesJson6902:
kind: OAuth2Client kind: OAuth2Client
name: oidc-test-oauth2-client name: oidc-test-oauth2-client
path: patches/oidc-test-oauth2-client.yaml path: patches/oidc-test-oauth2-client.yaml
- target:
version: v1
kind: ConfigMap
name: hydra-sql-env
path: patches/hydra-sql-env.yaml

10
examples/authenticated-app/patches/hydra-dispatcher-env.yaml
View File

@ -28,3 +28,13 @@
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL" path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
value: https://ssokustom/auth/saml/logout value: https://ssokustom/auth/saml/logout
# Hydra SQL configuration
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
value: https://ssokustom/auth/sql/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
value: https://ssokustom/auth/sql/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
value: https://ssokustom/auth/sql/logout

24
examples/authenticated-app/patches/hydra-sql-env.yaml Normal file
View File

@ -0,0 +1,24 @@
- op: replace
path: "/data/BASE_URL"
value: https://ssokustom/auth/sql
- op: replace
path: "/data/ISSUER_URL"
value: https://ssokustom
- op: replace
path: "/data/ISSUER_URL"
value: https://ssokustom
- op: replace
path: "/data/HYDRA_ADMIN_BASE_URL"
value: http://hydra-dispatcher
- op: replace
path: "/data/DSN_REMOTE_DATABASE"
value: pgsql:host='postgres';port=5432;dbname=lasql
- op: replace
path: "/data/REDIS_DSN"
value: redis://redis:6379
- op: replace
path: "/data/DB_USER"
value: makeMeASecret
- op: replace
path: "/data/DB_PASSWORD"
value: rmakeMeASecret

149
examples/authenticated-app/resources/ingress.yaml
View File

@ -10,19 +10,19 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
tls: tls:
- hosts: - hosts:
- ssokustom - ssokustom
secretName: ssokustom-example-tls secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
- path: / - path: /
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: oidc-test name: oidc-test
port: port:
name: http name: http
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@ -34,19 +34,43 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
tls: tls:
- hosts: - hosts:
- ssokustom - ssokustom
secretName: ssokustom-example-tls secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
- path: /auth/saml(/|$)(.*) - path: /auth/saml(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: hydra-saml name: hydra-saml
port: port:
name: http name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-sql
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/sql(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra-sql
port:
name: http
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@ -60,19 +84,19 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
tls: tls:
- hosts: - hosts:
- ssokustom - ssokustom
secretName: ssokustom-example-tls secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
- path: /auth/dispatcher(/|$)(.*) - path: /auth/dispatcher(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: hydra-dispatcher name: hydra-dispatcher
port: port:
name: http name: http
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@ -85,19 +109,19 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
tls: tls:
- hosts: - hosts:
- ssokustom - ssokustom
secretName: ssokustom-example-tls secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
- path: /auth(/|$)(.*) - path: /auth(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: hydra name: hydra
port: port:
name: hydra-public name: hydra-public
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
@ -111,21 +135,16 @@ metadata:
spec: spec:
ingressClassName: nginx ingressClassName: nginx
tls: tls:
- hosts: - hosts:
- ssokustom - ssokustom
secretName: ssokustom-example-tls secretName: ssokustom-example-tls
rules: rules:
- http: - http:
paths: paths:
- path: /simplesaml(/|$)(.*) - path: /simplesaml(/|$)(.*)
pathType: Prefix pathType: Prefix
backend: backend:
service: service:
name: saml-idp name: saml-idp
port: port:
name: https name: https

9
examples/k8s/kind/cluster/kustomization.yaml
View File

@ -1,10 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml - https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop - https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop - https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml - https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
patchesJson6902: patchesJson6902:
- target: - target:

172
resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml
View File

@ -17,91 +17,91 @@ spec:
app.kubernetes.io/name: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
spec: spec:
containers: containers:
- name: hydra-dispatcher-php-fpm - name: hydra-dispatcher-php-fpm
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16 image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
command: command:
- sh - sh
- -c - -c
- test -f /etc/php81/php-fpm.d/www.conf - test -f /etc/php81/php-fpm.d/www.conf
livenessProbe: livenessProbe:
exec: exec:
command: command:
- php - php
- bin/console - bin/console
- -V - -V
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 30 periodSeconds: 30
env: env:
- name: PHP_FPM_LISTEN - name: PHP_FPM_LISTEN
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: PHP_MEMORY_LIMIT - name: PHP_MEMORY_LIMIT
value: 128m value: 128m
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
value: 128m value: 128m
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-dispatcher-env name: hydra-dispatcher-env
volumeMounts: volumeMounts:
- mountPath: /app/config/hydra - mountPath: /app/config/hydra
name: hydra-dispatcher-apps name: hydra-dispatcher-apps
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
- name: hydra-dispatcher-caddy - name: hydra-dispatcher-caddy
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16 image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
imagePullPolicy: Always imagePullPolicy: Always
args: args:
[ [
"/usr/sbin/caddy", "/usr/sbin/caddy",
"run", "run",
"--adapter", "--adapter",
"caddyfile", "caddyfile",
"--config", "--config",
"/etc/caddy/Caddyfile", "/etc/caddy/Caddyfile",
] ]
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /health path: /health
port: 8080 port: 8080
initialDelaySeconds: 5 initialDelaySeconds: 5
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 10 periodSeconds: 10
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /health path: /health
port: 8080 port: 8080
initialDelaySeconds: 15 initialDelaySeconds: 15
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 15 periodSeconds: 15
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-dispatcher-env name: hydra-dispatcher-env
env: env:
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: CADDY_HTTPS_PORT - name: CADDY_HTTPS_PORT
value: "8443" value: "8443"
- name: CADDY_HTTP_PORT - name: CADDY_HTTP_PORT
value: "8080" value: "8080"
- name: CADDY_DATA_FS - name: CADDY_DATA_FS
value: "/tmp/caddy" value: "/tmp/caddy"
- name: CADDY_APP_ROOT_PUBLIC - name: CADDY_APP_ROOT_PUBLIC
value: "/app/public/" value: "/app/public/"
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http name: http
resources: {} resources: {}
securityContext: securityContext:
runAsNonRoot: true runAsNonRoot: true
runAsGroup: 1000 runAsGroup: 1000
runAsUser: 1000 runAsUser: 1000
restartPolicy: Always restartPolicy: Always
volumes: volumes:
- name: hydra-dispatcher-apps - name: hydra-dispatcher-apps
configMap: configMap:
name: hydra-dispatcher-apps name: hydra-dispatcher-apps

6
resources/hydra-dispatcher/resources/hydra-dispatcher-service.yaml
View File

@ -6,9 +6,9 @@ metadata:
name: hydra-dispatcher name: hydra-dispatcher
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
targetPort: http targetPort: http
selector: selector:
app.kubernetes.io/name: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
status: status: