CadolesKube/sso-kustom
15
0
Fork 0
Code Issues 20 Pull Requests 6 Projects Releases Wiki Activity

fix: example app deployment with saml login app

Browse Source
This commit is contained in:
wpetit
2023-11-02 18:32:37 +01:00
parent 8075071f22
commit 8fe8423071
31 changed files with 540 additions and 203 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
examples/authenticated-app/resources/app-deployment.yaml
View File

@ -1,40 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: app
name: app
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: app
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: app
spec:
containers:
- image: bornholm/oidc-test:v0.0.0-1-g936a77e
name: app
ports:
- containerPort: 8080
resources: {}
env:
- name: LOG_LEVEL
value: "0"
- name: HTTP_ADDRESS
value: 0.0.0.0:8080
- name: OIDC_CLIENT_ID
value: oidc-test
- name: OIDC_CLIENT_SECRET
value: oidc-test-123456
- name: OIDC_ISSUER_URL
value: http://ssokustom:8080/auth
- name: OIDC_REDIRECT_URL
value: http://ssokustom:8080
- name: OIDC_POST_LOGOUT_REDIRECT_URL
value: http://ssokustom:8080
restartPolicy: Always

15
examples/authenticated-app/resources/app-service.yaml
View File

@ -1,15 +0,0 @@
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: app
name: app
spec:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
io.kompose.service: app
status:
loadBalancer: {}

66
examples/authenticated-app/resources/app.yaml Normal file
View File

@ -0,0 +1,66 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: app
name: app
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: app
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: app
spec:
containers:
- image: reg.cadoles.com/cadoles/oidc-test:2023.11.6-stable.1557.e16b905
name: app
ports:
- containerPort: 8080
resources: {}
env:
- name: LOG_LEVEL
value: "0"
- name: HTTP_ADDRESS
value: 0.0.0.0:8080
- name: OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_id
- name: OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_secret
- name: OIDC_ISSUER_URL
value: http://hydra:4444
- name: OIDC_REDIRECT_URL
value: https://ssokustom/oauth2/callback
- name: OIDC_POST_LOGOUT_REDIRECT_URL
value: https://ssokustom
- name: OIDC_SKIP_ISSUER_VERIFICATION
value: "true"
- name: OIDC_INSECURE_SKIP_VERIFY
value: "true"
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: app
name: app
spec:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
io.kompose.service: app
status:
loadBalancer: {}

10
examples/authenticated-app/resources/ingress-prefix-traefik-middleware.yaml
View File

@ -1,10 +0,0 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: ingress-prefix
spec:
stripPrefixRegex:
regex:
- ^/auth/dispatcher
- ^/auth/saml
- ^/auth

118
examples/authenticated-app/resources/ingress.yaml
View File

@ -1,11 +1,18 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: portal
name: app
annotations:
ingress.kubernetes.io/ssl-redirect: "false"
traefik.ingress.kubernetes.io/router.middlewares: default-ingress-prefix@kubernetescrd
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
cert-manager.io/issuer: "self-signed"
# nginx.ingress.kubernetes.io/configuration-snippet: |
# more_set_headers "X-Forwarded-Proto: https";
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
@ -16,28 +23,109 @@ spec:
name: app
port:
name: http
- path: /auth/dispatcher
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-saml
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/saml(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra-saml
port:
name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-dispatcher
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/x-forwarded-prefix: /auth/dispatcher
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/dispatcher(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra-dispatcher
port:
name: http
- path: /auth
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra
port:
name: hydra-public
# - path: /auth/passwordless/?(.*)
# pathType: Prefix
# backend:
# service:
# name: hydra
# port:
# name: http-public
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: saml-idp
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /simplesaml/$2
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /simplesaml(/|$)(.*)
pathType: Prefix
backend:
service:
name: saml-idp
port:
name: https

18
examples/authenticated-app/resources/oauth2-client.yaml Normal file
View File

@ -0,0 +1,18 @@
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
name: app-oauth2-client
spec:
clientName: "app"
tokenEndpointAuthMethod: "client_secret_basic"
grantTypes:
- authorization_code
- refresh_token
responseTypes:
- code
scope: "openid email"
secretName: app-oidc-secret
redirectUris:
- https://ssokustom/oauth2/callback
postLogoutRedirectUris:
- https://ssokustom

29
examples/authenticated-app/resources/port-forwarder-deployment.yaml
View File

@ -1,29 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: port-forwarder
name: port-forwarder
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: port-forwarder
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: port-forwarder
spec:
containers:
- image: hpello/tcp-proxy:latest
name: port-forwarder
env:
- name: LISTEN_PORT
value: "8080"
ports:
- containerPort: 8080
resources: {}
args: ["traefik.kube-system.svc.cluster.local", "80"]
restartPolicy: Always

12
examples/authenticated-app/resources/port-forwarder-service.yaml
View File

@ -1,12 +0,0 @@
kind: Service
apiVersion: v1
metadata:
name: ssokustom
labels:
io.kompose.service: port-forwarder
spec:
ports:
- port: 8080
targetPort: 8080
selector:
io.kompose.service: port-forwarder

55
examples/authenticated-app/resources/port-forwarder.yaml Normal file
View File

@ -0,0 +1,55 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: port-forwarder
name: port-forwarder
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: port-forwarder
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: port-forwarder
spec:
containers:
- image: hpello/tcp-proxy:latest
name: port-forwarder-https
env:
- name: LISTEN_PORT
value: "443"
ports:
- containerPort: 443
resources: {}
args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "443"]
- image: hpello/tcp-proxy:latest
name: port-forwarder-http
env:
- name: LISTEN_PORT
value: "80"
ports:
- containerPort: 80
resources: {}
args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "80"]
restartPolicy: Always
---
kind: Service
apiVersion: v1
metadata:
name: ssokustom
labels:
io.kompose.service: port-forwarder
spec:
ports:
- name: https
port: 443
targetPort: 443
- name: http
port: 80
targetPort: 80
selector:
io.kompose.service: port-forwarder

51
examples/authenticated-app/resources/saml-idp.yaml Normal file
View File

@ -0,0 +1,51 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: saml-idp
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: saml-idp
spec:
containers:
- image: kristophjunge/test-saml-idp:1.15
name: saml-idp
ports:
- containerPort: 8443
resources: {}
env:
- name: SIMPLESAMLPHP_SP_ENTITY_ID
value: https://ssokustom/auth/saml
- name: SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/SAML2/POST
- name: SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=https://ssokustom
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
ports:
- name: http
port: 8080
targetPort: 8080
- name: https
port: 8443
targetPort: 8443
selector:
io.kompose.service: saml-idp
status:
loadBalancer: {}

6
examples/authenticated-app/resources/self-signed-issuer.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: self-signed
spec:
selfSigned: {}