fix: use hydra-ldap and olm operator to fix example

2025-02-13 17:02:48 +01:00
parent c97266c272
commit c01eb28d8c
34 changed files with 729 additions and 461 deletions
--- a/resources/hydra-dispatcher/files/hydra/default.yaml
+++ b/resources/hydra-dispatcher/files/hydra/default.yaml
@ -15,3 +15,5 @@ hydra:
  firewall:
    additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
    rules: {}
+  webhook_post_login:
+    enabled: false
--- a/resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml
+++ b/resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml
@ -3,6 +3,7 @@ kind: Deployment
 metadata:
  labels:
    app.kubernetes.io/name: hydra-dispatcher
+    com.cadoles.forge.sso-kustom/session: redis
  name: hydra-dispatcher
 spec:
  replicas: 1
@ -17,101 +18,101 @@ spec:
        app.kubernetes.io/name: hydra-dispatcher
    spec:
      containers:
-      - name: hydra-dispatcher-php-fpm
-        image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
-        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
-        readinessProbe:
-          exec:
-            command:
-            - sh
-            - -c
-            - test -f /etc/php81/php-fpm.d/www.conf
-        livenessProbe:
-          exec:
-            command:
-            - php
-            - bin/console
-            - -V
-          initialDelaySeconds: 10
-          periodSeconds: 30
-        env:
-        - name: PHP_FPM_LISTEN
-          value: 127.0.0.1:9000
-        - name: PHP_MEMORY_LIMIT
-          value: 128m
-        - name: PHP_FPM_MEMORY_LIMIT
-          value: 128m
-        - name: OPCACHE_VALIDATE_TIMESTAMP
-          value: "0"
-        - name: OPCACHE_REVALIDATE_FREQ
-          value: "0"
-        envFrom:
-        - configMapRef:
-            name: hydra-dispatcher-env
-        volumeMounts:
-        - mountPath: /app/config/hydra
-          name: hydra-dispatcher-apps
-        - name: hydra-dispatcher-php-ini
-          mountPath: /etc/php81/conf.d/03_base.ini
-          subPath: 03_base.ini
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
-      - name: hydra-dispatcher-caddy
-        image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
-        imagePullPolicy: IfNotPresent
-        args:
-          [
-            "/usr/sbin/caddy",
-            "run",
-            "--adapter",
-            "caddyfile",
-            "--config",
-            "/etc/caddy/Caddyfile",
-          ]
-        readinessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-          periodSeconds: 10
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 8080
-          initialDelaySeconds: 15
-          timeoutSeconds: 5
-          periodSeconds: 15
-        envFrom:
-        - configMapRef:
-            name: hydra-dispatcher-env
-        env:
-        - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
-          value: 127.0.0.1:9000
-        - name: CADDY_HTTPS_PORT
-          value: "8443"
-        - name: CADDY_HTTP_PORT
-          value: "8080"
-        - name: CADDY_DATA_FS
-          value: "/tmp/caddy"
-        - name: CADDY_APP_ROOT_PUBLIC
-          value: "/app/public/"
-        ports:
-        - containerPort: 8080
-          name: http
-        resources: {}
-        securityContext:
-          runAsNonRoot: true
-          runAsGroup: 1000
-          runAsUser: 1000
+        - name: hydra-dispatcher-php-fpm
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+                - sh
+                - -c
+                - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+                - php
+                - bin/console
+                - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+            - name: PHP_FPM_LISTEN
+              value: 127.0.0.1:9000
+            - name: PHP_MEMORY_LIMIT
+              value: 128m
+            - name: PHP_FPM_MEMORY_LIMIT
+              value: 128m
+            - name: OPCACHE_VALIDATE_TIMESTAMP
+              value: "0"
+            - name: OPCACHE_REVALIDATE_FREQ
+              value: "0"
+          envFrom:
+            - configMapRef:
+                name: hydra-dispatcher-env
+          volumeMounts:
+            - mountPath: /app/config/hydra
+              name: hydra-dispatcher-apps
+            - name: hydra-dispatcher-php-ini
+              mountPath: /etc/php81/conf.d/03_base.ini
+              subPath: 03_base.ini
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
+        - name: hydra-dispatcher-caddy
+          image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
+          imagePullPolicy: IfNotPresent
+          args:
+            [
+              "/usr/sbin/caddy",
+              "run",
+              "--adapter",
+              "caddyfile",
+              "--config",
+              "/etc/caddy/Caddyfile",
+            ]
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 15
+            timeoutSeconds: 5
+            periodSeconds: 15
+          envFrom:
+            - configMapRef:
+                name: hydra-dispatcher-env
+          env:
+            - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
+              value: 127.0.0.1:9000
+            - name: CADDY_HTTPS_PORT
+              value: "8443"
+            - name: CADDY_HTTP_PORT
+              value: "8080"
+            - name: CADDY_DATA_FS
+              value: "/tmp/caddy"
+            - name: CADDY_APP_ROOT_PUBLIC
+              value: "/app/public/"
+          ports:
+            - containerPort: 8080
+              name: http
+          resources: {}
+          securityContext:
+            runAsNonRoot: true
+            runAsGroup: 1000
+            runAsUser: 1000
      restartPolicy: Always
      volumes:
-      - name: hydra-dispatcher-apps
-        configMap:
-          name: hydra-dispatcher-apps
-      - name: hydra-dispatcher-php-ini
-        configMap:
-          name: hydra-dispatcher-php-ini
+        - name: hydra-dispatcher-apps
+          configMap:
+            name: hydra-dispatcher-apps
+        - name: hydra-dispatcher-php-ini
+          configMap:
+            name: hydra-dispatcher-php-ini
--- a/resources/hydra/kustomization.yaml
+++ b/resources/hydra/kustomization.yaml
@ -2,42 +2,45 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 images:
- name: reg.cadoles.com/proxy_cache/oryd/hydra
-  newTag: v2.1.2
- name: reg.cadoles.com/proxy_cache/oryd/hydra-maester
-  newTag: v0.0.32-amd64
+  - name: reg.cadoles.com/proxy_cache/oryd/hydra
+    newTag: v2.1.2
+  - name: reg.cadoles.com/proxy_cache/oryd/hydra-maester
+    newTag: v0.0.32-amd64

 resources:
- ./resources/hydra-deployment.yaml
- ./resources/hydra-service.yaml
- ./resources/hydra-role.yaml
- ./resources/hydra-rolebinding.yaml
- ./resources/hydra-serviceaccount.yaml
- ./resources/hydra-migrate-job.yaml
- ./resources/hydra-maester
- ./resources/hydra-janitor-cronjob.yaml
+  - ./resources/hydra-deployment.yaml
+  - ./resources/hydra-service.yaml
+  - ./resources/hydra-role.yaml
+  - ./resources/hydra-rolebinding.yaml
+  - ./resources/hydra-serviceaccount.yaml
+  - ./resources/hydra-migrate-job.yaml
+  - ./resources/hydra-maester
+  - ./resources/hydra-janitor-cronjob.yaml

 secretGenerator:
- name: hydra-secret
-  literals:
-  - SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged
+  - name: hydra-secret
+    literals:
+      - SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged

 configMapGenerator:
- name: hydra-env
-  literals:
-  - URLS_SELF_ISSUER=http://localhost:4444
-  - URLS_LOGIN=http://hydra-login-app/login
-  - URLS_CONSENT=http://hydra-consent-app/consent
-  - URLS_LOGOUT=http://hydra-logout-app/logout
-  - HYDRA_SERVE_ALL_ARGS=--dev
-  - HYDRA_DATABASE_MAX_CONN="10"
-  - LOG_LEVEL=info
+  - name: hydra-env
+    literals:
+      - URLS_SELF_ISSUER=http://localhost:4444
+      - URLS_LOGIN=http://hydra-login-app/login
+      - URLS_CONSENT=http://hydra-consent-app/consent
+      - URLS_LOGOUT=http://hydra-logout-app/logout
+      - HYDRA_SERVE_ALL_ARGS=--dev
+      - HYDRA_DATABASE_MAX_CONN="10"
+      - LOG_LEVEL=info

-vars:
- name: HYDRA_MIGRATE_JOB_NAME
-  objref:
-    name: hydra-migrate
-    kind: Job
-    apiVersion: batch/v1
-  fieldref:
-    fieldpath: metadata.name
+replacements:
+  - source:
+      kind: Job
+      name: hydra-migrate
+      fieldPath: metadata.name
+    targets:
+      - select:
+          kind: Deployment
+          name: hydra
+        fieldPaths:
+          - spec.template.spec.initContainers.0.args.1
--- a/resources/hydra/resources/hydra-deployment.yaml
+++ b/resources/hydra/resources/hydra-deployment.yaml
@ -21,8 +21,8 @@ spec:
        - name: wait-for-migrate
          image: reg.cadoles.com/proxy_cache/groundnuty/k8s-wait-for:v1.3
          args:
-          - job
-          - $(HYDRA_MIGRATE_JOB_NAME)
+            - job
+            - REPLACE_ME
      containers:
        - name: hydra
          image: reg.cadoles.com/proxy_cache/oryd/hydra:v2.0.3
@ -57,4 +57,3 @@ spec:
              name: hydra-admin
          resources: {}
      restartPolicy: Always
-  
--- a/resources/hydra/resources/hydra-maester/resources/hydra-maester-deployment.yaml
+++ b/resources/hydra/resources/hydra-maester/resources/hydra-maester-deployment.yaml
@ -7,7 +7,7 @@ metadata:
  labels:
    app.kubernetes.io/name: hydra-maester
    app.kubernetes.io/instance: hydra-master
-    app.kubernetes.io/version: "v0.0.23"
+    app.kubernetes.io/version: "v0.0.25"
 spec:
  replicas: 1
  revisionHistoryLimit: 10
@ -38,15 +38,14 @@ spec:
            - --hydra-url=$(HYDRA_ADMIN_BASE_URL)
            - --hydra-port=$(HYDRA_ADMIN_PORT)
            - --endpoint=/admin/clients
-          resources:
-            {}
+          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
-              - ALL
+                - ALL
            privileged: false
            readOnlyRootFilesystem: true
            runAsNonRoot: true