no-crd-in-deploy

Reviewed-on: #7

components/hydra-cnpg-database/kustomization.yaml

@@ -29,7 +29,7 @@ vars:
   fieldref:
     fieldpath: metadata.name
 
-patchesJson6902:
+patches:
 - target:
     group: apps
     version: v1
@@ -42,3 +42,9 @@ patchesJson6902:
     kind: Job
     name: hydra-migrate
   path: patches/hydra-migrate-job.yaml
+- target:
+    group: batch
+    version: v1
+    kind: CronJob
+    name: hydra-janitor
+  path: patches/hydra-janitor-cronjob.yaml

components/hydra-cnpg-database/patches/hydra-janitor-cronjob.yaml

@@ -0,0 +1,21 @@
+- op: add
+  path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
+  value:
+    name: HYDRA_DATABASE_USER
+    valueFrom:
+      secretKeyRef:
+        name: hydra-postgres-user
+        key: username
+- op: add
+  path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
+  value:
+    name: HYDRA_DATABASE_PASSWORD
+    valueFrom:
+      secretKeyRef:
+        name: hydra-postgres-user
+        key: password
+- op: add
+  path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
+  value:
+    name: DSN
+    value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"

components/hydra-ldap/kustomization.yaml

@@ -0,0 +1,26 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - ./resources/deployment.yaml
+  - ./resources/service.yaml
+
+configMapGenerator:
+  - name: hydra-ldap-env
+    literals:
+      - WERTHER_DEV_MODE=false
+      - WERTHER_LDAP_ROLE_CLAIM="https://hydra/claims/roles"
+      - WERTHER_SKIP_SSL_VERIFICATIONS=false
+      - WERTHER_IDENTP_CLAIM_SCOPES="name:profile,family_name:profile,given_name:profile,email:email,https%3A%2F%2Fhydra%2Fclaims%2Froles:roles"
+      - WERTHER_IDENTP_HYDRA_URL="http://hydra:4444"
+      - WERTHER_LDAP_ENDPOINTS="ldap.test.fr:636"
+      - WERTHER_LDAP_IS_TLS=true
+      - WERTHER_LDAP_BASEDN="o=test,c=fr"
+      - WERTHER_LDAP_ROLE_BASEDN="ou=groups,o=test,c=fr"
+      - WERTHER_LDAP_CONNECTION_TIMEOUT="10s"
+
+secretGenerator:
+  - name: hydra-ldap-sc
+    literals:
+      - WERTHER_LDAP_BINDDN="cn=reader,o=test,c=fr"
+      - WERTHER_LDAP_BINDPW=ThisMustBeAbsolutelyChanged

components/hydra-ldap/resources/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hydra-ldap
+  namespace: default
+  labels:
+    app.kubernetes.io/name: hydra-ldap
+    app.kubernetes.io/version: "v1.2.2"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: hydra-ldap
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: hydra-ldap
+        app.kubernetes.io/version: "v1.2.2"
+    spec:
+      containers:
+        - name: werther
+          image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: hydra-ldap-env
+          env:
+            - name: WERTHER_WEB_DIR
+              value: "/usr/share/werther/login/"
+            - name: WERTHER_LDAP_BINDDN
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDDN
+            - name: WERTHER_LDAP_BINDPW
+              valueFrom:
+                secretKeyRef:
+                  name: hydra-ldap-sc
+                  key: WERTHER_LDAP_BINDPW
+          ports:
+            - containerPort: 8080
+              name: hydra-ldap-http
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 100

components/hydra-ldap/resources/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-ldap
+  name: hydra-ldap
+spec:
+  type: ClusterIP
+  ports:
+    - name: hydra-ldap
+      port: 8080
+      targetPort: hydra-ldap-http
+      protocol: TCP
+  selector:
+    app.kubernetes.io/name: hydra-ldap
+status:
+  loadBalancer: {}

components/hydra-oidc/files/hydra/oidc.yaml

@@ -1,12 +1,13 @@
 hydra:
   apps:
     - id: oidc
-      title: 
+      title:
         fr: Connexion OIDC
         en: Login OIDC
-      description: 
+      description:
         fr: Authentification avec OpenID Connect
         en: Authentication with OpenID Connect
       login_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGIN_URL)%"
       consent_url: "%env(string:HYDRA_DISPATCHER_OIDC_CONSENT_URL)%"
-      logout_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGOUT_URL)%"
+      logout_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGOUT_URL)%"
+      attributes_rewrite_configuration: []

components/hydra-oidc/kustomization.yaml

@@ -10,6 +10,8 @@ configMapGenerator:
     literals:
       - APP_ENV=prod
       - APP_DEBUG=false
+      - PHP_FPM_MEMORY_LIMIT=256m
+      - NGINX_APP_SERVER_LISTEN=80
       - HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
       - OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize
       - OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token
@@ -24,14 +26,14 @@ configMapGenerator:
       - CLIENT_SECRET_FC=MyClientSecret
       - COOKIE_PATH=/
       - TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
-  - name: hydra-dispatcher-apps
+  # - name: hydra-dispatcher-apps
-    behavior: merge
+  #   behavior: merge
-    files:
+  #   files:
-      - ./files/hydra/oidc.yaml
+  #     - apps.yaml=./files/hydra/oidc.yaml
 
 patchesJson6902:
   - target:
       version: v1
       kind: ConfigMap
       name: hydra-dispatcher-env
-    path: patches/hydra-dispatcher-env.yaml
+    path: patches/hydra-dispatcher-env.yaml

components/hydra-oidc/resources/hydra-oidc-deployment.yaml

@@ -17,13 +17,70 @@ spec:
         io.kompose.service: hydra-oidc
     spec:
       containers:
-        - name: hydra-oidc
+        - name: hydra-oidc-php-fpm
-          image: reg.cadoles.com/cadoles/hydra-oidc-v1:v0.0.0-170-g485b138
+          image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035
+          imagePullPolicy: Always
+          args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+          readinessProbe:
+            exec:
+              command:
+              - sh
+              - -c
+              - test -f /etc/php81/php-fpm.d/www.conf
+          livenessProbe:
+            exec:
+              command:
+              - php
+              - bin/console
+              - -V
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          env:
+          - name: PHP_FPM_LISTEN
+            value: 127.0.0.1:9000
+          - name: PHP_MEMORY_LIMIT
+            value: 128m
+          - name: PHP_FPM_MEMORY_LIMIT
+            value: 128m
           envFrom:
             - configMapRef:
                 name: hydra-oidc-env
+          resources: {}
+
+        - image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035
+          imagePullPolicy: Always
+          name: hydra-oidc-nginx
+          args: ["/usr/sbin/nginx"]
+          readinessProbe:
+            httpGet:
+              path: /healthy
+              port: 80
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthy
+              port: 80
+            initialDelaySeconds: 15
+            timeoutSeconds: 5
+            periodSeconds: 15
+          envFrom:
+            - configMapRef:
+                name: hydra-oidc-env
+          env:
+          - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+            value: 127.0.0.1:9000
+          - name: NGINX_APP_ROOT
+            value: "/public/"
+          - name: NGINX_APP_PHP_INDEX
+            value: "/index.php"
+          - name: NGINX_ERROR_LOG_LEVEL
+            value: "warn"
+          - name: NGINX_APP_PHP_NON_FILE_PATTERN
+            value: "^/index\\.php(/|$)"
           ports:
-            - containerPort: 80
+          - containerPort: 8080
           resources: {}
       restartPolicy: Always
-            
+

components/hydra-saml/files/hydra/saml.yaml

@@ -1,13 +1,30 @@
 hydra:
   apps:
     - id: saml
-      title: 
+      title:
         fr: Connexion SAML
         en: Login SAML
-      description: 
+      description:
         fr: Authentification avec SAML
         en: Authentication with SAML
       login_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGIN_URL)%"
       consent_url: "%env(string:HYDRA_DISPATCHER_SAML_CONSENT_URL)%"
       logout_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGOUT_URL)%"
-      attributes_rewrite_rules: []
+      attributes_rewrite_configuration:
+        uid:
+          rules:
+          - "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
+        email:
+          rules:
+          - "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
+        eduPersonAffiliation:
+          rules:
+          - "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
+  firewall:
+    rules:
+      email:
+        required: false
+      uid:
+        required: false
+      eduPersonAffiliation:
+        required: false

components/hydra-saml/files/shibboleth-sp/attribute-map.inc.xml

@@ -0,0 +1,3 @@
+<Attribute name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="uid" />
+<Attribute name="eduPersonAffiliation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="eduPersonAffiliation" />
+<Attribute name="email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email" />

components/hydra-saml/kustomization.yaml

@@ -2,10 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
 kind: Component
 
 resources:
-  - ./resources/hydra-saml-service.yaml
+  - ./resources/hydra-saml-shibboleth-sp.yaml
-  - ./resources/hydra-saml-shibboleth-sp-deployment.yaml
+  - ./resources/hydra-saml-remote-user.yaml
-  - ./resources/hydra-saml-remote-user-deployment.yaml
-  - ./resources/hydra-saml-remote-user-service.yaml
 
 configMapGenerator:
   - name: hydra-saml-env
@@ -18,6 +16,7 @@ configMapGenerator:
       - HYDRA_ADMIN_BASE_URL=http://hydra:4445/admin
       - TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
       - LOGOUT_REDIRECT_URL_PATTERN=http://hydra-saml/Shibboleth.sso/Logout?return=%s'
+      - PATH_PREFIX=
       # Shibboleth SP environment variables
       - SP_ENTITY_ID=http://hydra-saml-shibboleth-sp
       - IDP_ENTITY_ID=http://saml-idp
@@ -29,10 +28,13 @@ configMapGenerator:
     behavior: merge
     files:
       - ./files/hydra/saml.yaml
+  - name: hydra-saml-shibboleth-sp
+    files:
+      - ./files/shibboleth-sp/attribute-map.inc.xml
 
 patchesJson6902:
   - target:
       version: v1
       kind: ConfigMap
       name: hydra-dispatcher-env
-    path: patches/hydra-dispatcher-env.yaml
+    path: patches/hydra-dispatcher-env.yaml

components/hydra-saml/resources/hydra-saml-remote-user-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    io.kompose.service: hydra-saml-remote-user
-  name: hydra-saml-remote-user
-spec:
-  ports:
-    - name: hydra-saml-remote-user
-      port: 80
-  selector:
-    io.kompose.service: hydra-saml-remote-user
-status:
-  loadBalancer: {}

components/hydra-saml/resources/hydra-saml-remote-user.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: hydra-saml-remote-user
-          image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-170-g485b138
+          image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-233-g64fcacc
           envFrom:
             - configMapRef:
                 name: hydra-saml-env
@@ -26,4 +26,18 @@ spec:
             - containerPort: 80
           resources: {}
       restartPolicy: Always
-            
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-saml-remote-user
+  name: hydra-saml-remote-user
+spec:
+  ports:
+    - name: http
+      port: 80
+  selector:
+    io.kompose.service: hydra-saml-remote-user
+status:
+  loadBalancer: {}

components/hydra-saml/resources/hydra-saml-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    io.kompose.service: hydra-saml
-  name: hydra-saml
-spec:
-  ports:
-    - name: hydra-saml-shibboleth-sp
-      port: 80
-  selector:
-    io.kompose.service: hydra-saml-shibboleth-sp
-status:
-  loadBalancer: {}

components/hydra-saml/resources/hydra-saml-shibboleth-sp.yaml

@@ -16,14 +16,39 @@ spec:
       labels:
         io.kompose.service: hydra-saml-shibboleth-sp
     spec:
+      securityContext:
+        fsGroup: 102
       containers:
         - name: hydra-saml-shibboleth-sp
-          image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-172-g0f44679
+          image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-233-g64fcacc
           envFrom:
             - configMapRef:
                 name: hydra-saml-env
+          volumeMounts:
+            - name: attributes-map-inc
+              mountPath: /etc/shibboleth/attribute-map.inc.xml
+              subPath: attribute-map.inc.xml
           ports:
             - containerPort: 80
           resources: {}
       restartPolicy: Always
-            
+      volumes:
+        - name: attributes-map-inc
+          configMap:
+            name: hydra-saml-shibboleth-sp
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-saml
+  name: hydra-saml
+spec:
+  ports:
+    - name: http
+      port: 80
+  selector:
+    io.kompose.service: hydra-saml-shibboleth-sp
+status:
+  loadBalancer: {}
+

components/hydra-sql/files/sql_login.yaml

@@ -0,0 +1,7 @@
+sql_login:
+  login_column_name: mail
+  password_column_name: password
+  salt_column_name: salt
+  table_name: user
+  data_to_fetch:
+  - mail

components/hydra-sql/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- ./resources/hydra-sql-service.yaml
+- ./resources/hydra-sql-deployment.yaml
+
+configMapGenerator:
+- name: hydra-sql-env
+  literals:
+  - ISSUER_URL="http://localhost:8000"
+  - BASE_URL='http://localhost:8080'
+  - HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
+  - APP_LOCALES="fr,en"
+  - HASH_ALGO_LEGACY="sha256, bcrypt"
+  - SECURITY_PATTERN="password,salt,pepper"
+  - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
+  - DB_USER="makeMeASecret"
+  - DB_PASSWORD="makeMeASecret"
+  - PEPPER="MakeMeABigSecret"
+- name: sql-login-config
+  files:
+  - ./files/sql_login.yaml

components/hydra-sql/resources/hydra-sql-deployment.yaml

@@ -0,0 +1,100 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.kompose.service: hydra-sql
+  name: hydra-sql
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: hydra-sql
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        io.kompose.service: hydra-sql
+    spec:
+      containers:
+      - name: hydra-sql-fpm
+        image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1
+        imagePullPolicy: Always
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        resources: {}
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_LOG_LEVEL
+          value: warning
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
+
+      - name: hydra-sql-nginx
+        image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1
+        imagePullPolicy: Always
+        args: ["/usr/sbin/nginx"]
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8080
+          initialDelaySeconds: 15
+          timeoutSeconds: 5
+          periodSeconds: 15
+        envFrom:
+        - configMapRef:
+            name: hydra-sql-env
+        env:
+        - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
+        - name: NGINX_APP_ROOT
+          value: "/public"
+        - name: NGINX_APP_PHP_INDEX
+          value: "/index.php"
+        - name: NGINX_ERROR_LOG_LEVEL
+          value: "warn"
+        - name: NGINX_APP_PHP_NON_FILE_PATTERN
+          value: "^/index\\.php(/|$)"
+        resources: {}
+        ports:
+        - containerPort: 8080
+        volumeMounts:
+        - name: sql-login-config
+          mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
+          subPath: "sql_login.yaml"
+      volumes:
+      - name: sql-login-config
+        configMap:
+          name: sql-login-config
+
+      restartPolicy: Always

components/hydra-sql/resources/hydra-sql-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: hydra-sql
+  name: hydra-sql
+spec:
+  ports:
+  - name: hydra-sql
+    port: 8080
+  selector:
+    io.kompose.service: hydra-sql
+status:
+  loadBalancer: {}

components/oidc-test/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - ./resources/deployment.yaml
+  - ./resources/service.yaml
+  - ./resources/oauth2-client.yaml
+
+configMapGenerator:
+  - name: oidc-test-env
+    literals:
+      - LOG_LEVEL=0
+      - HTTP_ADDRESS=0.0.0.0:8080
+      - OIDC_CLIENT_ID=oidc-test
+      - OIDC_CLIENT_SECRET=NotSoSecret
+      - OIDC_ISSUER_URL=http://hydra:4444
+      - OIDC_REDIRECT_URL=https://example.net/oauth2/callback
+      - OIDC_POST_LOGOUT_REDIRECT_URL=https://example.net
+      - OIDC_SKIP_ISSUER_VERIFICATION="true"
+      - OIDC_INSECURE_SKIP_VERIFY="true"

components/oidc-test/resources/deployment.yaml

@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: oidc-test
+  name: oidc-test
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oidc-test
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oidc-test
+    spec:
+      containers:
+        - image: reg.cadoles.com/cadoles/oidc-test:2023.12.6-stable.1502.ebfd504
+          name: oidc-test
+          ports:
+            - containerPort: 8080
+          resources: {}
+          envFrom:
+          - configMapRef:
+              name: oidc-test-env
+          env:
+          - name: OIDC_CLIENT_ID
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_id
+          - name: OIDC_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: oidc-test-oauth2-client
+                key: client_secret
+      restartPolicy: Always

components/oidc-test/resources/oauth2-client.yaml

@@ -0,0 +1,18 @@
+apiVersion: hydra.ory.sh/v1alpha1
+kind: OAuth2Client
+metadata:
+  name: oidc-test-oauth2-client
+spec:
+  clientName: "oidc-test"
+  tokenEndpointAuthMethod: "client_secret_basic"
+  grantTypes:
+  - authorization_code
+  - refresh_token
+  responseTypes:
+  - code
+  scope: "openid email"
+  secretName: oidc-test-oauth2-client
+  redirectUris:
+  - https://example.net/oauth2/callback
+  postLogoutRedirectUris:
+  - https://example.net

components/oidc-test/resources/service.yaml

@@ -2,14 +2,14 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    io.kompose.service: app
+    app.kubernetes.io/name: oidc-test
-  name: app
+  name: oidc-test
 spec:
   ports:
     - name: http
       port: 8080
       targetPort: 8080
   selector:
-    io.kompose.service: app
+    app.kubernetes.io/name: oidc-test
 status:
-  loadBalancer: {}
+  loadBalancer: {}

examples/authenticated-app/README.md

@@ -1,19 +1,21 @@
 # Exemple: Déploiement d'une application authentifiée avec la stack SSO
 
+L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
+
 ## Procédure
 
-### Avec `k3d`
+### Avec `kind`
 
-1. Créer un cluster avec `k3d`
+1. Créer un cluster avec `kind`
 
     ```
-    k3d cluster create -c ./examples/k8s/k3d/k3d/cluster-config.yaml
+    kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
     ```
 
 2. Déployer les opérateurs nécessaires au déploiement
 
     ```
-    kubectl apply -k ./examples/k8s/k3d/cluster
+    kubectl kustomize --enable-helm ./examples/k8s/kind/cluster | kubectl apply -f -
     ```
 
 3. Déployer l'application
@@ -22,4 +24,38 @@
     kubectl apply -k ./examples/authenticated-app
     ```
 
-Après stabilisation du déploiement, l'application devrait être accessible à l'adresse http://localhost:8080/
+   **Note** Il est possible d'avoir l'erreur suivante:
+
+   ```
+   error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
+   ```
+
+   Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
+
+4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
+
+    ```
+    127.0.0.1 ssokustom
+    ```
+
+5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
+
+#### Supprimer le cluster
+
+```
+kind delete cluster -n sso-kustom-example
+```
+
+## Authentification
+
+### SAML
+
+- Utilisateur: `user1`
+- Mot de passe `user1pass`
+
+#### URL utiles
+
+|URL|Description|
+|---|-----------|
+|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
+|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|

examples/authenticated-app/kustomization.yaml

@@ -2,19 +2,11 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../resources/hydra
+  - ../../overlays/full
-  - ../../resources/hydra-dispatcher
-  - ./resources/app-deployment.yaml
-  - ./resources/app-service.yaml
   - ./resources/ingress.yaml
-  - ./resources/ingress-prefix-traefik-middleware.yaml
+  - ./resources/saml-idp.yaml
-  - ./resources/port-forwarder-deployment.yaml
+  - ./resources/self-signed-issuer.yaml
-  - ./resources/port-forwarder-service.yaml
+  - ./resources/port-forwarder.yaml
-
-components:
-  - ../../components/hydra-cnpg-database
-  #- ../../components/hydra-oidc
-  - ../../components/hydra-saml
 
 patchesJson6902:
   - target:
@@ -36,4 +28,14 @@ patchesJson6902:
       version: v1
       kind: Secret
       name: hydra-secret
-    path: patches/hydra-secret.yaml
+    path: patches/hydra-secret.yaml
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: oidc-test
+    path: patches/oidc-test.yaml
+  - target:
+      version: v1alpha1
+      kind: OAuth2Client
+      name: oidc-test-oauth2-client
+    path: patches/oidc-test-oauth2-client.yaml

examples/authenticated-app/patches/hydra-dispatcher-env.yaml

@@ -1,18 +1,30 @@
 - op: replace
   path: "/data/HYDRA_BASE_URL"
-  value: http://ssokustom:8080/auth
+  value: http://hydra:4444
 - op: replace
   path: "/data/HYDRA_ADMIN_BASE_URL"
   value: http://hydra:4445/admin
 - op: replace
   path: "/data/HYDRA_ORIGINAL_ISSUER"
-  value: http://ssokustom:8080/auth
+  value: http://hydra:4444
 - op: replace
   path: "/data/HYDRA_NEW_ISSUER"
-  value: http://ssokustom:8080/auth/dispatcher/
+  value: https://ssokustom/auth/dispatcher
 - op: replace
   path: "/data/BASE_URL"
-  value: http://ssokustom:8080/auth/dispatcher
+  value: https://ssokustom/auth/dispatcher
 - op: replace
   path: "/data/COOKIE_PATH"
-  value: /auth/dispatcher
+  value: /auth/dispatcher
+
+# Hydra SAML configuration
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SAML_LOGIN_URL"
+  value: https://ssokustom/auth/saml/login
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SAML_CONSENT_URL"
+  value: https://ssokustom/auth/saml/consent
+- op: replace
+  path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
+  value: https://ssokustom/auth/saml/logout
+  

examples/authenticated-app/patches/hydra-env.yaml

@@ -1,15 +1,15 @@
 - op: replace
   path: "/data/URLS_SELF_ISSUER"
-  value: http://ssokustom:8080/auth
+  value: https://ssokustom/auth
 - op: replace
   path: "/data/URLS_LOGIN"
-  value: http://ssokustom:8080/auth/dispatcher/login
+  value: https://ssokustom/auth/dispatcher/login
 - op: replace
   path: "/data/URLS_LOGOUT"
-  value: http://ssokustom:8080/auth/dispatcher/logout
+  value: https://ssokustom/auth/dispatcher/logout
 - op: replace
   path: "/data/URLS_CONSENT"
-  value: http://ssokustom:8080/auth/dispatcher/consent
+  value: https://ssokustom/auth/dispatcher/consent
 - op: replace
   path: "/data/HYDRA_SERVE_ALL_ARGS"
   value: "--dev"

examples/authenticated-app/patches/hydra-saml-env.yaml

@@ -1,6 +1,6 @@
 - op: replace
   path: "/data/HTTP_BASE_URL"
-  value: http://ssokustom:8080/auth/saml
+  value: https://ssokustom/auth/saml
 - op: replace
   path: "/data/COOKIE_PATH"
   value: /auth/saml
@@ -9,23 +9,35 @@
   value: http://hydra-dispatcher
 - op: replace
   path: "/data/LOGOUT_REDIRECT_URL_PATTERN"
-  value: http://ssokustom:8080/auth/saml/Shibboleth.sso/Logout?return=%s
+  value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=%s
+- op: replace
+  path: "/data/PATH_PREFIX"
+  value: "/auth/saml"
 
 - op: replace
   path: "/data/SP_ENTITY_ID"
-  value: http://ssokustom:8080/auth/saml
+  value: https://ssokustom/auth/saml
 - op: replace
   path: "/data/IDP_ENTITY_ID"
-  value: http://ssokustom:8080/idp
+  value: https://ssokustom/simplesaml/saml2/idp/metadata.php
 - op: replace
   path: "/data/IDP_METADATA_URL"
-  value: http://ssokustom:8080/idp/metadata
+  value: https://ssokustom/simplesaml/saml2/idp/metadata.php
-- op: replace
-  path: "/data/APACHE_BACKEND_URL"
-  value: http://hydra-remote-user
 - op: replace
   path: "/data/APACHE_FORCE_HTTPS"
-  value: "false"
+  value: "true"
 - op: replace
   path: "/data/SP_HANDLER_BASE_PATH"
-  value: /auth/saml
+  value: "/auth/saml"
+- op: replace
+  path: "/data/SP_LOG_LEVEL"
+  value: DEBUG
+- op: replace
+  path: "/data/SP_SESSIONS_REDIRECT_LIMIT"
+  value: none
+- op: replace
+  path: "/data/SP_SESSIONS_REDIRECT_ALLOW"
+  value: https://ssokustom
+- op: replace
+  path: "/data/SP_SESSIONS_COOKIE_PROPS"
+  value: https

examples/authenticated-app/patches/oidc-test-oauth2-client.yaml

@@ -0,0 +1,6 @@
+- op: replace
+  path: "/spec/redirectUris/0"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/spec/postLogoutRedirectUris/0"
+  value: https://ssokustom

examples/authenticated-app/patches/oidc-test.yaml

@@ -0,0 +1,6 @@
+- op: replace
+  path: "/data/OIDC_REDIRECT_URL"
+  value: https://ssokustom/oauth2/callback
+- op: replace
+  path: "/data/OIDC_POST_LOGOUT_REDIRECT_URL"
+  value: https://ssokustom

examples/authenticated-app/resources/app-deployment.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    io.kompose.service: app
-  name: app
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: app
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        io.kompose.service: app
-    spec:
-      containers:
-        - image: bornholm/oidc-test:v0.0.0-1-g936a77e
-          name: app
-          ports:
-            - containerPort: 8080
-          resources: {}
-          env:
-            - name: LOG_LEVEL
-              value: "0"
-            - name: HTTP_ADDRESS
-              value: 0.0.0.0:8080
-            - name: OIDC_CLIENT_ID
-              value: oidc-test
-            - name: OIDC_CLIENT_SECRET
-              value: oidc-test-123456
-            - name: OIDC_ISSUER_URL
-              value: http://ssokustom:8080/auth
-            - name: OIDC_REDIRECT_URL
-              value: http://ssokustom:8080
-            - name: OIDC_POST_LOGOUT_REDIRECT_URL
-              value: http://ssokustom:8080
-      restartPolicy: Always

examples/authenticated-app/resources/ingress-prefix-traefik-middleware.yaml

@@ -1,10 +0,0 @@
-apiVersion: traefik.containo.us/v1alpha1
-kind: Middleware
-metadata:
-  name: ingress-prefix
-spec:
-  stripPrefixRegex:
-    regex:
-      - ^/auth/dispatcher
-      - ^/auth/saml
-      - ^/auth

examples/authenticated-app/resources/ingress.yaml

@@ -1,11 +1,18 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: portal
+  name: app
   annotations:
-    ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: default-ingress-prefix@kubernetescrd
+    cert-manager.io/issuer: "self-signed"
+    # nginx.ingress.kubernetes.io/configuration-snippet: |
+    #   more_set_headers "X-Forwarded-Proto: https";
 spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - ssokustom
+    secretName: ssokustom-example-tls
   rules:
   - http:
       paths:
@@ -13,31 +20,112 @@ spec:
         pathType: Prefix
         backend:
           service:
-            name: app
+            name: oidc-test
             port:
               name: http
-      
+---
-      - path: /auth/dispatcher
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-saml
+  annotations:
+    cert-manager.io/issuer: "self-signed"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - ssokustom
+    secretName: ssokustom-example-tls
+  rules:
+  - http:
+      paths:
+      - path: /auth/saml(/|$)(.*)
+        pathType: Prefix
+        backend:
+          service:
+            name: hydra-saml
+            port:
+              name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth-dispatcher
+  annotations:
+    cert-manager.io/issuer: "self-signed"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/x-forwarded-prefix: /auth/dispatcher
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - ssokustom
+    secretName: ssokustom-example-tls
+  rules:
+  - http:
+      paths:      
+      - path: /auth/dispatcher(/|$)(.*)
         pathType: Prefix
         backend:
           service:
             name: hydra-dispatcher
             port:
               name: http
-      
+---
-      - path: /auth
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: auth
+  annotations:
+    cert-manager.io/issuer: "self-signed"
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - ssokustom
+    secretName: ssokustom-example-tls
+  rules:
+  - http:
+      paths:      
+      - path: /auth(/|$)(.*)
         pathType: Prefix
         backend:
           service:
             name: hydra
             port:
               name: hydra-public
-          
+---
-      # - path: /auth/passwordless/?(.*)
+apiVersion: networking.k8s.io/v1
-      #   pathType: Prefix
+kind: Ingress
-      #   backend:
+metadata:
-      #     service:
+  name: saml-idp
-      #       name: hydra
+  annotations:
-      #       port:
+    cert-manager.io/issuer: "self-signed"
-      #         name: http-public
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /simplesaml/$2
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - ssokustom
+    secretName: ssokustom-example-tls
+  rules:
+  - http:
+      paths:     
+      - path: /simplesaml(/|$)(.*)
+        pathType: Prefix
+        backend:
+          service:
+            name: saml-idp
+            port:
+              name: https
+
+     
+
+      
           

examples/authenticated-app/resources/port-forwarder-deployment.yaml

@@ -1,29 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    io.kompose.service: port-forwarder
-  name: port-forwarder
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: port-forwarder
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        io.kompose.service: port-forwarder
-    spec:
-      containers:
-        - image: hpello/tcp-proxy:latest
-          name: port-forwarder
-          env:
-            - name: LISTEN_PORT
-              value: "8080"
-          ports:
-            - containerPort: 8080
-          resources: {}
-          args: ["traefik.kube-system.svc.cluster.local", "80"]
-      restartPolicy: Always

examples/authenticated-app/resources/port-forwarder-service.yaml

@@ -1,12 +0,0 @@
-kind: Service
-apiVersion: v1
-metadata:
-  name: ssokustom
-  labels:
-    io.kompose.service: port-forwarder
-spec:
-  ports:
-  - port: 8080
-    targetPort: 8080
-  selector:
-    io.kompose.service: port-forwarder

examples/authenticated-app/resources/port-forwarder.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.kompose.service: port-forwarder
+  name: port-forwarder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: port-forwarder
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        io.kompose.service: port-forwarder
+    spec:
+      containers:
+        - image: hpello/tcp-proxy:latest
+          name: port-forwarder-https
+          env:
+            - name: LISTEN_PORT
+              value: "443"
+          ports:
+            - containerPort: 443
+          resources: {}
+          args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "443"]
+        - image: hpello/tcp-proxy:latest
+          name: port-forwarder-http
+          env:
+            - name: LISTEN_PORT
+              value: "80"
+          ports:
+            - containerPort: 80
+          resources: {}
+          args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "80"]
+      restartPolicy: Always
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: ssokustom
+  labels:
+    io.kompose.service: port-forwarder
+spec:
+  ports:
+  - name: https
+    port: 443
+    targetPort: 443
+  - name: http
+    port: 80
+    targetPort: 80
+  selector:
+    io.kompose.service: port-forwarder

examples/authenticated-app/resources/saml-idp.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    io.kompose.service: saml-idp
+  name: saml-idp
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      io.kompose.service: saml-idp
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        io.kompose.service: saml-idp
+    spec:
+      containers:
+        - image: kristophjunge/test-saml-idp:1.15
+          name: saml-idp
+          ports:
+            - containerPort: 8443
+          resources: {}
+          env:
+            - name: SIMPLESAMLPHP_SP_ENTITY_ID
+              value: https://ssokustom/auth/saml
+            - name: SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE
+              value: https://ssokustom/auth/saml/Shibboleth.sso/SAML2/POST
+            - name: SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE
+              value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=https://ssokustom
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    io.kompose.service: saml-idp
+  name: saml-idp
+spec:
+  ports:
+    - name: http
+      port: 8080
+      targetPort: 8080
+    - name: https
+      port: 8443
+      targetPort: 8443
+  selector:
+    io.kompose.service: saml-idp
+status:
+  loadBalancer: {}

examples/authenticated-app/resources/self-signed-issuer.yaml

@@ -0,0 +1,6 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-signed
+spec:
+  selfSigned: {}

examples/k8s/k3d/cluster-config.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: k3d.io/v1alpha4
-kind: Simple
-metadata:
-  name: sso-kustom
-servers: 1
-agents: 2
-ports:
-  - port: 8080:80
-    nodeFilters:
-      - loadbalancer

examples/k8s/k3d/cluster/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop

examples/k8s/kind/cluster-config.yaml

@@ -0,0 +1,45 @@
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+name: sso-kustom-example
+nodes:
+- role: control-plane
+  image: kindest/node:v1.27.2
+  kubeadmConfigPatches:
+  - |
+    kind: InitConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        node-labels: "ingress-ready=true"
+  extraPortMappings:
+  - containerPort: 80
+    hostPort: 80
+    listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
+  - containerPort: 443
+    hostPort: 443
+    listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
+  labels:
+    ingress-ready: true
+- role: worker
+  image: kindest/node:v1.27.2
+  kubeadmConfigPatches:
+  - |
+    kind: JoinConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        system-reserved: memory=2Gi
+- role: worker
+  image: kindest/node:v1.27.2
+  kubeadmConfigPatches:
+  - |
+    kind: JoinConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        system-reserved: memory=2Gi
+- role: worker
+  image: kindest/node:v1.27.2
+  kubeadmConfigPatches:
+  - |
+    kind: JoinConfiguration
+    nodeRegistration:
+      kubeletExtraArgs:
+        system-reserved: memory=2Gi

examples/k8s/kind/cluster/.gitignore

@@ -0,0 +1 @@
+/charts

examples/k8s/kind/cluster/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
+- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
+- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
+
+patchesJson6902:
+  - target:
+      version: v1
+      kind: ConfigMap
+      name: ingress-nginx-controller
+      namespace: ingress-nginx
+    path: patches/nginx-controller.yaml

examples/k8s/kind/cluster/patches/nginx-controller.yaml

@@ -0,0 +1,6 @@
+- op: replace
+  path: "/data/allow-snippet-annotations"
+  value: "true"
+- op: replace
+  path: "/data/use-forwarded-headers"
+  value: "true"

kustomization.yaml

@@ -2,10 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-- ./resources/hydra
+- ./overlays/base
-- ./resources/hydra-dispatcher
-
-components:
-- ./components/hydra-cnpg-database
-- ./components/hydra-oidc
-- ./components/hydra-saml

overlays/base/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../resources/hydra
+- ../../resources/hydra-dispatcher
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth

overlays/full/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../base
+
+labels:
+  - pairs:
+      app.kubernetes.io/part-of: sso-kustom
+      app.kubernetes.io/component: auth
+
+components:
+- ../../components/hydra-cnpg-database
+- ../../components/hydra-oidc
+- ../../components/hydra-saml
+- ../../components/hydra-sql
+- ../../components/oidc-test

resources/hydra-dispatcher/files/hydra/default.yaml

@@ -1,2 +1,17 @@
+parameters:
+  env(HYDRA_DISPATCHER_WEBHOOK_ENABLED): false
+  env(HYDRA_DISPATCHER_WEBHOOK_API_URL): ""
+  env(HYDRA_DISPATCHER_WEBHOOK_API_KEY): ""
+  env(HYDRA_DISPATCHER_WEBHOOK_API_METHOD): POST
+  env(HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES): true
+
 hydra:
-  apps: []
+  apps: []
+  webhook:
+    enabled: "%env(bool:HYDRA_DISPATCHER_WEBHOOK_ENABLED)%"
+    api_url: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_URL)%"
+    api_key: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_KEY)%"
+    api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
+  firewall:
+    additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
+    rules: {}

resources/hydra-dispatcher/kustomization.yaml

@@ -10,6 +10,8 @@ configMapGenerator:
   literals:
   - APP_ENV=prod
   - APP_DEBUG=false
+  - PHP_FPM_MEMORY_LIMIT=256m
+  - NGINX_APP_SERVER_LISTEN=80
   - HYDRA_BASE_URL=http://hydra:4444
   - HYDRA_ADMIN_BASE_URL=http://hydra:4445
   - HYDRA_REWRITE_ISSUER=yes
@@ -21,4 +23,4 @@ configMapGenerator:
   - APP_LOCALES=fr,en
 - name: hydra-dispatcher-apps
   files:
-  - ./files/hydra/default.yaml
+  - apps.yaml=./files/hydra/default.yaml

resources/hydra-dispatcher/resources/hydra-dispatcher-deployment.yaml

@@ -17,20 +17,75 @@ spec:
         io.kompose.service: hydra-dispatcher
     spec:
       containers:
-      - name: hydra-dispatcher
+      - name: hydra-dispatcher-php-fpm
-        image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-218-g4b5e1d9
+        image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359
+        args: ["/usr/sbin/php-fpm81", "-F", "-e"]
+        readinessProbe:
+          exec:
+            command:
+            - sh
+            - -c
+            - test -f /etc/php81/php-fpm.d/www.conf
+        livenessProbe:
+          exec:
+            command:
+            - php
+            - bin/console
+            - -V
+          initialDelaySeconds: 10
+          periodSeconds: 30
+        env:
+        - name: PHP_FPM_LISTEN
+          value: 127.0.0.1:9000
+        - name: PHP_MEMORY_LIMIT
+          value: 128m
+        - name: PHP_FPM_MEMORY_LIMIT
+          value: 128m
         envFrom:
         - configMapRef:
             name: hydra-dispatcher-env
         volumeMounts:
-        - mountPath: /var/www/config/hydra
+        - mountPath: /app/config/hydra
           name: hydra-dispatcher-apps
+        resources: {}
+
+      - image:  reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359
+        imagePullPolicy: Always
+        name: hydra-dispatcher-nginx
+        args: ["/usr/sbin/nginx"]
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+          periodSeconds: 10
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 80
+          initialDelaySeconds: 15
+          timeoutSeconds: 5
+          periodSeconds: 15
+        envFrom:
+        - configMapRef:
+            name: hydra-dispatcher-env
+        env:
+        - name: NGINX_APP_UPSTREAM_BACKEND_SERVER
+          value: 127.0.0.1:9000
+        - name: NGINX_APP_ROOT
+          value: "/public/"
+        - name: NGINX_APP_PHP_INDEX
+          value: "/index.php"
+        - name: NGINX_ERROR_LOG_LEVEL
+          value: "warn"
+        - name: NGINX_APP_PHP_NON_FILE_PATTERN
+          value: "^/index\\.php(/|$)"
         ports:
-        - containerPort: 80
+        - containerPort: 8080
         resources: {}
       restartPolicy: Always
       volumes:
       - name: hydra-dispatcher-apps
         configMap:
           name: hydra-dispatcher-apps
-

resources/hydra/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - ./resources/hydra-serviceaccount.yaml
   - ./resources/hydra-migrate-job.yaml
   - ./resources/hydra-maester
+  - ./resources/hydra-janitor-cronjob.yaml
 
 secretGenerator:
   - name: hydra-secret

resources/hydra/resources/hydra-janitor-cronjob.yaml

@@ -0,0 +1,34 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: hydra-janitor
+  labels:
+    app.kubernetes.io/name: hydra-janitor
+spec:
+  concurrencyPolicy: Forbid
+  schedule: "0 */1 * * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: hydra-janitor
+        spec:
+          restartPolicy: OnFailure
+          serviceAccountName: hydra-sa
+          containers:
+            - name: janitor
+              image: reg.cadoles.com/proxy_cache/oryd/hydra:v2.0.3
+              envFrom:
+              - configMapRef:
+                  name: hydra-env
+              imagePullPolicy: IfNotPresent
+              command: ["hydra"]
+              env: []
+              args:
+                - janitor
+                - --read-from-env
+                - --grants
+                - --requests
+                - --tokens
+              resources: {}

resources/hydra/resources/hydra-maester/kustomization.yaml

@@ -2,14 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ./resources/hydra-maester-deployment.yaml
+- ./resources/hydra-maester-deployment.yaml
-  - ./resources/hydra-maester-rbac.yaml
+- ./resources/hydra-maester-rbac.yaml
-  - https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
 
 configMapGenerator:
-  - name: hydra-maester-env
+- name: hydra-maester-env
-    literals:
+  literals:
-      - APP_ENV=prod
+  - APP_ENV=prod
-      - APP_DEBUG=false
+  - APP_DEBUG=false
-      - HYDRA_ADMIN_BASE_URL=http://hydra
+  - HYDRA_ADMIN_BASE_URL=http://hydra
-      - HYDRA_ADMIN_PORT=4445
+  - HYDRA_ADMIN_PORT=4445