Compare commits

..

2 Commits

32 changed files with 231 additions and 568 deletions

View File

@ -10,21 +10,4 @@ hydra:
login_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGIN_URL)%"
consent_url: "%env(string:HYDRA_DISPATCHER_SAML_CONSENT_URL)%"
logout_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGOUT_URL)%"
attributes_rewrite_configuration:
uid:
rules:
- "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
email:
rules:
- "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
eduPersonAffiliation:
rules:
- "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
firewall:
rules:
email:
required: false
uid:
required: false
eduPersonAffiliation:
required: false
attributes_rewrite_rules: []

View File

@ -1,3 +0,0 @@
<Attribute name="uid" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="uid" />
<Attribute name="eduPersonAffiliation" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="eduPersonAffiliation" />
<Attribute name="email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email" />

View File

@ -2,8 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
resources:
- ./resources/hydra-saml-shibboleth-sp.yaml
- ./resources/hydra-saml-remote-user.yaml
- ./resources/hydra-saml-service.yaml
- ./resources/hydra-saml-shibboleth-sp-deployment.yaml
- ./resources/hydra-saml-remote-user-deployment.yaml
- ./resources/hydra-saml-remote-user-service.yaml
configMapGenerator:
- name: hydra-saml-env
@ -16,7 +18,6 @@ configMapGenerator:
- HYDRA_ADMIN_BASE_URL=http://hydra:4445/admin
- TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
- LOGOUT_REDIRECT_URL_PATTERN=http://hydra-saml/Shibboleth.sso/Logout?return=%s'
- PATH_PREFIX=
# Shibboleth SP environment variables
- SP_ENTITY_ID=http://hydra-saml-shibboleth-sp
- IDP_ENTITY_ID=http://saml-idp
@ -28,9 +29,6 @@ configMapGenerator:
behavior: merge
files:
- ./files/hydra/saml.yaml
- name: hydra-saml-shibboleth-sp
files:
- ./files/shibboleth-sp/attribute-map.inc.xml
patchesJson6902:
- target:

View File

@ -18,7 +18,7 @@ spec:
spec:
containers:
- name: hydra-saml-remote-user
image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-233-g64fcacc
image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-170-g485b138
envFrom:
- configMapRef:
name: hydra-saml-env
@ -26,18 +26,4 @@ spec:
- containerPort: 80
resources: {}
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: hydra-saml-remote-user
name: hydra-saml-remote-user
spec:
ports:
- name: http
port: 80
selector:
io.kompose.service: hydra-saml-remote-user
status:
loadBalancer: {}

View File

@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: hydra-saml-remote-user
name: hydra-saml-remote-user
spec:
ports:
- name: hydra-saml-remote-user
port: 80
selector:
io.kompose.service: hydra-saml-remote-user
status:
loadBalancer: {}

View File

@ -0,0 +1,14 @@
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: hydra-saml
name: hydra-saml
spec:
ports:
- name: hydra-saml
port: 80
selector:
io.kompose.service: hydra-saml
status:
loadBalancer: {}

View File

@ -0,0 +1,29 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: hydra-saml
name: hydra-saml
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: hydra-saml
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: hydra-saml
spec:
containers:
- name: hydra-saml
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-172-g0f44679
envFrom:
- configMapRef:
name: hydra-saml-env
ports:
- containerPort: 80
resources: {}
restartPolicy: Always

View File

@ -1,54 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: hydra-saml-shibboleth-sp
name: hydra-saml-shibboleth-sp
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: hydra-saml-shibboleth-sp
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: hydra-saml-shibboleth-sp
spec:
securityContext:
fsGroup: 102
containers:
- name: hydra-saml-shibboleth-sp
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-233-g64fcacc
envFrom:
- configMapRef:
name: hydra-saml-env
volumeMounts:
- name: attributes-map-inc
mountPath: /etc/shibboleth/attribute-map.inc.xml
subPath: attribute-map.inc.xml
ports:
- containerPort: 80
resources: {}
restartPolicy: Always
volumes:
- name: attributes-map-inc
configMap:
name: hydra-saml-shibboleth-sp
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: hydra-saml
name: hydra-saml
spec:
ports:
- name: http
port: 80
selector:
io.kompose.service: hydra-saml-shibboleth-sp
status:
loadBalancer: {}

View File

@ -1,21 +1,19 @@
# Exemple: Déploiement d'une application authentifiée avec la stack SSO
L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
## Procédure
### Avec `kind`
### Avec `k3d`
1. Créer un cluster avec `kind`
1. Créer un cluster avec `k3d`
```
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
k3d cluster create -c ./examples/k8s/k3d/k3d/cluster-config.yaml
```
2. Déployer les opérateurs nécessaires au déploiement
```
kubectl kustomize --enable-helm ./examples/k8s/kind/cluster | kubectl apply -f -
kubectl apply -k ./examples/k8s/k3d/cluster
```
3. Déployer l'application
@ -24,38 +22,4 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
kubectl apply -k ./examples/authenticated-app
```
**Note** Il est possible d'avoir l'erreur suivante:
```
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
```
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
```
127.0.0.1 ssokustom
```
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
#### Supprimer le cluster
```
kind delete cluster -n sso-kustom-example
```
## Authentification
### SAML
- Utilisateur: `user1`
- Mot de passe `user1pass`
#### URL utiles
|URL|Description|
|---|-----------|
|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|
Après stabilisation du déploiement, l'application devrait être accessible à l'adresse http://localhost:8080/

View File

@ -4,12 +4,12 @@ kind: Kustomization
resources:
- ../../resources/hydra
- ../../resources/hydra-dispatcher
- ./resources/app.yaml
- ./resources/app-deployment.yaml
- ./resources/app-service.yaml
- ./resources/ingress.yaml
- ./resources/oauth2-client.yaml
- ./resources/saml-idp.yaml
- ./resources/self-signed-issuer.yaml
- ./resources/port-forwarder.yaml
- ./resources/ingress-prefix-traefik-middleware.yaml
- ./resources/port-forwarder-deployment.yaml
- ./resources/port-forwarder-service.yaml
components:
- ../../components/hydra-cnpg-database

View File

@ -1,30 +1,18 @@
- op: replace
path: "/data/HYDRA_BASE_URL"
value: http://hydra:4444
value: http://ssokustom:8080/auth
- op: replace
path: "/data/HYDRA_ADMIN_BASE_URL"
value: http://hydra:4445/admin
- op: replace
path: "/data/HYDRA_ORIGINAL_ISSUER"
value: http://hydra:4444
value: http://ssokustom:8080/auth
- op: replace
path: "/data/HYDRA_NEW_ISSUER"
value: https://ssokustom/auth/dispatcher
value: http://ssokustom:8080/auth/dispatcher/
- op: replace
path: "/data/BASE_URL"
value: https://ssokustom/auth/dispatcher
value: http://ssokustom:8080/auth/dispatcher
- op: replace
path: "/data/COOKIE_PATH"
value: /auth/dispatcher
# Hydra SAML configuration
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_LOGIN_URL"
value: https://ssokustom/auth/saml/login
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_CONSENT_URL"
value: https://ssokustom/auth/saml/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
value: https://ssokustom/auth/saml/logout
value: /auth/dispatcher

View File

@ -1,15 +1,15 @@
- op: replace
path: "/data/URLS_SELF_ISSUER"
value: https://ssokustom/auth
value: http://ssokustom:8080/auth
- op: replace
path: "/data/URLS_LOGIN"
value: https://ssokustom/auth/dispatcher/login
value: http://ssokustom:8080/auth/dispatcher/login
- op: replace
path: "/data/URLS_LOGOUT"
value: https://ssokustom/auth/dispatcher/logout
value: http://ssokustom:8080/auth/dispatcher/logout
- op: replace
path: "/data/URLS_CONSENT"
value: https://ssokustom/auth/dispatcher/consent
value: http://ssokustom:8080/auth/dispatcher/consent
- op: replace
path: "/data/HYDRA_SERVE_ALL_ARGS"
value: "--dev"

View File

@ -1,6 +1,6 @@
- op: replace
path: "/data/HTTP_BASE_URL"
value: https://ssokustom/auth/saml
value: http://ssokustom:8080/auth/saml
- op: replace
path: "/data/COOKIE_PATH"
value: /auth/saml
@ -9,35 +9,23 @@
value: http://hydra-dispatcher
- op: replace
path: "/data/LOGOUT_REDIRECT_URL_PATTERN"
value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=%s
- op: replace
path: "/data/PATH_PREFIX"
value: "/auth/saml"
value: http://ssokustom:8080/auth/saml/Shibboleth.sso/Logout?return=%s
- op: replace
path: "/data/SP_ENTITY_ID"
value: https://ssokustom/auth/saml
value: http://ssokustom:8080/auth/saml
- op: replace
path: "/data/IDP_ENTITY_ID"
value: https://ssokustom/simplesaml/saml2/idp/metadata.php
value: http://ssokustom:8080/idp
- op: replace
path: "/data/IDP_METADATA_URL"
value: https://ssokustom/simplesaml/saml2/idp/metadata.php
value: http://ssokustom:8080/idp/metadata
- op: replace
path: "/data/APACHE_BACKEND_URL"
value: http://hydra-remote-user
- op: replace
path: "/data/APACHE_FORCE_HTTPS"
value: "true"
value: "false"
- op: replace
path: "/data/SP_HANDLER_BASE_PATH"
value: "/auth/saml"
- op: replace
path: "/data/SP_LOG_LEVEL"
value: DEBUG
- op: replace
path: "/data/SP_SESSIONS_REDIRECT_LIMIT"
value: none
- op: replace
path: "/data/SP_SESSIONS_REDIRECT_ALLOW"
value: https://ssokustom
- op: replace
path: "/data/SP_SESSIONS_COOKIE_PROPS"
value: https
value: /auth/saml

View File

@ -0,0 +1,40 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: app
name: app
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: app
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: app
spec:
containers:
- image: bornholm/oidc-test:v0.0.0-1-g936a77e
name: app
ports:
- containerPort: 8080
resources: {}
env:
- name: LOG_LEVEL
value: "0"
- name: HTTP_ADDRESS
value: 0.0.0.0:8080
- name: OIDC_CLIENT_ID
value: oidc-test
- name: OIDC_CLIENT_SECRET
value: oidc-test-123456
- name: OIDC_ISSUER_URL
value: http://ssokustom:8080/auth
- name: OIDC_REDIRECT_URL
value: http://ssokustom:8080
- name: OIDC_POST_LOGOUT_REDIRECT_URL
value: http://ssokustom:8080
restartPolicy: Always

View File

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: app
name: app
spec:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
io.kompose.service: app
status:
loadBalancer: {}

View File

@ -1,66 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: app
name: app
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: app
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: app
spec:
containers:
- image: reg.cadoles.com/cadoles/oidc-test:2023.11.6-stable.1557.e16b905
name: app
ports:
- containerPort: 8080
resources: {}
env:
- name: LOG_LEVEL
value: "0"
- name: HTTP_ADDRESS
value: 0.0.0.0:8080
- name: OIDC_CLIENT_ID
valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_id
- name: OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: app-oidc-secret
key: client_secret
- name: OIDC_ISSUER_URL
value: http://hydra:4444
- name: OIDC_REDIRECT_URL
value: https://ssokustom/oauth2/callback
- name: OIDC_POST_LOGOUT_REDIRECT_URL
value: https://ssokustom
- name: OIDC_SKIP_ISSUER_VERIFICATION
value: "true"
- name: OIDC_INSECURE_SKIP_VERIFY
value: "true"
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: app
name: app
spec:
ports:
- name: http
port: 8080
targetPort: 8080
selector:
io.kompose.service: app
status:
loadBalancer: {}

View File

@ -0,0 +1,10 @@
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: ingress-prefix
spec:
stripPrefixRegex:
regex:
- ^/auth/dispatcher
- ^/auth/saml
- ^/auth

View File

@ -1,18 +1,11 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: app
name: portal
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
cert-manager.io/issuer: "self-signed"
# nginx.ingress.kubernetes.io/configuration-snippet: |
# more_set_headers "X-Forwarded-Proto: https";
ingress.kubernetes.io/ssl-redirect: "false"
traefik.ingress.kubernetes.io/router.middlewares: default-ingress-prefix@kubernetescrd
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
@ -23,109 +16,28 @@ spec:
name: app
port:
name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-saml
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/saml(/|$)(.*)
pathType: Prefix
backend:
service:
name: hydra-saml
port:
name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth-dispatcher
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/x-forwarded-prefix: /auth/dispatcher
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth/dispatcher(/|$)(.*)
- path: /auth/dispatcher
pathType: Prefix
backend:
service:
name: hydra-dispatcher
port:
name: http
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: auth
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /auth(/|$)(.*)
- path: /auth
pathType: Prefix
backend:
service:
name: hydra
port:
name: hydra-public
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: saml-idp
annotations:
cert-manager.io/issuer: "self-signed"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/rewrite-target: /simplesaml/$2
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
spec:
ingressClassName: nginx
tls:
- hosts:
- ssokustom
secretName: ssokustom-example-tls
rules:
- http:
paths:
- path: /simplesaml(/|$)(.*)
pathType: Prefix
backend:
service:
name: saml-idp
port:
name: https
# - path: /auth/passwordless/?(.*)
# pathType: Prefix
# backend:
# service:
# name: hydra
# port:
# name: http-public

View File

@ -1,18 +0,0 @@
apiVersion: hydra.ory.sh/v1alpha1
kind: OAuth2Client
metadata:
name: app-oauth2-client
spec:
clientName: "app"
tokenEndpointAuthMethod: "client_secret_basic"
grantTypes:
- authorization_code
- refresh_token
responseTypes:
- code
scope: "openid email"
secretName: app-oidc-secret
redirectUris:
- https://ssokustom/oauth2/callback
postLogoutRedirectUris:
- https://ssokustom

View File

@ -0,0 +1,29 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: port-forwarder
name: port-forwarder
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: port-forwarder
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: port-forwarder
spec:
containers:
- image: hpello/tcp-proxy:latest
name: port-forwarder
env:
- name: LISTEN_PORT
value: "8080"
ports:
- containerPort: 8080
resources: {}
args: ["traefik.kube-system.svc.cluster.local", "80"]
restartPolicy: Always

View File

@ -0,0 +1,12 @@
kind: Service
apiVersion: v1
metadata:
name: ssokustom
labels:
io.kompose.service: port-forwarder
spec:
ports:
- port: 8080
targetPort: 8080
selector:
io.kompose.service: port-forwarder

View File

@ -1,55 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: port-forwarder
name: port-forwarder
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: port-forwarder
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: port-forwarder
spec:
containers:
- image: hpello/tcp-proxy:latest
name: port-forwarder-https
env:
- name: LISTEN_PORT
value: "443"
ports:
- containerPort: 443
resources: {}
args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "443"]
- image: hpello/tcp-proxy:latest
name: port-forwarder-http
env:
- name: LISTEN_PORT
value: "80"
ports:
- containerPort: 80
resources: {}
args: ["ingress-nginx-controller.ingress-nginx.svc.cluster.local", "80"]
restartPolicy: Always
---
kind: Service
apiVersion: v1
metadata:
name: ssokustom
labels:
io.kompose.service: port-forwarder
spec:
ports:
- name: https
port: 443
targetPort: 443
- name: http
port: 80
targetPort: 80
selector:
io.kompose.service: port-forwarder

View File

@ -1,51 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
replicas: 1
selector:
matchLabels:
io.kompose.service: saml-idp
strategy:
type: Recreate
template:
metadata:
labels:
io.kompose.service: saml-idp
spec:
containers:
- image: kristophjunge/test-saml-idp:1.15
name: saml-idp
ports:
- containerPort: 8443
resources: {}
env:
- name: SIMPLESAMLPHP_SP_ENTITY_ID
value: https://ssokustom/auth/saml
- name: SIMPLESAMLPHP_SP_ASSERTION_CONSUMER_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/SAML2/POST
- name: SIMPLESAMLPHP_SP_SINGLE_LOGOUT_SERVICE
value: https://ssokustom/auth/saml/Shibboleth.sso/Logout?return=https://ssokustom
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
labels:
io.kompose.service: saml-idp
name: saml-idp
spec:
ports:
- name: http
port: 8080
targetPort: 8080
- name: https
port: 8443
targetPort: 8443
selector:
io.kompose.service: saml-idp
status:
loadBalancer: {}

View File

@ -1,6 +0,0 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: self-signed
spec:
selfSigned: {}

View File

@ -0,0 +1,11 @@
---
apiVersion: k3d.io/v1alpha4
kind: Simple
metadata:
name: sso-kustom
servers: 1
agents: 2
ports:
- port: 8080:80
nodeFilters:
- loadbalancer

View File

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop

View File

@ -1,45 +0,0 @@
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
name: sso-kustom-example
nodes:
- role: control-plane
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: InitConfiguration
nodeRegistration:
kubeletExtraArgs:
node-labels: "ingress-ready=true"
extraPortMappings:
- containerPort: 80
hostPort: 80
listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
- containerPort: 443
hostPort: 443
listenAddress: "0.0.0.0" # Optional, defaults to "0.0.0.0"
labels:
ingress-ready: true
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi
- role: worker
image: kindest/node:v1.27.2
kubeadmConfigPatches:
- |
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
system-reserved: memory=2Gi

View File

@ -1 +0,0 @@
/charts

View File

@ -1,14 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
patchesJson6902:
- target:
version: v1
kind: ConfigMap
name: ingress-nginx-controller
namespace: ingress-nginx
path: patches/nginx-controller.yaml

View File

@ -1,6 +0,0 @@
- op: replace
path: "/data/allow-snippet-annotations"
value: "true"
- op: replace
path: "/data/use-forwarded-headers"
value: "true"

View File

@ -1,17 +1,2 @@
parameters:
env(HYDRA_DISPATCHER_WEBHOOK_ENABLED): false
env(HYDRA_DISPATCHER_WEBHOOK_API_URL): ""
env(HYDRA_DISPATCHER_WEBHOOK_API_KEY): ""
env(HYDRA_DISPATCHER_WEBHOOK_API_METHOD): POST
env(HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES): true
hydra:
apps: []
webhook:
enabled: "%env(bool:HYDRA_DISPATCHER_WEBHOOK_ENABLED)%"
api_url: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_URL)%"
api_key: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_KEY)%"
api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
firewall:
additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
rules: {}
apps: []

View File

@ -18,7 +18,7 @@ spec:
spec:
containers:
- name: hydra-dispatcher
image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-238-g7236416
image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-218-g4b5e1d9
envFrom:
- configMapRef:
name: hydra-dispatcher-env