Compare commits

..

68 Commits

Author SHA1 Message Date
c97266c272 Merge pull request 'feat(pods): change image pull policy from Always to IfNotPresent' (#53) from feat/pull-policy-IfNotPresent into unstable
Reviewed-on: #53
Reviewed-by: Matthieu Lamalle <mlamalle@cadoles.com>
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-12-16 14:07:35 +01:00
4df11ead1e feat(pods): change image pull policy from Always to IfNotPresent
Otherwise, we have a SPOF with the image registry used
2024-12-13 14:06:56 +01:00
99056b875e Merge pull request 'chore: update hydra-sql image ref to fix email search case' (#52) from fix-case-email into unstable
Reviewed-on: #52
2024-11-06 14:27:25 +01:00
ee0349e9df chore: update hydra-sql image ref to fix email search case 2024-11-06 11:18:49 +01:00
3a255707d1 Merge pull request 'chore(hydra-sql) : update image ref to fix error handle' (#50) from hydra-sql-fix-error into unstable
Reviewed-on: #50
2024-10-14 11:37:26 +02:00
ce1f650a86 chore(hydra-sql) : update image ref to fix error handle 2024-10-14 10:49:12 +02:00
de24eb0026 Merge pull request 'chore(hydra-sql): correction requete password et fetchdata et ajout paquet xdebug' (#49) from hydra-sql-fix into unstable
Reviewed-on: #49
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-10-10 10:35:09 +02:00
40ec4440a7 chore(hydra-sql): correction requete password et fetchdata et ajout paquet xdebug 2024-10-10 10:31:16 +02:00
4ec580fb7d fix(component): oidc adding behavior to secret generator 2024-10-09 11:49:39 +02:00
1cf7569678 fix(component): adding behavior to secret generator 2024-10-09 11:37:52 +02:00
a0ff37edf6 Merge pull request 'feat(postgres): adding max_conns hydra parameter support for cnpg component' (#47) from feat-hydra-pooler into unstable
Reviewed-on: #47
Reviewed-by: Laurent Gourvenec <lgourvenec@cadoles.com>
Reviewed-by: vfebvre <vfebvre@cadoles.com>
2024-10-09 10:00:02 +02:00
a5c9c733f6 feat(postgres): adding hydra max_conns parameter support
Mandatory for large scale deployements
2024-10-04 10:56:54 +02:00
a5cecb385c Merge pull request 'fix(hydra-dispatcher): typo on ref' (#46) from sprint-15 into unstable
Reviewed-on: #46
2024-09-24 15:19:58 +02:00
15ad23049f fix(hydra-dispatcher): typo on ref 2024-09-24 15:19:58 +02:00
78e5b30e1d Merge pull request 'sprint-15' (#45) from sprint-15 into unstable
Reviewed-on: #45
2024-09-24 14:02:36 +02:00
1ea76c2153 chore(hydra-dispatcher) : improve header cache 2024-09-24 13:44:40 +02:00
af76c99d91 chore(hydra-sql) : improve sql handler 2024-09-24 13:43:59 +02:00
3635f547a1 Merge pull request 'Ajout d'opcache sur les app symfony' (#43) from opcache into unstable
Reviewed-on: #43
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-08-07 09:49:26 +02:00
65fccdc3ce Add opcache to symfony apps 2024-08-07 09:49:26 +02:00
0b3504e631 Merge pull request 'update symfony-container ref, add rewrite subject hydra-sql' (#42) from rewrite-subject into unstable
Reviewed-on: #42
2024-08-07 08:47:47 +02:00
36a8e117e8 update symfony-container ref, add rewrite subject hydra-sql 2024-07-25 10:35:53 +02:00
176b5a6696 fix(hydra-sql): addin RollingUpdate stratgy config 2024-06-10 11:13:02 +02:00
efa00fc6a3 Merge pull request 'chore(hydra-sql): update image ref sprint-10' (#41) from sprint-10 into unstable
Reviewed-on: #41
2024-06-10 11:04:57 +02:00
f52b3117b5 chore(hydra-sql): update image ref sprint-10 2024-06-10 10:59:31 +02:00
35c46316d3 Merge pull request 'sprint-9: update hydra-sql ref image' (#40) from sprint-9 into unstable
Reviewed-on: #40
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-05-23 08:21:23 +02:00
456e92ca0e sprint-8: update hydra-sql ref image 2024-05-22 15:42:15 +02:00
e1432cb633 Merge pull request 'fix(php-fpm): set php-fpm81 for hydra-sql and hydra-dispatcher' (#39) from sprint-8 into unstable
Reviewed-on: #39
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-04-29 16:08:44 +02:00
513797be35 fix(php-fpm): set php-fpm81 for hydra-sql and hydra-dispatcher 2024-04-29 16:08:44 +02:00
f38ba80de6 Merge branch 'sprint-8' into unstable 2024-04-29 13:53:01 +02:00
1db87e2d08 Merge branch 'unstable' into sprint-8 2024-04-29 13:51:36 +02:00
a7578445b4 fix(php-fpm): set php-fpm82 for hydra-sql and hydra-dispatcher 2024-04-29 13:47:58 +02:00
119b09ac61 Merge pull request 'chore(dispatcher sql): update images refs' (#38) from sprint-8 into unstable
Reviewed-on: #38
Reviewed-by: pcaseiro <pcaseiro@cadoles.com>
2024-04-29 13:32:17 +02:00
32ccca7616 typo 2024-04-29 12:11:53 +02:00
c174ddb734 chore(dispatcher sql): update images refs 2024-04-29 12:11:01 +02:00
191024bb17 Merge pull request 'Intégration des images Caddy' (#37) from develop into unstable
Reviewed-on: #37
2024-04-04 17:49:04 +02:00
054f84baef clean(lint): fix indentation 2024-04-04 17:49:04 +02:00
a88a8240aa feat(deploiement): use port name 2024-04-04 17:49:04 +02:00
5ea7789cc2 feat(hydra-sql): non root deployment with caddy 2024-04-04 17:49:04 +02:00
212de51a84 feat(hydra-oidc): non root deployment with caddy 2024-04-04 17:49:04 +02:00
9020c73512 feat(hydra-dispatcher): non root deployment with caddy 2024-04-04 17:49:04 +02:00
380a116fa8 fix(all): use app.kubernetes.io/name label instead of io.kompose.service 2024-02-21 15:43:42 +01:00
72a9932fc5 fix(hydra): update hydra-maester version to 0.0.32-amd64 2024-02-14 11:30:54 +01:00
1060fdf4be fix(hydra): update hydra-maester version to 0.0.32 2024-02-14 11:07:47 +01:00
45953d5531 fix(hydra): update hydra version to 2.1.2 2024-02-14 11:06:36 +01:00
29f539f7ab fix(oidc): removing deprecated and useless patch
fix container liveness and readyness probes
fix service with correct port
2024-02-13 16:49:37 +01:00
0084707bbc fix(dispatcher): dispatcher service must use containerport 2024-02-13 15:56:10 +01:00
0dbd5dd551 fix(dispatcher): liveness probe must use the container port
Container port is 8080 so ... the probes must use the same port
2024-02-12 11:46:07 +01:00
f1d621d4a9 fix(maester): CRD must be installed cluster wide 2024-02-12 11:42:35 +01:00
83b81b1056 Revert "fix(resources): do not set namespace in maester rolebinding"
This reverts commit 1fccf5f8dc.
2024-01-30 12:34:54 +01:00
1fccf5f8dc fix(resources): do not set namespace in maester rolebinding 2024-01-30 12:27:50 +01:00
907618902e fix(resources): oauth2client CRD must be installed clusterwide 2024-01-30 12:21:13 +01:00
6b1702b7ed fix(component): do not specify namespace for werther component 2024-01-30 10:42:56 +01:00
fce733374c Merge pull request 'feat(hydra): mise en place du stockage des session redis sur la stack hydra, et correction logout sur hydra-oidc' (#31) from hydra-redis into develop
Reviewed-on: #31
2023-12-18 11:18:31 +01:00
824b8613c4 update doc 2023-12-18 11:15:51 +01:00
19910617bd typo 2023-12-18 10:52:54 +01:00
f4146345d5 Patche du DSN redis 2023-12-18 10:38:13 +01:00
bbeb1ec62f mise en place d'un component pour Redis 2023-12-18 09:25:30 +01:00
fcfbb6cc30 correction port mapping de hydra-remote-user 2023-12-15 15:25:02 +01:00
7a802a6d28 ajout redis à l'example 2023-12-15 14:44:04 +01:00
a02622b516 feat(hydra): mise en place du stockage des session redis sur la stack hydra, et correction logout sur hydra-oidc 2023-12-15 10:17:23 +01:00
61d9dade3b Merge pull request 'feat(hydra-dispatcher): maj ref image hydra-dispatcher pour ajout url_link env var' (#29) from hydra-dispatcher-link-url into develop
Reviewed-on: #29
2023-12-13 10:41:44 +01:00
e333d07c14 feat(hydra-dispatcher): maj ref image hydra-dispatcher pour ajout url_link env var 2023-12-13 10:41:44 +01:00
06f58a061d Merge pull request 'Issue-16 : update dev image ref' (#27) from issue-16 into develop
Reviewed-on: #27
2023-12-13 09:38:05 +01:00
dd6804aa11 feat(shibboleth-sp): update dev ref image 2023-12-13 09:38:05 +01:00
c7b937adaf feat(hydra-sql): update env vars 2023-12-13 09:38:05 +01:00
77eb73818f feat(hydra-remote-user): update dev image ref 2023-12-13 09:38:05 +01:00
cc3d07d654 feat(hydra-sql): update hydra-sql dev image ref 2023-12-13 09:38:05 +01:00
86754cf518 cosmetic(oidc-test): rename CM oidc-test to oidc-test-env 2023-12-11 17:33:02 +01:00
39 changed files with 462 additions and 313 deletions

View File

@ -7,28 +7,6 @@ configurations:
resources: resources:
- ./resources/hydra-cnpg-cluster.yaml - ./resources/hydra-cnpg-cluster.yaml
secretGenerator:
- name: hydra-postgres-admin
type: Secret
literals:
- username=postgres
- password=NotSoSecret
- name: hydra-postgres-user
type: Secret
literals:
- username=hydra
- password=NotSoSecret
vars:
- name: HYDRA_DATABASE_SERVICE_NAME
objref:
name: hydra-postgres
kind: Cluster
apiVersion: postgresql.cnpg.io/v1
fieldref:
fieldpath: metadata.name
patches: patches:
- target: - target:
group: apps group: apps

View File

@ -4,7 +4,7 @@
name: HYDRA_DATABASE_USER name: HYDRA_DATABASE_USER
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: username key: username
- op: add - op: add
path: "/spec/template/spec/containers/0/env/-" path: "/spec/template/spec/containers/0/env/-"
@ -12,10 +12,18 @@
name: HYDRA_DATABASE_PASSWORD name: HYDRA_DATABASE_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: password key: password
- op: add
path: "/spec/template/spec/containers/0/env/-"
value:
name: HYDRA_DATABASE_SERVICE_NAME
valueFrom:
secretKeyRef:
name: hydra-postgres-app
key: host
- op: add - op: add
path: "/spec/template/spec/containers/0/env/-" path: "/spec/template/spec/containers/0/env/-"
value: value:
name: DSN name: DSN
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable" value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable&max_conns=$(HYDRA_DATABASE_MAX_CONN)"

View File

@ -4,7 +4,7 @@
name: HYDRA_DATABASE_USER name: HYDRA_DATABASE_USER
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: username key: username
- op: add - op: add
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-" path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
@ -12,10 +12,18 @@
name: HYDRA_DATABASE_PASSWORD name: HYDRA_DATABASE_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: password key: password
- op: add
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
value:
name: HYDRA_DATABASE_SERVICE_NAME
valueFrom:
secretKeyRef:
name: hydra-postgres-app
key: host
- op: add - op: add
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-" path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
value: value:
name: DSN name: DSN
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable" value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"

View File

@ -4,7 +4,7 @@
name: HYDRA_DATABASE_USER name: HYDRA_DATABASE_USER
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: username key: username
- op: add - op: add
path: "/spec/template/spec/containers/0/env/-" path: "/spec/template/spec/containers/0/env/-"
@ -12,10 +12,18 @@
name: HYDRA_DATABASE_PASSWORD name: HYDRA_DATABASE_PASSWORD
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-postgres-user name: hydra-postgres-app
key: password key: password
- op: add
path: "/spec/template/spec/containers/0/env/-"
value:
name: HYDRA_DATABASE_SERVICE_NAME
valueFrom:
secretKeyRef:
name: hydra-postgres-app
key: host
- op: add - op: add
path: "/spec/template/spec/containers/0/env/-" path: "/spec/template/spec/containers/0/env/-"
value: value:
name: DSN name: DSN
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable" value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"

View File

@ -5,13 +5,9 @@ metadata:
spec: spec:
instances: 3 instances: 3
primaryUpdateStrategy: unsupervised primaryUpdateStrategy: unsupervised
superuserSecret:
name: hydra-postgres-admin
bootstrap: bootstrap:
initdb: initdb:
database: hydra database: hydra
owner: hydra owner: hydra
secret:
name: hydra-postgres-user
storage: storage:
size: 2Gi size: 2Gi

View File

@ -2,7 +2,6 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: hydra-ldap name: hydra-ldap
namespace: default
labels: labels:
app.kubernetes.io/name: hydra-ldap app.kubernetes.io/name: hydra-ldap
app.kubernetes.io/version: "v1.2.2" app.kubernetes.io/version: "v1.2.2"
@ -18,34 +17,34 @@ spec:
app.kubernetes.io/version: "v1.2.2" app.kubernetes.io/version: "v1.2.2"
spec: spec:
containers: containers:
- name: werther - name: werther
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717 image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-ldap-env name: hydra-ldap-env
env: env:
- name: WERTHER_WEB_DIR - name: WERTHER_WEB_DIR
value: "/usr/share/werther/login/" value: "/usr/share/werther/login/"
- name: WERTHER_LDAP_BINDDN - name: WERTHER_LDAP_BINDDN
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-ldap-sc name: hydra-ldap-sc
key: WERTHER_LDAP_BINDDN key: WERTHER_LDAP_BINDDN
- name: WERTHER_LDAP_BINDPW - name: WERTHER_LDAP_BINDPW
valueFrom: valueFrom:
secretKeyRef: secretKeyRef:
name: hydra-ldap-sc name: hydra-ldap-sc
key: WERTHER_LDAP_BINDPW key: WERTHER_LDAP_BINDPW
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: hydra-ldap-http name: hydra-ldap-http
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
capabilities: capabilities:
drop: drop:
- ALL - ALL
privileged: false privileged: false
readOnlyRootFilesystem: true readOnlyRootFilesystem: true
runAsNonRoot: true runAsNonRoot: true
runAsUser: 100 runAsUser: 100

View File

@ -2,7 +2,7 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-ldap app.kubernetes.io/name: hydra-ldap
name: hydra-ldap name: hydra-ldap
spec: spec:
type: ClusterIP type: ClusterIP

View File

@ -2,38 +2,36 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component kind: Component
resources: resources:
- ./resources/hydra-oidc-deployment.yaml - ./resources/hydra-oidc-deployment.yaml
- ./resources/hydra-oidc-service.yaml - ./resources/hydra-oidc-service.yaml
generatorOptions:
labels:
com.cadoles.forge.sso-kustom/session: redis
configMapGenerator: configMapGenerator:
- name: hydra-oidc-env - name: hydra-oidc-env
literals: behavior: create
- APP_ENV=prod literals:
- APP_DEBUG=false - APP_ENV=prod
- PHP_FPM_MEMORY_LIMIT=256m - APP_DEBUG=false
- NGINX_APP_SERVER_LISTEN=80 - PHP_FPM_MEMORY_LIMIT=256m
- HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher - NGINX_APP_SERVER_LISTEN=80
- OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize - HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
- OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token - OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize
- OIDC_USERINFO_ENDPOINT=https://oidc-idp/api/v1/userinfo - OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token
- POST_LOGOUT_REDIRECT_URL=http://oidc-sp/logout - OIDC_USERINFO_ENDPOINT=https://oidc-idp/api/v1/userinfo
- OIDC_LOGOUT_ENDPOINT=https://oidc-idp/api/v1/logout?%s - POST_LOGOUT_REDIRECT_URL=http://oidc-sp/logout
- BASE_URL=http://hydra-oidc - OIDC_LOGOUT_ENDPOINT=https://oidc-idp/api/v1/logout?%s
- PARAMS_TO_DELETE=[] - BASE_URL=http://hydra-oidc
- PARAMS_TO_INSERT={} - PARAMS_TO_DELETE=[]
- OIDC_SCOPE=openid email - PARAMS_TO_INSERT={}
- CLIENT_ID_FC=MyClientID - OIDC_SCOPE=openid email
- CLIENT_SECRET_FC=MyClientSecret - CLIENT_ID_FC=MyClientID
- COOKIE_PATH=/ - CLIENT_SECRET_FC=MyClientSecret
- TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR - COOKIE_PATH=/
# - name: hydra-dispatcher-apps - TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
# behavior: merge - REDIS_DSN="redis://redis:6379"
# files: - HYDRA_DISPATCHER_OIDC_LOGIN_URL="http://hydra-oidc/login"
# - apps.yaml=./files/hydra/oidc.yaml - HYDRA_DISPATCHER_OIDC_CONSENT_URL="http://hydra-oidc/consent"
- HYDRA_DISPATCHER_OIDC_LOGOUT_URL="http://hydra-oidc/logout"
patchesJson6902:
- target:
version: v1
kind: ConfigMap
name: hydra-dispatcher-env
path: patches/hydra-dispatcher-env.yaml

View File

@ -1,9 +0,0 @@
- op: replace
path: "/data/HYDRA_DISPATCHER_OIDC_LOGIN_URL"
value: http://hydra-oidc/login
- op: replace
path: "/data/HYDRA_DISPATCHER_OIDC_CONSENT_URL"
value: http://hydra-oidc/consent
- op: replace
path: "/data/HYDRA_DISPATCHER_OIDC_LOGOUT_URL"
value: http://hydra-oidc/logout

View File

@ -2,85 +2,101 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra-oidc app.kubernetes.io/name: hydra-oidc
name: hydra-oidc name: hydra-oidc
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra-oidc app.kubernetes.io/name: hydra-oidc
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra-oidc app.kubernetes.io/name: hydra-oidc
spec: spec:
containers: containers:
- name: hydra-oidc-php-fpm - name: hydra-oidc-php-fpm
image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035 image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
imagePullPolicy: Always imagePullPolicy: IfNotPresent
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
command: command:
- sh - sh
- -c - -c
- test -f /etc/php81/php-fpm.d/www.conf - test -f /etc/php81/php-fpm.d/www.conf
livenessProbe: livenessProbe:
exec: exec:
command: command:
- php - php
- bin/console - bin/console
- -V - -V
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 30 periodSeconds: 30
env: env:
- name: PHP_FPM_LISTEN - name: PHP_FPM_LISTEN
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: PHP_MEMORY_LIMIT - name: PHP_MEMORY_LIMIT
value: 128m value: 128m
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
value: 128m value: 128m
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-oidc-env name: hydra-oidc-env
resources: {} resources: {}
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 1000
- image: reg.cadoles.com/cadoles/hydra-oidc-base:2023.11.17-develop.1657.761e035 - name: hydra-oidc-caddy
imagePullPolicy: Always image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
name: hydra-oidc-nginx imagePullPolicy: IfNotPresent
args: ["/usr/sbin/nginx"] args:
readinessProbe: [
httpGet: "/usr/sbin/caddy",
path: /healthy "run",
port: 80 "--adapter",
initialDelaySeconds: 5 "caddyfile",
timeoutSeconds: 5 "--config",
periodSeconds: 10 "/etc/caddy/Caddyfile",
livenessProbe: ]
httpGet: readinessProbe:
path: /healthy httpGet:
port: 80 path: /healthy
initialDelaySeconds: 15 port: 8080
timeoutSeconds: 5 initialDelaySeconds: 5
periodSeconds: 15 timeoutSeconds: 5
envFrom: periodSeconds: 10
- configMapRef: livenessProbe:
name: hydra-oidc-env httpGet:
env: path: /healthy
- name: NGINX_APP_UPSTREAM_BACKEND_SERVER port: 8080
value: 127.0.0.1:9000 initialDelaySeconds: 15
- name: NGINX_APP_ROOT timeoutSeconds: 5
value: "/public/" periodSeconds: 15
- name: NGINX_APP_PHP_INDEX ports:
value: "/index.php"
- name: NGINX_ERROR_LOG_LEVEL
value: "warn"
- name: NGINX_APP_PHP_NON_FILE_PATTERN
value: "^/index\\.php(/|$)"
ports:
- containerPort: 8080 - containerPort: 8080
resources: {} name: http
envFrom:
- configMapRef:
name: hydra-oidc-env
env:
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000
- name: CADDY_HTTPS_PORT
value: "8443"
- name: CADDY_HTTP_PORT
value: "8080"
- name: CADDY_DATA_FS
value: "/tmp/caddy"
- name: CADDY_APP_ROOT_PUBLIC
value: "/app/public/"
resources: {}
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 1000
restartPolicy: Always restartPolicy: Always

View File

@ -2,13 +2,14 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-oidc app.kubernetes.io/name: hydra-oidc
name: hydra-oidc name: hydra-oidc
spec: spec:
ports: ports:
- name: hydra-oidc - name: http
port: 80 port: 80
targetPort: http
selector: selector:
io.kompose.service: hydra-oidc app.kubernetes.io/name: hydra-oidc
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -2,28 +2,28 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml-remote-user app.kubernetes.io/name: hydra-saml-remote-user
name: hydra-saml-remote-user name: hydra-saml-remote-user
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra-saml-remote-user app.kubernetes.io/name: hydra-saml-remote-user
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml-remote-user app.kubernetes.io/name: hydra-saml-remote-user
spec: spec:
containers: containers:
- name: hydra-saml-remote-user - name: hydra-saml-remote-user
image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-233-g64fcacc image: reg.cadoles.com/cadoles/hydra-remote-user-base:2023.12.11-develop.1523.5f14595
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-saml-env name: hydra-saml-env
ports: ports:
- containerPort: 80 - containerPort: 8080
resources: {} resources: {}
restartPolicy: Always restartPolicy: Always
--- ---
@ -31,13 +31,14 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml-remote-user app.kubernetes.io/name: hydra-saml-remote-user
name: hydra-saml-remote-user name: hydra-saml-remote-user
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
targetPort: 8080
selector: selector:
io.kompose.service: hydra-saml-remote-user app.kubernetes.io/name: hydra-saml-remote-user
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -2,25 +2,25 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml-shibboleth-sp app.kubernetes.io/name: hydra-saml-shibboleth-sp
name: hydra-saml-shibboleth-sp name: hydra-saml-shibboleth-sp
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra-saml-shibboleth-sp app.kubernetes.io/name: hydra-saml-shibboleth-sp
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml-shibboleth-sp app.kubernetes.io/name: hydra-saml-shibboleth-sp
spec: spec:
securityContext: securityContext:
fsGroup: 102 fsGroup: 102
containers: containers:
- name: hydra-saml-shibboleth-sp - name: hydra-saml-shibboleth-sp
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-233-g64fcacc image: reg.cadoles.com/cadoles/shibboleth-sp-v3:2023.12.12-develop.1039.49b85e1
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-saml-env name: hydra-saml-env
@ -41,14 +41,14 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-saml app.kubernetes.io/name: hydra-saml
name: hydra-saml name: hydra-saml
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
selector: selector:
io.kompose.service: hydra-saml-shibboleth-sp app.kubernetes.io/name: hydra-saml-shibboleth-sp
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -0,0 +1,22 @@
[opcache]
; Determines if Zend OPCache is enabled
opcache.enable=1
; Determines if Zend OPCache is enabled for the CLI version of PHP
opcache.enable_cli=1
; The OPcache shared memory storage size.
opcache.memory_consumption=512
; The maximum number of keys (scripts) in the OPcache hash table.
; Only numbers between 200 and 1000000 are allowed.
opcache.max_accelerated_files=20000
; When disabled, you must reset the OPcache manually or restart the
; webserver for changes to the filesystem to take effect.
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
; How often (in seconds) to check file timestamps for changes to the shared
; memory storage allocation. ("1" means validate once per second, but only
; once per request. "0" means always validate)
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}

View File

@ -5,8 +5,13 @@ resources:
- ./resources/hydra-sql-service.yaml - ./resources/hydra-sql-service.yaml
- ./resources/hydra-sql-deployment.yaml - ./resources/hydra-sql-deployment.yaml
generatorOptions:
labels:
com.cadoles.forge.sso-kustom/session: redis
configMapGenerator: configMapGenerator:
- name: hydra-sql-env - name: hydra-sql-env
behavior: create
literals: literals:
- ISSUER_URL="http://localhost:8000" - ISSUER_URL="http://localhost:8000"
- BASE_URL='http://localhost:8080' - BASE_URL='http://localhost:8080'
@ -17,7 +22,11 @@ configMapGenerator:
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql" - DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
- DB_USER="makeMeASecret" - DB_USER="makeMeASecret"
- DB_PASSWORD="makeMeASecret" - DB_PASSWORD="makeMeASecret"
- REDIS_DSN="redis://redis:6379"
- PEPPER="MakeMeABigSecret" - PEPPER="MakeMeABigSecret"
- name: sql-login-config - name: sql-login-config
files: files:
- ./files/sql_login.yaml - ./files/sql_login.yaml
- name: hydra-sql-php-ini
files:
- ./files/03_base.ini

View File

@ -2,24 +2,27 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra-sql app.kubernetes.io/name: hydra-sql
name: hydra-sql name: hydra-sql
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra-sql app.kubernetes.io/name: hydra-sql
strategy: strategy:
type: Recreate type: RollingUpdate
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra-sql app.kubernetes.io/name: hydra-sql
spec: spec:
containers: containers:
- name: hydra-sql-fpm - name: hydra-sql-fpm
image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1 image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
imagePullPolicy: Always imagePullPolicy: IfNotPresent
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
@ -36,6 +39,10 @@ spec:
initialDelaySeconds: 10 initialDelaySeconds: 10
periodSeconds: 30 periodSeconds: 30
resources: {} resources: {}
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 1000
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-sql-env name: hydra-sql-env
@ -48,15 +55,22 @@ spec:
value: 128m value: 128m
- name: PHP_FPM_LOG_LEVEL - name: PHP_FPM_LOG_LEVEL
value: warning value: warning
- name: OPCACHE_VALIDATE_TIMESTAMP
value: "0"
- name: OPCACHE_REVALIDATE_FREQ
value: "0"
volumeMounts: volumeMounts:
- name: sql-login-config - name: sql-login-config
mountPath: "/app/config/sql_login_configuration/sql_login.yaml" mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
subPath: "sql_login.yaml" subPath: "sql_login.yaml"
- name: hydra-sql-php-ini
mountPath: /etc/php81/conf.d/03_base.ini
subPath: 03_base.ini
- name: hydra-sql-nginx - name: hydra-sql-caddy
image: reg.cadoles.com/cadoles/hydra-sql-base:0.0.1 image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
imagePullPolicy: Always imagePullPolicy: IfNotPresent
args: ["/usr/sbin/nginx"] args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /health path: /health
@ -75,19 +89,24 @@ spec:
- configMapRef: - configMapRef:
name: hydra-sql-env name: hydra-sql-env
env: env:
- name: NGINX_APP_UPSTREAM_BACKEND_SERVER - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: NGINX_APP_ROOT - name: CADDY_HTTPS_PORT
value: "/public" value: "8443"
- name: NGINX_APP_PHP_INDEX - name: CADDY_HTTP_PORT
value: "/index.php" value: "8080"
- name: NGINX_ERROR_LOG_LEVEL - name: CADDY_DATA_FS
value: "warn" value: "/tmp/caddy"
- name: NGINX_APP_PHP_NON_FILE_PATTERN - name: CADDY_APP_ROOT_PUBLIC
value: "^/index\\.php(/|$)" value: "/app/public/"
resources: {} resources: {}
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 1000
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http
volumeMounts: volumeMounts:
- name: sql-login-config - name: sql-login-config
mountPath: "/app/config/sql_login_configuration/sql_login.yaml" mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
@ -96,5 +115,8 @@ spec:
- name: sql-login-config - name: sql-login-config
configMap: configMap:
name: sql-login-config name: sql-login-config
- name: hydra-sql-php-ini
configMap:
name: hydra-sql-php-ini
restartPolicy: Always restartPolicy: Always

View File

@ -2,13 +2,14 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-sql app.kubernetes.io/name: hydra-sql
name: hydra-sql name: hydra-sql
spec: spec:
ports: ports:
- name: hydra-sql - name: http
port: 8080 port: 80
targetPort: http
selector: selector:
io.kompose.service: hydra-sql app.kubernetes.io/name: hydra-sql
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -7,7 +7,7 @@ resources:
- ./resources/oauth2-client.yaml - ./resources/oauth2-client.yaml
configMapGenerator: configMapGenerator:
- name: oidc-test - name: oidc-test-env
literals: literals:
- LOG_LEVEL=0 - LOG_LEVEL=0
- HTTP_ADDRESS=0.0.0.0:8080 - HTTP_ADDRESS=0.0.0.0:8080

View File

@ -24,7 +24,7 @@ spec:
resources: {} resources: {}
envFrom: envFrom:
- configMapRef: - configMapRef:
name: oidc-test name: oidc-test-env
env: env:
- name: OIDC_CLIENT_ID - name: OIDC_CLIENT_ID
valueFrom: valueFrom:

View File

@ -0,0 +1,22 @@
# Composant `redis`
### Description
Les applications `hydra-dispatcher`, `hydra-sql` et `hydra-oidc` stockent dorénavant le cache et les sessions utilisateur sur un serveur Redis.
Le DSN du serveur est défini dans leur variable d'environnement respective `REDIS_DSN`.
Les applications peuvent utiliser le mode `sentinel` de redis
Il est donc nécessaire donc nécessaire de disposer d'un serveur Redis pour utiliser ces applications.
### Principe général de fonctionnement
Un `RedisFailOver` crée un cluster redis en mode sentinel avec 3 réplicats chacun.
### Personnalisation
Via des `patches` sur la ressource `ConfigMap` via un label selector `com.cadoles.forge.sso-kustom/session=redis` il est possible de modifier la valeur du `REDIS_DSN`.
|Clé|Description|Exemple|
|---|-----------|-------|
|`REDIS_DSN`| DSN du cluster Redis | `redis://rfs-sso-redis:26379?&redis_sentinel=mymaster`

View File

@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1alpha1
kind: Component
resources:
- ./resources/redis-failover.yaml
patches:
- path: ./patches/hydra-apps.yaml
target:
kind: ConfigMap
labelSelector: "com.cadoles.forge.sso-kustom/session=redis"

View File

@ -0,0 +1,3 @@
- op: replace
path: "/data/REDIS_DSN"
value: "redis://rfs-sso-redis:26379?&redis_sentinel=mymaster"

View File

@ -0,0 +1,21 @@
apiVersion: databases.spotahome.com/v1
kind: RedisFailover
metadata:
name: sso-redis
spec:
sentinel:
replicas: 3
resources:
requests:
cpu: 100m
limits:
memory: 100Mi
redis:
replicas: 3
resources:
requests:
cpu: 100m
memory: 100Mi
limits:
cpu: 400m
memory: 500Mi

View File

@ -1 +0,0 @@
# Documentation

View File

@ -15,7 +15,7 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
2. Déployer les opérateurs nécessaires au déploiement 2. Déployer les opérateurs nécessaires au déploiement
``` ```
kubectl kustomize --enable-helm ./examples/k8s/kind/cluster | kubectl apply -f - kubectl apply -k ./examples/k8s/kind/cluster --server-side
``` ```
3. Déployer l'application 3. Déployer l'application

View File

@ -2,19 +2,19 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: port-forwarder app.kubernetes.io/name: port-forwarder
name: port-forwarder name: port-forwarder
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: port-forwarder app.kubernetes.io/name: port-forwarder
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: port-forwarder app.kubernetes.io/name: port-forwarder
spec: spec:
containers: containers:
- image: hpello/tcp-proxy:latest - image: hpello/tcp-proxy:latest
@ -42,7 +42,7 @@ apiVersion: v1
metadata: metadata:
name: ssokustom name: ssokustom
labels: labels:
io.kompose.service: port-forwarder app.kubernetes.io/name: port-forwarder
spec: spec:
ports: ports:
- name: https - name: https
@ -52,4 +52,4 @@ spec:
port: 80 port: 80
targetPort: 80 targetPort: 80
selector: selector:
io.kompose.service: port-forwarder app.kubernetes.io/name: port-forwarder

View File

@ -2,19 +2,19 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: saml-idp app.kubernetes.io/name: saml-idp
name: saml-idp name: saml-idp
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: saml-idp app.kubernetes.io/name: saml-idp
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: saml-idp app.kubernetes.io/name: saml-idp
spec: spec:
containers: containers:
- image: kristophjunge/test-saml-idp:1.15 - image: kristophjunge/test-saml-idp:1.15
@ -35,7 +35,7 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: saml-idp app.kubernetes.io/name: saml-idp
name: saml-idp name: saml-idp
spec: spec:
ports: ports:
@ -46,6 +46,6 @@ spec:
port: 8443 port: 8443
targetPort: 8443 targetPort: 8443
selector: selector:
io.kompose.service: saml-idp app.kubernetes.io/name: saml-idp
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -3,6 +3,7 @@ kind: Kustomization
resources: resources:
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml - https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop - https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml - https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
patchesJson6902: patchesJson6902:
@ -11,4 +12,4 @@ patchesJson6902:
kind: ConfigMap kind: ConfigMap
name: ingress-nginx-controller name: ingress-nginx-controller
namespace: ingress-nginx namespace: ingress-nginx
path: patches/nginx-controller.yaml path: patches/nginx-controller.yaml

View File

@ -14,4 +14,5 @@ components:
- ../../components/hydra-oidc - ../../components/hydra-oidc
- ../../components/hydra-saml - ../../components/hydra-saml
- ../../components/hydra-sql - ../../components/hydra-sql
- ../../components/oidc-test - ../../components/oidc-test
- ../../components/redis

View File

@ -0,0 +1,22 @@
[opcache]
; Determines if Zend OPCache is enabled
opcache.enable=1
; Determines if Zend OPCache is enabled for the CLI version of PHP
opcache.enable_cli=1
; The OPcache shared memory storage size.
opcache.memory_consumption=512
; The maximum number of keys (scripts) in the OPcache hash table.
; Only numbers between 200 and 1000000 are allowed.
opcache.max_accelerated_files=20000
; When disabled, you must reset the OPcache manually or restart the
; webserver for changes to the filesystem to take effect.
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
; How often (in seconds) to check file timestamps for changes to the shared
; memory storage allocation. ("1" means validate once per second, but only
; once per request. "0" means always validate)
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}

View File

@ -14,4 +14,4 @@ hydra:
api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%" api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
firewall: firewall:
additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%" additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
rules: {} rules: {}

View File

@ -5,6 +5,10 @@ resources:
- ./resources/hydra-dispatcher-deployment.yaml - ./resources/hydra-dispatcher-deployment.yaml
- ./resources/hydra-dispatcher-service.yaml - ./resources/hydra-dispatcher-service.yaml
generatorOptions:
labels:
com.cadoles.forge.sso-kustom/session: redis
configMapGenerator: configMapGenerator:
- name: hydra-dispatcher-env - name: hydra-dispatcher-env
literals: literals:
@ -21,6 +25,10 @@ configMapGenerator:
- COOKIE_PATH=/ - COOKIE_PATH=/
- DEFAULT_LOCALE=fr - DEFAULT_LOCALE=fr
- APP_LOCALES=fr,en - APP_LOCALES=fr,en
- REDIS_DSN="redis://redis:6379"
- name: hydra-dispatcher-apps - name: hydra-dispatcher-apps
files: files:
- apps.yaml=./files/hydra/default.yaml - apps.yaml=./files/hydra/default.yaml
- name: hydra-dispatcher-php-ini
files:
- ./files/03_base.ini

View File

@ -2,23 +2,23 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
name: hydra-dispatcher name: hydra-dispatcher
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
spec: spec:
containers: containers:
- name: hydra-dispatcher-php-fpm - name: hydra-dispatcher-php-fpm
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359 image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
args: ["/usr/sbin/php-fpm81", "-F", "-e"] args: ["/usr/sbin/php-fpm81", "-F", "-e"]
readinessProbe: readinessProbe:
exec: exec:
@ -41,29 +41,47 @@ spec:
value: 128m value: 128m
- name: PHP_FPM_MEMORY_LIMIT - name: PHP_FPM_MEMORY_LIMIT
value: 128m value: 128m
- name: OPCACHE_VALIDATE_TIMESTAMP
value: "0"
- name: OPCACHE_REVALIDATE_FREQ
value: "0"
envFrom: envFrom:
- configMapRef: - configMapRef:
name: hydra-dispatcher-env name: hydra-dispatcher-env
volumeMounts: volumeMounts:
- mountPath: /app/config/hydra - mountPath: /app/config/hydra
name: hydra-dispatcher-apps name: hydra-dispatcher-apps
- name: hydra-dispatcher-php-ini
mountPath: /etc/php81/conf.d/03_base.ini
subPath: 03_base.ini
resources: {} resources: {}
securityContext:
- image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2023.11.17-develop.1408.ad93359 runAsNonRoot: true
imagePullPolicy: Always runAsGroup: 1000
name: hydra-dispatcher-nginx runAsUser: 1000
args: ["/usr/sbin/nginx"] - name: hydra-dispatcher-caddy
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
imagePullPolicy: IfNotPresent
args:
[
"/usr/sbin/caddy",
"run",
"--adapter",
"caddyfile",
"--config",
"/etc/caddy/Caddyfile",
]
readinessProbe: readinessProbe:
httpGet: httpGet:
path: /health path: /health
port: 80 port: 8080
initialDelaySeconds: 5 initialDelaySeconds: 5
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 10 periodSeconds: 10
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /health path: /health
port: 80 port: 8080
initialDelaySeconds: 15 initialDelaySeconds: 15
timeoutSeconds: 5 timeoutSeconds: 5
periodSeconds: 15 periodSeconds: 15
@ -71,21 +89,29 @@ spec:
- configMapRef: - configMapRef:
name: hydra-dispatcher-env name: hydra-dispatcher-env
env: env:
- name: NGINX_APP_UPSTREAM_BACKEND_SERVER - name: CADDY_APP_UPSTREAM_BACKEND_SERVER
value: 127.0.0.1:9000 value: 127.0.0.1:9000
- name: NGINX_APP_ROOT - name: CADDY_HTTPS_PORT
value: "/public/" value: "8443"
- name: NGINX_APP_PHP_INDEX - name: CADDY_HTTP_PORT
value: "/index.php" value: "8080"
- name: NGINX_ERROR_LOG_LEVEL - name: CADDY_DATA_FS
value: "warn" value: "/tmp/caddy"
- name: NGINX_APP_PHP_NON_FILE_PATTERN - name: CADDY_APP_ROOT_PUBLIC
value: "^/index\\.php(/|$)" value: "/app/public/"
ports: ports:
- containerPort: 8080 - containerPort: 8080
name: http
resources: {} resources: {}
securityContext:
runAsNonRoot: true
runAsGroup: 1000
runAsUser: 1000
restartPolicy: Always restartPolicy: Always
volumes: volumes:
- name: hydra-dispatcher-apps - name: hydra-dispatcher-apps
configMap: configMap:
name: hydra-dispatcher-apps name: hydra-dispatcher-apps
- name: hydra-dispatcher-php-ini
configMap:
name: hydra-dispatcher-php-ini

View File

@ -2,13 +2,14 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
name: hydra-dispatcher name: hydra-dispatcher
spec: spec:
ports: ports:
- name: http - name: http
port: 80 port: 80
targetPort: http
selector: selector:
io.kompose.service: hydra-dispatcher app.kubernetes.io/name: hydra-dispatcher
status: status:
loadBalancer: {} loadBalancer: {}

View File

@ -1,37 +1,43 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
images:
- name: reg.cadoles.com/proxy_cache/oryd/hydra
newTag: v2.1.2
- name: reg.cadoles.com/proxy_cache/oryd/hydra-maester
newTag: v0.0.32-amd64
resources: resources:
- ./resources/hydra-deployment.yaml - ./resources/hydra-deployment.yaml
- ./resources/hydra-service.yaml - ./resources/hydra-service.yaml
- ./resources/hydra-role.yaml - ./resources/hydra-role.yaml
- ./resources/hydra-rolebinding.yaml - ./resources/hydra-rolebinding.yaml
- ./resources/hydra-serviceaccount.yaml - ./resources/hydra-serviceaccount.yaml
- ./resources/hydra-migrate-job.yaml - ./resources/hydra-migrate-job.yaml
- ./resources/hydra-maester - ./resources/hydra-maester
- ./resources/hydra-janitor-cronjob.yaml - ./resources/hydra-janitor-cronjob.yaml
- ./resources/hydra-hpa.yaml
secretGenerator: secretGenerator:
- name: hydra-secret - name: hydra-secret
literals: literals:
- SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged - SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged
configMapGenerator: configMapGenerator:
- name: hydra-env - name: hydra-env
literals: literals:
- URLS_SELF_ISSUER=http://localhost:4444 - URLS_SELF_ISSUER=http://localhost:4444
- URLS_LOGIN=http://hydra-login-app/login - URLS_LOGIN=http://hydra-login-app/login
- URLS_CONSENT=http://hydra-consent-app/consent - URLS_CONSENT=http://hydra-consent-app/consent
- URLS_LOGOUT=http://hydra-logout-app/logout - URLS_LOGOUT=http://hydra-logout-app/logout
- HYDRA_SERVE_ALL_ARGS=--dev - HYDRA_SERVE_ALL_ARGS=--dev
- LOG_LEVEL=info - HYDRA_DATABASE_MAX_CONN="10"
- LOG_LEVEL=info
vars: vars:
- name: HYDRA_MIGRATE_JOB_NAME - name: HYDRA_MIGRATE_JOB_NAME
objref: objref:
name: hydra-migrate name: hydra-migrate
kind: Job kind: Job
apiVersion: batch/v1 apiVersion: batch/v1
fieldref: fieldref:
fieldpath: metadata.name fieldpath: metadata.name

View File

@ -2,19 +2,19 @@ apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
labels: labels:
io.kompose.service: hydra app.kubernetes.io/name: hydra
name: hydra name: hydra
spec: spec:
replicas: 1 replicas: 1
selector: selector:
matchLabels: matchLabels:
io.kompose.service: hydra app.kubernetes.io/name: hydra
strategy: strategy:
type: Recreate type: Recreate
template: template:
metadata: metadata:
labels: labels:
io.kompose.service: hydra app.kubernetes.io/name: hydra
spec: spec:
serviceAccountName: hydra-sa serviceAccountName: hydra-sa
initContainers: initContainers:
@ -55,9 +55,6 @@ spec:
name: hydra-public name: hydra-public
- containerPort: 4445 - containerPort: 4445
name: hydra-admin name: hydra-admin
resources: resources: {}
requests:
cpu: 100m
memory: 128Mi
restartPolicy: Always restartPolicy: Always

View File

@ -1,26 +0,0 @@
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: hydra
labels:
io.kompose.service: hydra
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: hydra
minReplicas: 1
maxReplicas: 3
metrics:
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: 80
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 80

View File

@ -2,14 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
- ./resources/hydra-maester-deployment.yaml - ./resources/hydra-maester-deployment.yaml
- ./resources/hydra-maester-rbac.yaml - ./resources/hydra-maester-rbac.yaml
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
configMapGenerator: configMapGenerator:
- name: hydra-maester-env - name: hydra-maester-env
literals: literals:
- APP_ENV=prod - APP_ENV=prod
- APP_DEBUG=false - APP_DEBUG=false
- HYDRA_ADMIN_BASE_URL=http://hydra - HYDRA_ADMIN_BASE_URL=http://hydra
- HYDRA_ADMIN_PORT=4445 - HYDRA_ADMIN_PORT=4445

View File

@ -2,7 +2,7 @@ apiVersion: v1
kind: Service kind: Service
metadata: metadata:
labels: labels:
io.kompose.service: hydra app.kubernetes.io/name: hydra
name: hydra name: hydra
spec: spec:
ports: ports:
@ -13,6 +13,6 @@ spec:
port: 4445 port: 4445
targetPort: hydra-admin targetPort: hydra-admin
selector: selector:
io.kompose.service: hydra app.kubernetes.io/name: hydra
status: status:
loadBalancer: {} loadBalancer: {}