Compare commits
40 Commits
hydra-sql-
...
unstable
Author | SHA1 | Date | |
---|---|---|---|
c97266c272 | |||
4df11ead1e | |||
99056b875e | |||
ee0349e9df | |||
3a255707d1 | |||
ce1f650a86 | |||
de24eb0026 | |||
40ec4440a7 | |||
4ec580fb7d | |||
1cf7569678 | |||
a0ff37edf6 | |||
a5c9c733f6 | |||
a5cecb385c | |||
15ad23049f | |||
78e5b30e1d | |||
1ea76c2153 | |||
af76c99d91 | |||
3635f547a1 | |||
65fccdc3ce | |||
0b3504e631 | |||
36a8e117e8 | |||
176b5a6696 | |||
efa00fc6a3 | |||
f52b3117b5 | |||
35c46316d3 | |||
456e92ca0e | |||
e1432cb633 | |||
513797be35 | |||
f38ba80de6 | |||
1db87e2d08 | |||
a7578445b4 | |||
119b09ac61 | |||
32ccca7616 | |||
c174ddb734 | |||
191024bb17 | |||
054f84baef | |||
a88a8240aa | |||
5ea7789cc2 | |||
212de51a84 | |||
9020c73512 |
@ -7,28 +7,6 @@ configurations:
|
|||||||
resources:
|
resources:
|
||||||
- ./resources/hydra-cnpg-cluster.yaml
|
- ./resources/hydra-cnpg-cluster.yaml
|
||||||
|
|
||||||
secretGenerator:
|
|
||||||
- name: hydra-postgres-admin
|
|
||||||
type: Secret
|
|
||||||
literals:
|
|
||||||
- username=postgres
|
|
||||||
- password=NotSoSecret
|
|
||||||
- name: hydra-postgres-user
|
|
||||||
type: Secret
|
|
||||||
literals:
|
|
||||||
- username=hydra
|
|
||||||
- password=NotSoSecret
|
|
||||||
|
|
||||||
|
|
||||||
vars:
|
|
||||||
- name: HYDRA_DATABASE_SERVICE_NAME
|
|
||||||
objref:
|
|
||||||
name: hydra-postgres
|
|
||||||
kind: Cluster
|
|
||||||
apiVersion: postgresql.cnpg.io/v1
|
|
||||||
fieldref:
|
|
||||||
fieldpath: metadata.name
|
|
||||||
|
|
||||||
patches:
|
patches:
|
||||||
- target:
|
- target:
|
||||||
group: apps
|
group: apps
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,10 +12,18 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: password
|
key: password
|
||||||
|
- op: add
|
||||||
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
|
value:
|
||||||
|
name: HYDRA_DATABASE_SERVICE_NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: hydra-postgres-app
|
||||||
|
key: host
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable&max_conns=$(HYDRA_DATABASE_MAX_CONN)"
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,10 +12,18 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: password
|
key: password
|
||||||
|
- op: add
|
||||||
|
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||||
|
value:
|
||||||
|
name: HYDRA_DATABASE_SERVICE_NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: hydra-postgres-app
|
||||||
|
key: host
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,10 +12,18 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-user
|
name: hydra-postgres-app
|
||||||
key: password
|
key: password
|
||||||
|
- op: add
|
||||||
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
|
value:
|
||||||
|
name: HYDRA_DATABASE_SERVICE_NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: hydra-postgres-app
|
||||||
|
key: host
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
||||||
|
@ -5,13 +5,9 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
instances: 3
|
instances: 3
|
||||||
primaryUpdateStrategy: unsupervised
|
primaryUpdateStrategy: unsupervised
|
||||||
superuserSecret:
|
|
||||||
name: hydra-postgres-admin
|
|
||||||
bootstrap:
|
bootstrap:
|
||||||
initdb:
|
initdb:
|
||||||
database: hydra
|
database: hydra
|
||||||
owner: hydra
|
owner: hydra
|
||||||
secret:
|
|
||||||
name: hydra-postgres-user
|
|
||||||
storage:
|
storage:
|
||||||
size: 2Gi
|
size: 2Gi
|
||||||
|
@ -17,34 +17,34 @@ spec:
|
|||||||
app.kubernetes.io/version: "v1.2.2"
|
app.kubernetes.io/version: "v1.2.2"
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: werther
|
- name: werther
|
||||||
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
|
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-ldap-env
|
name: hydra-ldap-env
|
||||||
env:
|
env:
|
||||||
- name: WERTHER_WEB_DIR
|
- name: WERTHER_WEB_DIR
|
||||||
value: "/usr/share/werther/login/"
|
value: "/usr/share/werther/login/"
|
||||||
- name: WERTHER_LDAP_BINDDN
|
- name: WERTHER_LDAP_BINDDN
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-ldap-sc
|
name: hydra-ldap-sc
|
||||||
key: WERTHER_LDAP_BINDDN
|
key: WERTHER_LDAP_BINDDN
|
||||||
- name: WERTHER_LDAP_BINDPW
|
- name: WERTHER_LDAP_BINDPW
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-ldap-sc
|
name: hydra-ldap-sc
|
||||||
key: WERTHER_LDAP_BINDPW
|
key: WERTHER_LDAP_BINDPW
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
name: http
|
name: hydra-ldap-http
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
- ALL
|
- ALL
|
||||||
privileged: false
|
privileged: false
|
||||||
readOnlyRootFilesystem: true
|
readOnlyRootFilesystem: true
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsUser: 100
|
runAsUser: 100
|
||||||
|
@ -7,9 +7,9 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: hydra-ldap
|
||||||
port: 8080
|
port: 8080
|
||||||
targetPort: http
|
targetPort: hydra-ldap-http
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-ldap
|
app.kubernetes.io/name: hydra-ldap
|
||||||
|
@ -11,6 +11,7 @@ generatorOptions:
|
|||||||
|
|
||||||
configMapGenerator:
|
configMapGenerator:
|
||||||
- name: hydra-oidc-env
|
- name: hydra-oidc-env
|
||||||
|
behavior: create
|
||||||
literals:
|
literals:
|
||||||
- APP_ENV=prod
|
- APP_ENV=prod
|
||||||
- APP_DEBUG=false
|
- APP_DEBUG=false
|
||||||
|
@ -17,86 +17,86 @@ spec:
|
|||||||
app.kubernetes.io/name: hydra-oidc
|
app.kubernetes.io/name: hydra-oidc
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-oidc-php-fpm
|
- name: hydra-oidc-php-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: IfNotPresent
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-oidc-env
|
name: hydra-oidc-env
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
|
|
||||||
- name: hydra-oidc-caddy
|
- name: hydra-oidc-caddy
|
||||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: IfNotPresent
|
||||||
args:
|
args:
|
||||||
[
|
[
|
||||||
"/usr/sbin/caddy",
|
"/usr/sbin/caddy",
|
||||||
"run",
|
"run",
|
||||||
"--adapter",
|
"--adapter",
|
||||||
"caddyfile",
|
"caddyfile",
|
||||||
"--config",
|
"--config",
|
||||||
"/etc/caddy/Caddyfile",
|
"/etc/caddy/Caddyfile",
|
||||||
]
|
]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /healthy
|
path: /healthy
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 10
|
periodSeconds: 10
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /healthy
|
path: /healthy
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 15
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 15
|
periodSeconds: 15
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
name: http
|
name: http
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-oidc-env
|
name: hydra-oidc-env
|
||||||
env:
|
env:
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: CADDY_HTTPS_PORT
|
- name: CADDY_HTTPS_PORT
|
||||||
value: "8443"
|
value: "8443"
|
||||||
- name: CADDY_HTTP_PORT
|
- name: CADDY_HTTP_PORT
|
||||||
value: "8080"
|
value: "8080"
|
||||||
- name: CADDY_DATA_FS
|
- name: CADDY_DATA_FS
|
||||||
value: "/tmp/caddy"
|
value: "/tmp/caddy"
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
value: "/app/public/"
|
value: "/app/public/"
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-oidc
|
name: hydra-oidc
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-oidc
|
app.kubernetes.io/name: hydra-oidc
|
||||||
status:
|
status:
|
||||||
|
22
components/hydra-sql/files/03_base.ini
Normal file
22
components/hydra-sql/files/03_base.ini
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
[opcache]
|
||||||
|
; Determines if Zend OPCache is enabled
|
||||||
|
opcache.enable=1
|
||||||
|
|
||||||
|
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
||||||
|
opcache.enable_cli=1
|
||||||
|
|
||||||
|
; The OPcache shared memory storage size.
|
||||||
|
opcache.memory_consumption=512
|
||||||
|
|
||||||
|
; The maximum number of keys (scripts) in the OPcache hash table.
|
||||||
|
; Only numbers between 200 and 1000000 are allowed.
|
||||||
|
opcache.max_accelerated_files=20000
|
||||||
|
|
||||||
|
; When disabled, you must reset the OPcache manually or restart the
|
||||||
|
; webserver for changes to the filesystem to take effect.
|
||||||
|
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
||||||
|
|
||||||
|
; How often (in seconds) to check file timestamps for changes to the shared
|
||||||
|
; memory storage allocation. ("1" means validate once per second, but only
|
||||||
|
; once per request. "0" means always validate)
|
||||||
|
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
@ -1,30 +0,0 @@
|
|||||||
hydra:
|
|
||||||
apps:
|
|
||||||
- id: sql
|
|
||||||
title:
|
|
||||||
fr: Connexion SQL
|
|
||||||
en: Login SQL
|
|
||||||
description:
|
|
||||||
fr: Authentification avec SQL
|
|
||||||
en: Authentication with SQL
|
|
||||||
login_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGIN_URL)%"
|
|
||||||
consent_url: "%env(string:HYDRA_DISPATCHER_SQL_CONSENT_URL)%"
|
|
||||||
logout_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGOUT_URL)%"
|
|
||||||
attributes_rewrite_configuration:
|
|
||||||
uid:
|
|
||||||
rules:
|
|
||||||
- "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
|
|
||||||
email:
|
|
||||||
rules:
|
|
||||||
- "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
|
|
||||||
eduPersonAffiliation:
|
|
||||||
rules:
|
|
||||||
- "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
|
|
||||||
firewall:
|
|
||||||
rules:
|
|
||||||
email:
|
|
||||||
required: false
|
|
||||||
uid:
|
|
||||||
required: false
|
|
||||||
eduPersonAffiliation:
|
|
||||||
required: false
|
|
@ -2,38 +2,31 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
|
|||||||
kind: Component
|
kind: Component
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
- ./resources/hydra-sql-service.yaml
|
- ./resources/hydra-sql-service.yaml
|
||||||
- ./resources/hydra-sql-deployment.yaml
|
- ./resources/hydra-sql-deployment.yaml
|
||||||
|
|
||||||
generatorOptions:
|
generatorOptions:
|
||||||
labels:
|
labels:
|
||||||
com.cadoles.forge.sso-kustom/session: redis
|
com.cadoles.forge.sso-kustom/session: redis
|
||||||
|
|
||||||
configMapGenerator:
|
configMapGenerator:
|
||||||
- name: hydra-sql-env
|
- name: hydra-sql-env
|
||||||
literals:
|
behavior: create
|
||||||
- ISSUER_URL="http://localhost:8000"
|
literals:
|
||||||
- BASE_URL='http://localhost:8080'
|
- ISSUER_URL="http://localhost:8000"
|
||||||
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
|
- BASE_URL='http://localhost:8080'
|
||||||
- APP_LOCALES="fr,en"
|
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
|
||||||
- HASH_ALGO_LEGACY="sha256, bcrypt"
|
- APP_LOCALES="fr,en"
|
||||||
- SECURITY_PATTERN="password,salt,pepper"
|
- HASH_ALGO_LEGACY="sha256, bcrypt"
|
||||||
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
|
- SECURITY_PATTERN="password,salt,pepper"
|
||||||
- DB_USER="makeMeASecret"
|
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
|
||||||
- DB_PASSWORD="makeMeASecret"
|
- DB_USER="makeMeASecret"
|
||||||
- REDIS_DSN="redis://redis:6379"
|
- DB_PASSWORD="makeMeASecret"
|
||||||
- PEPPER="MakeMeABigSecret"
|
- REDIS_DSN="redis://redis:6379"
|
||||||
- name: sql-login-config
|
- PEPPER="MakeMeABigSecret"
|
||||||
files:
|
- name: sql-login-config
|
||||||
- ./files/sql_login.yaml
|
files:
|
||||||
- name: hydra-dispatcher-apps
|
- ./files/sql_login.yaml
|
||||||
behavior: merge
|
- name: hydra-sql-php-ini
|
||||||
files:
|
files:
|
||||||
- ./files/hydra/sql.yaml
|
- ./files/03_base.ini
|
||||||
|
|
||||||
patchesJson6902:
|
|
||||||
- target:
|
|
||||||
version: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
name: hydra-dispatcher-env
|
|
||||||
path: patches/hydra-dispatcher-env.yaml
|
|
||||||
|
@ -1,9 +0,0 @@
|
|||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
|
|
||||||
value: http://hydra-sql/login
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
|
|
||||||
value: http://hydra-sql/consent
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
|
|
||||||
value: http://hydra-sql/logout
|
|
@ -10,108 +10,113 @@ spec:
|
|||||||
matchLabels:
|
matchLabels:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
strategy:
|
strategy:
|
||||||
type: Recreate
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxSurge: 25%
|
||||||
|
maxUnavailable: 25%
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-sql-fpm
|
- name: hydra-sql-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
|
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: IfNotPresent
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-sql-env
|
name: hydra-sql-env
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_LOG_LEVEL
|
- name: PHP_FPM_LOG_LEVEL
|
||||||
value: warning
|
value: warning
|
||||||
volumeMounts:
|
- name: OPCACHE_VALIDATE_TIMESTAMP
|
||||||
- name: sql-login-config
|
value: "0"
|
||||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
- name: OPCACHE_REVALIDATE_FREQ
|
||||||
subPath: "sql_login.yaml"
|
value: "0"
|
||||||
|
volumeMounts:
|
||||||
- name: hydra-sql-caddy
|
|
||||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
|
|
||||||
imagePullPolicy: Always
|
|
||||||
args:
|
|
||||||
[
|
|
||||||
"/usr/sbin/caddy",
|
|
||||||
"run",
|
|
||||||
"--adapter",
|
|
||||||
"caddyfile",
|
|
||||||
"--config",
|
|
||||||
"/etc/caddy/Caddyfile",
|
|
||||||
]
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /health
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
timeoutSeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /health
|
|
||||||
port: 8080
|
|
||||||
initialDelaySeconds: 15
|
|
||||||
timeoutSeconds: 5
|
|
||||||
periodSeconds: 15
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: hydra-sql-env
|
|
||||||
env:
|
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
|
||||||
value: 127.0.0.1:9000
|
|
||||||
- name: CADDY_HTTPS_PORT
|
|
||||||
value: "8443"
|
|
||||||
- name: CADDY_HTTP_PORT
|
|
||||||
value: "8080"
|
|
||||||
- name: CADDY_DATA_FS
|
|
||||||
value: "/tmp/caddy"
|
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
|
||||||
value: "/app/public/"
|
|
||||||
resources: {}
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsUser: 1000
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
name: http
|
|
||||||
volumeMounts:
|
|
||||||
- name: sql-login-config
|
|
||||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
|
||||||
subPath: "sql_login.yaml"
|
|
||||||
volumes:
|
|
||||||
- name: sql-login-config
|
- name: sql-login-config
|
||||||
configMap:
|
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||||
name: sql-login-config
|
subPath: "sql_login.yaml"
|
||||||
|
- name: hydra-sql-php-ini
|
||||||
|
mountPath: /etc/php81/conf.d/03_base.ini
|
||||||
|
subPath: 03_base.ini
|
||||||
|
|
||||||
|
- name: hydra-sql-caddy
|
||||||
|
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
timeoutSeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /health
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
timeoutSeconds: 5
|
||||||
|
periodSeconds: 15
|
||||||
|
envFrom:
|
||||||
|
- configMapRef:
|
||||||
|
name: hydra-sql-env
|
||||||
|
env:
|
||||||
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
|
value: 127.0.0.1:9000
|
||||||
|
- name: CADDY_HTTPS_PORT
|
||||||
|
value: "8443"
|
||||||
|
- name: CADDY_HTTP_PORT
|
||||||
|
value: "8080"
|
||||||
|
- name: CADDY_DATA_FS
|
||||||
|
value: "/tmp/caddy"
|
||||||
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
|
value: "/app/public/"
|
||||||
|
resources: {}
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsUser: 1000
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
volumeMounts:
|
||||||
|
- name: sql-login-config
|
||||||
|
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||||
|
subPath: "sql_login.yaml"
|
||||||
|
volumes:
|
||||||
|
- name: sql-login-config
|
||||||
|
configMap:
|
||||||
|
name: sql-login-config
|
||||||
|
- name: hydra-sql-php-ini
|
||||||
|
configMap:
|
||||||
|
name: hydra-sql-php-ini
|
||||||
|
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-sql
|
name: hydra-sql
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
status:
|
status:
|
||||||
|
@ -23,17 +23,17 @@ spec:
|
|||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
resources: {}
|
resources: {}
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: oidc-test-env
|
name: oidc-test-env
|
||||||
env:
|
env:
|
||||||
- name: OIDC_CLIENT_ID
|
- name: OIDC_CLIENT_ID
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
key: CLIENT_ID
|
key: client_id
|
||||||
- name: OIDC_CLIENT_SECRET
|
- name: OIDC_CLIENT_SECRET
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
key: CLIENT_SECRET
|
key: client_secret
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -8,27 +8,35 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
|
|||||||
|
|
||||||
1. Créer un cluster avec `kind`
|
1. Créer un cluster avec `kind`
|
||||||
|
|
||||||
```
|
```
|
||||||
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
|
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
2. Déployer les opérateurs nécessaires au déploiement
|
2. Déployer les opérateurs nécessaires au déploiement
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl apply -k ./examples/k8s/kind/cluster --server-side
|
kubectl apply -k ./examples/k8s/kind/cluster --server-side
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Déployer l'application
|
3. Déployer l'application
|
||||||
|
|
||||||
|
```
|
||||||
|
kubectl apply -k ./examples/authenticated-app
|
||||||
|
```
|
||||||
|
|
||||||
|
**Note** Il est possible d'avoir l'erreur suivante:
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl apply -k ./examples/authenticated-app
|
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
|
||||||
|
|
||||||
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
|
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
|
||||||
|
|
||||||
```
|
```
|
||||||
127.0.0.1 ssokustom
|
127.0.0.1 ssokustom
|
||||||
```
|
```
|
||||||
|
|
||||||
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
|
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
|
||||||
|
|
||||||
@ -47,7 +55,7 @@ kind delete cluster -n sso-kustom-example
|
|||||||
|
|
||||||
#### URL utiles
|
#### URL utiles
|
||||||
|
|
||||||
| URL | Description |
|
|URL|Description|
|
||||||
| --------------------------------------------------- | ------------------------------------- |
|
|---|-----------|
|
||||||
| https://ssokustom/auth/saml/Shibboleth.sso/Session | Attributs de la session SP Shibboleth |
|
|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
|
||||||
| https://ssokustom/auth/saml/Shibboleth.sso/Metadata | Métadonnées du SP Shibboleth |
|
|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|
|
||||||
|
@ -8,7 +8,7 @@ resources:
|
|||||||
- ./resources/self-signed-issuer.yaml
|
- ./resources/self-signed-issuer.yaml
|
||||||
- ./resources/port-forwarder.yaml
|
- ./resources/port-forwarder.yaml
|
||||||
|
|
||||||
patches:
|
patchesJson6902:
|
||||||
- target:
|
- target:
|
||||||
version: v1
|
version: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
@ -38,9 +38,4 @@ patches:
|
|||||||
version: v1alpha1
|
version: v1alpha1
|
||||||
kind: OAuth2Client
|
kind: OAuth2Client
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
path: patches/oidc-test-oauth2-client.yaml
|
path: patches/oidc-test-oauth2-client.yaml
|
||||||
- target:
|
|
||||||
version: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
name: hydra-sql-env
|
|
||||||
path: patches/hydra-sql-env.yaml
|
|
@ -27,14 +27,4 @@
|
|||||||
- op: replace
|
- op: replace
|
||||||
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
|
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
|
||||||
value: https://ssokustom/auth/saml/logout
|
value: https://ssokustom/auth/saml/logout
|
||||||
|
|
||||||
# Hydra SQL configuration
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
|
|
||||||
value: https://ssokustom/auth/sql/login
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
|
|
||||||
value: https://ssokustom/auth/sql/consent
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
|
|
||||||
value: https://ssokustom/auth/sql/logout
|
|
@ -1,24 +0,0 @@
|
|||||||
- op: replace
|
|
||||||
path: "/data/BASE_URL"
|
|
||||||
value: https://ssokustom/auth/sql
|
|
||||||
- op: replace
|
|
||||||
path: "/data/ISSUER_URL"
|
|
||||||
value: https://ssokustom
|
|
||||||
- op: replace
|
|
||||||
path: "/data/ISSUER_URL"
|
|
||||||
value: https://ssokustom
|
|
||||||
- op: replace
|
|
||||||
path: "/data/HYDRA_ADMIN_BASE_URL"
|
|
||||||
value: http://hydra-dispatcher
|
|
||||||
- op: replace
|
|
||||||
path: "/data/DSN_REMOTE_DATABASE"
|
|
||||||
value: pgsql:host='postgres';port=5432;dbname=lasql
|
|
||||||
- op: replace
|
|
||||||
path: "/data/REDIS_DSN"
|
|
||||||
value: redis://redis:6379
|
|
||||||
- op: replace
|
|
||||||
path: "/data/DB_USER"
|
|
||||||
value: makeMeASecret
|
|
||||||
- op: replace
|
|
||||||
path: "/data/DB_PASSWORD"
|
|
||||||
value: rmakeMeASecret
|
|
@ -10,19 +10,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: oidc-test
|
name: oidc-test
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -34,43 +34,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth/saml(/|$)(.*)
|
- path: /auth/saml(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra-saml
|
name: hydra-saml
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: auth-sql
|
|
||||||
annotations:
|
|
||||||
cert-manager.io/issuer: "self-signed"
|
|
||||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- ssokustom
|
|
||||||
secretName: ssokustom-example-tls
|
|
||||||
rules:
|
|
||||||
- http:
|
|
||||||
paths:
|
|
||||||
- path: /auth/sql(/|$)(.*)
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: hydra-sql
|
|
||||||
port:
|
|
||||||
name: http
|
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -84,19 +60,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth/dispatcher(/|$)(.*)
|
- path: /auth/dispatcher(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra-dispatcher
|
name: hydra-dispatcher
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -109,19 +85,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth(/|$)(.*)
|
- path: /auth(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra
|
name: hydra
|
||||||
port:
|
port:
|
||||||
name: hydra-public
|
name: hydra-public
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -135,16 +111,21 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /simplesaml(/|$)(.*)
|
- path: /simplesaml(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: saml-idp
|
name: saml-idp
|
||||||
port:
|
port:
|
||||||
name: https
|
name: https
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,11 +1,10 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
resources:
|
resources:
|
||||||
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
|
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
|
||||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
|
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
|
||||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
|
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
|
||||||
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
|
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
|
||||||
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
|
|
||||||
|
|
||||||
patchesJson6902:
|
patchesJson6902:
|
||||||
- target:
|
- target:
|
||||||
|
22
resources/hydra-dispatcher/files/03_base.ini
Normal file
22
resources/hydra-dispatcher/files/03_base.ini
Normal file
@ -0,0 +1,22 @@
|
|||||||
|
[opcache]
|
||||||
|
; Determines if Zend OPCache is enabled
|
||||||
|
opcache.enable=1
|
||||||
|
|
||||||
|
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
||||||
|
opcache.enable_cli=1
|
||||||
|
|
||||||
|
; The OPcache shared memory storage size.
|
||||||
|
opcache.memory_consumption=512
|
||||||
|
|
||||||
|
; The maximum number of keys (scripts) in the OPcache hash table.
|
||||||
|
; Only numbers between 200 and 1000000 are allowed.
|
||||||
|
opcache.max_accelerated_files=20000
|
||||||
|
|
||||||
|
; When disabled, you must reset the OPcache manually or restart the
|
||||||
|
; webserver for changes to the filesystem to take effect.
|
||||||
|
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
||||||
|
|
||||||
|
; How often (in seconds) to check file timestamps for changes to the shared
|
||||||
|
; memory storage allocation. ("1" means validate once per second, but only
|
||||||
|
; once per request. "0" means always validate)
|
||||||
|
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
@ -29,3 +29,6 @@ configMapGenerator:
|
|||||||
- name: hydra-dispatcher-apps
|
- name: hydra-dispatcher-apps
|
||||||
files:
|
files:
|
||||||
- apps.yaml=./files/hydra/default.yaml
|
- apps.yaml=./files/hydra/default.yaml
|
||||||
|
- name: hydra-dispatcher-php-ini
|
||||||
|
files:
|
||||||
|
- ./files/03_base.ini
|
@ -17,91 +17,101 @@ spec:
|
|||||||
app.kubernetes.io/name: hydra-dispatcher
|
app.kubernetes.io/name: hydra-dispatcher
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-dispatcher-php-fpm
|
- name: hydra-dispatcher-php-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
|
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
envFrom:
|
- name: OPCACHE_VALIDATE_TIMESTAMP
|
||||||
- configMapRef:
|
value: "0"
|
||||||
name: hydra-dispatcher-env
|
- name: OPCACHE_REVALIDATE_FREQ
|
||||||
volumeMounts:
|
value: "0"
|
||||||
- mountPath: /app/config/hydra
|
envFrom:
|
||||||
name: hydra-dispatcher-apps
|
- configMapRef:
|
||||||
resources: {}
|
name: hydra-dispatcher-env
|
||||||
securityContext:
|
volumeMounts:
|
||||||
runAsNonRoot: true
|
- mountPath: /app/config/hydra
|
||||||
runAsGroup: 1000
|
name: hydra-dispatcher-apps
|
||||||
runAsUser: 1000
|
- name: hydra-dispatcher-php-ini
|
||||||
- name: hydra-dispatcher-caddy
|
mountPath: /etc/php81/conf.d/03_base.ini
|
||||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
|
subPath: 03_base.ini
|
||||||
imagePullPolicy: Always
|
resources: {}
|
||||||
args:
|
securityContext:
|
||||||
[
|
runAsNonRoot: true
|
||||||
"/usr/sbin/caddy",
|
runAsGroup: 1000
|
||||||
"run",
|
runAsUser: 1000
|
||||||
"--adapter",
|
- name: hydra-dispatcher-caddy
|
||||||
"caddyfile",
|
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
||||||
"--config",
|
imagePullPolicy: IfNotPresent
|
||||||
"/etc/caddy/Caddyfile",
|
args:
|
||||||
]
|
[
|
||||||
readinessProbe:
|
"/usr/sbin/caddy",
|
||||||
httpGet:
|
"run",
|
||||||
path: /health
|
"--adapter",
|
||||||
port: 8080
|
"caddyfile",
|
||||||
initialDelaySeconds: 5
|
"--config",
|
||||||
timeoutSeconds: 5
|
"/etc/caddy/Caddyfile",
|
||||||
periodSeconds: 10
|
]
|
||||||
livenessProbe:
|
readinessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /health
|
path: /health
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 5
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 15
|
periodSeconds: 10
|
||||||
envFrom:
|
livenessProbe:
|
||||||
- configMapRef:
|
httpGet:
|
||||||
name: hydra-dispatcher-env
|
path: /health
|
||||||
env:
|
port: 8080
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
initialDelaySeconds: 15
|
||||||
value: 127.0.0.1:9000
|
timeoutSeconds: 5
|
||||||
- name: CADDY_HTTPS_PORT
|
periodSeconds: 15
|
||||||
value: "8443"
|
envFrom:
|
||||||
- name: CADDY_HTTP_PORT
|
- configMapRef:
|
||||||
value: "8080"
|
name: hydra-dispatcher-env
|
||||||
- name: CADDY_DATA_FS
|
env:
|
||||||
value: "/tmp/caddy"
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
value: 127.0.0.1:9000
|
||||||
value: "/app/public/"
|
- name: CADDY_HTTPS_PORT
|
||||||
ports:
|
value: "8443"
|
||||||
- containerPort: 8080
|
- name: CADDY_HTTP_PORT
|
||||||
name: http
|
value: "8080"
|
||||||
resources: {}
|
- name: CADDY_DATA_FS
|
||||||
securityContext:
|
value: "/tmp/caddy"
|
||||||
runAsNonRoot: true
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
runAsGroup: 1000
|
value: "/app/public/"
|
||||||
runAsUser: 1000
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
resources: {}
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsGroup: 1000
|
||||||
|
runAsUser: 1000
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
volumes:
|
volumes:
|
||||||
- name: hydra-dispatcher-apps
|
- name: hydra-dispatcher-apps
|
||||||
configMap:
|
configMap:
|
||||||
name: hydra-dispatcher-apps
|
name: hydra-dispatcher-apps
|
||||||
|
- name: hydra-dispatcher-php-ini
|
||||||
|
configMap:
|
||||||
|
name: hydra-dispatcher-php-ini
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-dispatcher
|
name: hydra-dispatcher
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-dispatcher
|
app.kubernetes.io/name: hydra-dispatcher
|
||||||
status:
|
status:
|
||||||
|
@ -30,6 +30,7 @@ configMapGenerator:
|
|||||||
- URLS_CONSENT=http://hydra-consent-app/consent
|
- URLS_CONSENT=http://hydra-consent-app/consent
|
||||||
- URLS_LOGOUT=http://hydra-logout-app/logout
|
- URLS_LOGOUT=http://hydra-logout-app/logout
|
||||||
- HYDRA_SERVE_ALL_ARGS=--dev
|
- HYDRA_SERVE_ALL_ARGS=--dev
|
||||||
|
- HYDRA_DATABASE_MAX_CONN="10"
|
||||||
- LOG_LEVEL=info
|
- LOG_LEVEL=info
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
|
Loading…
Reference in New Issue
Block a user