Compare commits
No commits in common. "unstable" and "fix-example-app" have entirely different histories.
unstable
...
fix-exampl
|
|
@ -7,7 +7,29 @@ configurations:
|
|||
resources:
|
||||
- ./resources/hydra-cnpg-cluster.yaml
|
||||
|
||||
patches:
|
||||
secretGenerator:
|
||||
- name: hydra-postgres-admin
|
||||
type: Secret
|
||||
literals:
|
||||
- username=postgres
|
||||
- password=NotSoSecret
|
||||
- name: hydra-postgres-user
|
||||
type: Secret
|
||||
literals:
|
||||
- username=hydra
|
||||
- password=NotSoSecret
|
||||
|
||||
|
||||
vars:
|
||||
- name: HYDRA_DATABASE_SERVICE_NAME
|
||||
objref:
|
||||
name: hydra-postgres
|
||||
kind: Cluster
|
||||
apiVersion: postgresql.cnpg.io/v1
|
||||
fieldref:
|
||||
fieldpath: metadata.name
|
||||
|
||||
patchesJson6902:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
|
|
@ -20,9 +42,3 @@ patches:
|
|||
kind: Job
|
||||
name: hydra-migrate
|
||||
path: patches/hydra-migrate-job.yaml
|
||||
- target:
|
||||
group: batch
|
||||
version: v1
|
||||
kind: CronJob
|
||||
name: hydra-janitor
|
||||
path: patches/hydra-janitor-cronjob.yaml
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
name: HYDRA_DATABASE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
name: hydra-postgres-user
|
||||
key: username
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
|
|
@ -12,18 +12,10 @@
|
|||
name: HYDRA_DATABASE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
name: hydra-postgres-user
|
||||
key: password
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: HYDRA_DATABASE_SERVICE_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
key: host
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: DSN
|
||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable&max_conns=$(HYDRA_DATABASE_MAX_CONN)"
|
||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
- op: add
|
||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: HYDRA_DATABASE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
key: username
|
||||
- op: add
|
||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: HYDRA_DATABASE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
key: password
|
||||
- op: add
|
||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: HYDRA_DATABASE_SERVICE_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
key: host
|
||||
- op: add
|
||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: DSN
|
||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
name: HYDRA_DATABASE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
name: hydra-postgres-user
|
||||
key: username
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
|
|
@ -12,18 +12,10 @@
|
|||
name: HYDRA_DATABASE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
name: hydra-postgres-user
|
||||
key: password
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: HYDRA_DATABASE_SERVICE_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-postgres-app
|
||||
key: host
|
||||
- op: add
|
||||
path: "/spec/template/spec/containers/0/env/-"
|
||||
value:
|
||||
name: DSN
|
||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
||||
|
|
@ -5,9 +5,13 @@ metadata:
|
|||
spec:
|
||||
instances: 3
|
||||
primaryUpdateStrategy: unsupervised
|
||||
superuserSecret:
|
||||
name: hydra-postgres-admin
|
||||
bootstrap:
|
||||
initdb:
|
||||
database: hydra
|
||||
owner: hydra
|
||||
secret:
|
||||
name: hydra-postgres-user
|
||||
storage:
|
||||
size: 2Gi
|
||||
size: 2Gi
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||
kind: Component
|
||||
|
||||
resources:
|
||||
- ./resources/deployment.yaml
|
||||
- ./resources/service.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-ldap-env
|
||||
literals:
|
||||
- WERTHER_DEV_MODE=false
|
||||
- WERTHER_LDAP_ROLE_CLAIM="https://hydra/claims/roles"
|
||||
- WERTHER_SKIP_SSL_VERIFICATIONS=false
|
||||
- WERTHER_IDENTP_CLAIM_SCOPES="name:profile,family_name:profile,given_name:profile,email:email,https%3A%2F%2Fhydra%2Fclaims%2Froles:roles"
|
||||
- WERTHER_IDENTP_HYDRA_URL="http://hydra:4444"
|
||||
- WERTHER_LDAP_ENDPOINTS="ldap.test.fr:636"
|
||||
- WERTHER_LDAP_IS_TLS=true
|
||||
- WERTHER_LDAP_BASEDN="o=test,c=fr"
|
||||
- WERTHER_LDAP_ROLE_BASEDN="ou=groups,o=test,c=fr"
|
||||
- WERTHER_LDAP_CONNECTION_TIMEOUT="10s"
|
||||
|
||||
secretGenerator:
|
||||
- name: hydra-ldap-sc
|
||||
literals:
|
||||
- WERTHER_LDAP_BINDDN="cn=reader,o=test,c=fr"
|
||||
- WERTHER_LDAP_BINDPW=ThisMustBeAbsolutelyChanged
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hydra-ldap
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-ldap
|
||||
app.kubernetes.io/version: "v1.2.2"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-ldap
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-ldap
|
||||
app.kubernetes.io/version: "v1.2.2"
|
||||
spec:
|
||||
containers:
|
||||
- name: werther
|
||||
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
|
||||
imagePullPolicy: IfNotPresent
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-ldap-env
|
||||
env:
|
||||
- name: WERTHER_WEB_DIR
|
||||
value: "/usr/share/werther/login/"
|
||||
- name: WERTHER_LDAP_BINDDN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-ldap-sc
|
||||
key: WERTHER_LDAP_BINDDN
|
||||
- name: WERTHER_LDAP_BINDPW
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: hydra-ldap-sc
|
||||
key: WERTHER_LDAP_BINDPW
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: hydra-ldap-http
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 100
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-ldap
|
||||
name: hydra-ldap
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: hydra-ldap
|
||||
port: 8080
|
||||
targetPort: hydra-ldap-http
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-ldap
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -1,13 +1,12 @@
|
|||
hydra:
|
||||
apps:
|
||||
- id: oidc
|
||||
title:
|
||||
title:
|
||||
fr: Connexion OIDC
|
||||
en: Login OIDC
|
||||
description:
|
||||
description:
|
||||
fr: Authentification avec OpenID Connect
|
||||
en: Authentication with OpenID Connect
|
||||
login_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGIN_URL)%"
|
||||
consent_url: "%env(string:HYDRA_DISPATCHER_OIDC_CONSENT_URL)%"
|
||||
logout_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGOUT_URL)%"
|
||||
attributes_rewrite_configuration: []
|
||||
logout_url: "%env(string:HYDRA_DISPATCHER_OIDC_LOGOUT_URL)%"
|
||||
|
|
@ -2,36 +2,36 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
|
|||
kind: Component
|
||||
|
||||
resources:
|
||||
- ./resources/hydra-oidc-deployment.yaml
|
||||
- ./resources/hydra-oidc-service.yaml
|
||||
|
||||
generatorOptions:
|
||||
labels:
|
||||
com.cadoles.forge.sso-kustom/session: redis
|
||||
- ./resources/hydra-oidc-deployment.yaml
|
||||
- ./resources/hydra-oidc-service.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-oidc-env
|
||||
behavior: create
|
||||
literals:
|
||||
- APP_ENV=prod
|
||||
- APP_DEBUG=false
|
||||
- PHP_FPM_MEMORY_LIMIT=256m
|
||||
- NGINX_APP_SERVER_LISTEN=80
|
||||
- HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
|
||||
- OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize
|
||||
- OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token
|
||||
- OIDC_USERINFO_ENDPOINT=https://oidc-idp/api/v1/userinfo
|
||||
- POST_LOGOUT_REDIRECT_URL=http://oidc-sp/logout
|
||||
- OIDC_LOGOUT_ENDPOINT=https://oidc-idp/api/v1/logout?%s
|
||||
- BASE_URL=http://hydra-oidc
|
||||
- PARAMS_TO_DELETE=[]
|
||||
- PARAMS_TO_INSERT={}
|
||||
- OIDC_SCOPE=openid email
|
||||
- CLIENT_ID_FC=MyClientID
|
||||
- CLIENT_SECRET_FC=MyClientSecret
|
||||
- COOKIE_PATH=/
|
||||
- TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
|
||||
- REDIS_DSN="redis://redis:6379"
|
||||
- HYDRA_DISPATCHER_OIDC_LOGIN_URL="http://hydra-oidc/login"
|
||||
- HYDRA_DISPATCHER_OIDC_CONSENT_URL="http://hydra-oidc/consent"
|
||||
- HYDRA_DISPATCHER_OIDC_LOGOUT_URL="http://hydra-oidc/logout"
|
||||
- name: hydra-oidc-env
|
||||
literals:
|
||||
- APP_ENV=prod
|
||||
- APP_DEBUG=false
|
||||
- HYDRA_ADMIN_BASE_URL=http://hydra-dispatcher
|
||||
- OIC_AUTHORIZE_ENDPOINT=https://oidc-idp/api/v1/authorize
|
||||
- OIDC_TOKEN_ENDPOINT=https://oidc-idp/api/v1/token
|
||||
- OIDC_USERINFO_ENDPOINT=https://oidc-idp/api/v1/userinfo
|
||||
- POST_LOGOUT_REDIRECT_URL=http://oidc-sp/logout
|
||||
- OIDC_LOGOUT_ENDPOINT=https://oidc-idp/api/v1/logout?%s
|
||||
- BASE_URL=http://hydra-oidc
|
||||
- PARAMS_TO_DELETE=[]
|
||||
- PARAMS_TO_INSERT={}
|
||||
- OIDC_SCOPE=openid email
|
||||
- CLIENT_ID_FC=MyClientID
|
||||
- CLIENT_SECRET_FC=MyClientSecret
|
||||
- COOKIE_PATH=/
|
||||
- TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR
|
||||
- name: hydra-dispatcher-apps
|
||||
behavior: merge
|
||||
files:
|
||||
- ./files/hydra/oidc.yaml
|
||||
|
||||
patchesJson6902:
|
||||
- target:
|
||||
version: v1
|
||||
kind: ConfigMap
|
||||
name: hydra-dispatcher-env
|
||||
path: patches/hydra-dispatcher-env.yaml
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
- op: replace
|
||||
path: "/data/HYDRA_DISPATCHER_OIDC_LOGIN_URL"
|
||||
value: http://hydra-oidc/login
|
||||
- op: replace
|
||||
path: "/data/HYDRA_DISPATCHER_OIDC_CONSENT_URL"
|
||||
value: http://hydra-oidc/consent
|
||||
- op: replace
|
||||
path: "/data/HYDRA_DISPATCHER_OIDC_LOGOUT_URL"
|
||||
value: http://hydra-oidc/logout
|
||||
|
|
@ -2,101 +2,28 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-oidc
|
||||
io.kompose.service: hydra-oidc
|
||||
name: hydra-oidc
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-oidc
|
||||
io.kompose.service: hydra-oidc
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-oidc
|
||||
io.kompose.service: hydra-oidc
|
||||
spec:
|
||||
containers:
|
||||
- name: hydra-oidc-php-fpm
|
||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||
imagePullPolicy: Always
|
||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -f /etc/php81/php-fpm.d/www.conf
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- php
|
||||
- bin/console
|
||||
- -V
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
env:
|
||||
- name: PHP_FPM_LISTEN
|
||||
value: 127.0.0.1:9000
|
||||
- name: PHP_MEMORY_LIMIT
|
||||
value: 128m
|
||||
- name: PHP_FPM_MEMORY_LIMIT
|
||||
value: 128m
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-oidc-env
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
|
||||
- name: hydra-oidc-caddy
|
||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
[
|
||||
"/usr/sbin/caddy",
|
||||
"run",
|
||||
"--adapter",
|
||||
"caddyfile",
|
||||
"--config",
|
||||
"/etc/caddy/Caddyfile",
|
||||
]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthy
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthy
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 15
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-oidc-env
|
||||
env:
|
||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||
value: 127.0.0.1:9000
|
||||
- name: CADDY_HTTPS_PORT
|
||||
value: "8443"
|
||||
- name: CADDY_HTTP_PORT
|
||||
value: "8080"
|
||||
- name: CADDY_DATA_FS
|
||||
value: "/tmp/caddy"
|
||||
- name: CADDY_APP_ROOT_PUBLIC
|
||||
value: "/app/public/"
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
- name: hydra-oidc
|
||||
image: reg.cadoles.com/cadoles/hydra-oidc-v1:v0.0.0-170-g485b138
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-oidc-env
|
||||
ports:
|
||||
- containerPort: 80
|
||||
resources: {}
|
||||
restartPolicy: Always
|
||||
|
||||
|
|
|
|||
|
|
@ -2,14 +2,13 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-oidc
|
||||
io.kompose.service: hydra-oidc
|
||||
name: hydra-oidc
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
- name: hydra-oidc
|
||||
port: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-oidc
|
||||
io.kompose.service: hydra-oidc
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,10 @@
|
|||
hydra:
|
||||
apps:
|
||||
- id: saml
|
||||
title:
|
||||
title:
|
||||
fr: Connexion SAML
|
||||
en: Login SAML
|
||||
description:
|
||||
description:
|
||||
fr: Authentification avec SAML
|
||||
en: Authentication with SAML
|
||||
login_url: "%env(string:HYDRA_DISPATCHER_SAML_LOGIN_URL)%"
|
||||
|
|
@ -27,4 +27,4 @@ hydra:
|
|||
uid:
|
||||
required: false
|
||||
eduPersonAffiliation:
|
||||
required: false
|
||||
required: false
|
||||
|
|
@ -37,4 +37,4 @@ patchesJson6902:
|
|||
version: v1
|
||||
kind: ConfigMap
|
||||
name: hydra-dispatcher-env
|
||||
path: patches/hydra-dispatcher-env.yaml
|
||||
path: patches/hydra-dispatcher-env.yaml
|
||||
|
|
@ -2,28 +2,28 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml-remote-user
|
||||
io.kompose.service: hydra-saml-remote-user
|
||||
name: hydra-saml-remote-user
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-saml-remote-user
|
||||
io.kompose.service: hydra-saml-remote-user
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml-remote-user
|
||||
io.kompose.service: hydra-saml-remote-user
|
||||
spec:
|
||||
containers:
|
||||
- name: hydra-saml-remote-user
|
||||
image: reg.cadoles.com/cadoles/hydra-remote-user-base:2023.12.11-develop.1523.5f14595
|
||||
image: reg.cadoles.com/cadoles/hydra-remote-user-v1:v0.0.0-233-g64fcacc
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-saml-env
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
- containerPort: 80
|
||||
resources: {}
|
||||
restartPolicy: Always
|
||||
---
|
||||
|
|
@ -31,14 +31,13 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml-remote-user
|
||||
io.kompose.service: hydra-saml-remote-user
|
||||
name: hydra-saml-remote-user
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-saml-remote-user
|
||||
io.kompose.service: hydra-saml-remote-user
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
|
|||
|
|
@ -2,25 +2,25 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml-shibboleth-sp
|
||||
io.kompose.service: hydra-saml-shibboleth-sp
|
||||
name: hydra-saml-shibboleth-sp
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-saml-shibboleth-sp
|
||||
io.kompose.service: hydra-saml-shibboleth-sp
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml-shibboleth-sp
|
||||
io.kompose.service: hydra-saml-shibboleth-sp
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 102
|
||||
containers:
|
||||
- name: hydra-saml-shibboleth-sp
|
||||
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:2023.12.12-develop.1039.49b85e1
|
||||
image: reg.cadoles.com/cadoles/shibboleth-sp-v3:v0.0.0-233-g64fcacc
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-saml-env
|
||||
|
|
@ -41,14 +41,14 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-saml
|
||||
io.kompose.service: hydra-saml
|
||||
name: hydra-saml
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-saml-shibboleth-sp
|
||||
io.kompose.service: hydra-saml-shibboleth-sp
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,22 +0,0 @@
|
|||
[opcache]
|
||||
; Determines if Zend OPCache is enabled
|
||||
opcache.enable=1
|
||||
|
||||
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
||||
opcache.enable_cli=1
|
||||
|
||||
; The OPcache shared memory storage size.
|
||||
opcache.memory_consumption=512
|
||||
|
||||
; The maximum number of keys (scripts) in the OPcache hash table.
|
||||
; Only numbers between 200 and 1000000 are allowed.
|
||||
opcache.max_accelerated_files=20000
|
||||
|
||||
; When disabled, you must reset the OPcache manually or restart the
|
||||
; webserver for changes to the filesystem to take effect.
|
||||
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
||||
|
||||
; How often (in seconds) to check file timestamps for changes to the shared
|
||||
; memory storage allocation. ("1" means validate once per second, but only
|
||||
; once per request. "0" means always validate)
|
||||
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
sql_login:
|
||||
login_column_name: mail
|
||||
password_column_name: password
|
||||
salt_column_name: salt
|
||||
table_name: user
|
||||
data_to_fetch:
|
||||
- mail
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||
kind: Component
|
||||
|
||||
resources:
|
||||
- ./resources/hydra-sql-service.yaml
|
||||
- ./resources/hydra-sql-deployment.yaml
|
||||
|
||||
generatorOptions:
|
||||
labels:
|
||||
com.cadoles.forge.sso-kustom/session: redis
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-sql-env
|
||||
behavior: create
|
||||
literals:
|
||||
- ISSUER_URL="http://localhost:8000"
|
||||
- BASE_URL='http://localhost:8080'
|
||||
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
|
||||
- APP_LOCALES="fr,en"
|
||||
- HASH_ALGO_LEGACY="sha256, bcrypt"
|
||||
- SECURITY_PATTERN="password,salt,pepper"
|
||||
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
|
||||
- DB_USER="makeMeASecret"
|
||||
- DB_PASSWORD="makeMeASecret"
|
||||
- REDIS_DSN="redis://redis:6379"
|
||||
- PEPPER="MakeMeABigSecret"
|
||||
- name: sql-login-config
|
||||
files:
|
||||
- ./files/sql_login.yaml
|
||||
- name: hydra-sql-php-ini
|
||||
files:
|
||||
- ./files/03_base.ini
|
||||
|
|
@ -1,122 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-sql
|
||||
name: hydra-sql
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-sql
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-sql
|
||||
spec:
|
||||
containers:
|
||||
- name: hydra-sql-fpm
|
||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
||||
imagePullPolicy: Always
|
||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -f /etc/php81/php-fpm.d/www.conf
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- php
|
||||
- bin/console
|
||||
- -V
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-sql-env
|
||||
env:
|
||||
- name: PHP_FPM_LISTEN
|
||||
value: 127.0.0.1:9000
|
||||
- name: PHP_MEMORY_LIMIT
|
||||
value: 128m
|
||||
- name: PHP_FPM_MEMORY_LIMIT
|
||||
value: 128m
|
||||
- name: PHP_FPM_LOG_LEVEL
|
||||
value: warning
|
||||
- name: OPCACHE_VALIDATE_TIMESTAMP
|
||||
value: "0"
|
||||
- name: OPCACHE_REVALIDATE_FREQ
|
||||
value: "0"
|
||||
volumeMounts:
|
||||
- name: sql-login-config
|
||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||
subPath: "sql_login.yaml"
|
||||
- name: hydra-sql-php-ini
|
||||
mountPath: /etc/php81/conf.d/03_base.ini
|
||||
subPath: 03_base.ini
|
||||
|
||||
- name: hydra-sql-caddy
|
||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
||||
imagePullPolicy: Always
|
||||
args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 15
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-sql-env
|
||||
env:
|
||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||
value: 127.0.0.1:9000
|
||||
- name: CADDY_HTTPS_PORT
|
||||
value: "8443"
|
||||
- name: CADDY_HTTP_PORT
|
||||
value: "8080"
|
||||
- name: CADDY_DATA_FS
|
||||
value: "/tmp/caddy"
|
||||
- name: CADDY_APP_ROOT_PUBLIC
|
||||
value: "/app/public/"
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: sql-login-config
|
||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||
subPath: "sql_login.yaml"
|
||||
volumes:
|
||||
- name: sql-login-config
|
||||
configMap:
|
||||
name: sql-login-config
|
||||
- name: hydra-sql-php-ini
|
||||
configMap:
|
||||
name: hydra-sql-php-ini
|
||||
|
||||
restartPolicy: Always
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-sql
|
||||
name: hydra-sql
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-sql
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||
kind: Component
|
||||
|
||||
resources:
|
||||
- ./resources/deployment.yaml
|
||||
- ./resources/service.yaml
|
||||
- ./resources/oauth2-client.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: oidc-test-env
|
||||
literals:
|
||||
- LOG_LEVEL=0
|
||||
- HTTP_ADDRESS=0.0.0.0:8080
|
||||
- OIDC_CLIENT_ID=oidc-test
|
||||
- OIDC_CLIENT_SECRET=NotSoSecret
|
||||
- OIDC_ISSUER_URL=http://hydra:4444
|
||||
- OIDC_REDIRECT_URL=https://example.net/oauth2/callback
|
||||
- OIDC_POST_LOGOUT_REDIRECT_URL=https://example.net
|
||||
- OIDC_SKIP_ISSUER_VERIFICATION="true"
|
||||
- OIDC_INSECURE_SKIP_VERIFY="true"
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: oidc-test
|
||||
name: oidc-test
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: oidc-test
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: oidc-test
|
||||
spec:
|
||||
containers:
|
||||
- image: reg.cadoles.com/cadoles/oidc-test:2023.12.6-stable.1502.ebfd504
|
||||
name: oidc-test
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
resources: {}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: oidc-test-env
|
||||
env:
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oidc-test-oauth2-client
|
||||
key: client_id
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: oidc-test-oauth2-client
|
||||
key: client_secret
|
||||
restartPolicy: Always
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: oidc-test
|
||||
name: oidc-test
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app.kubernetes.io/name: oidc-test
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# Composant `redis`
|
||||
|
||||
### Description
|
||||
|
||||
Les applications `hydra-dispatcher`, `hydra-sql` et `hydra-oidc` stockent dorénavant le cache et les sessions utilisateur sur un serveur Redis.
|
||||
Le DSN du serveur est défini dans leur variable d'environnement respective `REDIS_DSN`.
|
||||
Les applications peuvent utiliser le mode `sentinel` de redis
|
||||
Il est donc nécessaire donc nécessaire de disposer d'un serveur Redis pour utiliser ces applications.
|
||||
|
||||
### Principe général de fonctionnement
|
||||
|
||||
Un `RedisFailOver` crée un cluster redis en mode sentinel avec 3 réplicats chacun.
|
||||
|
||||
|
||||
### Personnalisation
|
||||
|
||||
Via des `patches` sur la ressource `ConfigMap` via un label selector `com.cadoles.forge.sso-kustom/session=redis` il est possible de modifier la valeur du `REDIS_DSN`.
|
||||
|
||||
|
||||
|Clé|Description|Exemple|
|
||||
|---|-----------|-------|
|
||||
|`REDIS_DSN`| DSN du cluster Redis | `redis://rfs-sso-redis:26379?&redis_sentinel=mymaster`
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
||||
kind: Component
|
||||
|
||||
resources:
|
||||
- ./resources/redis-failover.yaml
|
||||
|
||||
patches:
|
||||
- path: ./patches/hydra-apps.yaml
|
||||
target:
|
||||
kind: ConfigMap
|
||||
labelSelector: "com.cadoles.forge.sso-kustom/session=redis"
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
- op: replace
|
||||
path: "/data/REDIS_DSN"
|
||||
value: "redis://rfs-sso-redis:26379?&redis_sentinel=mymaster"
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
apiVersion: databases.spotahome.com/v1
|
||||
kind: RedisFailover
|
||||
metadata:
|
||||
name: sso-redis
|
||||
spec:
|
||||
sentinel:
|
||||
replicas: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 100Mi
|
||||
redis:
|
||||
replicas: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 100Mi
|
||||
limits:
|
||||
cpu: 400m
|
||||
memory: 500Mi
|
||||
|
|
@ -0,0 +1 @@
|
|||
# Documentation
|
||||
|
|
@ -15,7 +15,7 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
|
|||
2. Déployer les opérateurs nécessaires au déploiement
|
||||
|
||||
```
|
||||
kubectl apply -k ./examples/k8s/kind/cluster --server-side
|
||||
kubectl kustomize --enable-helm ./examples/k8s/kind/cluster | kubectl apply -f -
|
||||
```
|
||||
|
||||
3. Déployer l'application
|
||||
|
|
|
|||
|
|
@ -2,12 +2,20 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
|||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../overlays/full
|
||||
- ../../resources/hydra
|
||||
- ../../resources/hydra-dispatcher
|
||||
- ./resources/app.yaml
|
||||
- ./resources/ingress.yaml
|
||||
- ./resources/oauth2-client.yaml
|
||||
- ./resources/saml-idp.yaml
|
||||
- ./resources/self-signed-issuer.yaml
|
||||
- ./resources/port-forwarder.yaml
|
||||
|
||||
components:
|
||||
- ../../components/hydra-cnpg-database
|
||||
#- ../../components/hydra-oidc
|
||||
- ../../components/hydra-saml
|
||||
|
||||
patchesJson6902:
|
||||
- target:
|
||||
version: v1
|
||||
|
|
@ -28,14 +36,4 @@ patchesJson6902:
|
|||
version: v1
|
||||
kind: Secret
|
||||
name: hydra-secret
|
||||
path: patches/hydra-secret.yaml
|
||||
- target:
|
||||
version: v1
|
||||
kind: ConfigMap
|
||||
name: oidc-test
|
||||
path: patches/oidc-test.yaml
|
||||
- target:
|
||||
version: v1alpha1
|
||||
kind: OAuth2Client
|
||||
name: oidc-test-oauth2-client
|
||||
path: patches/oidc-test-oauth2-client.yaml
|
||||
path: patches/hydra-secret.yaml
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
- op: replace
|
||||
path: "/spec/redirectUris/0"
|
||||
value: https://ssokustom/oauth2/callback
|
||||
- op: replace
|
||||
path: "/spec/postLogoutRedirectUris/0"
|
||||
value: https://ssokustom
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
- op: replace
|
||||
path: "/data/OIDC_REDIRECT_URL"
|
||||
value: https://ssokustom/oauth2/callback
|
||||
- op: replace
|
||||
path: "/data/OIDC_POST_LOGOUT_REDIRECT_URL"
|
||||
value: https://ssokustom
|
||||
|
|
@ -0,0 +1,66 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
io.kompose.service: app
|
||||
name: app
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
io.kompose.service: app
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
io.kompose.service: app
|
||||
spec:
|
||||
containers:
|
||||
- image: reg.cadoles.com/cadoles/oidc-test:2023.11.6-stable.1557.e16b905
|
||||
name: app
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
resources: {}
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: "0"
|
||||
- name: HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: app-oidc-secret
|
||||
key: client_id
|
||||
- name: OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: app-oidc-secret
|
||||
key: client_secret
|
||||
- name: OIDC_ISSUER_URL
|
||||
value: http://hydra:4444
|
||||
- name: OIDC_REDIRECT_URL
|
||||
value: https://ssokustom/oauth2/callback
|
||||
- name: OIDC_POST_LOGOUT_REDIRECT_URL
|
||||
value: https://ssokustom
|
||||
- name: OIDC_SKIP_ISSUER_VERIFICATION
|
||||
value: "true"
|
||||
- name: OIDC_INSECURE_SKIP_VERIFY
|
||||
value: "true"
|
||||
restartPolicy: Always
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
io.kompose.service: app
|
||||
name: app
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
selector:
|
||||
io.kompose.service: app
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -20,7 +20,7 @@ spec:
|
|||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: oidc-test
|
||||
name: app
|
||||
port:
|
||||
name: http
|
||||
---
|
||||
|
|
|
|||
|
|
@ -1,9 +1,9 @@
|
|||
apiVersion: hydra.ory.sh/v1alpha1
|
||||
kind: OAuth2Client
|
||||
metadata:
|
||||
name: oidc-test-oauth2-client
|
||||
name: app-oauth2-client
|
||||
spec:
|
||||
clientName: "oidc-test"
|
||||
clientName: "app"
|
||||
tokenEndpointAuthMethod: "client_secret_basic"
|
||||
grantTypes:
|
||||
- authorization_code
|
||||
|
|
@ -11,8 +11,8 @@ spec:
|
|||
responseTypes:
|
||||
- code
|
||||
scope: "openid email"
|
||||
secretName: oidc-test-oauth2-client
|
||||
secretName: app-oidc-secret
|
||||
redirectUris:
|
||||
- https://example.net/oauth2/callback
|
||||
- https://ssokustom/oauth2/callback
|
||||
postLogoutRedirectUris:
|
||||
- https://example.net
|
||||
- https://ssokustom
|
||||
|
|
@ -2,19 +2,19 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: port-forwarder
|
||||
io.kompose.service: port-forwarder
|
||||
name: port-forwarder
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: port-forwarder
|
||||
io.kompose.service: port-forwarder
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: port-forwarder
|
||||
io.kompose.service: port-forwarder
|
||||
spec:
|
||||
containers:
|
||||
- image: hpello/tcp-proxy:latest
|
||||
|
|
@ -42,7 +42,7 @@ apiVersion: v1
|
|||
metadata:
|
||||
name: ssokustom
|
||||
labels:
|
||||
app.kubernetes.io/name: port-forwarder
|
||||
io.kompose.service: port-forwarder
|
||||
spec:
|
||||
ports:
|
||||
- name: https
|
||||
|
|
@ -52,4 +52,4 @@ spec:
|
|||
port: 80
|
||||
targetPort: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: port-forwarder
|
||||
io.kompose.service: port-forwarder
|
||||
|
|
@ -2,19 +2,19 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: saml-idp
|
||||
io.kompose.service: saml-idp
|
||||
name: saml-idp
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: saml-idp
|
||||
io.kompose.service: saml-idp
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: saml-idp
|
||||
io.kompose.service: saml-idp
|
||||
spec:
|
||||
containers:
|
||||
- image: kristophjunge/test-saml-idp:1.15
|
||||
|
|
@ -35,7 +35,7 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: saml-idp
|
||||
io.kompose.service: saml-idp
|
||||
name: saml-idp
|
||||
spec:
|
||||
ports:
|
||||
|
|
@ -46,6 +46,6 @@ spec:
|
|||
port: 8443
|
||||
targetPort: 8443
|
||||
selector:
|
||||
app.kubernetes.io/name: saml-idp
|
||||
io.kompose.service: saml-idp
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
@ -3,7 +3,6 @@ kind: Kustomization
|
|||
resources:
|
||||
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
|
||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
|
||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
|
||||
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
|
||||
|
||||
patchesJson6902:
|
||||
|
|
@ -12,4 +11,4 @@ patchesJson6902:
|
|||
kind: ConfigMap
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
path: patches/nginx-controller.yaml
|
||||
path: patches/nginx-controller.yaml
|
||||
|
|
@ -2,4 +2,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
|||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ./overlays/base
|
||||
- ./resources/hydra
|
||||
- ./resources/hydra-dispatcher
|
||||
|
||||
components:
|
||||
- ./components/hydra-cnpg-database
|
||||
- ./components/hydra-oidc
|
||||
- ./components/hydra-saml
|
||||
|
|
|
|||
|
|
@ -1,11 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../resources/hydra
|
||||
- ../../resources/hydra-dispatcher
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/part-of: sso-kustom
|
||||
app.kubernetes.io/component: auth
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../base
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app.kubernetes.io/part-of: sso-kustom
|
||||
app.kubernetes.io/component: auth
|
||||
|
||||
components:
|
||||
- ../../components/hydra-cnpg-database
|
||||
- ../../components/hydra-oidc
|
||||
- ../../components/hydra-saml
|
||||
- ../../components/hydra-sql
|
||||
- ../../components/oidc-test
|
||||
- ../../components/redis
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
[opcache]
|
||||
; Determines if Zend OPCache is enabled
|
||||
opcache.enable=1
|
||||
|
||||
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
||||
opcache.enable_cli=1
|
||||
|
||||
; The OPcache shared memory storage size.
|
||||
opcache.memory_consumption=512
|
||||
|
||||
; The maximum number of keys (scripts) in the OPcache hash table.
|
||||
; Only numbers between 200 and 1000000 are allowed.
|
||||
opcache.max_accelerated_files=20000
|
||||
|
||||
; When disabled, you must reset the OPcache manually or restart the
|
||||
; webserver for changes to the filesystem to take effect.
|
||||
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
||||
|
||||
; How often (in seconds) to check file timestamps for changes to the shared
|
||||
; memory storage allocation. ("1" means validate once per second, but only
|
||||
; once per request. "0" means always validate)
|
||||
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
||||
|
|
@ -14,4 +14,4 @@ hydra:
|
|||
api_method: "%env(string:HYDRA_DISPATCHER_WEBHOOK_API_METHOD)%"
|
||||
firewall:
|
||||
additional_properties: "%env(bool:HYDRA_DISPATCHER_FIREWALL_ADDITIONAL_PROPERTIES)%"
|
||||
rules: {}
|
||||
rules: {}
|
||||
|
|
@ -5,17 +5,11 @@ resources:
|
|||
- ./resources/hydra-dispatcher-deployment.yaml
|
||||
- ./resources/hydra-dispatcher-service.yaml
|
||||
|
||||
generatorOptions:
|
||||
labels:
|
||||
com.cadoles.forge.sso-kustom/session: redis
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-dispatcher-env
|
||||
literals:
|
||||
- APP_ENV=prod
|
||||
- APP_DEBUG=false
|
||||
- PHP_FPM_MEMORY_LIMIT=256m
|
||||
- NGINX_APP_SERVER_LISTEN=80
|
||||
- HYDRA_BASE_URL=http://hydra:4444
|
||||
- HYDRA_ADMIN_BASE_URL=http://hydra:4445
|
||||
- HYDRA_REWRITE_ISSUER=yes
|
||||
|
|
@ -25,10 +19,6 @@ configMapGenerator:
|
|||
- COOKIE_PATH=/
|
||||
- DEFAULT_LOCALE=fr
|
||||
- APP_LOCALES=fr,en
|
||||
- REDIS_DSN="redis://redis:6379"
|
||||
- name: hydra-dispatcher-apps
|
||||
files:
|
||||
- apps.yaml=./files/hydra/default.yaml
|
||||
- name: hydra-dispatcher-php-ini
|
||||
files:
|
||||
- ./files/03_base.ini
|
||||
- ./files/hydra/default.yaml
|
||||
|
|
|
|||
|
|
@ -2,116 +2,35 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-dispatcher
|
||||
io.kompose.service: hydra-dispatcher
|
||||
name: hydra-dispatcher
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra-dispatcher
|
||||
io.kompose.service: hydra-dispatcher
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-dispatcher
|
||||
io.kompose.service: hydra-dispatcher
|
||||
spec:
|
||||
containers:
|
||||
- name: hydra-dispatcher-php-fpm
|
||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- test -f /etc/php81/php-fpm.d/www.conf
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- php
|
||||
- bin/console
|
||||
- -V
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 30
|
||||
env:
|
||||
- name: PHP_FPM_LISTEN
|
||||
value: 127.0.0.1:9000
|
||||
- name: PHP_MEMORY_LIMIT
|
||||
value: 128m
|
||||
- name: PHP_FPM_MEMORY_LIMIT
|
||||
value: 128m
|
||||
- name: OPCACHE_VALIDATE_TIMESTAMP
|
||||
value: "0"
|
||||
- name: OPCACHE_REVALIDATE_FREQ
|
||||
value: "0"
|
||||
- name: hydra-dispatcher
|
||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-v1:v0.0.0-238-g7236416
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-dispatcher-env
|
||||
volumeMounts:
|
||||
- mountPath: /app/config/hydra
|
||||
- mountPath: /var/www/config/hydra
|
||||
name: hydra-dispatcher-apps
|
||||
- name: hydra-dispatcher-php-ini
|
||||
mountPath: /etc/php81/conf.d/03_base.ini
|
||||
subPath: 03_base.ini
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
- name: hydra-dispatcher-caddy
|
||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
||||
imagePullPolicy: Always
|
||||
args:
|
||||
[
|
||||
"/usr/sbin/caddy",
|
||||
"run",
|
||||
"--adapter",
|
||||
"caddyfile",
|
||||
"--config",
|
||||
"/etc/caddy/Caddyfile",
|
||||
]
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
timeoutSeconds: 5
|
||||
periodSeconds: 15
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-dispatcher-env
|
||||
env:
|
||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||
value: 127.0.0.1:9000
|
||||
- name: CADDY_HTTPS_PORT
|
||||
value: "8443"
|
||||
- name: CADDY_HTTP_PORT
|
||||
value: "8080"
|
||||
- name: CADDY_DATA_FS
|
||||
value: "/tmp/caddy"
|
||||
- name: CADDY_APP_ROOT_PUBLIC
|
||||
value: "/app/public/"
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
- containerPort: 80
|
||||
resources: {}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
restartPolicy: Always
|
||||
volumes:
|
||||
- name: hydra-dispatcher-apps
|
||||
configMap:
|
||||
name: hydra-dispatcher-apps
|
||||
- name: hydra-dispatcher-php-ini
|
||||
configMap:
|
||||
name: hydra-dispatcher-php-ini
|
||||
|
||||
|
|
|
|||
|
|
@ -2,14 +2,13 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-dispatcher
|
||||
io.kompose.service: hydra-dispatcher
|
||||
name: hydra-dispatcher
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: http
|
||||
- name: http
|
||||
port: 80
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra-dispatcher
|
||||
io.kompose.service: hydra-dispatcher
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
|
|||
|
|
@ -1,43 +1,35 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
images:
|
||||
- name: reg.cadoles.com/proxy_cache/oryd/hydra
|
||||
newTag: v2.1.2
|
||||
- name: reg.cadoles.com/proxy_cache/oryd/hydra-maester
|
||||
newTag: v0.0.32-amd64
|
||||
|
||||
resources:
|
||||
- ./resources/hydra-deployment.yaml
|
||||
- ./resources/hydra-service.yaml
|
||||
- ./resources/hydra-role.yaml
|
||||
- ./resources/hydra-rolebinding.yaml
|
||||
- ./resources/hydra-serviceaccount.yaml
|
||||
- ./resources/hydra-migrate-job.yaml
|
||||
- ./resources/hydra-maester
|
||||
- ./resources/hydra-janitor-cronjob.yaml
|
||||
- ./resources/hydra-deployment.yaml
|
||||
- ./resources/hydra-service.yaml
|
||||
- ./resources/hydra-role.yaml
|
||||
- ./resources/hydra-rolebinding.yaml
|
||||
- ./resources/hydra-serviceaccount.yaml
|
||||
- ./resources/hydra-migrate-job.yaml
|
||||
- ./resources/hydra-maester
|
||||
|
||||
secretGenerator:
|
||||
- name: hydra-secret
|
||||
literals:
|
||||
- SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged
|
||||
- name: hydra-secret
|
||||
literals:
|
||||
- SECRETS_SYSTEM=ThisShouldBeAbsolutelyChanged
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-env
|
||||
literals:
|
||||
- URLS_SELF_ISSUER=http://localhost:4444
|
||||
- URLS_LOGIN=http://hydra-login-app/login
|
||||
- URLS_CONSENT=http://hydra-consent-app/consent
|
||||
- URLS_LOGOUT=http://hydra-logout-app/logout
|
||||
- HYDRA_SERVE_ALL_ARGS=--dev
|
||||
- HYDRA_DATABASE_MAX_CONN="10"
|
||||
- LOG_LEVEL=info
|
||||
- name: hydra-env
|
||||
literals:
|
||||
- URLS_SELF_ISSUER=http://localhost:4444
|
||||
- URLS_LOGIN=http://hydra-login-app/login
|
||||
- URLS_CONSENT=http://hydra-consent-app/consent
|
||||
- URLS_LOGOUT=http://hydra-logout-app/logout
|
||||
- HYDRA_SERVE_ALL_ARGS=--dev
|
||||
- LOG_LEVEL=info
|
||||
|
||||
vars:
|
||||
- name: HYDRA_MIGRATE_JOB_NAME
|
||||
objref:
|
||||
name: hydra-migrate
|
||||
kind: Job
|
||||
kind: Job
|
||||
apiVersion: batch/v1
|
||||
fieldref:
|
||||
fieldpath: metadata.name
|
||||
fieldpath: metadata.name
|
||||
|
|
@ -2,19 +2,19 @@ apiVersion: apps/v1
|
|||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra
|
||||
io.kompose.service: hydra
|
||||
name: hydra
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: hydra
|
||||
io.kompose.service: hydra
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra
|
||||
io.kompose.service: hydra
|
||||
spec:
|
||||
serviceAccountName: hydra-sa
|
||||
initContainers:
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: hydra-janitor
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-janitor
|
||||
spec:
|
||||
concurrencyPolicy: Forbid
|
||||
schedule: "0 */1 * * *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra-janitor
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: hydra-sa
|
||||
containers:
|
||||
- name: janitor
|
||||
image: reg.cadoles.com/proxy_cache/oryd/hydra:v2.0.3
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: hydra-env
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["hydra"]
|
||||
env: []
|
||||
args:
|
||||
- janitor
|
||||
- --read-from-env
|
||||
- --grants
|
||||
- --requests
|
||||
- --tokens
|
||||
resources: {}
|
||||
|
|
@ -2,13 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
|||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ./resources/hydra-maester-deployment.yaml
|
||||
- ./resources/hydra-maester-rbac.yaml
|
||||
- ./resources/hydra-maester-deployment.yaml
|
||||
- ./resources/hydra-maester-rbac.yaml
|
||||
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
|
||||
|
||||
configMapGenerator:
|
||||
- name: hydra-maester-env
|
||||
literals:
|
||||
- APP_ENV=prod
|
||||
- APP_DEBUG=false
|
||||
- HYDRA_ADMIN_BASE_URL=http://hydra
|
||||
- HYDRA_ADMIN_PORT=4445
|
||||
- name: hydra-maester-env
|
||||
literals:
|
||||
- APP_ENV=prod
|
||||
- APP_DEBUG=false
|
||||
- HYDRA_ADMIN_BASE_URL=http://hydra
|
||||
- HYDRA_ADMIN_PORT=4445
|
||||
|
|
@ -2,7 +2,7 @@ apiVersion: v1
|
|||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: hydra
|
||||
io.kompose.service: hydra
|
||||
name: hydra
|
||||
spec:
|
||||
ports:
|
||||
|
|
@ -13,6 +13,6 @@ spec:
|
|||
port: 4445
|
||||
targetPort: hydra-admin
|
||||
selector:
|
||||
app.kubernetes.io/name: hydra
|
||||
io.kompose.service: hydra
|
||||
status:
|
||||
loadBalancer: {}
|
||||
|
|
|
|||
Loading…
Reference in New Issue