Compare commits
5 Commits
unstable
...
hydra-sql-
Author | SHA1 | Date | |
---|---|---|---|
62ef2763de | |||
546f31b2dd | |||
ea9a27bb00 | |||
7ab78d97aa | |||
a2154c5587 |
@ -7,6 +7,28 @@ configurations:
|
|||||||
resources:
|
resources:
|
||||||
- ./resources/hydra-cnpg-cluster.yaml
|
- ./resources/hydra-cnpg-cluster.yaml
|
||||||
|
|
||||||
|
secretGenerator:
|
||||||
|
- name: hydra-postgres-admin
|
||||||
|
type: Secret
|
||||||
|
literals:
|
||||||
|
- username=postgres
|
||||||
|
- password=NotSoSecret
|
||||||
|
- name: hydra-postgres-user
|
||||||
|
type: Secret
|
||||||
|
literals:
|
||||||
|
- username=hydra
|
||||||
|
- password=NotSoSecret
|
||||||
|
|
||||||
|
|
||||||
|
vars:
|
||||||
|
- name: HYDRA_DATABASE_SERVICE_NAME
|
||||||
|
objref:
|
||||||
|
name: hydra-postgres
|
||||||
|
kind: Cluster
|
||||||
|
apiVersion: postgresql.cnpg.io/v1
|
||||||
|
fieldref:
|
||||||
|
fieldpath: metadata.name
|
||||||
|
|
||||||
patches:
|
patches:
|
||||||
- target:
|
- target:
|
||||||
group: apps
|
group: apps
|
||||||
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,18 +12,10 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: password
|
key: password
|
||||||
- op: add
|
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
|
||||||
value:
|
|
||||||
name: HYDRA_DATABASE_SERVICE_NAME
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: hydra-postgres-app
|
|
||||||
key: host
|
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable&max_conns=$(HYDRA_DATABASE_MAX_CONN)"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,18 +12,10 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: password
|
key: password
|
||||||
- op: add
|
|
||||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
|
||||||
value:
|
|
||||||
name: HYDRA_DATABASE_SERVICE_NAME
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: hydra-postgres-app
|
|
||||||
key: host
|
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
path: "/spec/jobTemplate/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
@ -4,7 +4,7 @@
|
|||||||
name: HYDRA_DATABASE_USER
|
name: HYDRA_DATABASE_USER
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: username
|
key: username
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
@ -12,18 +12,10 @@
|
|||||||
name: HYDRA_DATABASE_PASSWORD
|
name: HYDRA_DATABASE_PASSWORD
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-postgres-app
|
name: hydra-postgres-user
|
||||||
key: password
|
key: password
|
||||||
- op: add
|
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
|
||||||
value:
|
|
||||||
name: HYDRA_DATABASE_SERVICE_NAME
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: hydra-postgres-app
|
|
||||||
key: host
|
|
||||||
- op: add
|
- op: add
|
||||||
path: "/spec/template/spec/containers/0/env/-"
|
path: "/spec/template/spec/containers/0/env/-"
|
||||||
value:
|
value:
|
||||||
name: DSN
|
name: DSN
|
||||||
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME):5432/hydra?sslmode=disable"
|
value: "postgres://$(HYDRA_DATABASE_USER):$(HYDRA_DATABASE_PASSWORD)@$(HYDRA_DATABASE_SERVICE_NAME)-rw:5432/hydra?sslmode=disable"
|
@ -5,9 +5,13 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
instances: 3
|
instances: 3
|
||||||
primaryUpdateStrategy: unsupervised
|
primaryUpdateStrategy: unsupervised
|
||||||
|
superuserSecret:
|
||||||
|
name: hydra-postgres-admin
|
||||||
bootstrap:
|
bootstrap:
|
||||||
initdb:
|
initdb:
|
||||||
database: hydra
|
database: hydra
|
||||||
owner: hydra
|
owner: hydra
|
||||||
|
secret:
|
||||||
|
name: hydra-postgres-user
|
||||||
storage:
|
storage:
|
||||||
size: 2Gi
|
size: 2Gi
|
@ -17,34 +17,34 @@ spec:
|
|||||||
app.kubernetes.io/version: "v1.2.2"
|
app.kubernetes.io/version: "v1.2.2"
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: werther
|
- name: werther
|
||||||
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
|
image: reg.cadoles.com/cadoles/hydra-werther:2023.12.6-stable.1421.15a4717
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-ldap-env
|
name: hydra-ldap-env
|
||||||
env:
|
env:
|
||||||
- name: WERTHER_WEB_DIR
|
- name: WERTHER_WEB_DIR
|
||||||
value: "/usr/share/werther/login/"
|
value: "/usr/share/werther/login/"
|
||||||
- name: WERTHER_LDAP_BINDDN
|
- name: WERTHER_LDAP_BINDDN
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-ldap-sc
|
name: hydra-ldap-sc
|
||||||
key: WERTHER_LDAP_BINDDN
|
key: WERTHER_LDAP_BINDDN
|
||||||
- name: WERTHER_LDAP_BINDPW
|
- name: WERTHER_LDAP_BINDPW
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: hydra-ldap-sc
|
name: hydra-ldap-sc
|
||||||
key: WERTHER_LDAP_BINDPW
|
key: WERTHER_LDAP_BINDPW
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
name: hydra-ldap-http
|
name: http
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
capabilities:
|
capabilities:
|
||||||
drop:
|
drop:
|
||||||
- ALL
|
- ALL
|
||||||
privileged: false
|
privileged: false
|
||||||
readOnlyRootFilesystem: true
|
readOnlyRootFilesystem: true
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsUser: 100
|
runAsUser: 100
|
||||||
|
@ -7,9 +7,9 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
ports:
|
ports:
|
||||||
- name: hydra-ldap
|
- name: http
|
||||||
port: 8080
|
port: 8080
|
||||||
targetPort: hydra-ldap-http
|
targetPort: http
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-ldap
|
app.kubernetes.io/name: hydra-ldap
|
||||||
|
@ -11,7 +11,6 @@ generatorOptions:
|
|||||||
|
|
||||||
configMapGenerator:
|
configMapGenerator:
|
||||||
- name: hydra-oidc-env
|
- name: hydra-oidc-env
|
||||||
behavior: create
|
|
||||||
literals:
|
literals:
|
||||||
- APP_ENV=prod
|
- APP_ENV=prod
|
||||||
- APP_DEBUG=false
|
- APP_DEBUG=false
|
||||||
|
@ -17,86 +17,86 @@ spec:
|
|||||||
app.kubernetes.io/name: hydra-oidc
|
app.kubernetes.io/name: hydra-oidc
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-oidc-php-fpm
|
- name: hydra-oidc-php-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: Always
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-oidc-env
|
name: hydra-oidc-env
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
|
|
||||||
- name: hydra-oidc-caddy
|
- name: hydra-oidc-caddy
|
||||||
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
image: reg.cadoles.com/cadoles/hydra-oidc-base:2024.4.2-develop.1349.c4711f6
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: Always
|
||||||
args:
|
args:
|
||||||
[
|
[
|
||||||
"/usr/sbin/caddy",
|
"/usr/sbin/caddy",
|
||||||
"run",
|
"run",
|
||||||
"--adapter",
|
"--adapter",
|
||||||
"caddyfile",
|
"caddyfile",
|
||||||
"--config",
|
"--config",
|
||||||
"/etc/caddy/Caddyfile",
|
"/etc/caddy/Caddyfile",
|
||||||
]
|
]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /healthy
|
path: /healthy
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 5
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 10
|
periodSeconds: 10
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /healthy
|
path: /healthy
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 15
|
initialDelaySeconds: 15
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 15
|
periodSeconds: 15
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
name: http
|
name: http
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-oidc-env
|
name: hydra-oidc-env
|
||||||
env:
|
env:
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: CADDY_HTTPS_PORT
|
- name: CADDY_HTTPS_PORT
|
||||||
value: "8443"
|
value: "8443"
|
||||||
- name: CADDY_HTTP_PORT
|
- name: CADDY_HTTP_PORT
|
||||||
value: "8080"
|
value: "8080"
|
||||||
- name: CADDY_DATA_FS
|
- name: CADDY_DATA_FS
|
||||||
value: "/tmp/caddy"
|
value: "/tmp/caddy"
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
value: "/app/public/"
|
value: "/app/public/"
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-oidc
|
name: hydra-oidc
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-oidc
|
app.kubernetes.io/name: hydra-oidc
|
||||||
status:
|
status:
|
||||||
|
@ -1,22 +0,0 @@
|
|||||||
[opcache]
|
|
||||||
; Determines if Zend OPCache is enabled
|
|
||||||
opcache.enable=1
|
|
||||||
|
|
||||||
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
|
||||||
opcache.enable_cli=1
|
|
||||||
|
|
||||||
; The OPcache shared memory storage size.
|
|
||||||
opcache.memory_consumption=512
|
|
||||||
|
|
||||||
; The maximum number of keys (scripts) in the OPcache hash table.
|
|
||||||
; Only numbers between 200 and 1000000 are allowed.
|
|
||||||
opcache.max_accelerated_files=20000
|
|
||||||
|
|
||||||
; When disabled, you must reset the OPcache manually or restart the
|
|
||||||
; webserver for changes to the filesystem to take effect.
|
|
||||||
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
|
||||||
|
|
||||||
; How often (in seconds) to check file timestamps for changes to the shared
|
|
||||||
; memory storage allocation. ("1" means validate once per second, but only
|
|
||||||
; once per request. "0" means always validate)
|
|
||||||
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
|
30
components/hydra-sql/files/hydra/sql.yaml
Normal file
30
components/hydra-sql/files/hydra/sql.yaml
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
hydra:
|
||||||
|
apps:
|
||||||
|
- id: sql
|
||||||
|
title:
|
||||||
|
fr: Connexion SQL
|
||||||
|
en: Login SQL
|
||||||
|
description:
|
||||||
|
fr: Authentification avec SQL
|
||||||
|
en: Authentication with SQL
|
||||||
|
login_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGIN_URL)%"
|
||||||
|
consent_url: "%env(string:HYDRA_DISPATCHER_SQL_CONSENT_URL)%"
|
||||||
|
logout_url: "%env(string:HYDRA_DISPATCHER_SQL_LOGOUT_URL)%"
|
||||||
|
attributes_rewrite_configuration:
|
||||||
|
uid:
|
||||||
|
rules:
|
||||||
|
- "property_exists(consent.session.id_token, 'uid') ? consent.session.id_token.uid : null"
|
||||||
|
email:
|
||||||
|
rules:
|
||||||
|
- "property_exists(consent.session.id_token, 'email') ? consent.session.id_token.email : null"
|
||||||
|
eduPersonAffiliation:
|
||||||
|
rules:
|
||||||
|
- "property_exists(consent.session.id_token, 'eduPersonAffiliation') ? consent.session.id_token.eduPersonAffiliation : null"
|
||||||
|
firewall:
|
||||||
|
rules:
|
||||||
|
email:
|
||||||
|
required: false
|
||||||
|
uid:
|
||||||
|
required: false
|
||||||
|
eduPersonAffiliation:
|
||||||
|
required: false
|
@ -2,31 +2,38 @@ apiVersion: kustomize.config.k8s.io/v1alpha1
|
|||||||
kind: Component
|
kind: Component
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
- ./resources/hydra-sql-service.yaml
|
- ./resources/hydra-sql-service.yaml
|
||||||
- ./resources/hydra-sql-deployment.yaml
|
- ./resources/hydra-sql-deployment.yaml
|
||||||
|
|
||||||
generatorOptions:
|
generatorOptions:
|
||||||
labels:
|
labels:
|
||||||
com.cadoles.forge.sso-kustom/session: redis
|
com.cadoles.forge.sso-kustom/session: redis
|
||||||
|
|
||||||
configMapGenerator:
|
configMapGenerator:
|
||||||
- name: hydra-sql-env
|
- name: hydra-sql-env
|
||||||
behavior: create
|
literals:
|
||||||
literals:
|
- ISSUER_URL="http://localhost:8000"
|
||||||
- ISSUER_URL="http://localhost:8000"
|
- BASE_URL='http://localhost:8080'
|
||||||
- BASE_URL='http://localhost:8080'
|
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
|
||||||
- HYDRA_ADMIN_BASE_URL='http://hydra:4445/admin'
|
- APP_LOCALES="fr,en"
|
||||||
- APP_LOCALES="fr,en"
|
- HASH_ALGO_LEGACY="sha256, bcrypt"
|
||||||
- HASH_ALGO_LEGACY="sha256, bcrypt"
|
- SECURITY_PATTERN="password,salt,pepper"
|
||||||
- SECURITY_PATTERN="password,salt,pepper"
|
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
|
||||||
- DSN_REMOTE_DATABASE="pgsql:host='postgres';port=5432;dbname=lasql"
|
- DB_USER="makeMeASecret"
|
||||||
- DB_USER="makeMeASecret"
|
- DB_PASSWORD="makeMeASecret"
|
||||||
- DB_PASSWORD="makeMeASecret"
|
- REDIS_DSN="redis://redis:6379"
|
||||||
- REDIS_DSN="redis://redis:6379"
|
- PEPPER="MakeMeABigSecret"
|
||||||
- PEPPER="MakeMeABigSecret"
|
- name: sql-login-config
|
||||||
- name: sql-login-config
|
files:
|
||||||
files:
|
- ./files/sql_login.yaml
|
||||||
- ./files/sql_login.yaml
|
- name: hydra-dispatcher-apps
|
||||||
- name: hydra-sql-php-ini
|
behavior: merge
|
||||||
files:
|
files:
|
||||||
- ./files/03_base.ini
|
- ./files/hydra/sql.yaml
|
||||||
|
|
||||||
|
patchesJson6902:
|
||||||
|
- target:
|
||||||
|
version: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: hydra-dispatcher-env
|
||||||
|
path: patches/hydra-dispatcher-env.yaml
|
||||||
|
9
components/hydra-sql/patches/hydra-dispatcher-env.yaml
Normal file
9
components/hydra-sql/patches/hydra-dispatcher-env.yaml
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
|
||||||
|
value: http://hydra-sql/login
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
|
||||||
|
value: http://hydra-sql/consent
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
|
||||||
|
value: http://hydra-sql/logout
|
@ -10,113 +10,108 @@ spec:
|
|||||||
matchLabels:
|
matchLabels:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
strategy:
|
strategy:
|
||||||
type: RollingUpdate
|
type: Recreate
|
||||||
rollingUpdate:
|
|
||||||
maxSurge: 25%
|
|
||||||
maxUnavailable: 25%
|
|
||||||
template:
|
template:
|
||||||
metadata:
|
metadata:
|
||||||
labels:
|
labels:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-sql-fpm
|
- name: hydra-sql-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: Always
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
resources: {}
|
resources: {}
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsNonRoot: true
|
runAsNonRoot: true
|
||||||
runAsGroup: 1000
|
runAsGroup: 1000
|
||||||
runAsUser: 1000
|
runAsUser: 1000
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: hydra-sql-env
|
name: hydra-sql-env
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_LOG_LEVEL
|
- name: PHP_FPM_LOG_LEVEL
|
||||||
value: warning
|
value: warning
|
||||||
- name: OPCACHE_VALIDATE_TIMESTAMP
|
volumeMounts:
|
||||||
value: "0"
|
- name: sql-login-config
|
||||||
- name: OPCACHE_REVALIDATE_FREQ
|
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||||
value: "0"
|
subPath: "sql_login.yaml"
|
||||||
volumeMounts:
|
|
||||||
- name: sql-login-config
|
|
||||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
|
||||||
subPath: "sql_login.yaml"
|
|
||||||
- name: hydra-sql-php-ini
|
|
||||||
mountPath: /etc/php81/conf.d/03_base.ini
|
|
||||||
subPath: 03_base.ini
|
|
||||||
|
|
||||||
- name: hydra-sql-caddy
|
- name: hydra-sql-caddy
|
||||||
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.11.6-develop.1113.075be9b
|
image: reg.cadoles.com/cadoles/hydra-sql-base:2024.4.2-develop.953.fc87b24
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: Always
|
||||||
args: ["/usr/sbin/caddy", "run", "--adapter", "caddyfile", "--config", "/etc/caddy/Caddyfile"]
|
args:
|
||||||
readinessProbe:
|
[
|
||||||
httpGet:
|
"/usr/sbin/caddy",
|
||||||
path: /health
|
"run",
|
||||||
port: 8080
|
"--adapter",
|
||||||
initialDelaySeconds: 5
|
"caddyfile",
|
||||||
timeoutSeconds: 5
|
"--config",
|
||||||
periodSeconds: 10
|
"/etc/caddy/Caddyfile",
|
||||||
livenessProbe:
|
]
|
||||||
httpGet:
|
readinessProbe:
|
||||||
path: /health
|
httpGet:
|
||||||
port: 8080
|
path: /health
|
||||||
initialDelaySeconds: 15
|
port: 8080
|
||||||
timeoutSeconds: 5
|
initialDelaySeconds: 5
|
||||||
periodSeconds: 15
|
timeoutSeconds: 5
|
||||||
envFrom:
|
periodSeconds: 10
|
||||||
- configMapRef:
|
livenessProbe:
|
||||||
name: hydra-sql-env
|
httpGet:
|
||||||
env:
|
path: /health
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
port: 8080
|
||||||
value: 127.0.0.1:9000
|
initialDelaySeconds: 15
|
||||||
- name: CADDY_HTTPS_PORT
|
timeoutSeconds: 5
|
||||||
value: "8443"
|
periodSeconds: 15
|
||||||
- name: CADDY_HTTP_PORT
|
envFrom:
|
||||||
value: "8080"
|
- configMapRef:
|
||||||
- name: CADDY_DATA_FS
|
name: hydra-sql-env
|
||||||
value: "/tmp/caddy"
|
env:
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
value: "/app/public/"
|
value: 127.0.0.1:9000
|
||||||
resources: {}
|
- name: CADDY_HTTPS_PORT
|
||||||
securityContext:
|
value: "8443"
|
||||||
runAsNonRoot: true
|
- name: CADDY_HTTP_PORT
|
||||||
runAsGroup: 1000
|
value: "8080"
|
||||||
runAsUser: 1000
|
- name: CADDY_DATA_FS
|
||||||
ports:
|
value: "/tmp/caddy"
|
||||||
- containerPort: 8080
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
name: http
|
value: "/app/public/"
|
||||||
volumeMounts:
|
resources: {}
|
||||||
- name: sql-login-config
|
securityContext:
|
||||||
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
runAsNonRoot: true
|
||||||
subPath: "sql_login.yaml"
|
runAsGroup: 1000
|
||||||
|
runAsUser: 1000
|
||||||
|
ports:
|
||||||
|
- containerPort: 8080
|
||||||
|
name: http
|
||||||
|
volumeMounts:
|
||||||
|
- name: sql-login-config
|
||||||
|
mountPath: "/app/config/sql_login_configuration/sql_login.yaml"
|
||||||
|
subPath: "sql_login.yaml"
|
||||||
volumes:
|
volumes:
|
||||||
- name: sql-login-config
|
- name: sql-login-config
|
||||||
configMap:
|
configMap:
|
||||||
name: sql-login-config
|
name: sql-login-config
|
||||||
- name: hydra-sql-php-ini
|
|
||||||
configMap:
|
|
||||||
name: hydra-sql-php-ini
|
|
||||||
|
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-sql
|
name: hydra-sql
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-sql
|
app.kubernetes.io/name: hydra-sql
|
||||||
status:
|
status:
|
||||||
|
@ -23,17 +23,17 @@ spec:
|
|||||||
- containerPort: 8080
|
- containerPort: 8080
|
||||||
resources: {}
|
resources: {}
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: oidc-test-env
|
name: oidc-test-env
|
||||||
env:
|
env:
|
||||||
- name: OIDC_CLIENT_ID
|
- name: OIDC_CLIENT_ID
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
key: client_id
|
key: CLIENT_ID
|
||||||
- name: OIDC_CLIENT_SECRET
|
- name: OIDC_CLIENT_SECRET
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
key: client_secret
|
key: CLIENT_SECRET
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
|
@ -8,35 +8,27 @@ L'exemple est actuellement déployé avec le composant `hydra-saml` uniquement.
|
|||||||
|
|
||||||
1. Créer un cluster avec `kind`
|
1. Créer un cluster avec `kind`
|
||||||
|
|
||||||
```
|
```
|
||||||
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
|
kind create cluster --config ./examples/k8s/kind/cluster-config.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
2. Déployer les opérateurs nécessaires au déploiement
|
2. Déployer les opérateurs nécessaires au déploiement
|
||||||
|
|
||||||
```
|
```
|
||||||
kubectl apply -k ./examples/k8s/kind/cluster --server-side
|
kubectl apply -k ./examples/k8s/kind/cluster --server-side
|
||||||
```
|
```
|
||||||
|
|
||||||
3. Déployer l'application
|
3. Déployer l'application
|
||||||
|
|
||||||
```
|
|
||||||
kubectl apply -k ./examples/authenticated-app
|
|
||||||
```
|
|
||||||
|
|
||||||
**Note** Il est possible d'avoir l'erreur suivante:
|
|
||||||
|
|
||||||
```
|
```
|
||||||
error: resource mapping not found for name: "app-oauth2-client" namespace: "" from "./examples/authenticated-app": no matches for kind "OAuth2Client" in version "hydra.ory.sh/v1alpha1"
|
kubectl apply -k ./examples/authenticated-app
|
||||||
```
|
```
|
||||||
|
|
||||||
Cette erreur est "normale" (voir https://github.com/kubernetes/kubectl/issues/1117). Dans ce cas, attendre la création de la CRD (voir ticket) puis relancer la commande.
|
|
||||||
|
|
||||||
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
|
4. Ajouter l'entrée suivante dans votre fichier `/etc/hosts`
|
||||||
|
|
||||||
```
|
```
|
||||||
127.0.0.1 ssokustom
|
127.0.0.1 ssokustom
|
||||||
```
|
```
|
||||||
|
|
||||||
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
|
5. Après stabilisation du déploiement, l'application devrait être accessible à l'adresse https://ssokustom
|
||||||
|
|
||||||
@ -55,7 +47,7 @@ kind delete cluster -n sso-kustom-example
|
|||||||
|
|
||||||
#### URL utiles
|
#### URL utiles
|
||||||
|
|
||||||
|URL|Description|
|
| URL | Description |
|
||||||
|---|-----------|
|
| --------------------------------------------------- | ------------------------------------- |
|
||||||
|https://ssokustom/auth/saml/Shibboleth.sso/Session|Attributs de la session SP Shibboleth|
|
| https://ssokustom/auth/saml/Shibboleth.sso/Session | Attributs de la session SP Shibboleth |
|
||||||
|https://ssokustom/auth/saml/Shibboleth.sso/Metadata|Métadonnées du SP Shibboleth|
|
| https://ssokustom/auth/saml/Shibboleth.sso/Metadata | Métadonnées du SP Shibboleth |
|
||||||
|
@ -8,7 +8,7 @@ resources:
|
|||||||
- ./resources/self-signed-issuer.yaml
|
- ./resources/self-signed-issuer.yaml
|
||||||
- ./resources/port-forwarder.yaml
|
- ./resources/port-forwarder.yaml
|
||||||
|
|
||||||
patchesJson6902:
|
patches:
|
||||||
- target:
|
- target:
|
||||||
version: v1
|
version: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
@ -39,3 +39,8 @@ patchesJson6902:
|
|||||||
kind: OAuth2Client
|
kind: OAuth2Client
|
||||||
name: oidc-test-oauth2-client
|
name: oidc-test-oauth2-client
|
||||||
path: patches/oidc-test-oauth2-client.yaml
|
path: patches/oidc-test-oauth2-client.yaml
|
||||||
|
- target:
|
||||||
|
version: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
name: hydra-sql-env
|
||||||
|
path: patches/hydra-sql-env.yaml
|
||||||
|
@ -28,3 +28,13 @@
|
|||||||
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
|
path: "/data/HYDRA_DISPATCHER_SAML_LOGOUT_URL"
|
||||||
value: https://ssokustom/auth/saml/logout
|
value: https://ssokustom/auth/saml/logout
|
||||||
|
|
||||||
|
# Hydra SQL configuration
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_LOGIN_URL"
|
||||||
|
value: https://ssokustom/auth/sql/login
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_CONSENT_URL"
|
||||||
|
value: https://ssokustom/auth/sql/consent
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_DISPATCHER_SQL_LOGOUT_URL"
|
||||||
|
value: https://ssokustom/auth/sql/logout
|
||||||
|
24
examples/authenticated-app/patches/hydra-sql-env.yaml
Normal file
24
examples/authenticated-app/patches/hydra-sql-env.yaml
Normal file
@ -0,0 +1,24 @@
|
|||||||
|
- op: replace
|
||||||
|
path: "/data/BASE_URL"
|
||||||
|
value: https://ssokustom/auth/sql
|
||||||
|
- op: replace
|
||||||
|
path: "/data/ISSUER_URL"
|
||||||
|
value: https://ssokustom
|
||||||
|
- op: replace
|
||||||
|
path: "/data/ISSUER_URL"
|
||||||
|
value: https://ssokustom
|
||||||
|
- op: replace
|
||||||
|
path: "/data/HYDRA_ADMIN_BASE_URL"
|
||||||
|
value: http://hydra-dispatcher
|
||||||
|
- op: replace
|
||||||
|
path: "/data/DSN_REMOTE_DATABASE"
|
||||||
|
value: pgsql:host='postgres';port=5432;dbname=lasql
|
||||||
|
- op: replace
|
||||||
|
path: "/data/REDIS_DSN"
|
||||||
|
value: redis://redis:6379
|
||||||
|
- op: replace
|
||||||
|
path: "/data/DB_USER"
|
||||||
|
value: makeMeASecret
|
||||||
|
- op: replace
|
||||||
|
path: "/data/DB_PASSWORD"
|
||||||
|
value: rmakeMeASecret
|
@ -10,19 +10,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: oidc-test
|
name: oidc-test
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -34,19 +34,43 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth/saml(/|$)(.*)
|
- path: /auth/saml(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra-saml
|
name: hydra-saml
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: auth-sql
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/issuer: "self-signed"
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- ssokustom
|
||||||
|
secretName: ssokustom-example-tls
|
||||||
|
rules:
|
||||||
|
- http:
|
||||||
|
paths:
|
||||||
|
- path: /auth/sql(/|$)(.*)
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: hydra-sql
|
||||||
|
port:
|
||||||
|
name: http
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -60,19 +84,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth/dispatcher(/|$)(.*)
|
- path: /auth/dispatcher(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra-dispatcher
|
name: hydra-dispatcher
|
||||||
port:
|
port:
|
||||||
name: http
|
name: http
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -85,19 +109,19 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /auth(/|$)(.*)
|
- path: /auth(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: hydra
|
name: hydra
|
||||||
port:
|
port:
|
||||||
name: hydra-public
|
name: hydra-public
|
||||||
---
|
---
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@ -111,21 +135,16 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- ssokustom
|
- ssokustom
|
||||||
secretName: ssokustom-example-tls
|
secretName: ssokustom-example-tls
|
||||||
rules:
|
rules:
|
||||||
- http:
|
- http:
|
||||||
paths:
|
paths:
|
||||||
- path: /simplesaml(/|$)(.*)
|
- path: /simplesaml(/|$)(.*)
|
||||||
pathType: Prefix
|
pathType: Prefix
|
||||||
backend:
|
backend:
|
||||||
service:
|
service:
|
||||||
name: saml-idp
|
name: saml-idp
|
||||||
port:
|
port:
|
||||||
name: https
|
name: https
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
@ -1,10 +1,11 @@
|
|||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
kind: Kustomization
|
kind: Kustomization
|
||||||
resources:
|
resources:
|
||||||
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
|
- https://github.com/jetstack/cert-manager/releases/download/v1.13.2/cert-manager.yaml
|
||||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
|
- https://forge.cadoles.com/CadolesKube/c-kustom//base/cloudnative-pg-operator?ref=develop
|
||||||
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
|
- https://forge.cadoles.com/CadolesKube/c-kustom//base/redis?ref=develop
|
||||||
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
|
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml
|
||||||
|
- https://raw.githubusercontent.com/ory/k8s/v0.28.2/helm/charts/hydra-maester/crds/crd-oauth2clients.yaml
|
||||||
|
|
||||||
patchesJson6902:
|
patchesJson6902:
|
||||||
- target:
|
- target:
|
||||||
|
@ -1,22 +0,0 @@
|
|||||||
[opcache]
|
|
||||||
; Determines if Zend OPCache is enabled
|
|
||||||
opcache.enable=1
|
|
||||||
|
|
||||||
; Determines if Zend OPCache is enabled for the CLI version of PHP
|
|
||||||
opcache.enable_cli=1
|
|
||||||
|
|
||||||
; The OPcache shared memory storage size.
|
|
||||||
opcache.memory_consumption=512
|
|
||||||
|
|
||||||
; The maximum number of keys (scripts) in the OPcache hash table.
|
|
||||||
; Only numbers between 200 and 1000000 are allowed.
|
|
||||||
opcache.max_accelerated_files=20000
|
|
||||||
|
|
||||||
; When disabled, you must reset the OPcache manually or restart the
|
|
||||||
; webserver for changes to the filesystem to take effect.
|
|
||||||
opcache.validate_timestamps=${OPCACHE_VALIDATE_TIMESTAMP}
|
|
||||||
|
|
||||||
; How often (in seconds) to check file timestamps for changes to the shared
|
|
||||||
; memory storage allocation. ("1" means validate once per second, but only
|
|
||||||
; once per request. "0" means always validate)
|
|
||||||
opcache.revalidate_freq=${OPCACHE_REVALIDATE_FREQ}
|
|
@ -29,6 +29,3 @@ configMapGenerator:
|
|||||||
- name: hydra-dispatcher-apps
|
- name: hydra-dispatcher-apps
|
||||||
files:
|
files:
|
||||||
- apps.yaml=./files/hydra/default.yaml
|
- apps.yaml=./files/hydra/default.yaml
|
||||||
- name: hydra-dispatcher-php-ini
|
|
||||||
files:
|
|
||||||
- ./files/03_base.ini
|
|
@ -17,101 +17,91 @@ spec:
|
|||||||
app.kubernetes.io/name: hydra-dispatcher
|
app.kubernetes.io/name: hydra-dispatcher
|
||||||
spec:
|
spec:
|
||||||
containers:
|
containers:
|
||||||
- name: hydra-dispatcher-php-fpm
|
- name: hydra-dispatcher-php-fpm
|
||||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
|
||||||
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
args: ["/usr/sbin/php-fpm81", "-F", "-e"]
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- sh
|
- sh
|
||||||
- -c
|
- -c
|
||||||
- test -f /etc/php81/php-fpm.d/www.conf
|
- test -f /etc/php81/php-fpm.d/www.conf
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
- php
|
- php
|
||||||
- bin/console
|
- bin/console
|
||||||
- -V
|
- -V
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
periodSeconds: 30
|
periodSeconds: 30
|
||||||
env:
|
env:
|
||||||
- name: PHP_FPM_LISTEN
|
- name: PHP_FPM_LISTEN
|
||||||
value: 127.0.0.1:9000
|
value: 127.0.0.1:9000
|
||||||
- name: PHP_MEMORY_LIMIT
|
- name: PHP_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: PHP_FPM_MEMORY_LIMIT
|
- name: PHP_FPM_MEMORY_LIMIT
|
||||||
value: 128m
|
value: 128m
|
||||||
- name: OPCACHE_VALIDATE_TIMESTAMP
|
envFrom:
|
||||||
value: "0"
|
- configMapRef:
|
||||||
- name: OPCACHE_REVALIDATE_FREQ
|
name: hydra-dispatcher-env
|
||||||
value: "0"
|
volumeMounts:
|
||||||
envFrom:
|
- mountPath: /app/config/hydra
|
||||||
- configMapRef:
|
name: hydra-dispatcher-apps
|
||||||
name: hydra-dispatcher-env
|
resources: {}
|
||||||
volumeMounts:
|
securityContext:
|
||||||
- mountPath: /app/config/hydra
|
runAsNonRoot: true
|
||||||
name: hydra-dispatcher-apps
|
runAsGroup: 1000
|
||||||
- name: hydra-dispatcher-php-ini
|
runAsUser: 1000
|
||||||
mountPath: /etc/php81/conf.d/03_base.ini
|
- name: hydra-dispatcher-caddy
|
||||||
subPath: 03_base.ini
|
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.4.2-develop.1411.74a9f16
|
||||||
resources: {}
|
imagePullPolicy: Always
|
||||||
securityContext:
|
args:
|
||||||
runAsNonRoot: true
|
[
|
||||||
runAsGroup: 1000
|
"/usr/sbin/caddy",
|
||||||
runAsUser: 1000
|
"run",
|
||||||
- name: hydra-dispatcher-caddy
|
"--adapter",
|
||||||
image: reg.cadoles.com/cadoles/hydra-dispatcher-base:2024.9.24-develop.1122.f88a5eb
|
"caddyfile",
|
||||||
imagePullPolicy: IfNotPresent
|
"--config",
|
||||||
args:
|
"/etc/caddy/Caddyfile",
|
||||||
[
|
]
|
||||||
"/usr/sbin/caddy",
|
readinessProbe:
|
||||||
"run",
|
httpGet:
|
||||||
"--adapter",
|
path: /health
|
||||||
"caddyfile",
|
port: 8080
|
||||||
"--config",
|
initialDelaySeconds: 5
|
||||||
"/etc/caddy/Caddyfile",
|
timeoutSeconds: 5
|
||||||
]
|
periodSeconds: 10
|
||||||
readinessProbe:
|
livenessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /health
|
path: /health
|
||||||
port: 8080
|
port: 8080
|
||||||
initialDelaySeconds: 5
|
initialDelaySeconds: 15
|
||||||
timeoutSeconds: 5
|
timeoutSeconds: 5
|
||||||
periodSeconds: 10
|
periodSeconds: 15
|
||||||
livenessProbe:
|
envFrom:
|
||||||
httpGet:
|
- configMapRef:
|
||||||
path: /health
|
name: hydra-dispatcher-env
|
||||||
port: 8080
|
env:
|
||||||
initialDelaySeconds: 15
|
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
||||||
timeoutSeconds: 5
|
value: 127.0.0.1:9000
|
||||||
periodSeconds: 15
|
- name: CADDY_HTTPS_PORT
|
||||||
envFrom:
|
value: "8443"
|
||||||
- configMapRef:
|
- name: CADDY_HTTP_PORT
|
||||||
name: hydra-dispatcher-env
|
value: "8080"
|
||||||
env:
|
- name: CADDY_DATA_FS
|
||||||
- name: CADDY_APP_UPSTREAM_BACKEND_SERVER
|
value: "/tmp/caddy"
|
||||||
value: 127.0.0.1:9000
|
- name: CADDY_APP_ROOT_PUBLIC
|
||||||
- name: CADDY_HTTPS_PORT
|
value: "/app/public/"
|
||||||
value: "8443"
|
ports:
|
||||||
- name: CADDY_HTTP_PORT
|
- containerPort: 8080
|
||||||
value: "8080"
|
name: http
|
||||||
- name: CADDY_DATA_FS
|
resources: {}
|
||||||
value: "/tmp/caddy"
|
securityContext:
|
||||||
- name: CADDY_APP_ROOT_PUBLIC
|
runAsNonRoot: true
|
||||||
value: "/app/public/"
|
runAsGroup: 1000
|
||||||
ports:
|
runAsUser: 1000
|
||||||
- containerPort: 8080
|
|
||||||
name: http
|
|
||||||
resources: {}
|
|
||||||
securityContext:
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsGroup: 1000
|
|
||||||
runAsUser: 1000
|
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
volumes:
|
volumes:
|
||||||
- name: hydra-dispatcher-apps
|
- name: hydra-dispatcher-apps
|
||||||
configMap:
|
configMap:
|
||||||
name: hydra-dispatcher-apps
|
name: hydra-dispatcher-apps
|
||||||
- name: hydra-dispatcher-php-ini
|
|
||||||
configMap:
|
|
||||||
name: hydra-dispatcher-php-ini
|
|
||||||
|
@ -6,9 +6,9 @@ metadata:
|
|||||||
name: hydra-dispatcher
|
name: hydra-dispatcher
|
||||||
spec:
|
spec:
|
||||||
ports:
|
ports:
|
||||||
- name: http
|
- name: http
|
||||||
port: 80
|
port: 80
|
||||||
targetPort: http
|
targetPort: http
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: hydra-dispatcher
|
app.kubernetes.io/name: hydra-dispatcher
|
||||||
status:
|
status:
|
||||||
|
@ -30,7 +30,6 @@ configMapGenerator:
|
|||||||
- URLS_CONSENT=http://hydra-consent-app/consent
|
- URLS_CONSENT=http://hydra-consent-app/consent
|
||||||
- URLS_LOGOUT=http://hydra-logout-app/logout
|
- URLS_LOGOUT=http://hydra-logout-app/logout
|
||||||
- HYDRA_SERVE_ALL_ARGS=--dev
|
- HYDRA_SERVE_ALL_ARGS=--dev
|
||||||
- HYDRA_DATABASE_MAX_CONN="10"
|
|
||||||
- LOG_LEVEL=info
|
- LOG_LEVEL=info
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
|
Loading…
Reference in New Issue
Block a user