7e89d65a8c
This patchset introduces the VariableCatalogue and respective Replacement transformers for the Dex/API server. It also implements the kustomization of LDAP values through patches. The VariableCatalogue for Dex/API server is located under manifests/function/treasuremap-base-catalogues/utility-catalogue.yaml. The replacement transformers for Dex HelmRelease and API server are located at: - Dex HelmRelease: manifests/function/dex-aio/replacements - API Server: manifests/function/k8scontrol-ha/replacements The API server replacement transformer is invoked when executing the command "airshipctl phase run controlplane-ephemeral". The dex-aio service replacement transformer is invoked when executing the command "airshipctl phase run workload-target". During this phase the LDAP values are also "kustomized" through patchesStrategicMerge. Similar patch was add for the subclusters/provide-infra. Also updated dex-aio nodeSelector to deploy pod on the worker node. This patchset also supports the LDAP Group authentication. It also updated treasuremap/manifests/site/test-site/target/encrypted/results/imported/secrets.yaml with the encrypted LDAP Binding password. Relates-To: #135, #137, #128 Change-Id: Ie7eef44a8f0e9d02860a94a4140841d8662f8c85
92 lines
2.3 KiB
YAML
92 lines
2.3 KiB
YAML
# ---
|
|
# Dex Helm Charts from Git Repository
|
|
# apiVersion: source.toolkit.fluxcd.io/v1beta1
|
|
# kind: GitRepository
|
|
# metadata:
|
|
# name: dex-git-repo
|
|
# namespace: collator
|
|
# spec:
|
|
# interval: 5m
|
|
# url: https://github.com/airshipit/charts.git
|
|
# ref:
|
|
# branch: master
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2beta1
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: dex-aio
|
|
spec:
|
|
interval: 5m
|
|
chart:
|
|
spec:
|
|
chart: dex-aio
|
|
# Referencing Dex Helm charts from Helm Collator repo
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: collator
|
|
namespace: helm-chart-collator
|
|
# Referencing Dex Helm charts from Git repo
|
|
# sourceRef:
|
|
# kind: GitRepository
|
|
# name: dex-git-repo
|
|
# namespace: collator
|
|
values:
|
|
images:
|
|
applications:
|
|
dex:
|
|
tag: v2.28.1
|
|
name: dexidp/dex
|
|
repo: quay.io
|
|
nginx:
|
|
tag: 1.17.10-alpine
|
|
name: nginx
|
|
repo: docker.io
|
|
authenticator:
|
|
tag: 1.2.0
|
|
name: mintel/dex-k8s-authenticator
|
|
repo: docker.io
|
|
node_labels:
|
|
dex:
|
|
key: node-role.kubernetes.io/worker
|
|
value: ""
|
|
params:
|
|
site:
|
|
name: dex-test-site
|
|
endpoints:
|
|
hostname: dex.function.local
|
|
port:
|
|
https: 30556
|
|
http: 30554
|
|
k8s: 6443
|
|
tls:
|
|
cert_manager: true
|
|
issuer:
|
|
name: workload-cluster-ca-issuer
|
|
kind: Issuer
|
|
oidc:
|
|
client_id: function-kubernetes
|
|
client_secret: pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
|
|
ldap:
|
|
bind_password: "your LDAP bind password"
|
|
name: "LDAP TEST SERVICES"
|
|
config:
|
|
host: "your LDAP FQDN"
|
|
port: 636
|
|
bind_dn: "your LDAP bind username"
|
|
bind_pw_env: LDAP_BIND_PW
|
|
username_prompt: SSO Username
|
|
user_search:
|
|
base_dn: dc=testservices,dc=test,dc=com
|
|
filter: "(objectClass=person)"
|
|
username: cn
|
|
idAttr: cn
|
|
emailAttr: name
|
|
nameAttr: name
|
|
group_search:
|
|
base_dn: ou=groups,dc=testservices,dc=test,dc=com
|
|
filter: "(objectClass=group)"
|
|
userMatchers:
|
|
userAttr: DN
|
|
groupAttr: member
|
|
nameAttr: cn
|