cluster

commit 834dd070fe972fc4a336c9edd8282507f134a0f4
parent ed955e50607e9da0278841e1ac32a5ba86aaf9a7
Author: MTRNord <mtrnord1@gmail.com>
Date:   Thu,  4 Jan 2024 15:23:22 +0100

Add traefik-sso

Diffstat:
A
apps/base/traefik-sso/deployment.yaml
 | 
66
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
A
apps/base/traefik-sso/kustomization.yaml
 | 
6
++++++
A
apps/base/traefik-sso/service.yaml
 | 
49
+++++++++++++++++++++++++++++++++++++++++++++++++
M
apps/production/kustomization.yaml
 | 
1
+

4 files changed, 122 insertions(+), 0 deletions(-)
diff --git a/apps/base/traefik-sso/deployment.yaml b/apps/base/traefik-sso/deployment.yaml
@@ -0,0 +1,66 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik-sso
+  namespace: traefik-ingress
+  labels:
+    app: traefik-sso
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: traefik-sso
+  template:
+    metadata:
+      namespace: traefik-ingress
+      labels:
+        app: traefik-sso
+    spec:
+      # No arm images
+      # tolerations:
+      #   - key: "arch"
+      #     operator: "Equal"
+      #     value: "arm64"
+      #     effect: "NoSchedule"
+      containers:
+      - name: traefik-sso
+        image: thomseddon/traefik-forward-auth:2.2
+        imagePullPolicy: Always
+        env:
+        - name: PROVIDERS_OIDC_ISSUER_URL
+          valueFrom:
+            secretKeyRef:
+              name: traefik-sso
+              key: issuer_url
+        - name: PROVIDERS_OIDC_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: traefik-sso
+              key: client_id
+        - name: PROVIDERS_OIDC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: traefik-sso
+              key: client_secret
+        - name: SECRET
+          valueFrom:
+            secretKeyRef:
+              name: traefik-sso
+              key: secret
+        - name: COOKIE_DOMAIN
+          value: nordgedanken.dev
+        - name: AUTH_HOST
+          value: auth.nordgedanken.dev
+        - name: INSECURE_COOKIE
+          value: "false"
+        - name: DEFAULT_PROVIDER
+          value: "oidc"
+        # - name: URL_PATH 
+        #   value: /_oauth
+        #- name: WHITELIST
+        #  value: joooostb@gmail.com
+        - name: LOG_LEVEL
+          value: debug
+        ports:
+        - containerPort: 4181
diff --git a/apps/base/traefik-sso/kustomization.yaml b/apps/base/traefik-sso/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: traefik-ingress
+resources:
+  - deployment.yaml
+  - service.yaml
diff --git a/apps/base/traefik-sso/service.yaml b/apps/base/traefik-sso/service.yaml
@@ -0,0 +1,49 @@
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: traefik-sso
+  namespace: traefik-ingress
+spec:
+  selector:
+    app: traefik-sso
+  ports:
+  - protocol: TCP
+    port: 4181
+    targetPort: 4181
+---
+apiVersion: traefik.containo.us/v1alpha1
+kind: Middleware
+metadata:
+  name: sso
+  namespace: traefik-ingress
+spec:
+  forwardAuth:
+    address: http://traefik-sso:4181
+    authResponseHeaders: 
+        - "X-Forwarded-User"
+    trustForwardHeader: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: traefik-sso
+  namespace: traefik-ingress
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-ingress-sso@kubernetescrd
+spec:
+  rules:
+  - host: auth.nordgedanken.dev
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        backend:
+          service:
+            name: traefik-sso
+            port:
+              number: 4181
+  tls:
+  - hosts:
+    - "auth.nordgedanken.dev"
+    secretName: auth.nordgedanken.dev-tls
diff --git a/apps/production/kustomization.yaml b/apps/production/kustomization.yaml
@@ -24,6 +24,7 @@ resources:
   - pvcs-mjolnir.yaml
   - nfs-server.yaml
   - nfs-csi.yaml
+  - ../base/traefik-sso
 patchesStrategicMerge:
   - cosign-values.yaml
   - vaultwarden-values.yaml