191 lines
4 KiB
HCL
191 lines
4 KiB
HCL
variable "namespace" {
|
|
type = string
|
|
}
|
|
variable "host" {
|
|
type = string
|
|
}
|
|
variable "tls_secret_name" {
|
|
type = string
|
|
}
|
|
variable "svc_name" {
|
|
type = string
|
|
}
|
|
variable "client_id" {}
|
|
variable "client_secret" {}
|
|
|
|
resource "random_password" "cookie" {
|
|
length = 16
|
|
special = true
|
|
override_special = "_%@"
|
|
}
|
|
|
|
resource "kubernetes_deployment" "oauth_proxy" {
|
|
metadata {
|
|
name = "oauth-proxy"
|
|
namespace = var.namespace
|
|
labels = {
|
|
run = "oauth-proxy"
|
|
}
|
|
}
|
|
spec {
|
|
replicas = 1
|
|
selector {
|
|
match_labels = {
|
|
run = "oauth-proxy"
|
|
}
|
|
}
|
|
template {
|
|
metadata {
|
|
labels = {
|
|
run = "oauth-proxy"
|
|
}
|
|
}
|
|
spec {
|
|
container {
|
|
image = "quay.io/oauth2-proxy/oauth2-proxy:latest"
|
|
args = ["--provider=github", "--email-domain=*", "upstream=file:///dev/null", "--http-address=0.0.0.0:4180"]
|
|
name = "oauth-proxy"
|
|
image_pull_policy = "IfNotPresent"
|
|
resources {
|
|
limits = {
|
|
cpu = "0.5"
|
|
memory = "512Mi"
|
|
}
|
|
requests = {
|
|
cpu = "250m"
|
|
memory = "50Mi"
|
|
}
|
|
}
|
|
port {
|
|
container_port = 4180
|
|
}
|
|
env {
|
|
name = "OAUTH2_PROXY_CLIENT_ID"
|
|
value = var.client_id
|
|
}
|
|
env {
|
|
name = "OAUTH2_PROXY_CLIENT_SECRET"
|
|
value = var.client_secret
|
|
}
|
|
env {
|
|
name = "OAUTH2_PROXY_COOKIE_SECRET"
|
|
value = random_password.cookie.result
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_service" "oauth_proxy" {
|
|
metadata {
|
|
name = var.svc_name
|
|
namespace = var.namespace
|
|
labels = {
|
|
run = "oauth-proxy"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
selector = {
|
|
run = "oauth-proxy"
|
|
}
|
|
port {
|
|
name = "http"
|
|
port = "80"
|
|
target_port = "4180"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_ingress_v1" "oauth" {
|
|
metadata {
|
|
name = "oauth-ingress"
|
|
namespace = var.namespace
|
|
annotations = {
|
|
"kubernetes.io/ingress.class" = "nginx"
|
|
"nginx.ingress.kubernetes.io/use-regex" = "true"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
tls {
|
|
hosts = [var.host]
|
|
secret_name = var.tls_secret_name
|
|
}
|
|
rule {
|
|
host = var.host
|
|
http {
|
|
path {
|
|
path = "/oauth2/.*"
|
|
backend {
|
|
service {
|
|
name = var.svc_name
|
|
port {
|
|
number = 80
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
# apiVersion: apps/v1
|
|
# kind: Deployment
|
|
# metadata:
|
|
# labels:
|
|
# k8s-app: oauth2-proxy
|
|
# name: oauth2-proxy
|
|
# namespace: kube-system
|
|
# spec:
|
|
# replicas: 1
|
|
# selector:
|
|
# matchLabels:
|
|
# k8s-app: oauth2-proxy
|
|
# template:
|
|
# metadata:
|
|
# labels:
|
|
# k8s-app: oauth2-proxy
|
|
# spec:
|
|
# containers:
|
|
# - args:
|
|
# - --provider=github
|
|
# - --email-domain=*
|
|
# - --upstream=file:///dev/null
|
|
# - --http-address=0.0.0.0:4180
|
|
# # Register a new application
|
|
# # https://github.com/settings/applications/new
|
|
# env:
|
|
# - name: OAUTH2_PROXY_CLIENT_ID
|
|
# value: <Client ID>
|
|
# - name: OAUTH2_PROXY_CLIENT_SECRET
|
|
# value: <Client Secret>
|
|
# # docker run -ti --rm python:3-alpine python -c 'import secrets,base64; print(base64.b64encode(base64.b64encode(secrets.token_bytes(16))));'
|
|
# - name: OAUTH2_PROXY_COOKIE_SECRET
|
|
# value: SECRET
|
|
# image: quay.io/oauth2-proxy/oauth2-proxy:latest
|
|
# imagePullPolicy: Always
|
|
# name: oauth2-proxy
|
|
# ports:
|
|
# - containerPort: 4180
|
|
# protocol: TCP
|
|
|
|
# ---
|
|
|
|
# apiVersion: v1
|
|
# kind: Service
|
|
# metadata:
|
|
# labels:
|
|
# k8s-app: oauth2-proxy
|
|
# name: oauth2-proxy
|
|
# namespace: kube-system
|
|
# spec:
|
|
# ports:
|
|
# - name: http
|
|
# port: 4180
|
|
# protocol: TCP
|
|
# targetPort: 4180
|
|
# selector:
|
|
# k8s-app: oauth2-proxy
|