update kubeflow dip-catalog

2025-01-13 02:31:27 +00:00
parent 1dc1181a03
commit 5451f16d72
1959 changed files with 602337 additions and 0 deletions
@@ -0,0 +1,24 @@
+# oauth2-proxy
+
+## `oauth2-proxy` Deployment
+
+This deployment of `oauth2-proxy` has been configured to align closely with the official
+`oauth2-proxy` Helm installation. This approach facilitates easier integration with any
+existing `oauth2-proxy` deployments that may already be present on the cluster.
+
+### Upgrading `oauth2-proxy`
+
+The `oauth2-proxy` component is designed for easy upgrading, thanks to its foundation on the
+official `oauth2-proxy` Helm chart. The use of the standard Helm chart simplifies the upgrade
+process, closely following the upgrades of the official `oauth2-proxy` releases.
+
+### Stateless Nature of `oauth2-proxy`
+
+`oauth2-proxy` operates as a stateless application. This statelessness simplifies many
+aspects of its operation, particularly upgrades, as there are no concerns about complex state
+management or data migration. Additionally, while `oauth2-proxy` is integrated into the
+Kubernetes environment, this integration is limited to running the application, thereby
+minimizing the impact on Kubernetes infrastructure during upgrades.
+
+These characteristics make the upgrade process for `oauth2-proxy` more predictable and
+manageable in Kubernetes environments.
@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+  labels:
+    app: oauth2-proxy
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oauth2-proxy
+    spec:
+      volumes:
+        - name: configmain
+          configMap:
+            name: oauth2-proxy
+            defaultMode: 420
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:latest
+          args:
+            - --http-address=0.0.0.0:4180
+            - --config=/etc/oauth2_proxy/oauth2_proxy.cfg
+          ports:
+            - name: http
+              containerPort: 4180
+              protocol: TCP
+            - name: metrics
+              containerPort: 44180
+              protocol: TCP
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy
+                  key: client-id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy
+                  key: client-secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy
+                  key: cookie-secret
+            - name: OAUTH2_PROXY_COOKIE_SECURE
+              valueFrom:
+                configMapKeyRef:
+                  name: oauth2-proxy-parameters
+                  key: FORCE_HTTPS
+            - name: OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY
+              valueFrom:
+                configMapKeyRef:
+                  name: oauth2-proxy-parameters
+                  key: ALLOW_SELF_SIGNED_ISSUER
+            - name: OAUTH2_PROXY_SKIP_JWT_BEARER_TOKENS
+              valueFrom:
+                configMapKeyRef:
+                  name: oauth2-proxy-parameters
+                  key: ENABLE_M2M_TOKENS
+            - name: OAUTH2_PROXY_EXTRA_JWT_ISSUERS
+              valueFrom:
+                configMapKeyRef:
+                  name: oauth2-proxy-parameters
+                  key: EXTRA_JWT_ISSUERS
+          volumeMounts:
+            - name: configmain
+              mountPath: /etc/oauth2_proxy/oauth2_proxy.cfg
+              subPath: oauth2_proxy.cfg
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+              scheme: HTTP
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+              scheme: HTTP
+          resources: {}
@@ -0,0 +1,64 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: oauth2-proxy
+
+resources:
+- namespace.yaml
+- deployment.yaml
+- serviceaccount.yaml
+- service.yaml
+- oauth2-proxy-config.yaml
+# To use oauth2-proxy in OpenShift, use openshift distribution of oauth2-proxy
+# available here: https://github.com/openshift/oauth-proxy
+# and add RBAC to enable creation of tokenreviews
+# Token Reviews for OpenShift
+# - rbac.tokenreviews.yaml
+
+secretGenerator:
+- name: oauth2-proxy
+  type: Opaque
+  envs:
+  - secrets.env
+
+configMapGenerator:
+- name: oauth2-proxy-parameters
+  literals:
+  # This will configure oauth2-proxy option --cookie-secure which can force
+  # auth redirect with redirect_uri parameter using https.
+  - FORCE_HTTPS=false
+
+  # If Kubernetes is managed by kind, vCluster, minikube or similar tool,
+  # most probably the Kubernetes OIDC Issuer will be server in-cluster
+  # behind self-signed certs. This option will configure
+  # --ssl-insecure-skip-verify which will accept self-signed-certificates.
+  - ALLOW_SELF_SIGNED_ISSUER=true
+
+  # This will configure oauth2-proxy option --skip-jwt-bearer-tokens which
+  # will pass the requests with 'Authorization' header with Bearer Token
+  # matching --extra-jwt-issuers.
+  - ENABLE_M2M_TOKENS=true
+
+  # Bearer tokens issued by these OIDC Issuers will be verified against the
+  # Issuer and accepted on success.
+  # The format is exactly like in --extra-jwt-issuers.
+  # If extra jwt issuers are meant to be used with m2m bearer tokens,
+  # each issuer has to be added with RequestAuthentication so Istio can
+  # verify, trust and use the JWT. See
+  # 'common/oidc-client/oauth2-proxy/components/istio-m2m' for details.
+  # Examples:
+  # - EXTRA_JWT_ISSUERS=https://kubernetes.default.svc.cluster.local=https://kubernetes.default.svc.cluster.local
+  # - EXTRA_JWT_ISSUERS=https://oidc.eks.region.amazonaws.com/id/1234abcd=https://kubernetes.default.svc
+  - EXTRA_JWT_ISSUERS=
+
+patches:
+- target:
+    kind: ConfigMap
+    name: oauth2-proxy
+  path: patch-configmap.yaml
+
+
+images:
+- name: quay.io/oauth2-proxy/oauth2-proxy
+  newName: quay.io/oauth2-proxy/oauth2-proxy
+  newTag: v7.6.0
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: oauth2-proxy
@@ -0,0 +1,57 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: oauth2-proxy
+  labels:
+    app: oauth2-proxy
+data:
+  oauth2_proxy.cfg: |
+    provider = "oidc"
+    oidc_issuer_url = "http://dex.auth.svc.cluster.local:5556/dex"
+    scope = "profile email groups openid"
+    upstreams = "static://200"
+    email_domains = [ "*" ]
+    skip_auth_regex=["/dex/.*"]
+    # ---
+    # OIDC Discovery has to be skipped and login url has to be provided directly
+    # in order to enable relative auth redirect.
+    # Turning On OIDC Discovery would set the auth redirect location as the dex
+    # Issuer URL which is http://dex.auth.svc.cluster.local:5556 in the default,
+    # example installation. This address is usuallynot available through the Web
+    # Browser. If you have a setup where dex has it's url as other than the
+    # in-cluster service, this is optional.
+    skip_oidc_discovery = true
+    login_url = "/dex/auth"
+    redeem_url = "http://dex.auth.svc.cluster.local:5556/dex/token"
+    oidc_jwks_url = "http://dex.auth.svc.cluster.local:5556/dex/keys"
+    # ---
+    # Go to dex login page directly instead of showing the oauth2-proxy login
+    # page.
+    skip_provider_button = true
+    # ---
+    # Set Authorization Bearer response header. This is needed in order to
+    # forward the Authorization Bearer token to Istio and enable authorization
+    # based on JWT.
+    set_authorization_header = true
+    # ---
+    # set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
+    # X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
+    # may have other services that use standard auth headers.
+    set_xauthrequest = true
+    # ---
+    cookie_name = "oauth2_proxy_kubeflow"
+    # ---
+    # Dex default cookie expiration is 24h. If set to 168h (default oauth2-proxy),
+    # Istio will not be able to use the JWT after 24h but oauth2-proxy will still
+    # consider the cookie valid.
+    # It's possible to configure the JWT Refresh Token to enable longer login
+    # session.
+    cookie_expire = "24h"
+    cookie_refresh = 0
+    # ---
+    code_challenge_method = "S256"
+    # ---
+    redirect_url = "/oauth2/callback"
+    relative_redirect_url = true
+
+binaryData: {}
@@ -0,0 +1,5 @@
+varReference:
+- path: spec/configPatches/patch/value/typed_config/http_service/server_uri/uri
+  kind: EnvoyFilter
+- path: spec/configPatches/patch/value/typed_config/http_service/server_uri/cluster
+  kind: EnvoyFilter
@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: oauth2-proxy
+  labels:
+    app: oauth2-proxy
+data:
+  oauth2_proxy.cfg: |
+    provider = "keycloak-oidc"
+    oidc_issuer_url = ""
+    scope = "profile email roles openid"
+    upstreams = "static://200"
+    email_domains = [ "*" ]
+    skip_auth_regex=["/dex/.*"]
+    # ---
+    # OIDC Discovery has to be skipped and login url has to be provided directly
+    # in order to enable relative auth redirect.
+    # Turning On OIDC Discovery would set the auth redirect location as the dex
+    # Issuer URL which is http://dex.auth.svc.cluster.local:5556 in the default,
+    # example installation. This address is usuallynot available through the Web
+    # Browser. If you have a setup where dex has it's url as other than the
+    # in-cluster service, this is optional.
+    # ---
+    # Go to dex login page directly instead of showing the oauth2-proxy login
+    # page.
+    skip_provider_button = true
+    # ---
+    # Set Authorization Bearer response header. This is needed in order to
+    # forward the Authorization Bearer token to Istio and enable authorization
+    # based on JWT.
+    set_authorization_header = true
+    # ---
+    # set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
+    # X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
+    # may have other services that use standard auth headers.
+    set_xauthrequest = true
+    # ---
+    cookie_name = "oauth2_proxy_kubeflow"
+    # ---
+    # Dex default cookie expiration is 24h. If set to 168h (default oauth2-proxy),
+    # Istio will not be able to use the JWT after 24h but oauth2-proxy will still
+    # consider the cookie valid.
+    # It's possible to configure the JWT Refresh Token to enable longer login
+    # session.
+    cookie_expire = "24h"
+    cookie_refresh = "5m"
+    # ---
+    code_challenge_method = "S256"
+    # ---
+    redirect_url = "/oauth2/callback"
+    relative_redirect_url = true
+
+binaryData: {}
@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: authn-delegator
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: authn-delegators
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authn-delegator
+subjects:
+  - kind: ServiceAccount
+    name: oauth2-proxy
@@ -0,0 +1,3 @@
+client-id=kubeflow-oidc-authservice
+client-secret=5kD2WwXGUYQ3lEUpy6dkTIVXHpVeemuA
+cookie-secret=094f9651100c4ee4a3a7337e405d8650
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: oauth2-proxy
+  ports:
+    - port: 80
+      name: http
+      targetPort: http
+  publishNotReadyAddresses: true
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oauth2-proxy