update kubeflow dip-catalog

2025-01-13 02:31:27 +00:00
parent 1dc1181a03
commit 5451f16d72
1959 changed files with 602337 additions and 0 deletions
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+
+components:
+- ../../components/istio-m2m
+- ../../components/istio-external-auth
+- ../../components/allow-unauthenticated-issuer-discovery
+- ../../components/configure-self-signed-kubernetes-oidc-issuer
+
+configMapGenerator:
+- name: oauth2-proxy-parameters
+  behavior: merge
+  literals:
+  - ALLOW_SELF_SIGNED_ISSUER=true
+  - ENABLE_M2M_TOKENS=true
+  - EXTRA_JWT_ISSUERS=https://kubernetes.default.svc.cluster.local=https://kubernetes.default.svc.cluster.local
@@ -0,0 +1,27 @@
+# Kustomize Overlay for M2M Authentication Integration with Istio
+
+## Overview
+
+This kustomize overlay facilitates the integration of M2M (Machine-to-Machine) authentication
+with Istio in a Kubernetes environment. It includes components designed to enable effective
+authentication within the service mesh.
+
+## Components
+
+The overlay consists of:
+
+1. **`istio-m2m`**: Configures Istio to trust JWTs in M2M communication, essential for enabling
+   M2M authentication within the service mesh.
+
+2. **`component-overwrite-m2m-token-issuer`**: This component is used when the OIDC issuer used
+   by Kubernetes is external to the cluster. It allows for the modification of the default
+   issuer URL in the M2M authentication setup to match the externally defined OIDC issuer. This
+   adjustment is necessary due to kustomize's handling of config map generators, requiring a
+   separate component for proper configuration merging.
+
+## Usage Scenario
+
+- **External OIDC Issuer Integration**: In cases where the OIDC Issuer integrated with Kubernetes
+   is defined outside the cluster, `component-overwrite-m2m-token-issuer` is used to update the
+   issuer URL for M2M authentication. This scenario is common in setups where an external OIDC
+   issuer is preferred over the default Kubernetes self-served OIDC issuer.
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+configMapGenerator:
+- name: istio-m2m-params
+  behavior: merge
+  literals:
+  - M2M_TOKEN_ISSUER=https://oidc.eks.region.amazonaws.com/id/1234abcd
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+
+components:
+- ../../components/istio-m2m
+- ../../components/istio-external-auth
+- component-overwrite-m2m-token-issuer
+
+configMapGenerator:
+- name: oauth2-proxy-parameters
+  behavior: merge
+  literals:
+  - FORCE_HTTPS=true
+  - ENABLE_M2M_TOKENS=true
+  - EXTRA_JWT_ISSUERS=https://oidc.eks.region.amazonaws.com/id/1234abcd=https://kubernetes.default.svc