update kubeflow dip-catalog

2025-01-13 02:31:27 +00:00
parent 1dc1181a03
commit 5451f16d72
1959 changed files with 602337 additions and 0 deletions
@@ -0,0 +1,40 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+  name: authn-filter
+spec:
+  workloadSelector:
+    labels:
+      istio: ingressgateway
+  configPatches:
+    - applyTo: HTTP_FILTER
+      match:
+        context: GATEWAY
+        listener:
+          filterChain:
+            filter:
+              name: "envoy.filters.network.http_connection_manager"
+      patch:
+        # For some reason, INSERT_FIRST doesn't work
+        operation: INSERT_BEFORE
+        value:
+          # See: https://www.envoyproxy.io/docs/envoy/v1.17.0/configuration/http/http_filters/ext_authz_filter#config-http-filters-ext-authz
+          name: "envoy.filters.http.ext_authz"
+          typed_config:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            http_service:
+              server_uri:
+                uri: http://$(AUTHSERVICE_SERVICE).$(AUTHSERVICE_NAMESPACE).svc.cluster.local
+                cluster: outbound|8080||$(AUTHSERVICE_SERVICE).$(AUTHSERVICE_NAMESPACE).svc.cluster.local
+                timeout: 10s
+              authorization_request:
+                allowed_headers:
+                  patterns:
+                    # XXX: MUST be lowercase!
+                    - exact: "authorization"
+                    - exact: "cookie"
+                    - exact: "x-auth-token"
+              authorization_response:
+                allowed_upstream_headers:
+                  patterns:
+                    - exact: "kubeflow-userid"
@@ -0,0 +1,47 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - rbac.yaml
+  - service.yaml
+  - statefulset.yaml
+  - envoy-filter.yaml
+  - pvc.yaml
+
+namespace: istio-system
+
+configMapGenerator:
+  - name: oidc-authservice-parameters
+    envs:
+      - params.env
+
+secretGenerator:
+  - name: oidc-authservice-client
+    type: Opaque
+    envs:
+      - secret_params.env
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+vars:
+  - name: AUTHSERVICE_NAMESPACE
+    objref:
+      kind: Service
+      name: authservice
+      apiVersion: v1
+    fieldref:
+      fieldpath: metadata.namespace
+  - name: AUTHSERVICE_SERVICE
+    objref:
+      kind: Service
+      name: authservice
+      apiVersion: v1
+    fieldref:
+      fieldpath: metadata.name
+configurations:
+  - params.yaml
+images:
+  - name: gcr.io/arrikto/kubeflow/oidc-authservice
+    newName: docker.io/kubeflowmanifestswg/oidc-authservice
+    newTag: e236439
@@ -0,0 +1,11 @@
+OIDC_PROVIDER=http://dex.auth.svc.cluster.local:5556/dex
+OIDC_AUTH_URL=/dex/auth
+OIDC_SCOPES=profile email groups
+AUTHSERVICE_URL_PREFIX=/authservice/
+SKIP_AUTH_URLS=/dex
+AFTER_LOGOUT_URL=/
+USERID_HEADER=kubeflow-userid
+USERID_PREFIX=
+USERID_CLAIM=email
+PORT="8080"
+STORE_PATH=/var/lib/authservice/data.db
@@ -0,0 +1,5 @@
+varReference:
+- path: spec/configPatches/patch/value/typed_config/http_service/server_uri/uri
+  kind: EnvoyFilter
+- path: spec/configPatches/patch/value/typed_config/http_service/server_uri/cluster
+  kind: EnvoyFilter
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authservice-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: authservice
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: authn-delegator
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: authn-delegators
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: authn-delegator
+subjects:
+  - kind: ServiceAccount
+    name: authservice
@@ -0,0 +1,2 @@
+CLIENT_ID=kubeflow-oidc-authservice
+CLIENT_SECRET=pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authservice
+spec:
+  type: ClusterIP
+  selector:
+    app: authservice
+  ports:
+    - port: 8080
+      name: http-authservice
+      targetPort: http-api
+  publishNotReadyAddresses: true
@@ -0,0 +1,43 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: oidc-authservice
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authservice
+  serviceName: authservice
+  template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "false"
+      labels:
+        app: authservice
+    spec:
+      serviceAccountName: authservice
+      containers:
+      - name: authservice
+        image: gcr.io/arrikto/kubeflow/oidc-authservice:e236439
+        imagePullPolicy: Always
+        ports:
+        - name: http-api
+          containerPort: 8080
+        envFrom:
+          - secretRef:
+              name: oidc-authservice-client
+          - configMapRef:
+              name: oidc-authservice-parameters
+        volumeMounts:
+          - name: data
+            mountPath: /var/lib/authservice
+        readinessProbe:
+            httpGet:
+              path: /
+              port: 8081
+      securityContext:
+        fsGroup: 111
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+              claimName: authservice-pvc
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+  - ../../base
+patchesStrategicMerge:
+  - statefulset.yaml
+images:
+  - name: busybox
+    newTag: "latest"
+    newName: busybox
@@ -0,0 +1,15 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: oidc-authservice
+spec:
+  template:
+    spec:
+      initContainers:
+      - name: fix-permission
+        image: busybox
+        command: ['sh', '-c']
+        args: ['chmod -R 777 /var/lib/authservice;']
+        volumeMounts:
+        - mountPath: /var/lib/authservice
+          name: data