apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: oauth2-proxy

resources:
- namespace.yaml
- deployment.yaml
- serviceaccount.yaml
- service.yaml
- oauth2-proxy-config.yaml
# To use oauth2-proxy in OpenShift, use openshift distribution of oauth2-proxy
# available here: https://github.com/openshift/oauth-proxy
# and add RBAC to enable creation of tokenreviews
# Token Reviews for OpenShift
# - rbac.tokenreviews.yaml

secretGenerator:
- name: oauth2-proxy
  type: Opaque
  envs:
  - secrets.env

patches:
- target:
    kind: ConfigMap
    name: oauth2-proxy
  path: patch-oauth2-proxy-config.yaml

configMapGenerator:
- name: oauth2-proxy-parameters
  literals:
  # This will configure oauth2-proxy option --cookie-secure which can force
  # auth redirect with redirect_uri parameter using https.
  - FORCE_HTTPS=false

  # If Kubernetes is managed by kind, vCluster, minikube or similar tool,
  # most probably the Kubernetes OIDC Issuer will be server in-cluster
  # behind self-signed certs. This option will configure
  # --ssl-insecure-skip-verify which will accept self-signed-certificates.
  - ALLOW_SELF_SIGNED_ISSUER=true

  # This will configure oauth2-proxy option --skip-jwt-bearer-tokens which
  # will pass the requests with 'Authorization' header with Bearer Token
  # matching --extra-jwt-issuers.
  - ENABLE_M2M_TOKENS=true

  # Bearer tokens issued by these OIDC Issuers will be verified against the
  # Issuer and accepted on success.
  # The format is exactly like in --extra-jwt-issuers.
  # If extra jwt issuers are meant to be used with m2m bearer tokens,
  # each issuer has to be added with RequestAuthentication so Istio can
  # verify, trust and use the JWT. See
  # 'common/oidc-client/oauth2-proxy/components/istio-m2m' for details.
  # Examples:
  # - EXTRA_JWT_ISSUERS=https://kubernetes.default.svc.cluster.local=https://kubernetes.default.svc.cluster.local
  # - EXTRA_JWT_ISSUERS=https://oidc.eks.region.amazonaws.com/id/1234abcd=https://kubernetes.default.svc
  - EXTRA_JWT_ISSUERS=


images:
- name: quay.io/oauth2-proxy/oauth2-proxy
  newName: quay.io/oauth2-proxy/oauth2-proxy
  newTag: v7.6.0