ChanghoWoo
65 lines
2.1 KiB
YAML
65 lines
2.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
namespace: oauth2-proxy
|
|
|
|
resources:
|
|
- namespace.yaml
|
|
- deployment.yaml
|
|
- serviceaccount.yaml
|
|
- service.yaml
|
|
- oauth2-proxy-config.yaml
|
|
# To use oauth2-proxy in OpenShift, use openshift distribution of oauth2-proxy
|
|
# available here: https://github.com/openshift/oauth-proxy
|
|
# and add RBAC to enable creation of tokenreviews
|
|
# Token Reviews for OpenShift
|
|
# - rbac.tokenreviews.yaml
|
|
|
|
secretGenerator:
|
|
- name: oauth2-proxy
|
|
type: Opaque
|
|
envs:
|
|
- secrets.env
|
|
|
|
patches:
|
|
- target:
|
|
kind: ConfigMap
|
|
name: oauth2-proxy
|
|
path: patch-oauth2-proxy-config.yaml
|
|
|
|
configMapGenerator:
|
|
- name: oauth2-proxy-parameters
|
|
literals:
|
|
# This will configure oauth2-proxy option --cookie-secure which can force
|
|
# auth redirect with redirect_uri parameter using https.
|
|
- FORCE_HTTPS=false
|
|
|
|
# If Kubernetes is managed by kind, vCluster, minikube or similar tool,
|
|
# most probably the Kubernetes OIDC Issuer will be server in-cluster
|
|
# behind self-signed certs. This option will configure
|
|
# --ssl-insecure-skip-verify which will accept self-signed-certificates.
|
|
- ALLOW_SELF_SIGNED_ISSUER=true
|
|
|
|
# This will configure oauth2-proxy option --skip-jwt-bearer-tokens which
|
|
# will pass the requests with 'Authorization' header with Bearer Token
|
|
# matching --extra-jwt-issuers.
|
|
- ENABLE_M2M_TOKENS=true
|
|
|
|
# Bearer tokens issued by these OIDC Issuers will be verified against the
|
|
# Issuer and accepted on success.
|
|
# The format is exactly like in --extra-jwt-issuers.
|
|
# If extra jwt issuers are meant to be used with m2m bearer tokens,
|
|
# each issuer has to be added with RequestAuthentication so Istio can
|
|
# verify, trust and use the JWT. See
|
|
# 'common/oidc-client/oauth2-proxy/components/istio-m2m' for details.
|
|
# Examples:
|
|
# - EXTRA_JWT_ISSUERS=https://kubernetes.default.svc.cluster.local=https://kubernetes.default.svc.cluster.local
|
|
# - EXTRA_JWT_ISSUERS=https://oidc.eks.region.amazonaws.com/id/1234abcd=https://kubernetes.default.svc
|
|
- EXTRA_JWT_ISSUERS=
|
|
|
|
|
|
images:
|
|
- name: quay.io/oauth2-proxy/oauth2-proxy
|
|
newName: quay.io/oauth2-proxy/oauth2-proxy
|
|
newTag: v7.6.0
|