ChanghoWoo
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: oauth2-proxy
|
|
labels:
|
|
app: oauth2-proxy
|
|
data:
|
|
oauth2_proxy.cfg: |
|
|
provider = "oidc"
|
|
oidc_issuer_url = "http://dex.auth.svc.cluster.local:5556/dex"
|
|
scope = "profile email groups openid"
|
|
upstreams = "static://200"
|
|
email_domains = [ "*" ]
|
|
skip_auth_regex=["/dex/.*"]
|
|
# ---
|
|
# OIDC Discovery has to be skipped and login url has to be provided directly
|
|
# in order to enable relative auth redirect.
|
|
# Turning On OIDC Discovery would set the auth redirect location as the dex
|
|
# Issuer URL which is http://dex.auth.svc.cluster.local:5556 in the default,
|
|
# example installation. This address is usuallynot available through the Web
|
|
# Browser. If you have a setup where dex has it's url as other than the
|
|
# in-cluster service, this is optional.
|
|
skip_oidc_discovery = true
|
|
login_url = "/dex/auth"
|
|
redeem_url = "http://dex.auth.svc.cluster.local:5556/dex/token"
|
|
oidc_jwks_url = "http://dex.auth.svc.cluster.local:5556/dex/keys"
|
|
# ---
|
|
# Go to dex login page directly instead of showing the oauth2-proxy login
|
|
# page.
|
|
skip_provider_button = true
|
|
# ---
|
|
# Set Authorization Bearer response header. This is needed in order to
|
|
# forward the Authorization Bearer token to Istio and enable authorization
|
|
# based on JWT.
|
|
set_authorization_header = true
|
|
# ---
|
|
# set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
|
|
# X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
|
|
# may have other services that use standard auth headers.
|
|
set_xauthrequest = true
|
|
# ---
|
|
cookie_name = "oauth2_proxy_kubeflow"
|
|
# ---
|
|
# Dex default cookie expiration is 24h. If set to 168h (default oauth2-proxy),
|
|
# Istio will not be able to use the JWT after 24h but oauth2-proxy will still
|
|
# consider the cookie valid.
|
|
# It's possible to configure the JWT Refresh Token to enable longer login
|
|
# session.
|
|
cookie_expire = "24h"
|
|
cookie_refresh = 0
|
|
# ---
|
|
code_challenge_method = "S256"
|
|
# ---
|
|
redirect_url = "/oauth2/callback"
|
|
relative_redirect_url = true
|
|
|
|
binaryData: {}
|