ChanghoWoo
53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: oauth2-proxy
|
|
labels:
|
|
app: oauth2-proxy
|
|
data:
|
|
oauth2_proxy.cfg: |
|
|
provider = "keycloak-oidc"
|
|
oidc_issuer_url = "$OIDC_ISSUER_URL"
|
|
scope = "profile email roles openid"
|
|
upstreams = "static://200"
|
|
email_domains = [ "*" ]
|
|
# ---
|
|
# OIDC Discovery has to be skipped and login url has to be provided directly
|
|
# in order to enable relative auth redirect.
|
|
# Turning On OIDC Discovery would set the auth redirect location as the dex
|
|
# Issuer URL which is http://dex.auth.svc.cluster.local:5556 in the default,
|
|
# example installation. This address is usuallynot available through the Web
|
|
# Browser. If you have a setup where dex has it's url as other than the
|
|
# in-cluster service, this is optional.
|
|
# ---
|
|
# Go to dex login page directly instead of showing the oauth2-proxy login
|
|
# page.
|
|
skip_provider_button = true
|
|
# ---
|
|
# Set Authorization Bearer response header. This is needed in order to
|
|
# forward the Authorization Bearer token to Istio and enable authorization
|
|
# based on JWT.
|
|
set_authorization_header = true
|
|
# ---
|
|
# set X-Auth-Request-User, X-Auth-Request-Groups, X-Auth-Request-Email and
|
|
# X-Auth-Request-Preferred-Username. This is optional for Kubeflow but you
|
|
# may have other services that use standard auth headers.
|
|
set_xauthrequest = true
|
|
# ---
|
|
cookie_name = "oauth2_proxy_kubeflow"
|
|
# ---
|
|
# Dex default cookie expiration is 24h. If set to 168h (default oauth2-proxy),
|
|
# Istio will not be able to use the JWT after 24h but oauth2-proxy will still
|
|
# consider the cookie valid.
|
|
# It's possible to configure the JWT Refresh Token to enable longer login
|
|
# session.
|
|
cookie_expire = "24h"
|
|
cookie_refresh = "5m"
|
|
# ---
|
|
code_challenge_method = "S256"
|
|
# ---
|
|
redirect_url = "$REDIRECT_URL"
|
|
relative_redirect_url = true
|
|
|
|
binaryData: {}
|