Skip to content

Commit

Permalink
chart: Template and render the Dex charts to use service values
Browse files Browse the repository at this point in the history
This chart is rendered using the following commmand:

./charts/render.py dex --namespace metalk8s-auth  charts/dex.yaml  --service-config dex metalk8s-dex-config  charts/dex/ > salt/metalk8s/addons/dex/deployed/chart.sls

Note: The `Dex` secret automatically generated in `chart.sls`
has been replaced with `secret.sls` because we require iterating over list([]) structures
which cannot be included in `dex.yaml` before rendering using the `render.py`

Each time a user generated the `chart.sls`, the `Dex` secret yaml section
needs to be removed.

Closes: #2261
  • Loading branch information
Ebaneck committed Mar 4, 2020
1 parent e50441e commit 9a7937c
Showing 1 changed file with 6 additions and 72 deletions.
78 changes: 6 additions & 72 deletions salt/metalk8s/addons/dex/deployed/chart.sls
Original file line number Diff line number Diff line change
@@ -1,75 +1,10 @@
#!jinja | metalk8s_kubernetes

{%- from "metalk8s/repo/macro.sls" import build_image_name with context %}
{%- set dex = salt.metalk8s_service_configuration.get_service_conf('metalk8s-auth', 'metalk8s-dex-config') %}
{% raw %}
apiVersion: v1
kind: Secret
metadata:
labels:
app.kubernetes.io/instance: dex
app.kubernetes.io/managed-by: salt
app.kubernetes.io/name: dex
app.kubernetes.io/part-of: metalk8s
app.kubernetes.io/version: 2.19.0
helm.sh/chart: dex-2.4.0
heritage: metalk8s
name: dex
namespace: metalk8s-auth
stringData:
config.yaml: |-
issuer: {% endraw %}https://{{ grains.metalk8s.control_plane_ip }}:8443/oidc{% raw %}
storage:
config:
inCluster: true
type: kubernetes
logger:
level: debug
web:
https: 0.0.0.0:5556
tlsCert: /etc/dex/tls/https/server/tls.crt
tlsKey: /etc/dex/tls/https/server/tls.key
oauth2:
alwaysShowLoginScreen: true
responseTypes:
- code
- token
- id_token
skipApprovalScreen: true
staticClients:
- id: oidc-auth-client
name: oidc-auth-client
redirectURIs:
- urn:ietf:wg:oauth:2.0:oob
secret: lkfa9jaf3kfakqyeoikfjakf93k2l
trustedPeers:
- metalk8s-ui
- grafana-ui
- id: metalk8s-ui
name: MetalK8s UI
redirectURIs:
- '{% endraw %}https://{{ grains.metalk8s.control_plane_ip }}:8443/oauth2/callback{%
raw %}'
secret: ybrMJpVMQxsiZw26MhJzCjA2ut
- id: grafana-ui
name: Grafana UI
redirectURIs:
- '{% endraw %}https://{{ grains.metalk8s.control_plane_ip }}:8443/grafana/login/generic_oauth{%
raw %}'
secret: 4lqK98NcsWG5qBRHJUqYM1
enablePasswordDB: true
staticPasswords:
- email: [email protected]
hash: $2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W
userID: 08a8684b-db88-4b73-90a9-3cd1661f5466
username: admin
expiry:
idTokens: 24h
signingKeys: 6h
frontend:
issuer: MetalK8s
theme: scality
---
apiVersion: v1
kind: ServiceAccount
metadata:
Expand Down Expand Up @@ -147,8 +82,7 @@ metadata:
name: dex
namespace: metalk8s-auth
spec:
clusterIP: '{% endraw %}{{ salt.metalk8s_network.get_oidc_service_ip() }}{% raw
%}'
clusterIP: {% endraw -%}{{ salt.metalk8s_network.get_oidc_service_ip() }}{%- raw %}
ports:
- name: https
port: 32000
Expand All @@ -174,7 +108,7 @@ metadata:
name: dex
namespace: metalk8s-auth
spec:
replicas: 2
replicas: {% endraw -%}{{ dex.spec.deployment.replicas }}{%- raw %}
selector:
matchLabels:
app.kubernetes.io/component: dex
Expand All @@ -188,7 +122,7 @@ spec:
template:
metadata:
annotations:
checksum/config: 278f2b27e9441887e4070365aa3df2ccf668da0025ebf565605555c2b7b16042
checksum/config: de3d826b4063dcf4c5baf2dab1e00c82fc418afa4f52c8f4468b823736f0b3c9
labels:
app.kubernetes.io/component: dex
app.kubernetes.io/instance: dex
Expand All @@ -200,7 +134,7 @@ spec:
- serve
- /etc/dex/cfg/config.yaml
env: []
image: '{% endraw %}{{ build_image_name("dex", False) }}{% raw %}:v2.19.0'
image: {% endraw -%}{{ build_image_name("dex", False) }}{%- raw %}:v2.19.0
imagePullPolicy: IfNotPresent
name: main
ports:
Expand Down

0 comments on commit 9a7937c

Please sign in to comment.