From 5d0eb01b86cb1fd01985dff255b2d5e67aeb3cbd Mon Sep 17 00:00:00 2001 From: CatalogBot Date: Wed, 13 Nov 2024 09:13:25 +0000 Subject: [PATCH] add dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/README.md dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json --- ...b9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz | Bin 0 -> 10390 bytes .../README.md | 295 ++++++++++ .../main.yaml | 12 + .../values.schema.json | 513 ++++++++++++++++++ index.yaml | 39 +- 5 files changed, 858 insertions(+), 1 deletion(-) create mode 100644 dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz create mode 100644 dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/README.md create mode 100644 dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml create mode 100644 dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json diff --git a/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz b/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz new file mode 100644 index 0000000000000000000000000000000000000000..f649c12d49871cf19317eff3c86e0c2436ef7492 GIT binary patch literal 10390 zcmV;HC~4OpiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBzbK5rZaR1h)z@zl0NuP>(@ms2yo2hH(?mW$le{tIT-E=x0 zh=eGdDS!n)+iL3Pvp)lXAVCrosTa#hDs-liNno*DU>A$UVmCndJs8LRvl(Q+V0 z2O}7K@B1g72>&-T497yXeitKhaSqNXA;=ft`MZnrvljpdhzKke0FnT_J59t4jJyGe8NI~;V&D#o z8Hl4K4B;d~`Ws|>%6Ml+i?c>i)u(fdtcH>u>`NR>U0$Mrq_wQUW&QrBFMnT0IGhQO z--ewVw78=z;NwmYz(mX>%6jZOJwS2bcjQDD5EH~yB{YXP8iSwEEhgSS==~2dA(0o- z+YSH(N~~|D^nN%T4)e-<1_|<{WbhSP-kNYTwPmI1oQL9E8bT|xJy2KweD?^)wRS?6}`x%<>Yen~Ow zf6C*Jq5w3k|A&Xiqtg0+Fc=>0*Z*CVXW$%7VG;?TX8@Q|Cb_Be41Abj4loB0{O9z| z>)w>IITQi~V2UH;b!1CFf($99)DsBA5Hk)01rzz3a})qf1O*G4Fd)!8j-WtXHcrKa zY}M)b5k^Ev1q9Dwh~y6d7z!~LY%vDECvf3ms-Eh0C8=CxR#{cRP%*1FP=Cfr6kXB? z`-?HSn7*ark|Bfzkc6R>?{Y5?gfLt&?uQBJ_f)3WVbjx-Ps#^B<27$Do@&V50Qo1}#cY z3{qFfXGmyN06;{p&4EF)BUeQAc?yryAW+|{VW9gMvxRQSaY!%;e?kjB2FEk?38boTD2f4@Kd*}#Q{ zFmmpU`~8UeFq%;=#xDmikNQ+HN8g80G=ct&YBPgz43~Vi3)2AI|Mc?e)Mm6IgyQ%( zs26Bq)6q6FcX@0fW^TY{Y(!$Q%ddXlR+!=X7XoRWs0z$a6#uNrB!K$7g~H+#Hb1< zW#_IF*P32C&%j$M5D+sc6eZ$h5@Fv=6iFYOid8zL3Vy=$<`BS0Zmkvo6F*7u=fh7#toRbP991 z2(rMCrB?;cFTRsZ!bP?iWG^LMvz4I(KtQFgJ_aGDKK9@r2}3@Ui$$k6M`K1~!~{;4 zSJ$M({7v@sOg}U;WL|lZDZ<@uLsxf{-9!`yc1QnCpOw1lJOi)P)KnuIpg5ung(ID& zPwv6ZOAZSB3Iq+2n3>I$Rva!P1UUl4ntxJ_h-0Zu1Sn?6hf|qp>)5h#iBppOYkJ^gdk;loT{`MK7o3FG4R>Jw>}Pq7xXY#x%G>e!{R= zTnR`5sJ3XDU#FD$Im14+#whd~%>N>0bR)d7VB9esZN@bu9 zQ?ZCu9WEFqVYP#YYP)W}ZK)?aBFTLD*PljraIy6B?Jd!=dT-G!Vk^>Sjn6jAc28)nsqrAW_5tYoQk#+w)r1FAM&}#Oq;$u*j7YO&;sw;dLCo{%e9f8k-jHC6WEC)M zP0_0u`FM&`RWh}%84@dMey6kwnh4<2h>{KIs!R_{=icq1H}pn57{!>NHL3amhHDeF z@T5fEEtcmSCD=c%?+QQV)HaTADSz%M6@hOegy{85y-zc$EI7Wlh%LIgwhB>(yf7a z|M?Q5V#%ui6v!A{xJh6e$kqa&_4sX*(X}V2r|Qza+V+`~B;9o^tp%1&vT}KFzNtQK zGw!LiaoZHP43*70K_hwsxchse^9q*>Q z%rL#1?kqF1)uv$K`Dcv7>Y)zdyS+Hsd3G_YNE*}Ur1OQuRq zy}?+%;HioviK68TQH_}(gMbB^w_Gt-T93gRYcg18vN}<08dAF~8D2MHttRyD(P}m6 zcZL>juUV~+%j2nF%hcGGisK{fhaIb#c0JkEN@5&Yb|YLZSDGz$xB;;(ccV{z>3*C| zlW{~@eb>~MuUp8MuI>Bsw3rA4>!-rz7(9aX+AA!}TI>~;9ip{YSXQmE1)Gt}B5ixL zZr27-b)9U6zf6|2;QsbpzY4dvogOPqi-xJ$#lb6byZdf=`-Sxp`hAj5wtS3NTw7YN zeC^jQ@Cdp>!}q7A#Y==*=mp@*`+n^byxNzyItOU#c&XXd+3hx_ySBlgN-g+imyY9rs_h3uEmK!wuaSb6X%(S8*A=-o1S*A`!1WV%Z{6t_ql>^;C4DqVKk#S9ZM1>L{#-rsl^cskX9il>wQ zPNRZ@KLJB=1bqa$|F;Xe*In=@5G)}+I6hE6@%$>8PVqhH_Hy`$1nPH3eapY}>@{(0 zYfw}t^{Q2X?j2Ch=zLCzig~BLl)J&`cb>0m8;ned#6lI0BISMC1s-^K=*&Ler3mIdQ@3aKr!HbtVr{hg>H>gD*pFtSq%fq$W#CL8N9W4SpFJ{x zcpiHs{s~nyUx|%s3ew{v5F@#?&?$gv9Q8C7wu*QNZXv@o;ULYwQ5}O6OizL7S_n$= zfd{?alYf70pI3qL-$6p~@8CI*{3d6J2VSJDv-ZU%4`vgYeSYx_Y%J9aB6SlYz;Onv z23r2wh2Eb)(Eq@Bv;?9dZ}sox19281NI()>L!qwq6shl^w5r?lW%HhD(bFx`nCr`l zU%fdbhakdS0D_~!hcHM&1iaGcx*+@=z&Ms)=X&{^&aoU-dyL*qyDw^prvEmR!3EGU zCWq}PK12Qu*Sxp@<_HX60$>nesjEtX^i#G90LV~EbrrW-hfsEkA4nEGqX0-^q97MQ zU(*{&W5uA^LrvVTZ@vRx-^#Z}3}jeY;)}?N1zS6?K>uBeMfu}7LEw3W2>ANeOHI@- zz~DuN80FvD_U*Q-;FRk;^$vDlHYpDK4?|jtZ_NPIVE-8oEBXJ94i5J5zjsokO zJ_Z~KmDxvbQ2subWbtQc43s!4$g^yIG#XOs+8`nIF&%ZvZQYAi z^Ojx4JYKn@n8)p)o88BX`{o8dT7Nu<-e!WjRP z(In<$@T)!%pbSyfOZPYM44htGfKXNdzB=7h=a*7P1;D^oO}|x647Z3)vOi0}VT`3< zBa%owrHE=&fTK;^=8;mYl+Az_;cH|Rh978}2}~I`=^e=dey2{Yq!JD$2U}n<>GOc6k?mC#jJQ?lEu5Q*wL_9?hp7Qcf1zrm()jjzoh{9+R+B?Z z?>Q0-`@AqASDud96eE@7N)Fjv{z+{ zJ@tK>5TQP~JwQ`iB_^w$^Xq(NyVyCq`9IJ8xQ&e9P5xhp!(mzfJ3Jcf`F|J1=6@K+ zJZJUuY!0lx8mDu7Lva9emm!l)HulP16>_(hLd|rujx0jUr6KpW^@uWD?%a z;r&&@LNo@0{K?M*-a;Hnm2M1%>bc(kzPCZh4pPSj4Q&pEKYMMFv!0-~rM^q+~Z{v=kmwr5Z1CBw`wz5`j-EFMvuK zi5Nq{dBQLWulyMb5;-ClA)(phSNF(ISvCaLSs;To-X)>7aaLMoyV7qPH}{6LZ%Fs5P|3DTxTFpUuOyM zGRpTr<`R^FK;*W>6w|U}hNo^QfReXBT|I9mL~K_!z5eUNhs*2B_wWAqKNkM#V7Xu! zS`N&z1+_+o*I{$D7CL+re9~(PE{xv3TNxb(v>Jp;k4&FG{ruyr_itZ)cy)Ds`R@Gs z?dh9WSC^+}ugW<5gV7S_Pce#uR86fsm-20#iC{0&1}&7De2Xk(RSv%~=vrhj7mz)D zV;DR<^sTp&QB@<=GkACyJN+Ra9=bL{%DZTJw>e;gz;=2r4vqqFndPo6jDOxip4`@M zE0-@wg0VHy{e-iAM12_bCz$kY=I`lruXbf5e7#MchUs#q)}~xW+13_QB0R^UB;frx zQBrJPcsfUO$`)gAGJS}_a&j3Rn>$?z?XP>5b}A4X~cH%ZSeEb2uz z06vW21V>n4R6;XgG%mA251hV!Z9S`(;BFZ%pIb{ivq@u^R|+E=K_l-kDHCIGbaZrF z&;h8RK8?oU!`Wp8RBl|VhxW1-TJ|Esw}>FlFBzQ_K2oCkPb7-p9V;o(?avU5#O#ma zCBRs9Tlz$04TRA-is0f3`IH3QXqss&#IVY2nZ6p>OC_Eonh0mRDa292(1#gAd`6?d ze#;OH@E7-0w^m|Pduq+)6D_}OSztlcGe*k>%TG)BUl}n~$({NF4D?Zs@nEa1S=PHN ztCz;yQfjmcZI42rndl7-&=?$!YVFk643pGh-(z=Y@6-Te(u^vY{tJ4@mTjhPkyy zNCRsm{>tRna9dHdOq*CQKx`u~CMt%t9J!3nu!kluEb$N8&B1eyTK{{~wk0zr&N^ z{``L@MXOeCZD;dlWo{J>%;Cnq4Sme4-?7~DKgLO!cAb*)K0Wm}>Zknu%KS_hL*rGI znV@>96~i(xRgFtlrI$68kOltZW5^RX|Hr{(ivpmD{|^sO%KN{;!O5QgcTw7@E1DUk zj&ezZbIe&1%Z<>FNf07Y*#Ks>(~X;>&6=Ay!}W7aPV-~*qru-cIWTw0n7@p5sD}Uf zHWh#d{vVEp<@+B;gX6wWZghkZoxsRbE2};*x)P8CkOkaBWJ;M|z0;AgytdtB zd~YD6n#JyX1xx&p-H%O@>S$ueLc~*RId2wzY{1s&Er(E3fe_J>IbXhL{hX)5`|L@_^(eZx& zx0AB$V&0Q@cI(KZ=jIAtex^7EfA&=OcW7c{qO#+Gfv5f(Tbr#K^N}kKhr@uRWE~3L zF&tu2&>tJ)a+Iy6kOV67Mkzwai`sA;WdL$SE;#7&2>YmO)h^ad5yJw_C0?#-$^xuw zEI0NR4Su>=O}Evyt2_`$E=qzeYR6OWi@Bf-hMD=Zd|@mw$q4bO5@iD($2 z%mp(-wCdV`4kfrD%P`?qZ3+`$FE zn$f%0G{oe}X9$&iX!s3|Pve-;TNs)58G8E0>?P#hRFS$)m7$iY|*q0SOej9FhvSd!YOn2>%k7@v{a|nd)W1P<H^(+LpWAW06pTV$&m@J&Bdx7aTg&N8 zX7m6Ksut>|{z?ZeD+16c z_k9>e6X@T#cK)SEWNlDz#TP5hzK@Q$dL?K&14f1Ltwyb;EdV;Ge8CZKEo!G7IEkH( zsjjjiNz;C|Ls64SZ9SUSwsulAB?9*&Ea%vUWXSs73L#X2k+q26Zn?E-rNOu5;FH{) zKXu-e%{Qa8#$a_SFF6X-bajXLsV9|d6tnQGR-_D@IT%w8c0GI)4!NyB9a z{HXWfSnZR6czu!1EQmDn*k_eKK{x#TVeY`nNs% zt|aYVfEUYIVGTuaJ=VylPb9VGTGi3HtZ!%DHgvq7lkMl^$}`R2-yFEKq>EQVf2L5g zfiJ4!>&}y2y5S75m?e{JlQ6d2&I%LYpIH1WnW!l2cI0L*;B;EERW)5!XU0nN*#Nq# znP!c^%JWNZC1G$H8KZIOHpph4Zk8x$w{RNAQjY{G*oZvHfF|4l(V-V7O_QVqgvvM{3|rdy(L}KUgB2%c-NI; z2MroXl4(}039_Wcmq?Bjy5kF%x2t}37Tdr4)yo03AVsS$SWcg(Hm`s3rSAMk+sNmX zV5t&pb`aEb{$Gv%c5*n}pa1WqwDbQ-=K&_66=tn}JFK|=)K%;hV&=TjwbqRCwOMp8 z;|YLB5K~Mnhdu4`UA*O~9rTLN^k46h>Isw3+Q$gULL`*i(b%M=xW++QVQT5JZ%oKi zzmoKOm$#gk+r7wg^1Uc3Ln@!v+$15YZC~!Us#UcFWG;0tQ>1L)>$R0fH$Hiuj5-vS z`iZUKD*Ab^HcRFIZtnjLj!r86Unl$cpSvkF=l^Q>pXR2W5ztyAO{L1krQ%#J5zV6a zfVY&Oj&=3Fa_L{o;K+%B1DamGG3JcMbkuIU_(5|DPO>O8kFtba=4m z|6P>b@c*j00v=NgJbvZ?N3UB+AmD%tTILa`6)~;(U!AtjVVvc1-xmK5N5|#(Z=-|5 zqrLriCuOz$Un>vRw*DA8tt9wb=S{Y5Q>A@UP|IPJgj=xW4xGBYM#jd6+PX1yq~715$#o3H>^e^G3U&MXrb>V& zNjNt7;5957((8obF~~>5(^rTtN=_wmGjD1%!~sja2(KBX;@XGTDx@#yOIgEt)YrRY zm;XwtX%v0;vQC$|WosX{>n0ae$FZsb-|kp7n<=%;^11=yKEtuTDc#MHHw%iLPyF=q zLU|2h!Uc@<^=j}Yw53cW6g0BG@?x!Y=oY=klP z^c|7B+09FSJ%`HWp)5`6K)COe7UtF(P%+V_#r(s@En3Btl{~8p11RzE;dPAWWAODy zD<{C&>DjCIA0A5n?HbuS!f$$sV>JhgY=x=1>sL6};XhGijv5ZF0nw7p>?UP#(^9H` z5)77lFPon0LU(R~xlE6;Ze5RS&iYTD{qh*!rTKGq3jPGud_-=Z%&vSmY3JZKx5?ZQ z(|C)Driy54dDw1a)BGfQrBT@H^~#pq|i~m~D8Y(Qefm+!FVm-C8395TtYy6zYRV%l8 zH+Vz8++LMoH&7>CAX;+Qqo|X+=c|^1;J3h2C2i8#HGljpi>#+Z$?$rd*k3o4}R z*A9;Z+uHy0jKHfO05sVDj}8wj_W$F3{_owCzmWZZ3+auY;1mF)d5?=eZ%aZA^omA` zYFnSqV@lM;nI-_$+{eQw-!@Dvj5ZuZF=e{?bN@#mOt*Jk)M8R%Qb zO|o`pL7~{jFy;_=GPzum@zKtX zDOF2Xt<}$yK_&C1!{nz+iZ<-|sPH_;yV%0PGpl9rJ*vsRdwke7fp04aUt0d&Oh3BA zVwTMVLIY${x>%+_>*?6e@|o|^jzN7uj6x4Ey+CNG9Og=)8}hQq8wJRMMu_PgfjMyN z;fk0$^0+!#G83)i3Kwjs$$~X`wX{^HMteEu&Q9}My&6{CELm-quGU)T3J6rLsOu8D zWJ4wYoEu_ZX_@(BTWNU9D7M9Y#hK74PNm`~Iim=+KO@`vX6!Le%9gdwHl58Eeb?MY zZPxSgBkqR0x?Rv_D8KxI_A<-2Ff9XsSQ`k_!o7vbEtl@CgY*50TNo#d(iUcWcrs^cKd#yjg)xvn*DXw0{{w5XXlaFhvYm?) zfsJ-9ZirvZ&c)ko$MVGIuuoOmp8p!YStk@w!~M_W(Q*0wcX%+`$A8>OS^fN%GVS7+ zvE&T$ULH=kmmR`d9zrkLpBitNH@`7=b)7-NRaqyqwB&%cR+voCo0uxLW}$$DP+^v4 zwUQzxdfJPSsdGfVuk0D`qPhqpsn3+ERdUZQ*Eg|S&fi{@YOdimW`Okq!aW$pGgvwZ zol!0{d6zrcbU?|4t;H^Th0Zs3wsYx6#k^cLI^)z8G$=PS){%5H&LYTpWsx^SRjvd~ z+!%cmS$>(abtR@bP6>uDmr2z6Yl)CPJ@;VaT;7FiyhPOeQU z6}>u^EyT1<`gHrPGhcLUZS8~F2k9hq*^3GEZ_*5OTax6qE~uRRikkAudjn^j{?wM> zG~}fA1(#VY!)fJd;lv^ZR)|wsZ%*Hh4_0qGPFSVsw9Z7b+(JH?8MXAlY}XU35t-HI zS9#~R!O(p|Bj&OXJc$Hw;Ltce)nA*e*DBds^NQVey)J^?%9364@qdB+_^wOa{XdD< zj{@8n|EUuHWiUG4$A8*MS!MsPcfV zabZp-gZw~pnmUuH4&;t}4BjMMyidrfP9&iAN!HQV924#QqstuLkHPWL(ZNy2c3N?P zOOHD{1t*rR^vls}Op<#Wm;!W47V>Qp$B|O^V3bGAbW|)H^Yy?t*@50Soi=B?Qh7{Q zmg2*U%d_Hx%ZqdKz`cigYL@z}N?ZAFGJ>rh{jX8}j|PW>^8LTz!CwE{N%;%i|JxwF z%@f@Ft51VtrMoGqhVFDX6-Tdvaii#l`eZi^R|%`L>G(Z{tMJnd*A|?U|FWJB`|{Q5 z>;GCAp_=SJ2NnCzNdB{5|94PUS^u}0E9wy=eD9^#3dQihH$%}JhlDb;^*);TzncGd zbaJ%M|F)Cz3|vAX5F;E23iJd3cQZu5B*9UDNeE)--@p)Yuk#Fim|?DL0#c~~e1@V3 zgb|%+<0&TLcYqNzi!)2nuziwdXp5APThm@&9?@fp;WY07_I#i4uqr z0}&?3>v-o^*H?lv)OiNZl&k>1oLzwcGv4t+Ec)vI8vTwp`GfV<|ILG0*q8q^fAU+> z&jC%Kf0M*uiX+53-+KHm?tJS_;7#XSPt4=axBsv64EzEarU?fZ=dXCjiy8ed@dXV=BB?@Nu zbL5yWs~G;**A*q>dr}^5wU0*o-*L(QH#|5zJlgaBE=obCA9ZqT4~*l^t$EWOdWR!# zc+l;@IL_*KyPZM^#&dW8P z5e{d<E}@Th8l(JV2&mMy2nAR`l+ijm+Ncf-ePy=5Zf1u z%@w1YDZL*Khx+tJ$=NaZ3Eg7i{e#~B5EBx4A-%O4a5S?Xbww%{{JkZ0cf5Xz?# zC954nB$&bIw%9O60(lcg@5m1^y+drq!cx0id}24a#V0UYKxY@HkWm8O(?u|&NqVO* zZ3gA5ADDSnYWNoWH{eGYghk}YL_PXJ(^a)8`NP9l-MLpOor*I + clientSecret: + tenant: + redirectURI: https://dex../callback +``` + +Some notes: + +- `.service.kubernetes.api.caPem` is the CA certificate of your workload cluster in PEM format. At Giant Swarm, you can retrieve this certificate via the [kubectl gs login](https://docs.giantswarm.io/ui-api/kubectl-gs/login/) command, when creating a client certificate for the workload cluster. It ends up in Base46-encoded form in your kubectl config file. The CA certificate is required by Dex K8s Authenticator. + +- The `redirectURI` in your connector configuration must contain the proper host name for Dex's own ingress. In the default form, it contains the workload cluster name (replace `` with the actual name) and a base domain (replace `` with the proper base domain). + +- If you configure more than one connector, make sure to set a unique `id` for each one. Be aware that this version of Dex is configured to prefix all user group names with the connector ID. So if your connector's `id` is `customer`, a membership in group `devops` will appear as `customer:devops`. + +### Other connector types + +Example connector configuration for Keycloak: + +```yaml + - id: customer + connectorName: test + connectorType: oidc + connectorConfig: |- + clientID: + clientSecret: + insecureEnableGroups: true + scopes: + - email + - groups + - profile + issuer: https:///auth/realms/master + redirectURI: https://dex../callback +``` + +Example connector configuration for GitHub: + +```yaml + - id: customer + connectorName: test + connectorType: github + connectorConfig: |- + clientID: + clientSecret: + loadAllGroups: false + teamNameField: slug + orgs: + - name: + teams: + - + redirectURI: https://dex../callback +``` + +Note: + +- `` is your GitHub organization name. For example, the part `myorg` in `https://github.com/myorg`. +- `` is the part of the team's URL representing the team name. For example, the part `my-team` in `https://github.com/orgs/myorg/teams/my-team`. + +### Installing the Chart in Giant Swarm workload clusters + +The app is installed in workload clusters, via our [app platform](https://docs.giantswarm.io/app-platform/). +Before doing so, please create the following `ConfigMap` resource in the namespace named after that workload cluster to provide the contents of your `values.yaml` file. + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: dex-app-user-values + namespace: +data: + values: | + +``` + +Then you either install the app via our web UI, or you'll create an App resource in the following format: + +```yaml +apiVersion: application.giantswarm.io/v1alpha1 +kind: App +metadata: + labels: + app.kubernetes.io/name: dex-app + name: dex-app + namespace: +spec: + catalog: giantswarm-playground + name: dex-app + namespace: dex + userConfig: + configMap: + name: + namespace: +``` + +Notes: + +- `` must be replaced with the name of the ConfigMap resource shown above. +- `` is replaced with the name of your workload cluster. + +As a result, you should see Dex deployed in your workload cluster. + +### Ingress, TLS and custom certification authorities + +Dex app exposes a web interface, which is accessible over https. Therefore, it creates an ingress, which needs to be configured with a TLS certificate signed by a certification authority, which needs to be trusted by the browsers. +The app consists of several components, which also need to be able to communicate with each other internally over https. So the certification authority signing the certificates needs to be trusted by the individual app components as well. + +In case a custom certification authority is used, it needs to be exposed to the individual app components and set as trusted, otherwise the components will not be able to communicate with each other and the app may not work as expected. +Based on the cluster setup, this can be achieved by providing an additional set of values to the app configuration: + +1. Add a base64-encoded certificate of the certification authority to the User Values configmap or secret. This option is useful when using custom, self-signed certificates in a cluster: + +```yaml +ingress: + tls: + letsencrypt: false + caPemB64: "base64-encoded CA certificate" +``` + +2. Provide a reference to an existing Secret resource, which contains the custom certification authority. This option is useful for cluster setup, where TLS certificates signed by a custom certification authority are provided by an external service: + +```yaml +ingress: + tls: + letsencrypt: false + +trustedRootCA: + name: "name-of-the property-in-the-secret" + secretName: "name-of-the-custom-ca-secret" +``` + +3. When disabling `letsencrypt`, a secret called `dex-tls` will be created and propagated with the b64-encoded values provided by the user. +Alternatively, the user can manage the creation of this secret by themselves and enable its usage like so: + +```yaml +ingress: + tls: + letsencrypt: false + externalSecret: + enabled: true +``` + +The following secret then needs to be applied to the namespace `dex` is running in: + +```yaml +apiVersion: v1 +kind: Secret +type: kubernetes.io/tls +metadata: + name: dex-tls +data: + ca.crt: ... + tls.crt: ... + tls.key: ... +``` + +### Proxy configuration + +In case the traffic to Dex needs to go through a proxy (for example when the app is installed in a private cluster), the individual components of the app need to be set up to use the proxy. + +The proxy setup can be provided to the app in a specific section of the user values configmap or secret with the app configuration: + +```yaml +cluster: + proxy: + http: "https://proxy.host:4040" # hostname of the proxy for HTTP traffic + https: "https://proxy.host:4040" # hostname of the proxy for HTTPS traffic + noProxy: "kubernetes-api-ip-range" # comma-separated list of hostnames and IP ranges, whose traffic should not go through the proxy. # Kubernetes API IP range needs to be defined here in order for Dex to work correctly +``` + +### Static clients + +In addition to a few pre-defined static clients Dex app supports the possibility to define custom static clients as well. +They need to be defined as an array of object in a specific property of the configuration yaml file called `extraStaticClients`. +The structure of each custom static client object is exactly the same as in upstream Dex: + +```yaml +extraStaticClients: +- id: "client-id" + secret: "client-secret" + trustedPeers: + - "https://example.com" + public: true + name: "client-name-1" + logoURL: "https://example.com/logo" +- idEnv: "CLIENT_ID" + secretEnv: "CLIENT_SECRET" + redirectURIs: + - "https://example.com/redirect" + name: "client-name-2" +``` + +**Notes:** + +- `id` and `idEnv` properties are mutually exclusive +- `secret` and `secretEnv` properties are mutually exclusive +- Required properties: + - `name` + - `id` or `idEnv` + - `secret` or `secretEnv` + +Extra static clients can also be configured as trusted peers of the pre-defined static clients: + +**Add the extra static client id to the list of `trustedPeers` in the pre-defined static client:** + +```yaml +staticClients: + dexK8SAuthenticator: + clientAddress: "dex.installation.basedomain.io" + clientSecret: "default-client-dex-authenticator-secret" + trustedPeers: + - "client-id" +extraStaticClients: +- id: "client-id" + name: "client-name-1" + secret: "client-secret" +``` + +It will produce the same configuration: + +```yaml +staticClients: +- id: dex-k8s-authenticator + name: dex-k8s-authenticator + secret: default-client-dex-authenticator-secret + trustedPeers: + - client-id +- id: client-id + name: client-name-1 + secret: client-secret + public: true +``` +Duplicities are prevented in case an ID of any additional trusted peer equals an automatically pre-populated trusted peer ID. + +## Update Process + +Giant Swarm is currently building the `dex` app from [a fork](https://github.com/giantswarm/dex) of the [original project](https://github.com/dexidp/dex). +We implement additional logic which adds the connector id as prefix to user groups. +In order to update the image used in this chart it is currently needed to to do the following steps in our fork repo: + +- Fetch upstream changes. +- Ensure that our commits with prefixing logic on token creation _and_ refresh are present on the branch we want to release from. +- Ensure CircleCI builds are green +- Create the version tag with -gs suffix to push the image to our registry + +Then in this repo: + +- Update the image version tag +- Test the new version before releasing. Make sure to test token refresh as well. + +## Release Process + +- Ensure CHANGELOG.md is up to date. +- In case of changes to `values.yaml`, ensure that `values.schema.json` is updated to reflect all values and their types correctly. +- Create a branch `master#release#v`, wait for the according release PR to be created, approve it, merge it. +- This will push a new git tag and trigger a new tarball to be pushed to the +[control-plane-catalog](https://github.com/giantswarm/control-plane-catalog). diff --git a/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml b/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml new file mode 100644 index 0000000000..ea9f823a87 --- /dev/null +++ b/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml @@ -0,0 +1,12 @@ +annotations: + application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml + application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/README.md + application.giantswarm.io/team: shield + application.giantswarm.io/values-schema: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json + config.giantswarm.io/version: 1.x.x +chartApiVersion: v2 +chartFile: dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz +dateCreated: '2024-11-13T09:13:18.928525Z' +digest: 23bca5a2d4dbda11b0dcdbfc13bc5f7bb2dc6e8dbd5604ca85613ef50a88b390 +home: https://github.com/giantswarm/dex-app +icon: https://s.giantswarm.io/app-icons/dex/2/icon_light.svg diff --git a/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json b/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json new file mode 100644 index 0000000000..746c6bfb1c --- /dev/null +++ b/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json @@ -0,0 +1,513 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$defs": { + "image": { + "properties": { + "name": { + "description": "Image name, optionally prefixed by a namespace and a separator, excluding tag.", + "examples": [ + "redis", + "giantswarm/happa" + ], + "title": "Name", + "type": "string" + }, + "pullPolicy": { + "enum": [ + "Always", + "IfNotPresent", + "Never" + ], + "type": "string" + }, + "registry": { + "description": "Name of the server to access the image from.", + "examples": [ + "quay.io", + "hub.docker.com" + ], + "title": "Registry", + "type": "string" + }, + "tag": { + "description": "Specifies the version of the image, without colon.", + "examples": [ + "latest", + "v4.1.2-alpine" + ], + "title": "Tag", + "type": "string" + } + }, + "required": [ + "name" + ], + "title": "Schema for container images", + "type": "object" + } + }, + "type": "object", + "properties": { + "client": { + "type": "object", + "properties": { + "image": { + "$ref": "#/$defs/image" + } + } + }, + "deployDexK8SAuthenticator": { + "type": "boolean" + }, + "dex": { + "type": "object", + "properties": { + "image": { + "$ref": "#/$defs/image" + } + } + }, + "extraVolumeMounts": { + "type": "array" + }, + "extraVolumes": { + "type": "array" + }, + "global": { + "type": "object", + "properties": { + "podSecurityStandards": { + "type": "object", + "properties": { + "enforced": { + "type": "boolean" + } + } + } + } + }, + "ingress": { + "type": "object", + "properties": { + "externalDNS": { + "type": "boolean" + }, + "ingressClassName": { + "type": "string" + }, + "tls": { + "type": "object", + "properties": { + "caPemB64": { + "type": "string" + }, + "clusterIssuer": { + "type": "string" + }, + "crtPemB64": { + "type": "string" + }, + "keyPemB64": { + "type": "string" + }, + "letsencrypt": { + "type": "boolean" + }, + "externalSecret": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + } + } + } + } + }, + "isManagementCluster": { + "type": "boolean" + }, + "isWorkloadCluster": { + "type": "boolean" + }, + "logoURI": { + "type": "string" + }, + "managementCluster": { + "type": [ + "object", + "string" + ], + "properties": { + "name": { + "type": "string" + } + } + }, + "trustedRootCA": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "secretName": { + "type": "string" + } + }, + "required": [ + "name", + "secretName" + ] + }, + "oidc": { + "type": "object", + "properties": { + "customer": { + "type": "object", + "properties": { + "connectorConfig": { + "type": "string" + }, + "connectorName": { + "type": "string" + }, + "connectorType": { + "type": "string" + }, + "connectors": { + "type": [ + "array", + "null" + ], + "items": { + "type": "object", + "properties": { + "connectorConfig": { + "type": "string" + }, + "connectorName": { + "type": "string" + }, + "connectorType": { + "type": "string" + }, + "id": { + "type": "string" + } + } + } + }, + "enabled": { + "type": "boolean" + } + } + }, + "expiry": { + "type": "object", + "properties": { + "idTokens": { + "type": "string" + }, + "signingKeys": { + "type": "string" + } + } + }, + "giantswarm": { + "type": "object", + "properties": { + "connectorConfig": { + "type": "object", + "properties": { + "clientID": { + "type": "string" + }, + "clientSecret": { + "type": "string" + }, + "team": { + "type": "string" + } + } + }, + "connectors": { + "type": [ + "array", + "null" + ], + "items": { + "type": "object", + "properties": { + "connectorConfig": { + "type": "string" + }, + "connectorName": { + "type": "string" + }, + "connectorType": { + "type": "string" + }, + "id": { + "type": "string" + } + } + } + } + } + }, + "issuerAddress": { + "type": "string" + }, + "extraStaticClients": { + "type": "array", + "items": { + "type": "object", + "properties": { + "id": { + "type": "string" + }, + "idEnv": { + "type": "string" + }, + "secret": { + "type": "string" + }, + "secretEnv": { + "type": "string" + }, + "redirectURIs": { + "type": "array", + "items": { + "type": "string" + } + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + }, + "public": { + "type": "boolean" + }, + "name": { + "type": "string" + }, + "logoURL": { + "type": "string" + } + }, + "allOf": [{ + "oneOf": [{ + "required": [ + "id" + ] + }, { + "required": [ + "idEnv" + ] + }] + }, { + "oneOf": [{ + "required": [ + "secret" + ] + }, { + "required": [ + "secretEnv" + ] + }] + }, { + "required": [ + "name" + ] + }] + } + }, + "staticClients": { + "type": "object", + "properties": { + "dexK8SAuthenticator": { + "type": "object", + "properties": { + "clientAddress": { + "type": "string" + }, + "clientSecret": { + "type": "string" + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "gitopsui": { + "type": "object", + "properties": { + "cliendID": { + "type": "string" + }, + "clientSecret": { + "type": "string" + }, + "redirectURI": { + "type": "string" + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "grafana": { + "type": "object", + "properties": { + "cliendID": { + "type": "string" + }, + "redirectURI": { + "type": "string" + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "gsCLIAuth": { + "type": "object", + "properties": { + "address": { + "type": "string" + }, + "clientID": { + "type": "string" + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + } + } + }, + "happa": { + "type": "object", + "properties": { + "clientID": { + "type": "string" + }, + "redirectURI": { + "type": "string" + }, + "trustedPeers": { + "type": "array", + "items": { + "type": "string" + } + } + } + } + } + } + } + }, + "registry": { + "type": "object", + "properties": { + "domain": { + "type": "string" + } + } + }, + "services": { + "type": "object", + "properties": { + "backstage": { + "type": "object", + "properties": { + "address": { + "type": "array" + } + } + }, + "gitopsui": { + "type": "object", + "properties": { + "address": { + "type": "string" + } + } + }, + "grafana": { + "type": "object", + "properties": { + "address": { + "type": "string" + } + } + }, + "happa": { + "type": "object", + "properties": { + "address": { + "type": "string" + } + } + }, + "kubernetes": { + "type": "object", + "properties": { + "api": { + "type": "object", + "properties": { + "address": { + "type": "string" + }, + "caPem": { + "type": "string" + }, + "internalAddress": { + "type": "string" + }, + "port": { + "type": "integer" + }, + "public": { + "type": "boolean" + } + } + } + } + } + } + }, + "cluster": { + "type": "object", + "properties": { + "proxy": { + "type": "object", + "properties": { + "http": { + "type": ["null", "string"] + }, + "https": { + "type": ["null", "string"] + }, + "noProxy": { + "type": ["null", "string"] + } + } + } + } + } + } +} diff --git a/index.yaml b/index.yaml index 5a43725903..19a8b88743 100644 --- a/index.yaml +++ b/index.yaml @@ -5024,6 +5024,43 @@ entries: urls: - https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9f0f1e85be2d70e05d9613ebdc2cff3bc5e280fb.tgz version: 1.42.12-9f0f1e85be2d70e05d9613ebdc2cff3bc5e280fb + - annotations: + application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/main.yaml + application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/README.md + application.giantswarm.io/team: shield + application.giantswarm.io/values-schema: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz-meta/values.schema.json + config.giantswarm.io/version: 1.x.x + apiVersion: v2 + appVersion: 1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7 + created: "2024-11-13T09:13:24.928232153Z" + description: OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable + connectors + digest: 23bca5a2d4dbda11b0dcdbfc13bc5f7bb2dc6e8dbd5604ca85613ef50a88b390 + home: https://github.com/giantswarm/dex-app + icon: https://s.giantswarm.io/app-icons/dex/2/icon_light.svg + keywords: + - authentication + - oidc + maintainers: + - email: Kevin.Fox@pnnl.gov + name: kfox1111 + - email: shane.starcher@gmail.com + name: sstarcher + - email: pete.brown@powerhrg.com + name: rendhalver + - email: vi7alya@gmail.com + name: vi7 + - email: aaron@roydhouse.com + name: Aaron Roydhouse + - email: nbadger@mintel.com + name: Nick Badger + name: dex-app + sources: + - https://github.com/dexidp/dex/ + - https://github.com/mintel/dex-k8s-authenticator + urls: + - https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7.tgz + version: 1.42.12-9db9bdfcb6914733daaaa3cd9dcdcb3902ad9cc7 - annotations: application.giantswarm.io/metadata: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9ab1863a0b1fac2dc5ff34930c89dc1544137389.tgz-meta/main.yaml application.giantswarm.io/readme: https://giantswarm.github.io/giantswarm-test-catalog/dex-app-1.42.12-9ab1863a0b1fac2dc5ff34930c89dc1544137389.tgz-meta/README.md @@ -29299,4 +29336,4 @@ entries: urls: - https://giantswarm.github.io/giantswarm-test-catalog/zot-0.0.0-0b141fee021e1ccb5c4b25af6b43fe4fc866a0f1.tgz version: 0.0.0-0b141fee021e1ccb5c4b25af6b43fe4fc866a0f1 -generated: "2024-11-12T23:48:36.702802971Z" +generated: "2024-11-13T09:13:24.926489675Z"