ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/longhorn-ui/oauth2-proxy.yaml

@@ -0,0 +1,97 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: longhorn-vso
+  namespace: longhorn
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: longhorn
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oauth2-proxy
+        app.kubernetes.io/instance: longhorn
+        gateway.quorate.internal/allow-gateway-client: "true"
+        quorate.dev/zitadel-relay: "true"
+    spec:
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
+          imagePullPolicy: IfNotPresent
+          args:
+            - --http-address=0.0.0.0:4180
+            - --provider=oidc
+            - --oidc-issuer-url=https://auth.quorate.dev
+            - --redirect-url=https://longhorn.quorate.internal/oauth2/callback
+            - --upstream=http://longhorn-frontend.longhorn.svc.cluster.local:80
+            - --email-domain=*
+            - --scope=openid profile email groups
+            - --allowed-group=longhorn_admin
+            - --reverse-proxy=true
+            - --skip-provider-button=true
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --cookie-refresh=1h
+            - --cookie-expire=8h
+          envFrom:
+            - secretRef:
+                name: longhorn-oauth2-proxy
+          ports:
+            - name: http
+              containerPort: 4180
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          startupProbe:
+            httpGet:
+              path: /ping
+              port: http
+            failureThreshold: 12
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: longhorn-oauth2-proxy
+  namespace: longhorn
+  labels:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: oauth2-proxy
+    app.kubernetes.io/instance: longhorn
+  ports:
+    - name: http
+      port: 4180
+      targetPort: http
+      protocol: TCP