ms2k/remora
SHA256
Watch
0
Code Releases Activity

Move browser authentication behind a generated-contract BFF

Browse source
This commit is contained in:
ms2k 2026-07-19 18:21:17 +09:00
commit fa7220ee33
5 changed files with 7259 additions and 2825 deletions
Download patch file Download diff file Expand all files Collapse all files

3
deploy/charts/remora/templates/_helpers.tpl
View file

@ -6,6 +6,9 @@
{{- if ge (int .Values.runtime.workerRenewSeconds) (int .Values.coordination.leaseTtlSeconds) -}}
{{- fail "runtime.workerRenewSeconds must be less than coordination.leaseTtlSeconds" -}}
{{- end -}}
{{- if eq .Values.web.sessionUrlSecret.name .Values.coordination.urlSecret.name -}}
{{- fail "web.sessionUrlSecret must not share the coordination Secret" -}}
{{- end -}}
{{- range $entry := splitList "," .Values.outbound.allowedSchemePorts -}}
{{- $parts := splitList ":" $entry -}}
{{- $port := int (index $parts 1) -}}

18
deploy/charts/remora/templates/networkpolicy.yaml
View file

@ -200,4 +200,22 @@ spec:
- {port: 53, protocol: UDP}
- {port: 53, protocol: TCP}
{{- end }}
- to:
- podSelector:
matchLabels:
{{- include "remora.selectorLabels" . | nindent 14 }}
app.kubernetes.io/component: api
ports:
- {port: 8080, protocol: TCP}
{{- range .Values.networkPolicy.webDependencyPodLabels }}
- to:
- podSelector:
matchLabels:
{{- toYaml . | nindent 14 }}
{{- end }}
{{- range .Values.networkPolicy.webExternalEgressCidrs }}
- to:
- ipBlock:
cidr: {{ . | quote }}
{{- end }}
{{- end }}

27
deploy/charts/remora/templates/web.yaml
View file

@ -55,22 +55,39 @@ spec:
imagePullPolicy: {{ .Values.web.image.pullPolicy }}
env:
- {name: REMORA_WEB_PUBLIC_ORIGIN, value: {{ required "web.publicOrigin is required" .Values.web.publicOrigin | quote }}}
- {name: REMORA_WEB_API_URL, value: {{ .Values.web.apiUrl | quote }}}
- {name: REMORA_WEB_EVENTS_URL, value: {{ .Values.web.eventsUrl | quote }}}
- {name: REMORA_WEB_API_UPSTREAM, value: {{ printf "http://%s.%s.svc.cluster.local/v1/" (include "remora.fullname" .) .Release.Namespace | quote }}}
- {name: REMORA_WEB_EVENTS_UPSTREAM, value: {{ printf "ws://%s.%s.svc.cluster.local/v1/events" (include "remora.fullname" .) .Release.Namespace | quote }}}
- {name: REMORA_WEB_OIDC_AUTHORITY, value: {{ required "oidc.issuer is required" .Values.oidc.issuer | quote }}}
- {name: REMORA_WEB_OIDC_CLIENT_ID, value: {{ .Values.web.oidcClientId | quote }}}
- {name: REMORA_WEB_OIDC_REDIRECT_URI, value: {{ .Values.web.publicOrigin | quote }}}
- {name: REMORA_WEB_OIDC_POST_LOGOUT_REDIRECT_URI, value: {{ .Values.web.publicOrigin | quote }}}
- name: REMORA_WEB_OIDC_CLIENT_SECRET
valueFrom:
secretKeyRef:
name: {{ .Values.web.oidcClientSecretSecret.name }}
key: {{ .Values.web.oidcClientSecretSecret.key }}
- {name: REMORA_WEB_OIDC_SCOPE, value: {{ .Values.web.oidcScope | quote }}}
- {name: REMORA_WEB_CSP_CONNECT_SRC, value: {{ .Values.web.cspConnectSrc | quote }}}
- name: REMORA_WEB_SESSION_URL
valueFrom:
secretKeyRef:
name: {{ .Values.web.sessionUrlSecret.name }}
key: {{ .Values.web.sessionUrlSecret.key }}
- {name: REMORA_WEB_SESSION_NAMESPACE, value: {{ printf "%sweb-session:" .Values.coordination.namespace | quote }}}
- {name: REMORA_WEB_SESSION_TTL_SECONDS, value: {{ .Values.web.sessionTtlSeconds | quote }}}
ports:
- {name: http, containerPort: 8080}
readinessProbe:
httpGet: {path: /health/ready, port: http}
periodSeconds: 5
timeoutSeconds: 2
failureThreshold: 6
livenessProbe:
httpGet: {path: /health/live, port: http}
periodSeconds: 10
timeoutSeconds: 2
failureThreshold: 3
startupProbe:
httpGet: {path: /health/live, port: http}
periodSeconds: 2
failureThreshold: 30
resources:
{{- toYaml .Values.web.resources | nindent 12 }}
securityContext:

20
deploy/charts/remora/values.schema.json
View file

@ -218,6 +218,8 @@
"dnsPodLabels",
"dependencyPodLabels",
"externalEgressCidrs",
"webDependencyPodLabels",
"webExternalEgressCidrs",
"allowPublicSourceEgress"
],
"properties": {
@ -233,6 +235,12 @@
"uniqueItems": true,
"items": {"$ref": "#/$defs/cidr"}
},
"webDependencyPodLabels": {"$ref": "#/$defs/labelMapList"},
"webExternalEgressCidrs": {
"type": "array",
"uniqueItems": true,
"items": {"$ref": "#/$defs/cidr"}
},
"allowPublicSourceEgress": {"type": "boolean"}
}
},
@ -392,22 +400,22 @@
"replicas",
"image",
"publicOrigin",
"apiUrl",
"eventsUrl",
"oidcClientId",
"oidcClientSecretSecret",
"oidcScope",
"cspConnectSrc",
"sessionUrlSecret",
"sessionTtlSeconds",
"resources"
],
"properties": {
"replicas": {"$ref": "#/$defs/positiveInteger"},
"image": {"$ref": "#/$defs/image"},
"publicOrigin": {"$ref": "#/$defs/httpUrl"},
"apiUrl": {"type": "string", "pattern": "^(https?://|/).+"},
"eventsUrl": {"type": "string", "pattern": "^(|https?://.+|wss?://.+|/.+)$"},
"oidcClientId": {"$ref": "#/$defs/nonEmpty"},
"oidcClientSecretSecret": {"$ref": "#/$defs/secretRef"},
"oidcScope": {"$ref": "#/$defs/nonEmpty"},
"cspConnectSrc": {"$ref": "#/$defs/nonEmpty"},
"sessionUrlSecret": {"$ref": "#/$defs/secretRef"},
"sessionTtlSeconds": {"$ref": "#/$defs/positiveInteger"},
"resources": {"$ref": "#/$defs/resources"}
}
},

14
deploy/charts/remora/values.yaml
View file

@ -43,11 +43,15 @@ web:
digest: ""
pullPolicy: IfNotPresent
publicOrigin: https://remora.example.com
apiUrl: /v1/
eventsUrl: ""
oidcClientId: remora-web
oidcClientSecretSecret:
name: remora-web-oidc
key: client-secret
oidcScope: openid profile
cspConnectSrc: "'self' https://identity.example.com"
sessionUrlSecret:
name: remora-web-session
key: url
sessionTtlSeconds: 28800
resources:
requests:
cpu: 25m
@ -143,6 +147,10 @@ networkPolicy:
- fixture.remora.dev/component: zitadel
- fixture.remora.dev/component: versitygw
externalEgressCidrs: []
webDependencyPodLabels:
- fixture.remora.dev/component: dragonfly
- fixture.remora.dev/component: zitadel
webExternalEgressCidrs: []
allowPublicSourceEgress: true
observability: