Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
a90f43b415 |
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ./app.yaml
|
||||
- ./deployment.yaml
|
||||
- ./external-secret.yaml
|
||||
- ./ingress.yaml
|
||||
- ./kustomization.yaml
|
||||
- ./rbac.yaml
|
||||
- ./service-account.yaml
|
||||
- ./service.yaml
|
||||
+17
-16
@@ -24,30 +24,31 @@ configs:
|
||||
statusbadge.enabled: true
|
||||
timeout.reconciliation: 60s
|
||||
oidc.config: |
|
||||
name: Keycloak
|
||||
issuer: https://auth.hexor.cy/auth/realms/hexor
|
||||
name: Authentik
|
||||
issuer: https://idm.hexor.cy/application/o/argocd/
|
||||
clientID: $oidc-creds:id
|
||||
clientSecret: $oidc-creds:secret
|
||||
requestedScopes: ["openid", "profile", "email", "offline_access"]
|
||||
requestedScopes: ["openid", "profile", "email", "groups", "offline_access"]
|
||||
requestedIDTokenClaims: {"groups": {"essential": true}}
|
||||
refreshTokenThreshold: 2m
|
||||
rbac:
|
||||
create: true
|
||||
policy.default: ""
|
||||
policy.csv: |
|
||||
g, game-servers-managers, GameServersManagersRole
|
||||
# Role permissions
|
||||
p, GameServersManagersRole, applications, get, games/*, allow
|
||||
p, GameServersManagersRole, applications, update, games/*, allow
|
||||
p, GameServersManagersRole, applications, sync, games/*, allow
|
||||
p, GameServersManagersRole, applications, override, games/*, allow
|
||||
p, GameServersManagersRole, applications, action/*, games/*, allow
|
||||
p, GameServersManagersRole, exec, create, games/*, allow
|
||||
p, GameServersManagersRole, logs, get, games/*, allow
|
||||
p, GameServersManagersRole, applications, delete, games/*, deny
|
||||
|
||||
# Admin policy
|
||||
g, argocd-admins, role:admin
|
||||
# Bound OIDC Group and internal role
|
||||
g, Game Servers Managers, GameServersManagersRole
|
||||
# Role permissions
|
||||
p, GameServersManagersRole, applications, get, games/*, allow
|
||||
p, GameServersManagersRole, applications, update, games/*, allow
|
||||
p, GameServersManagersRole, applications, sync, games/*, allow
|
||||
p, GameServersManagersRole, applications, override, games/*, allow
|
||||
p, GameServersManagersRole, applications, action/*, games/*, allow
|
||||
p, GameServersManagersRole, exec, create, games/*, allow
|
||||
p, GameServersManagersRole, logs, get, games/*, allow
|
||||
p, GameServersManagersRole, applications, delete, games/*, deny
|
||||
|
||||
# Admin policy
|
||||
g, ArgoCD Admins, role:admin
|
||||
|
||||
secret:
|
||||
createSecret: true
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
spec:
|
||||
containers:
|
||||
- name: auth-proxy
|
||||
image: ultradesu/rsauth2-proxy:latest
|
||||
image: ultradesu/rsauth2-proxy:0.1.0
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
|
||||
@@ -7,5 +7,4 @@ resources:
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- ingress.yaml
|
||||
- servicemonitor.yaml
|
||||
# routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: auth-proxy-metrics
|
||||
labels:
|
||||
app: auth-proxy
|
||||
release: prometheus
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: auth-proxy
|
||||
endpoints:
|
||||
- port: http
|
||||
path: /metrics
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
honorLabels: true
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- auth-proxy
|
||||
@@ -1,367 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: auth-proxy-dashboard
|
||||
labels:
|
||||
grafana_dashboard: "1"
|
||||
data:
|
||||
auth-proxy.json: |-
|
||||
{
|
||||
"annotations": {
|
||||
"list": [
|
||||
{
|
||||
"builtIn": 1,
|
||||
"datasource": {
|
||||
"type": "grafana",
|
||||
"uid": "-- Grafana --"
|
||||
},
|
||||
"enable": true,
|
||||
"hide": true,
|
||||
"iconColor": "rgba(0, 211, 255, 1)",
|
||||
"name": "Annotations & Alerts",
|
||||
"type": "dashboard"
|
||||
}
|
||||
]
|
||||
},
|
||||
"editable": true,
|
||||
"fiscalYearStartMonth": 0,
|
||||
"graphTooltip": 1,
|
||||
"id": null,
|
||||
"links": [],
|
||||
"liveNow": false,
|
||||
"panels": [
|
||||
{
|
||||
"gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
|
||||
"id": 1,
|
||||
"options": {
|
||||
"colorMode": "value",
|
||||
"graphMode": "area",
|
||||
"justifyMode": "auto",
|
||||
"orientation": "auto",
|
||||
"reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
|
||||
"textMode": "auto"
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "routes_loaded_total",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Loaded Routes",
|
||||
"type": "stat"
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
|
||||
"id": 2,
|
||||
"options": {
|
||||
"colorMode": "value",
|
||||
"graphMode": "area",
|
||||
"justifyMode": "auto",
|
||||
"orientation": "auto",
|
||||
"reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
|
||||
"textMode": "auto"
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "sum(increase(auth_requests_total[$__rate_interval]))",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Auth Requests (total)",
|
||||
"type": "stat",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "thresholds" },
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{ "color": "green", "value": null }
|
||||
]
|
||||
}
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
|
||||
"id": 3,
|
||||
"options": {
|
||||
"colorMode": "value",
|
||||
"graphMode": "area",
|
||||
"justifyMode": "auto",
|
||||
"orientation": "auto",
|
||||
"reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
|
||||
"textMode": "auto"
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "sum(increase(auth_requests_total{status=\"403\"}[$__rate_interval]))",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Forbidden (403)",
|
||||
"type": "stat",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "thresholds" },
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{ "color": "green", "value": null },
|
||||
{ "color": "red", "value": 1 }
|
||||
]
|
||||
}
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
|
||||
"id": 4,
|
||||
"options": {
|
||||
"colorMode": "value",
|
||||
"graphMode": "area",
|
||||
"justifyMode": "auto",
|
||||
"orientation": "auto",
|
||||
"reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
|
||||
"textMode": "auto"
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "sum(increase(callback_requests_total{result=\"success\"}[$__rate_interval]))",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Successful Logins",
|
||||
"type": "stat",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "thresholds" },
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{ "color": "green", "value": null }
|
||||
]
|
||||
}
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
|
||||
"id": 5,
|
||||
"options": {
|
||||
"legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
|
||||
"tooltip": { "mode": "single", "sort": "none" }
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "sum by (status) (rate(auth_requests_total[$__rate_interval]))",
|
||||
"legendFormat": "{{status}}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "Auth Request Rate by Status",
|
||||
"type": "timeseries",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "palette-classic" },
|
||||
"custom": {
|
||||
"axisBorderShow": false,
|
||||
"axisCenteredZero": false,
|
||||
"axisColorMode": "text",
|
||||
"axisLabel": "",
|
||||
"axisPlacement": "auto",
|
||||
"barAlignment": 0,
|
||||
"drawStyle": "line",
|
||||
"fillOpacity": 10,
|
||||
"gradientMode": "none",
|
||||
"hideFrom": { "legend": false, "tooltip": false, "viz": false },
|
||||
"insertNulls": false,
|
||||
"lineInterpolation": "linear",
|
||||
"lineWidth": 2,
|
||||
"pointSize": 5,
|
||||
"scaleDistribution": { "type": "linear" },
|
||||
"showPoints": "auto",
|
||||
"spanNulls": false,
|
||||
"stacking": { "group": "A", "mode": "none" },
|
||||
"thresholdsStyle": { "mode": "off" }
|
||||
},
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [ { "color": "green", "value": null } ]
|
||||
},
|
||||
"unit": "reqps"
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
|
||||
"id": 6,
|
||||
"options": {
|
||||
"legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
|
||||
"tooltip": { "mode": "single", "sort": "none" }
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "auth_request_duration_seconds{quantile=\"0.5\"}",
|
||||
"legendFormat": "p50",
|
||||
"refId": "A"
|
||||
},
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "auth_request_duration_seconds{quantile=\"0.95\"}",
|
||||
"legendFormat": "p95",
|
||||
"refId": "B"
|
||||
},
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "auth_request_duration_seconds{quantile=\"0.99\"}",
|
||||
"legendFormat": "p99",
|
||||
"refId": "C"
|
||||
}
|
||||
],
|
||||
"title": "Auth Request Duration (p50, p95, p99)",
|
||||
"type": "timeseries",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "palette-classic" },
|
||||
"custom": {
|
||||
"axisBorderShow": false,
|
||||
"axisCenteredZero": false,
|
||||
"axisColorMode": "text",
|
||||
"axisLabel": "",
|
||||
"axisPlacement": "auto",
|
||||
"barAlignment": 0,
|
||||
"drawStyle": "line",
|
||||
"fillOpacity": 0,
|
||||
"gradientMode": "none",
|
||||
"hideFrom": { "legend": false, "tooltip": false, "viz": false },
|
||||
"insertNulls": false,
|
||||
"lineInterpolation": "linear",
|
||||
"lineWidth": 2,
|
||||
"pointSize": 5,
|
||||
"scaleDistribution": { "type": "linear" },
|
||||
"showPoints": "auto",
|
||||
"spanNulls": false,
|
||||
"stacking": { "group": "A", "mode": "none" },
|
||||
"thresholdsStyle": { "mode": "off" }
|
||||
},
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [ { "color": "green", "value": null } ]
|
||||
},
|
||||
"unit": "s"
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
},
|
||||
{
|
||||
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 12 },
|
||||
"id": 7,
|
||||
"options": {
|
||||
"legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
|
||||
"tooltip": { "mode": "single", "sort": "none" }
|
||||
},
|
||||
"pluginVersion": "10.0.0",
|
||||
"targets": [
|
||||
{
|
||||
"datasource": { "type": "prometheus", "uid": "${datasource}" },
|
||||
"expr": "sum by (result) (rate(callback_requests_total[$__rate_interval]))",
|
||||
"legendFormat": "{{result}}",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"title": "OIDC Callback Rate by Result",
|
||||
"type": "timeseries",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": { "mode": "palette-classic" },
|
||||
"custom": {
|
||||
"axisBorderShow": false,
|
||||
"axisCenteredZero": false,
|
||||
"axisColorMode": "text",
|
||||
"axisLabel": "",
|
||||
"axisPlacement": "auto",
|
||||
"barAlignment": 0,
|
||||
"drawStyle": "bars",
|
||||
"fillOpacity": 50,
|
||||
"gradientMode": "none",
|
||||
"hideFrom": { "legend": false, "tooltip": false, "viz": false },
|
||||
"insertNulls": false,
|
||||
"lineInterpolation": "linear",
|
||||
"lineWidth": 1,
|
||||
"pointSize": 5,
|
||||
"scaleDistribution": { "type": "linear" },
|
||||
"showPoints": "auto",
|
||||
"spanNulls": false,
|
||||
"stacking": { "group": "A", "mode": "normal" },
|
||||
"thresholdsStyle": { "mode": "off" }
|
||||
},
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [ { "color": "green", "value": null } ]
|
||||
},
|
||||
"unit": "reqps"
|
||||
},
|
||||
"overrides": []
|
||||
}
|
||||
}
|
||||
],
|
||||
"refresh": "30s",
|
||||
"schemaVersion": 38,
|
||||
"style": "dark",
|
||||
"tags": [
|
||||
"auth-proxy",
|
||||
"rsauth2-proxy"
|
||||
],
|
||||
"templating": {
|
||||
"list": [
|
||||
{
|
||||
"current": {
|
||||
"selected": false,
|
||||
"text": "Prometheus",
|
||||
"value": "Prometheus"
|
||||
},
|
||||
"hide": 0,
|
||||
"includeAll": false,
|
||||
"multi": false,
|
||||
"name": "datasource",
|
||||
"options": [],
|
||||
"query": "prometheus",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"type": "datasource"
|
||||
}
|
||||
]
|
||||
},
|
||||
"time": {
|
||||
"from": "now-1h",
|
||||
"to": "now"
|
||||
},
|
||||
"timepicker": {},
|
||||
"timezone": "",
|
||||
"title": "Auth Proxy (rsauth2-proxy)",
|
||||
"uid": "auth-proxy-metrics",
|
||||
"version": 1
|
||||
}
|
||||
@@ -8,7 +8,6 @@ resources:
|
||||
- alertmanager-config.yaml
|
||||
- furumi-dashboard-cm.yaml
|
||||
- telemt-dashboard-cm.yaml
|
||||
- auth-proxy-dashboard-cm.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: kube-prometheus-stack
|
||||
|
||||
+43
-68
@@ -92,6 +92,48 @@ resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
|
||||
]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# rsauth2-proxy client (localhost testing)
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_openid_client" "rsauth2_proxy_dev" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = "rsauth2-proxy-dev"
|
||||
|
||||
name = "rsauth2-proxy (dev)"
|
||||
enabled = true
|
||||
access_type = "CONFIDENTIAL"
|
||||
standard_flow_enabled = true
|
||||
direct_access_grants_enabled = false
|
||||
|
||||
valid_redirect_uris = [
|
||||
"http://localhost:8080/callback",
|
||||
]
|
||||
|
||||
web_origins = [
|
||||
"http://localhost:8080",
|
||||
]
|
||||
}
|
||||
|
||||
resource "keycloak_openid_group_membership_protocol_mapper" "rsauth2_proxy_dev_groups" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy_dev.id
|
||||
name = "groups"
|
||||
claim_name = "groups"
|
||||
full_path = false
|
||||
}
|
||||
|
||||
resource "keycloak_openid_client_default_scopes" "rsauth2_proxy_dev" {
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.rsauth2_proxy_dev.id
|
||||
|
||||
default_scopes = [
|
||||
"openid",
|
||||
"profile",
|
||||
"email",
|
||||
]
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Proxy applications — auto-created groups + routes ConfigMap
|
||||
# =============================================================================
|
||||
@@ -112,74 +154,7 @@ locals {
|
||||
}
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# OAuth2 applications — full OIDC clients for apps that handle auth themselves
|
||||
# =============================================================================
|
||||
|
||||
resource "keycloak_openid_client" "oauth2_app" {
|
||||
for_each = var.oauth2_applications
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = each.key
|
||||
|
||||
name = each.key
|
||||
enabled = true
|
||||
access_type = "CONFIDENTIAL"
|
||||
standard_flow_enabled = true
|
||||
direct_access_grants_enabled = false
|
||||
|
||||
valid_redirect_uris = each.value.redirect_uris
|
||||
valid_post_logout_redirect_uris = each.value.post_logout_redirect_uris
|
||||
web_origins = each.value.web_origins
|
||||
}
|
||||
|
||||
resource "keycloak_openid_group_membership_protocol_mapper" "oauth2_app_groups" {
|
||||
for_each = var.oauth2_applications
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.oauth2_app[each.key].id
|
||||
name = "groups"
|
||||
claim_name = "groups"
|
||||
full_path = false
|
||||
}
|
||||
|
||||
resource "keycloak_openid_client_default_scopes" "oauth2_app" {
|
||||
for_each = var.oauth2_applications
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.oauth2_app[each.key].id
|
||||
|
||||
default_scopes = concat(
|
||||
["openid", "profile", "email"],
|
||||
each.value.extra_default_scopes
|
||||
)
|
||||
}
|
||||
|
||||
resource "keycloak_openid_client_optional_scopes" "oauth2_app" {
|
||||
for_each = {
|
||||
for k, v in var.oauth2_applications : k => v if length(v.extra_optional_scopes) > 0
|
||||
}
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
client_id = keycloak_openid_client.oauth2_app[each.key].id
|
||||
|
||||
optional_scopes = each.value.extra_optional_scopes
|
||||
}
|
||||
|
||||
resource "keycloak_group" "oauth2_app" {
|
||||
for_each = {
|
||||
for k, v in var.oauth2_applications : k => v if length(v.allowed_groups) > 0
|
||||
}
|
||||
|
||||
realm_id = keycloak_realm.hexor.id
|
||||
name = "app-${each.key}"
|
||||
}
|
||||
|
||||
# =============================================================================
|
||||
# Proxy applications — routes ConfigMap
|
||||
# =============================================================================
|
||||
|
||||
resource "kubernetes_config_map_v1" "auth_proxy_routes" {
|
||||
resource "kubernetes_config_map" "auth_proxy_routes" {
|
||||
metadata {
|
||||
name = "auth-proxy-routes"
|
||||
namespace = "auth-proxy"
|
||||
|
||||
@@ -15,6 +15,15 @@ output "rsauth2_proxy_client_secret" {
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_dev_client_id" {
|
||||
value = keycloak_openid_client.rsauth2_proxy_dev.client_id
|
||||
}
|
||||
|
||||
output "rsauth2_proxy_dev_client_secret" {
|
||||
value = keycloak_openid_client.rsauth2_proxy_dev.client_secret
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
output "standalone_groups" {
|
||||
value = [for g in keycloak_group.standalone : g.name]
|
||||
}
|
||||
@@ -26,12 +35,3 @@ output "app_groups" {
|
||||
output "app_allowed_groups" {
|
||||
value = local.app_allowed_groups
|
||||
}
|
||||
|
||||
output "oauth2_app_client_ids" {
|
||||
value = { for k, c in keycloak_openid_client.oauth2_app : k => c.client_id }
|
||||
}
|
||||
|
||||
output "oauth2_app_client_secrets" {
|
||||
value = { for k, c in keycloak_openid_client.oauth2_app : k => c.client_secret }
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
@@ -19,5 +19,5 @@ provider "keycloak" {
|
||||
}
|
||||
|
||||
provider "kubernetes" {
|
||||
config_path = "~/.kube/config"
|
||||
config_path = var.kubeconfig_path
|
||||
}
|
||||
|
||||
@@ -1,32 +0,0 @@
|
||||
groups = [
|
||||
"hexor-admin",
|
||||
"hexor-guest",
|
||||
"game-servers-managers",
|
||||
"argocd-admins",
|
||||
]
|
||||
|
||||
proxy_applications = {
|
||||
secret-reader = {
|
||||
domain = "secret-reader.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
}
|
||||
pass = {
|
||||
domain = "pass.hexor.cy"
|
||||
allowed_groups = ["hexor-guest", "hexor-admin"]
|
||||
}
|
||||
}
|
||||
|
||||
oauth2_applications = {
|
||||
gitea = {
|
||||
redirect_uris = ["https://gt.hexor.cy/user/oauth2/Keycloak/callback"]
|
||||
web_origins = ["https://gt.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://gt.hexor.cy/*"]
|
||||
}
|
||||
ArgoCD = {
|
||||
redirect_uris = ["https://ag.hexor.cy/auth/callback"]
|
||||
web_origins = ["https://ag.hexor.cy"]
|
||||
post_logout_redirect_uris = ["https://ag.hexor.cy/*"]
|
||||
extra_optional_scopes = ["offline_access"]
|
||||
}
|
||||
}
|
||||
|
||||
@@ -16,6 +16,12 @@ variable "keycloak_client_secret" {
|
||||
sensitive = true
|
||||
}
|
||||
|
||||
variable "kubeconfig_path" {
|
||||
description = "Path to kubeconfig (set via TF_VAR_kubeconfig_path or KUBE_CONFIG_PATH)"
|
||||
type = string
|
||||
default = "~/.kube/config"
|
||||
}
|
||||
|
||||
variable "google_client_id" {
|
||||
description = "Google OAuth client ID (set via TF_VAR_google_client_id)"
|
||||
type = string
|
||||
@@ -41,16 +47,3 @@ variable "proxy_applications" {
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "oauth2_applications" {
|
||||
description = "OAuth2/OIDC applications that handle authentication themselves"
|
||||
type = map(object({
|
||||
redirect_uris = list(string)
|
||||
post_logout_redirect_uris = optional(list(string), [])
|
||||
web_origins = optional(list(string), [])
|
||||
extra_default_scopes = optional(list(string), [])
|
||||
extra_optional_scopes = optional(list(string), [])
|
||||
allowed_groups = optional(list(string), [])
|
||||
}))
|
||||
default = {}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user