Skip to content

Commit ad4d8d5

Browse files
lucas-koehlerlucas-koehler
authored
Facilitate logout via OAuth proxy and fix line endings (#61)
* OAuth proxy allows redirect to keycloak for logout Add the keycloak host to the whitelist_domains of sessions' OAuth proxy configuration. This enables a logout from the OAuth proxy that automatically redirects to the Keycloak logout URL. * Unify template line endings to LF Some template files in the theia.cloud chart used CRLF line endings for some reason. This changes them to LF.
1 parent 63a265f commit ad4d8d5

5 files changed

+205
-198
lines changed

‎charts/theia-cloud/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type: application
1515
# This is the chart version. This version number should be incremented each time you make changes
1616
# to the chart and its templates, including the app version.
1717
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18-
version: 0.12.0-next.3
18+
version: 0.12.0-next.4
1919

2020
# This is the version number of the application being deployed. This version number should be
2121
# incremented each time you make changes to the application. Versions are not expected to

‎charts/theia-cloud/templates/instances-ingress-path-based.yaml

+76-76
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,76 @@
1-
{{- if .Values.hosts.usePaths }}
2-
apiVersion: networking.k8s.io/v1
3-
kind: Ingress
4-
metadata:
5-
name: {{ tpl (.Values.ingress.instanceName | toString) . }}
6-
namespace: {{ .Release.Namespace }}
7-
annotations:
8-
{{- if not .Values.ingress.tls }}
9-
nginx.ingress.kubernetes.io/ssl-redirect: "false"
10-
{{- end }}
11-
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
12-
nginx.ingress.kubernetes.io/rewrite-target: /$2
13-
nginx.ingress.kubernetes.io/configuration-snippet: |
14-
proxy_set_header 'X-Forwarded-Uri' $request_uri;
15-
nginx.ingress.kubernetes.io/proxy-body-size: {{ tpl (.Values.ingress.proxyBodySize | toString) . }}
16-
{{- if .Values.ingress.addTLSSecretName }}
17-
{{- if .Values.ingress.certManagerAnnotations }}
18-
cert-manager.io/cluster-issuer: {{ tpl (.Values.ingress.clusterIssuer | toString) . }}
19-
{{- if .Values.ingress.theiaCloudCommonName }}
20-
cert-manager.io/common-name: "Theia Cloud"
21-
{{- end }}
22-
acme.cert-manager.io/http01-ingress-class: nginx
23-
{{- end }}
24-
{{- end }}
25-
spec:
26-
ingressClassName: nginx
27-
{{- if .Values.ingress.tls }}
28-
tls:
29-
- hosts:
30-
- {{ tpl (.Values.hosts.configuration.baseHost | toString) . }}
31-
{{- if .Values.ingress.addTLSSecretName }}
32-
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
33-
{{- if (not (hasKey $.Values.ingress.allWildcardSecretNames $wildcard)) }}
34-
- {{ printf "%s%s" (tpl . $) (tpl $.Values.hosts.configuration.baseHost $)| quote }}
35-
{{- end }}
36-
{{- end }}
37-
secretName: ws-cert-secret
38-
{{- end }}
39-
{{- end }}
40-
41-
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
42-
{{- if hasKey $.Values.ingress.allWildcardSecretNames $wildcard }}
43-
{{- $secretName := get $.Values.ingress.allWildcardSecretNames $wildcard }}
44-
- hosts:
45-
- {{ printf "%s%s" (tpl $wildcard $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
46-
secretName: {{ tpl $secretName $ | quote }}
47-
{{- end }}
48-
{{- end }}
49-
{{- if not (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .) ) }}
50-
rules:
51-
- host: {{ tpl (.Values.hosts.configuration.baseHost | toString) . }}
52-
http:
53-
{{- range .Values.hosts.allWildcardInstances }}
54-
- host: {{ printf "'%s%s'" (tpl . $) (tpl $.Values.hosts.configuration.baseHost $) }}
55-
http:
56-
{{- end }}
57-
{{- else }}
58-
rules:
59-
{{ range $rule := (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .)).spec.rules }}
60-
- host: {{ .host | quote }}
61-
{{ if .http }}
62-
http:
63-
paths:
64-
{{ with index .http.paths 0 }}
65-
- path: {{ .path }}
66-
pathType: Prefix
67-
backend:
68-
service:
69-
name: {{ .backend.service.name }}
70-
port:
71-
number: {{ .backend.service.port.number }}
72-
{{- end }}
73-
{{ end }}
74-
{{- end }}
75-
{{- end }}
76-
{{- end }}
1+
{{- if .Values.hosts.usePaths }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: {{ tpl (.Values.ingress.instanceName | toString) . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
{{- if not .Values.ingress.tls }}
9+
nginx.ingress.kubernetes.io/ssl-redirect: "false"
10+
{{- end }}
11+
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
12+
nginx.ingress.kubernetes.io/rewrite-target: /$2
13+
nginx.ingress.kubernetes.io/configuration-snippet: |
14+
proxy_set_header 'X-Forwarded-Uri' $request_uri;
15+
nginx.ingress.kubernetes.io/proxy-body-size: {{ tpl (.Values.ingress.proxyBodySize | toString) . }}
16+
{{- if .Values.ingress.addTLSSecretName }}
17+
{{- if .Values.ingress.certManagerAnnotations }}
18+
cert-manager.io/cluster-issuer: {{ tpl (.Values.ingress.clusterIssuer | toString) . }}
19+
{{- if .Values.ingress.theiaCloudCommonName }}
20+
cert-manager.io/common-name: "Theia Cloud"
21+
{{- end }}
22+
acme.cert-manager.io/http01-ingress-class: nginx
23+
{{- end }}
24+
{{- end }}
25+
spec:
26+
ingressClassName: nginx
27+
{{- if .Values.ingress.tls }}
28+
tls:
29+
- hosts:
30+
- {{ tpl (.Values.hosts.configuration.baseHost | toString) . }}
31+
{{- if .Values.ingress.addTLSSecretName }}
32+
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
33+
{{- if (not (hasKey $.Values.ingress.allWildcardSecretNames $wildcard)) }}
34+
- {{ printf "%s%s" (tpl . $) (tpl $.Values.hosts.configuration.baseHost $)| quote }}
35+
{{- end }}
36+
{{- end }}
37+
secretName: ws-cert-secret
38+
{{- end }}
39+
{{- end }}
40+
41+
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
42+
{{- if hasKey $.Values.ingress.allWildcardSecretNames $wildcard }}
43+
{{- $secretName := get $.Values.ingress.allWildcardSecretNames $wildcard }}
44+
- hosts:
45+
- {{ printf "%s%s" (tpl $wildcard $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
46+
secretName: {{ tpl $secretName $ | quote }}
47+
{{- end }}
48+
{{- end }}
49+
{{- if not (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .) ) }}
50+
rules:
51+
- host: {{ tpl (.Values.hosts.configuration.baseHost | toString) . }}
52+
http:
53+
{{- range .Values.hosts.allWildcardInstances }}
54+
- host: {{ printf "'%s%s'" (tpl . $) (tpl $.Values.hosts.configuration.baseHost $) }}
55+
http:
56+
{{- end }}
57+
{{- else }}
58+
rules:
59+
{{ range $rule := (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .)).spec.rules }}
60+
- host: {{ .host | quote }}
61+
{{ if .http }}
62+
http:
63+
paths:
64+
{{ with index .http.paths 0 }}
65+
- path: {{ .path }}
66+
pathType: Prefix
67+
backend:
68+
service:
69+
name: {{ .backend.service.name }}
70+
port:
71+
number: {{ .backend.service.port.number }}
72+
{{- end }}
73+
{{ end }}
74+
{{- end }}
75+
{{- end }}
76+
{{- end }}

‎charts/theia-cloud/templates/instances-ingress.yaml

+77-77
Original file line numberDiff line numberDiff line change
@@ -1,77 +1,77 @@
1-
{{- if not .Values.hosts.usePaths }}
2-
apiVersion: networking.k8s.io/v1
3-
kind: Ingress
4-
metadata:
5-
name: {{ tpl (.Values.ingress.instanceName | toString) . }}
6-
namespace: {{ .Release.Namespace }}
7-
annotations:
8-
{{- if not .Values.ingress.tls }}
9-
nginx.ingress.kubernetes.io/ssl-redirect: "false"
10-
{{- end }}
11-
{{- if .Values.ingress.addTLSSecretName }}
12-
{{- if .Values.ingress.certManagerAnnotations }}
13-
cert-manager.io/cluster-issuer: {{ tpl (.Values.ingress.clusterIssuer | toString) . }}
14-
{{- if .Values.ingress.theiaCloudCommonName }}
15-
cert-manager.io/common-name: "Theia Cloud"
16-
{{- end }}
17-
acme.cert-manager.io/http01-ingress-class: nginx
18-
{{- end }}
19-
{{- end }}
20-
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
21-
nginx.ingress.kubernetes.io/rewrite-target: /$2
22-
nginx.ingress.kubernetes.io/configuration-snippet: |
23-
proxy_set_header 'X-Forwarded-Uri' $request_uri;
24-
nginx.ingress.kubernetes.io/proxy-body-size: {{ tpl (.Values.ingress.proxyBodySize | toString) . }}
25-
spec:
26-
ingressClassName: nginx
27-
{{- if .Values.ingress.tls }}
28-
tls:
29-
- hosts:
30-
- {{ tpl (printf "%s.%s" .Values.hosts.configuration.instance .Values.hosts.configuration.baseHost | toString) . }}
31-
{{- if .Values.ingress.addTLSSecretName }}
32-
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
33-
{{- if (not (hasKey $.Values.ingress.allWildcardSecretNames $wildcard)) }}
34-
- {{ printf "%s%s.%s" (tpl . $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
35-
{{- end }}
36-
{{- end }}
37-
secretName: ws-cert-secret
38-
{{- end }}
39-
{{- end }}
40-
41-
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
42-
{{- if hasKey $.Values.ingress.allWildcardSecretNames $wildcard }}
43-
{{- $secretName := get $.Values.ingress.allWildcardSecretNames $wildcard }}
44-
- hosts:
45-
- {{ printf "%s%s.%s" (tpl $wildcard $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
46-
secretName: {{ tpl $secretName $ | quote }}
47-
{{- end }}
48-
{{- end }}
49-
50-
{{- if not (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .) ) }}
51-
rules:
52-
- host: {{ printf "%s.%s" (tpl .Values.hosts.configuration.instance .) (tpl .Values.hosts.configuration.baseHost .) }}
53-
http:
54-
{{- range .Values.hosts.allWildcardInstances }}
55-
- host: {{ printf "%s%s.%s" (tpl . $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
56-
http:
57-
{{- end }}
58-
{{- else }}
59-
rules:
60-
{{ range $rule := (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .)).spec.rules }}
61-
- host: {{ .host | quote }}
62-
{{ if .http }}
63-
http:
64-
paths:
65-
{{ with index .http.paths 0 }}
66-
- path: {{ .path }}
67-
pathType: Prefix
68-
backend:
69-
service:
70-
name: {{ .backend.service.name }}
71-
port:
72-
number: {{ .backend.service.port.number }}
73-
{{- end }}
74-
{{ end }}
75-
{{- end }}
76-
{{- end }}
77-
{{- end }}
1+
{{- if not .Values.hosts.usePaths }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: {{ tpl (.Values.ingress.instanceName | toString) . }}
6+
namespace: {{ .Release.Namespace }}
7+
annotations:
8+
{{- if not .Values.ingress.tls }}
9+
nginx.ingress.kubernetes.io/ssl-redirect: "false"
10+
{{- end }}
11+
{{- if .Values.ingress.addTLSSecretName }}
12+
{{- if .Values.ingress.certManagerAnnotations }}
13+
cert-manager.io/cluster-issuer: {{ tpl (.Values.ingress.clusterIssuer | toString) . }}
14+
{{- if .Values.ingress.theiaCloudCommonName }}
15+
cert-manager.io/common-name: "Theia Cloud"
16+
{{- end }}
17+
acme.cert-manager.io/http01-ingress-class: nginx
18+
{{- end }}
19+
{{- end }}
20+
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
21+
nginx.ingress.kubernetes.io/rewrite-target: /$2
22+
nginx.ingress.kubernetes.io/configuration-snippet: |
23+
proxy_set_header 'X-Forwarded-Uri' $request_uri;
24+
nginx.ingress.kubernetes.io/proxy-body-size: {{ tpl (.Values.ingress.proxyBodySize | toString) . }}
25+
spec:
26+
ingressClassName: nginx
27+
{{- if .Values.ingress.tls }}
28+
tls:
29+
- hosts:
30+
- {{ tpl (printf "%s.%s" .Values.hosts.configuration.instance .Values.hosts.configuration.baseHost | toString) . }}
31+
{{- if .Values.ingress.addTLSSecretName }}
32+
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
33+
{{- if (not (hasKey $.Values.ingress.allWildcardSecretNames $wildcard)) }}
34+
- {{ printf "%s%s.%s" (tpl . $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
35+
{{- end }}
36+
{{- end }}
37+
secretName: ws-cert-secret
38+
{{- end }}
39+
{{- end }}
40+
41+
{{- range $wildcard := .Values.hosts.allWildcardInstances }}
42+
{{- if hasKey $.Values.ingress.allWildcardSecretNames $wildcard }}
43+
{{- $secretName := get $.Values.ingress.allWildcardSecretNames $wildcard }}
44+
- hosts:
45+
- {{ printf "%s%s.%s" (tpl $wildcard $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
46+
secretName: {{ tpl $secretName $ | quote }}
47+
{{- end }}
48+
{{- end }}
49+
50+
{{- if not (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .) ) }}
51+
rules:
52+
- host: {{ printf "%s.%s" (tpl .Values.hosts.configuration.instance .) (tpl .Values.hosts.configuration.baseHost .) }}
53+
http:
54+
{{- range .Values.hosts.allWildcardInstances }}
55+
- host: {{ printf "%s%s.%s" (tpl . $) (tpl $.Values.hosts.configuration.instance $) (tpl $.Values.hosts.configuration.baseHost $) | quote }}
56+
http:
57+
{{- end }}
58+
{{- else }}
59+
rules:
60+
{{ range $rule := (lookup "networking.k8s.io/v1" "Ingress" .Release.Namespace (tpl (.Values.ingress.instanceName | toString) .)).spec.rules }}
61+
- host: {{ .host | quote }}
62+
{{ if .http }}
63+
http:
64+
paths:
65+
{{ with index .http.paths 0 }}
66+
- path: {{ .path }}
67+
pathType: Prefix
68+
backend:
69+
service:
70+
name: {{ .backend.service.name }}
71+
port:
72+
number: {{ .backend.service.port.number }}
73+
{{- end }}
74+
{{ end }}
75+
{{- end }}
76+
{{- end }}
77+
{{- end }}

‎charts/theia-cloud/templates/oauth2-configmap-oauth2proxy-keycloak.yaml

+42-35
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,42 @@
1-
apiVersion: v1
2-
kind: ConfigMap
3-
metadata:
4-
name: oauth2-proxy-config
5-
namespace: {{ .Release.Namespace }}
6-
data:
7-
oauth2-proxy.cfg: |+
8-
# Provider config
9-
provider="keycloak-oidc"
10-
redirect_url="https://placeholder/oauth2/callback"
11-
oidc_issuer_url="{{ tpl (.Values.keycloak.authUrl | toString) . }}realms/{{ tpl (.Values.keycloak.realm | toString) . }}"
12-
ssl_insecure_skip_verify=true
13-
# Client config
14-
client_id="{{ tpl (.Values.keycloak.clientId | toString) . }}"
15-
client_secret="{{ tpl (.Values.keycloak.clientSecret | toString) . }}"
16-
cookie_secret="{{ tpl (.Values.keycloak.cookieSecret | toString) . }}"
17-
cookie_secure="false"
18-
#proxy_prefix=""
19-
# Upstream config
20-
http_address="0.0.0.0:5000"
21-
upstreams="http://127.0.0.1:placeholder-port/"
22-
# Proxy Config
23-
#user_id_claim="preferred_username"
24-
skip_auth_routes=["/health.*"]
25-
skip_provider_button="true"
26-
reverse_proxy="true"
27-
# email_domains=["*"]
28-
{{- if .Values.hosts.usePaths }}
29-
cookie_domains=["{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}"]
30-
whitelist_domains=["{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}:*",".google.com:*"]
31-
{{- else }}
32-
cookie_domains=["{{ tpl (.Values.hosts.configuration.instance | toString) . }}.{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}"]
33-
whitelist_domains=["{{ tpl (.Values.hosts.configuration.instance | toString) . }}.{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}:*",".google.com:*"]
34-
{{- end }}
35-
custom_templates_dir="/templates"
1+
{{- /* Extract the host where the Keycloak runs by extracting it from the auth URL via regex. */ -}}
2+
{{- $keycloakUrl := tpl (.Values.keycloak.authUrl | toString) . -}}
3+
{{- /* Regex to match a URL that matches the host in group 1: ([^/]+) */ -}}
4+
{{- $hostRegex := `^https?://([^/]+)(/.*)?$` -}}
5+
{{- /* Replace the URL with only the first group which is only the host. */ -}}
6+
{{- $keycloakHost:= regexReplaceAll $hostRegex $keycloakUrl `$1` -}}
7+
8+
apiVersion: v1
9+
kind: ConfigMap
10+
metadata:
11+
name: oauth2-proxy-config
12+
namespace: {{ .Release.Namespace }}
13+
data:
14+
oauth2-proxy.cfg: |+
15+
# Provider config
16+
provider="keycloak-oidc"
17+
redirect_url="https://placeholder/oauth2/callback"
18+
oidc_issuer_url="{{ $keycloakUrl }}realms/{{ tpl (.Values.keycloak.realm | toString) . }}"
19+
ssl_insecure_skip_verify=true
20+
# Client config
21+
client_id="{{ tpl (.Values.keycloak.clientId | toString) . }}"
22+
client_secret="{{ tpl (.Values.keycloak.clientSecret | toString) . }}"
23+
cookie_secret="{{ tpl (.Values.keycloak.cookieSecret | toString) . }}"
24+
cookie_secure="false"
25+
#proxy_prefix=""
26+
# Upstream config
27+
http_address="0.0.0.0:5000"
28+
upstreams="http://127.0.0.1:placeholder-port/"
29+
# Proxy Config
30+
#user_id_claim="preferred_username"
31+
skip_auth_routes=["/health.*"]
32+
skip_provider_button="true"
33+
reverse_proxy="true"
34+
# email_domains=["*"]
35+
{{- if .Values.hosts.usePaths }}
36+
cookie_domains=["{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}"]
37+
whitelist_domains=["{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}:*","{{ $keycloakHost }}:*",".google.com:*"]
38+
{{- else }}
39+
cookie_domains=["{{ tpl (.Values.hosts.configuration.instance | toString) . }}.{{ tpl (.Values.hosts.configuration.baseHost | toString) . }}"]
40+
whitelist_domains=["{{ tpl (.Values.hosts.configuration.instance | toString) . }}:*","{{ $keycloakHost }}:*",".google.com:*"]
41+
{{- end }}
42+
custom_templates_dir="/templates"

0 commit comments

Comments
 (0)