From 9d057b2f3eb281f90c638ee6648d9f54690edb54 Mon Sep 17 00:00:00 2001 From: sHa Date: Sun, 19 Apr 2026 13:21:22 +0300 Subject: [PATCH] feat: Add traefik-forward-auth Helm chart with deployment, service, ingress, middleware, and configuration templates --- traefik-forward-auth/Chart.yaml | 9 +++ traefik-forward-auth/templates/_helpers.tpl | 13 ++++ traefik-forward-auth/templates/configmap.yaml | 27 ++++++++ .../templates/deployment.yaml | 60 ++++++++++++++++ traefik-forward-auth/templates/ingress.yaml | 29 ++++++++ .../templates/middleware.yaml | 16 +++++ traefik-forward-auth/templates/service.yaml | 15 ++++ traefik-forward-auth/values.yaml | 69 +++++++++++++++++++ 8 files changed, 238 insertions(+) create mode 100644 traefik-forward-auth/Chart.yaml create mode 100644 traefik-forward-auth/templates/_helpers.tpl create mode 100644 traefik-forward-auth/templates/configmap.yaml create mode 100644 traefik-forward-auth/templates/deployment.yaml create mode 100644 traefik-forward-auth/templates/ingress.yaml create mode 100644 traefik-forward-auth/templates/middleware.yaml create mode 100644 traefik-forward-auth/templates/service.yaml create mode 100644 traefik-forward-auth/values.yaml diff --git a/traefik-forward-auth/Chart.yaml b/traefik-forward-auth/Chart.yaml new file mode 100644 index 0000000..a7a5eea --- /dev/null +++ b/traefik-forward-auth/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +name: traefik-forward-auth +description: Forward auth for Traefik (ItalyPaleAle/traefik-forward-auth) with Pocket ID provider +type: application +version: 0.1.0 +appVersion: "4.8.0" +annotations: + version-source: github-release:ItalyPaleAle/traefik-forward-auth + version-pattern: "s|^v||" diff --git a/traefik-forward-auth/templates/_helpers.tpl b/traefik-forward-auth/templates/_helpers.tpl new file mode 100644 index 0000000..44f416f --- /dev/null +++ b/traefik-forward-auth/templates/_helpers.tpl @@ -0,0 +1,13 @@ +{{- define "tfa.middlewareName" -}} +{{- if .Values.middleware.name -}} +{{ .Values.middleware.name }} +{{- else -}} +{{ .Release.Name }}-auth +{{- end -}} +{{- end -}} + +{{- define "tfa.labels" -}} +app.kubernetes.io/name: {{ .Chart.Name }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end -}} diff --git a/traefik-forward-auth/templates/configmap.yaml b/traefik-forward-auth/templates/configmap.yaml new file mode 100644 index 0000000..531fb0c --- /dev/null +++ b/traefik-forward-auth/templates/configmap.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-config + labels: + {{- include "tfa.labels" . | nindent 4 }} +data: + config.yaml: | + server: + hostname: {{ .Values.hostname | quote }} + + tokens: + sessionLifetime: {{ .Values.tokens.sessionLifetime }} + + cookies: + domain: {{ .Values.cookieDomain | quote }} + + portals: + - name: {{ .Values.portal.name | quote }} + providers: + - pocketID: + endpoint: {{ .Values.pocketID.endpoint | quote }} + clientID: {{ .Values.pocketID.clientID | quote }} + clientSecretFile: "/var/run/secrets/traefik-forward-auth/client-secret" + {{- with .Values.extraConfig }} + {{ . | nindent 4 }} + {{- end }} diff --git a/traefik-forward-auth/templates/deployment.yaml b/traefik-forward-auth/templates/deployment.yaml new file mode 100644 index 0000000..64f0f6e --- /dev/null +++ b/traefik-forward-auth/templates/deployment.yaml @@ -0,0 +1,60 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }} + labels: + {{- include "tfa.labels" . | nindent 4 }} + annotations: + version-source: {{ index .Chart.Annotations "version-source" }} + version-pattern: {{ index .Chart.Annotations "version-pattern" | quote }} +spec: + replicas: 1 + selector: + matchLabels: + app: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ .Release.Name }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + spec: + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: 4181 + protocol: TCP + volumeMounts: + - name: config + mountPath: /etc/traefik-forward-auth + readOnly: true + - name: client-secret + mountPath: /var/run/secrets/traefik-forward-auth + readOnly: true + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumes: + - name: config + configMap: + name: {{ .Release.Name }}-config + - name: client-secret + secret: + secretName: {{ required "existingSecret is required" .Values.existingSecret }} + items: + - key: client-secret + path: client-secret diff --git a/traefik-forward-auth/templates/ingress.yaml b/traefik-forward-auth/templates/ingress.yaml new file mode 100644 index 0000000..2f787d9 --- /dev/null +++ b/traefik-forward-auth/templates/ingress.yaml @@ -0,0 +1,29 @@ +{{- range $name, $config := .Values.ingresses }} +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $.Release.Name }}-{{ $name }} + labels: + {{- include "tfa.labels" $ | nindent 4 }} + {{- with $config.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + rules: + - host: {{ $config.host }} + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: {{ $.Release.Name }} + port: + number: {{ $.Values.service.port }} + {{- with $config.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/traefik-forward-auth/templates/middleware.yaml b/traefik-forward-auth/templates/middleware.yaml new file mode 100644 index 0000000..cc433be --- /dev/null +++ b/traefik-forward-auth/templates/middleware.yaml @@ -0,0 +1,16 @@ +{{- if .Values.middleware.enabled }} +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: {{ include "tfa.middlewareName" . }} + labels: + {{- include "tfa.labels" . | nindent 4 }} +spec: + forwardAuth: + address: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local/portals/{{ .Values.portal.name }}" + trustForwardHeader: {{ .Values.middleware.trustForwardHeader }} + {{- with .Values.middleware.authResponseHeaders }} + authResponseHeaders: + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end }} diff --git a/traefik-forward-auth/templates/service.yaml b/traefik-forward-auth/templates/service.yaml new file mode 100644 index 0000000..3b54288 --- /dev/null +++ b/traefik-forward-auth/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }} + labels: + {{- include "tfa.labels" . | nindent 4 }} +spec: + type: ClusterIP + selector: + app: {{ .Release.Name }} + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: http + protocol: TCP diff --git a/traefik-forward-auth/values.yaml b/traefik-forward-auth/values.yaml new file mode 100644 index 0000000..05773ca --- /dev/null +++ b/traefik-forward-auth/values.yaml @@ -0,0 +1,69 @@ +image: + repository: ghcr.io/italypaleale/traefik-forward-auth + pullPolicy: IfNotPresent + # Overrides the image tag; defaults to Chart.AppVersion + tag: "" + +# TFA server hostname (used for OIDC redirects). E.g. "auth.example.com" +hostname: "" + +# Cookie domain — scope at which the session cookie is valid. +# Must be a parent of `hostname` (e.g. "example.com" for "auth.example.com"). +cookieDomain: "" + +tokens: + sessionLifetime: 24h + +# Pocket ID OIDC configuration. `clientID` is a public identifier; +# `clientSecret` is read from `existingSecret` (key: `client-secret`). +pocketID: + endpoint: "" + clientID: "" + +# Secret containing the client secret. Must define key `client-secret`. +# Use sealed-secrets to provide this in cluster overlays. +existingSecret: "" + +portal: + name: main + +# Extra YAML appended to config.yaml (advanced use only). +extraConfig: "" + +service: + port: 80 + +resources: + requests: + cpu: 50m + memory: 32Mi + limits: + cpu: 200m + memory: 128Mi + +nodeSelector: {} +tolerations: [] +affinity: {} + +# Traefik Middleware of kind forwardAuth. Referenced by apps as +# -@kubernetescrd. +middleware: + enabled: true + name: "" # defaults to "-auth" if empty + authResponseHeaders: + - X-Forwarded-User + - X-Forwarded-Displayname + - X-Forwarded-Groups + trustForwardHeader: true + +ingresses: {} + # https: + # host: auth.example.com + # annotations: + # traefik.ingress.kubernetes.io/router.entrypoints: web,websecure + # traefik.ingress.kubernetes.io/router.tls: "true" + # traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt + # traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd + # tls: + # - hosts: + # - auth.example.com