feat: Add traefik-forward-auth Helm chart with deployment, service, ingress, middleware, and configuration templates

traefik-forward-auth/Chart.yaml

@@ -0,0 +1,9 @@
+apiVersion: v2
+name: traefik-forward-auth
+description: Forward auth for Traefik (ItalyPaleAle/traefik-forward-auth) with Pocket ID provider
+type: application
+version: 0.1.0
+appVersion: "4.8.0"
+annotations:
+  version-source: github-release:ItalyPaleAle/traefik-forward-auth
+  version-pattern: "s|^v||"

traefik-forward-auth/templates/_helpers.tpl

@@ -0,0 +1,13 @@
+{{- define "tfa.middlewareName" -}}
+{{- if .Values.middleware.name -}}
+{{ .Values.middleware.name }}
+{{- else -}}
+{{ .Release.Name }}-auth
+{{- end -}}
+{{- end -}}
+
+{{- define "tfa.labels" -}}
+app.kubernetes.io/name: {{ .Chart.Name }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end -}}

traefik-forward-auth/templates/configmap.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-config
+  labels:
+    {{- include "tfa.labels" . | nindent 4 }}
+data:
+  config.yaml: |
+    server:
+      hostname: {{ .Values.hostname | quote }}
+
+    tokens:
+      sessionLifetime: {{ .Values.tokens.sessionLifetime }}
+
+    cookies:
+      domain: {{ .Values.cookieDomain | quote }}
+
+    portals:
+      - name: {{ .Values.portal.name | quote }}
+        providers:
+          - pocketID:
+              endpoint: {{ .Values.pocketID.endpoint | quote }}
+              clientID: {{ .Values.pocketID.clientID | quote }}
+              clientSecretFile: "/var/run/secrets/traefik-forward-auth/client-secret"
+    {{- with .Values.extraConfig }}
+    {{ . | nindent 4 }}
+    {{- end }}

traefik-forward-auth/templates/deployment.yaml

@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "tfa.labels" . | nindent 4 }}
+  annotations:
+    version-source: {{ index .Chart.Annotations "version-source" }}
+    version-pattern: {{ index .Chart.Annotations "version-pattern" | quote }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
+    spec:
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 4181
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /etc/traefik-forward-auth
+              readOnly: true
+            - name: client-secret
+              mountPath: /var/run/secrets/traefik-forward-auth
+              readOnly: true
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ .Release.Name }}-config
+        - name: client-secret
+          secret:
+            secretName: {{ required "existingSecret is required" .Values.existingSecret }}
+            items:
+              - key: client-secret
+                path: client-secret

traefik-forward-auth/templates/ingress.yaml

@@ -0,0 +1,29 @@
+{{- range $name, $config := .Values.ingresses }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $.Release.Name }}-{{ $name }}
+  labels:
+    {{- include "tfa.labels" $ | nindent 4 }}
+  {{- with $config.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  rules:
+    - host: {{ $config.host }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $.Release.Name }}
+                port:
+                  number: {{ $.Values.service.port }}
+  {{- with $config.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

traefik-forward-auth/templates/middleware.yaml

@@ -0,0 +1,16 @@
+{{- if .Values.middleware.enabled }}
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: {{ include "tfa.middlewareName" . }}
+  labels:
+    {{- include "tfa.labels" . | nindent 4 }}
+spec:
+  forwardAuth:
+    address: "http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local/portals/{{ .Values.portal.name }}"
+    trustForwardHeader: {{ .Values.middleware.trustForwardHeader }}
+    {{- with .Values.middleware.authResponseHeaders }}
+    authResponseHeaders:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+{{- end }}

traefik-forward-auth/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    {{- include "tfa.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    app: {{ .Release.Name }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP

traefik-forward-auth/values.yaml

@@ -0,0 +1,69 @@
+image:
+  repository: ghcr.io/italypaleale/traefik-forward-auth
+  pullPolicy: IfNotPresent
+  # Overrides the image tag; defaults to Chart.AppVersion
+  tag: ""
+
+# TFA server hostname (used for OIDC redirects). E.g. "auth.example.com"
+hostname: ""
+
+# Cookie domain — scope at which the session cookie is valid.
+# Must be a parent of `hostname` (e.g. "example.com" for "auth.example.com").
+cookieDomain: ""
+
+tokens:
+  sessionLifetime: 24h
+
+# Pocket ID OIDC configuration. `clientID` is a public identifier;
+# `clientSecret` is read from `existingSecret` (key: `client-secret`).
+pocketID:
+  endpoint: ""
+  clientID: ""
+
+# Secret containing the client secret. Must define key `client-secret`.
+# Use sealed-secrets to provide this in cluster overlays.
+existingSecret: ""
+
+portal:
+  name: main
+
+# Extra YAML appended to config.yaml (advanced use only).
+extraConfig: ""
+
+service:
+  port: 80
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 32Mi
+  limits:
+    cpu: 200m
+    memory: 128Mi
+
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+# Traefik Middleware of kind forwardAuth. Referenced by apps as
+# <namespace>-<middleware.name>@kubernetescrd.
+middleware:
+  enabled: true
+  name: ""        # defaults to "<release>-auth" if empty
+  authResponseHeaders:
+    - X-Forwarded-User
+    - X-Forwarded-Displayname
+    - X-Forwarded-Groups
+  trustForwardHeader: true
+
+ingresses: {}
+  # https:
+  #   host: auth.example.com
+  #   annotations:
+  #     traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+  #     traefik.ingress.kubernetes.io/router.tls: "true"
+  #     traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+  #     traefik.ingress.kubernetes.io/router.middlewares: traefik-redirect-to-https@kubernetescrd
+  #   tls:
+  #     - hosts:
+  #         - auth.example.com