From 0b8a451b36af1636baa675efa5b08305cd51b6db Mon Sep 17 00:00:00 2001 From: Kjeld Schouten-Lebbing Date: Mon, 3 May 2021 23:48:17 +0200 Subject: [PATCH] temporary fix to cleanup auth forward (#422) * temporary fix to cleanup auth forward * actually: its crd based to begin with! * update tests * actually fix tests --- .tools/tests/charts/common-test_spec.rb | 7 +++-- library/common/Chart.yaml | 2 +- library/common/templates/_ingress.tpl | 15 ---------- .../classes/ingress/_authForward.tpl | 30 ------------------- .../templates/classes/ingress/_ingress.tpl | 25 +++++++++++++++- .../classes/ingress/_ingressRoute.tpl | 22 +++++++++++++- 6 files changed, 50 insertions(+), 51 deletions(-) delete mode 100644 library/common/templates/classes/ingress/_authForward.tpl diff --git a/.tools/tests/charts/common-test_spec.rb b/.tools/tests/charts/common-test_spec.rb index de73cfaeace..c7585dc53fe 100644 --- a/.tools/tests/charts/common-test_spec.rb +++ b/.tools/tests/charts/common-test_spec.rb @@ -983,7 +983,8 @@ class Test < ChartTest it 'HTTP-ingressRoute+selfsigned+forwardAuth is evaluated is evaluated ' do expectedHostString = 'Host(`hostname`) && PathPrefix(`/`)' - expectedName = 'common-test-test1-auth-forward' + expectedName1 = 'common-test-test1-auth-forward' + expectedName2 = 'common-test-test1-auth-forward@kubernetescrd' values = { ingress: { test1: { @@ -1008,8 +1009,8 @@ class Test < ChartTest refute_nil(resource('IngressRoute')) jq('.spec.tls.domains[0].main', resource('IngressRoute')).must_equal values[:ingress][:test1][:hosts][0][:host] jq('.spec.tls.secretName', resource('IngressRoute')).must_equal nil - jq('.metadata.name', resource('Middleware')).must_equal expectedName - jq('.spec.routes[0].middlewares[1].name', resource('IngressRoute')).must_equal expectedName + jq('.metadata.name', resource('Middleware')).must_equal expectedName1 + jq('.spec.routes[0].middlewares[1].name', resource('IngressRoute')).must_equal expectedName2 end end diff --git a/library/common/Chart.yaml b/library/common/Chart.yaml index 2b8145c6006..7b34e673f42 100644 --- a/library/common/Chart.yaml +++ b/library/common/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 kubeVersion: ">=1.16.0-0" name: common -version: 3.5.2 +version: 3.5.3 # upstream_version: appVersion: none description: Function library for TrueCharts diff --git a/library/common/templates/_ingress.tpl b/library/common/templates/_ingress.tpl index 4189ad1a77b..b329c09c088 100644 --- a/library/common/templates/_ingress.tpl +++ b/library/common/templates/_ingress.tpl @@ -30,11 +30,6 @@ of the main Ingress and any additionalIngresses. {{- include "common.classes.ingress" $ -}} {{ end -}} - {{- if $ingressValues.authForwardURL -}} - {{- print ("---") | nindent 0 -}} - {{- include "common.classes.ingress.authForward" $ }} - {{ end -}} - {{- if eq $ingressValues.certType "ixcert" -}} {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}} {{- print ("---") | nindent 0 -}} @@ -74,11 +69,6 @@ of the main Ingress and any additionalIngresses. {{- include "common.classes.ingress" $ -}} {{ end -}} - {{- if $ingressValues.authForwardURL -}} - {{- print ("---") | nindent 0 -}} - {{- include "common.classes.ingress.authForward" $ }} - {{ end -}} - {{- if eq $ingressValues.certType "ixcert" -}} {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}} {{- print ("---") | nindent 0 -}} @@ -121,11 +111,6 @@ of the main Ingress and any additionalIngresses. {{- print ("---") | nindent 0 -}} {{- include "common.classes.externalService" $ }} - {{- if $ingressValues.authForwardURL -}} - {{- print ("---") | nindent 0 -}} - {{- include "common.classes.ingress.authForward" $ }} - {{ end -}} - {{- if eq $ingressValues.certType "ixcert" -}} {{- $_ := set $ "ObjectValues" (dict "certHolder" $ingressValues) -}} {{- print ("---") | nindent 0 -}} diff --git a/library/common/templates/classes/ingress/_authForward.tpl b/library/common/templates/classes/ingress/_authForward.tpl deleted file mode 100644 index 7cb6b9c5fb2..00000000000 --- a/library/common/templates/classes/ingress/_authForward.tpl +++ /dev/null @@ -1,30 +0,0 @@ -{{/* -Renders the additional authForward objects from ingress -*/}} -{{- define "common.classes.ingress.authForward" -}} -{{- $authForwardName := include "common.names.fullname" . -}} -{{- $values := .Values -}} -{{- if hasKey . "ObjectValues" -}} - {{- with .ObjectValues.ingress -}} - {{- $values = . -}} - {{- end -}} -{{ end -}} -{{- if hasKey $values "nameSuffix" -}} - {{- $authForwardName = printf "%v-%v" $authForwardName $values.nameSuffix -}} -{{ end -}} -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: {{ $authForwardName }}-auth-forward -spec: - forwardAuth: - address: {{ $values.authForwardURL | quote }} - tls: - insecureSkipVerify: true - trustForwardHeader: true - authResponseHeaders: - - Remote-User - - Remote-Groups - - Remote-Name - - Remote-Email -{{- end }} diff --git a/library/common/templates/classes/ingress/_ingress.tpl b/library/common/templates/classes/ingress/_ingress.tpl index 18d9b68a71d..4ec7a533700 100644 --- a/library/common/templates/classes/ingress/_ingress.tpl +++ b/library/common/templates/classes/ingress/_ingress.tpl @@ -14,6 +14,7 @@ within the common library. {{- end -}} {{ end -}} + {{- if hasKey $values "nameSuffix" -}} {{- $ingressName = printf "%v-%v" $ingressName $values.nameSuffix -}} {{- if and ( $.Values.services ) ( not $values.servicePort ) }} @@ -52,7 +53,7 @@ metadata: traefik.ingress.kubernetes.io/service.serversscheme: https {{- end }} traefik.ingress.kubernetes.io/router.entrypoints: {{ $values.entrypoint | default "websecure" }} - traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd{{ if $values.authForwardURL }},{{ $ingressName }}-auth-forward{{ end }} + traefik.ingress.kubernetes.io/router.middlewares: traefik-middlewares-chain-public@kubernetescrd{{ if $values.authForwardURL }},{{ $ingressName }}-auth-forward@kubernetescrd{{ end }} {{- with $values.annotations }} {{- toYaml . | nindent 4 }} {{- end }} @@ -115,4 +116,26 @@ spec: servicePort: {{ $svcPort }} {{- end }} {{- end }} + +{{- if $values.authForwardURL }} + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $ingressName }}-auth-forward +spec: + forwardAuth: + address: {{ $values.authForwardURL | quote }} + tls: + insecureSkipVerify: true + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email +{{- end }} + {{- end }} diff --git a/library/common/templates/classes/ingress/_ingressRoute.tpl b/library/common/templates/classes/ingress/_ingressRoute.tpl index 643a6d2e37b..b3c2f1f8a38 100644 --- a/library/common/templates/classes/ingress/_ingressRoute.tpl +++ b/library/common/templates/classes/ingress/_ingressRoute.tpl @@ -81,7 +81,7 @@ spec: middlewares: - name: traefik-middlewares-chain-public@kubernetescrd {{- if $values.authForwardURL }} - - name: "{{ $ingressName }}-auth-forward" + - name: "{{ $ingressName }}-auth-forward@kubernetescrd" {{- end }} {{- end }} @@ -102,4 +102,24 @@ spec: {{- end }} {{- end }} +{{- if $values.authForwardURL }} +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $ingressName }}-auth-forward +spec: + forwardAuth: + address: {{ $values.authForwardURL | quote }} + tls: + insecureSkipVerify: true + trustForwardHeader: true + authResponseHeaders: + - Remote-User + - Remote-Groups + - Remote-Name + - Remote-Email + +{{- end }} {{- end }}