adds basic-auth (kubeflow#41)

add selector to deployments, istio virtual service add full path for virtualservice adds clusterDomain to vars
arrikto · May 7, 2019 · ad3874e · ad3874e
1 parent bbb4389
commit ad3874e
Show file tree

Hide file tree

Showing 8 changed files with 162 additions and 0 deletions.
diff --git a/common/basic-auth/base/gatekeeper-deployment.yaml b/common/basic-auth/base/gatekeeper-deployment.yaml
@@ -0,0 +1,38 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: basic-auth
+spec:
+  selector:
+    matchLabels:
+      app: basic-auth-login
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: basic-auth
+    spec:
+      name: app
+      containers:
+      - args:
+        - --username=$(USERNAME)
+        - --pwhash=$(PASSWORDHASH)
+        command:
+        - /opt/kubeflow/gatekeeper
+        env:
+        - name: USERNAME
+          valueFrom:
+            secretKeyRef:
+              key: username
+              name: kubeflow-login
+        - name: PASSWORDHASH
+          valueFrom:
+            secretKeyRef:
+              key: passwordhash
+              name: kubeflow-login
+        image: gcr.io/kubeflow-images-public/gatekeeper:v20190211-v0.4.0-rc.1-119-g5098995b-e3b0c4
+        ports:
+        - containerPort: 8085
+        workingDir: /opt/kubeflow
diff --git a/common/basic-auth/base/gatekeeper-service.yaml b/common/basic-auth/base/gatekeeper-service.yaml
@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    getambassador.io/config: |-
+      ---
+      apiVersion: ambassador/v0
+      kind:  AuthService
+      name: basic-auth
+      auth_service: basic-auth.$(service-namespace):8085
+      allowed_headers:
+      - "x-from-login"
+  name: basic-auth
+spec:
+  ports:
+  - port: 8085
+    targetPort: 8085
+  selector:
+    app: basic-auth
+  type: ClusterIP
diff --git a/common/basic-auth/base/kflogin-deployment.yaml b/common/basic-auth/base/kflogin-deployment.yaml
@@ -0,0 +1,21 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: basic-auth-login
+spec:
+  selector:
+    matchLabels:
+      app: basic-auth-login
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: basic-auth-login
+    spec:
+      name: app
+      containers:
+      - image: gcr.io/kubeflow-images-public/kflogin-ui:v20190123-v0.4.0-rc.1-73-g38ad5f77
+        ports:
+        - containerPort: 5000
diff --git a/common/basic-auth/base/kflogin-service.yaml b/common/basic-auth/base/kflogin-service.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    getambassador.io/config: |-
+      ---
+      apiVersion: ambassador/v0
+      kind:  Mapping
+      name: kflogin-mapping
+      prefix: /kflogin
+      rewrite: /kflogin
+      timeout_ms: 300000
+      service: basic-auth-login.$(service-namespace)
+      use_websocket: true
+  name: basic-auth-login
+spec:
+  ports:
+  - port: 80
+    targetPort: 5000
+  selector:
+    app: basic-auth-login
+  type: ClusterIP
diff --git a/common/basic-auth/base/kflogin-virtual-service.yaml b/common/basic-auth/base/kflogin-virtual-service.yaml
@@ -0,0 +1,20 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: gatekeeper
+spec:
+  gateways:
+  - kubeflow-gateway
+  hosts:
+  - '*'
+  http:
+  - match:
+    - uri:
+        prefix: /kflogin
+    rewrite:
+      uri: /kflogin
+    route:
+    - destination:
+        host: basic-auth.$(service-namespace).svc.$(clusterDomain)
+        port:
+          number: 8085
diff --git a/common/basic-auth/base/kustomization.yaml b/common/basic-auth/base/kustomization.yaml
@@ -0,0 +1,35 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- kflogin-deployment.yaml
+- gatekeeper-deployment.yaml
+- gatekeeper-service.yaml
+- kflogin-service.yaml
+- kflogin-virtual-service.yaml
+
+commonLabels:
+  kustomize.component: basic-auth
+namespace: kubeflow
+
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: parameters
+  env: params.env
+vars:
+- name: service-namespace
+  objref:
+    kind: Service
+    name: basic-auth
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.namespace
+- name: clusterDomain
+  objref:
+    kind: ConfigMap
+    name: parameters
+    apiVersion: v1
+  fieldref:
+fieldpath: data.clusterDomain
+configurations:
+- params.yaml
diff --git a/common/basic-auth/base/params.env b/common/basic-auth/base/params.env
@@ -0,0 +1 @@
+clusterDomain=cluster.local
diff --git a/common/basic-auth/base/params.yaml b/common/basic-auth/base/params.yaml
@@ -0,0 +1,5 @@
+varReference:
+- path: metadata/annotations/getambassador.io\/config
+  kind: Service
+- path: spec/http/route/destination/host
+  kind: VirtualService