Skip to content

Generalize proxy external auth #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
SystemsPurge wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Generalize proxy external auth #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
14c4dd0
fix: replace deprecated bitnami charts, set equivalent debian postgre…
Oct 10, 2025
847ed1b
fix: generalize oauth proxy login, fix incorrect secret names
Oct 14, 2025
87cd4bf
put back proxy body size to ingress annotations
Oct 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions charts/villas/Chart.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
dependencies:
- name: rabbitmq
repository: https://charts.bitnami.com/bitnami
version: 10.3.6
- name: postgresql
repository: https://charts.bitnami.com/bitnami
version: 11.9.1
repository: oci://registry-1.docker.io/cloudpirates
version: 0.3.2
- name: postgres
repository: oci://registry-1.docker.io/cloudpirates
version: 0.7.3
- name: minio
repository: https://charts.bitnami.com/bitnami
version: 11.10.3
digest: sha256:402fe7dacea276f5fb96caa8e4837bcb6309d3bb2e41dc7113adfaaf78ca6e66
generated: "2022-09-28T11:25:46.960695+02:00"
digest: sha256:0e95383933f3249335bb0b5e6b72b45763dc9fd078e3d86a37bf46e910c51de3
generated: "2025-10-09T13:47:55.981685779Z"
10 changes: 5 additions & 5 deletions charts/villas/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,14 @@ maintainers:

dependencies:
- name: rabbitmq
version: 10.3.6
repository: "https://charts.bitnami.com/bitnami"
version: 0.3.2
repository: "oci://registry-1.docker.io/cloudpirates"
condition: "broker.enabled"
alias: broker

- name: postgresql
version: 11.9.1
repository: "https://charts.bitnami.com/bitnami"
- name: postgres
version: 0.7.3
repository: "oci://registry-1.docker.io/cloudpirates"
condition: "database.enabled"
alias: database

Expand Down
Binary file added charts/villas/charts/postgres-0.7.3.tgz
View file
Open in desktop
Binary file not shown.
Binary file removed charts/villas/charts/postgresql-11.9.1.tgz
View file
Open in desktop
Binary file not shown.
Binary file added charts/villas/charts/rabbitmq-0.3.2.tgz
View file
Open in desktop
Binary file not shown.
Binary file removed charts/villas/charts/rabbitmq-10.3.6.tgz
View file
Open in desktop
Binary file not shown.
2 changes: 1 addition & 1 deletion charts/villas/templates/controller-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ spec:
valueFrom:
secretKeyRef:
name: {{ include "broker.secretName" . }}
key: rabbitmq-password
key: password
{{- else }}
- name: AMQP_USER
value: {{ .Values.broker.external.username | quote }}
Expand Down
8 changes: 8 additions & 0 deletions charts/villas/templates/ingress.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,16 @@ metadata:
labels:
{{- include "villas.labels" . | nindent 4 }}
annotations:
{{- if .Values.web.auth.external.enabled }}
nginx.ingress.kubernetes.io/proxy-set-headers: "true"
nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
nginx.ingress.kubernetes.io/proxy-buffers-number: "4"
nginx.ingress.kubernetes.io/proxy-buffering: "on"
{{- else }}
nginx.ingress.kubernetes.io/proxy-buffering: "off"
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
nginx.ingress.kubernetes.io/proxy-body-size: 1024m
{{- end }}
nginx.ingress.kubernetes.io/rewrite-target: /$1
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/proxy-body-size: 1024m
Copy link
Contributor

@stv0g stv0g Oct 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this was necessary to upload larger files, e.g. CSV results which are pushed to VILLASweb.

Expand Down
12 changes: 6 additions & 6 deletions charts/villas/templates/proxy-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,16 +31,16 @@ spec:
value: "http://{{ include "villas.fullname" . }}-web-backend"
- name: OAUTH2_PROXY_CLIENT_ID
value: {{ .Values.web.auth.external.client_id | quote }}
- name: OAUTH2_PROXY_REDIRECT_URL
value: "https://{{ .Values.ingress.host}}/oauth2/callback"
- name: OAUTH2_PROXY_CODE_CHALLENGE_METHOD
value: {{ .Values.web.auth.external.pkce_method | quote }}
- name: OAUTH2_PROXY_CLIENT_SECRET
value: {{ .Values.web.auth.external.client_secret | quote }}
- name: OAUTH2_PROXY_COOKIE_SECRET
value: {{ .Values.web.auth.external.cookie_secret }}
- name: OAUTH2_PROXY_LOGIN_URL
value: {{ .Values.web.auth.external.login_url | quote }}
- name: OAUTH2_PROXY_REDEEM_URL
value: {{ .Values.web.auth.external.redeem_url | quote }}
- name: OAUTH2_PROXY_VALIDATE_URL
value: {{ .Values.web.auth.external.validate_url | quote }}
- name: OAUTH2_PROXY_OIDC_ISSUER_URL
value: {{ .Values.web.auth.external.issuer_url | quote }}
- name: OAUTH2_PROXY_REVERSE_PROXY
value: "true"
- name: OAUTH2_PROXY_SET_XAUTHREQUEST
Expand Down
4 changes: 2 additions & 2 deletions charts/villas/templates/web-backend-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ spec:
valueFrom:
secretKeyRef:
name: {{ include "database.secretName" . }}
key: password
key: postgres-password
{{- else }}
value: {{ .Values.database.external.password | quote }}
{{- end }}
Expand All @@ -60,7 +60,7 @@ spec:
valueFrom:
secretKeyRef:
name: {{ include "broker.secretName" . }}
key: rabbitmq-password
key: password
{{- else }}
value: {{ .Values.broker.external.password | quote }}
{{- end }}
Expand Down
21 changes: 9 additions & 12 deletions charts/villas/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,24 +57,19 @@ web:
# password: changeme

external:
enabled: false
enabled: true

client_id: villas
client_secret: "Ho0Zeilahxoh3Cae0ao9rieHooL1oonah0nash6aiNae7phaiceeCoo9Eesh6tei"

pkce_method: S256
client_secret: ff
cookie_secret: "ohth8iin6QuiequeGu5tiengizip4eid"

# email_domains:
# - "*"
# allowed_groups:
# - student

provider: jupyterhub
provider_name: JupyterHub

login_url: https://jupyter.k8s.eonerc.rwth-aachen.de/hub/api/oauth2/authorize
redeem_url: https://jupyter.k8s.eonerc.rwth-aachen.de/hub/api/oauth2/token
validate_url: https://jupyter.k8s.eonerc.rwth-aachen.de/hub/api/oauth2/validate
provider_name: keycloak
provider: oidc
issuer_url: https://keycloak.k8s.eonerc.rwth-aachen.de/realms/s-dev-realm

backend:
enabled: true
Expand All @@ -91,7 +86,7 @@ proxy:
image: quay.io/oauth2-proxy/oauth2-proxy

extraEnv:
OAUTH2_PROXY_JUPYTERHUB_URL: https://jupyter.k8s.eonerc.rwth-aachen.de
OAUTH2_PROXY_SILENCE_PING_LOGGING: true

node:
enabled: true
Expand Down Expand Up @@ -222,6 +217,8 @@ controller:
extraConfig: {}

database:
image:
tag: 14.5-bullseye
# Set to false for using an external broker
# If so, provide the connection details in broker.external
enabled: true
Expand Down