values.yaml

nameOverride: ""
fullnameOverride: ""
kubeVersionOverride: ""
deployment:
  replicaCount: 1
  image:
    repository: quay.io/gogatekeeper/gatekeeper
    # tag: null  # default is Chart.appVersion
    pullPolicy: IfNotPresent
  strategy:
    type: Recreate
    # rollingUpdate:
    #   maxSurge: 25%
    #   maxUnavailable: 25%
  automountServiceAccountToken: false
  podAnnotations: {}
  podLabels: {}
  podSecurityContext:
    enabled: false
    # fsGroup: 2000
  containerSecurityContext:
    enabled: true
    capabilities:
      drop:
        - ALL
    readOnlyRootFilesystem: true
    runAsNonRoot: true
    # runAsUser: 1000
  extraArgs: []
  # - --foo
  # - --bar
  extraEnvVars: []
  # - name: FOO
  #   value: BAR
  extraVolumes: []
  # - emptyDir: {}
  #   name: tmp
  extraVolumeMounts: []
  # - mountPath: /tmp
  #   name: tmp
  priorityClassName: ""
  hostAliases: []
  # - ip: "127.0.0.1"
  #   hostnames:
  #   - "foo.local"
  #   - "bar.local"
  # - ip: "10.1.2.3"
  #   hostnames:
  #   - "foo.remote"
  #   - "bar.remote"
  resources:
    limits: {}
    #   cpu: 100m
    #   memory: 128Mi
    requests: {}
    #   cpu: 100m
    #   memory: 128Mi
  nodeSelector: {}
  tolerations: []
  affinity: {}
  livenessProbe:
    enabled: false
    httpGet:
      path: /oauth/health
      port: admin
  readinessProbe:
    enabled: true
    httpGet:
      path: /oauth/health
      port: admin
service:
  type: ClusterIP
  annotations: {}
  proxy:
    port: 3000
    nodePort:
  admin:
    port: 4000
    nodePort:
serviceAccount:
  create: true
  annotations: {}
  name: ""
targetService:
  host: myservice.myplatform.eoepca.org
  name: target-service
  port:
    number: 80
ingress:
  enabled: true
  className: ""
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/configuration-snippet: |-
      auth_request /auth;
    nginx.ingress.kubernetes.io/server-snippet: |-
      {{ include "identity-gatekeeper.ingressServerSnippet" . }}

  # openUri specifies a set of $request_uri regex to match for open access - i.e. avoiding the auth check
  openUri: []

  # Server snippets separated into different values, to allow them to be more easily overridden,
  # and to more easily introduce addition custom locations.
  serverSnippets:
    custom: |-
      #----------
      # Custom server snippets
      #----------
    gatekeeper: |-
      #----------
      # Gatekeeper-specific server snippets
      #----------
      # Open endpoints provided by gatekeeper itself
      # - which should passthru to gatekeeper, rather than the 'target' protected service,
      # without need for any auth.
      location ~ /oauth/(authorize|callback|expired|login|logout|token|discovery) {
        proxy_pass {{ include "identity-gatekeeper.proxyServiceUrl" . }}$request_uri;
      }
      location ~ /oauth/(health|metrics) {
        proxy_pass {{ include "identity-gatekeeper.adminServiceUrl" . }}$request_uri;
      }
    auth: |-
      #----------
      # Auth Request server snippets
      #----------
      # Endpoint for the nginx 'auth_request' - which directs to gatekeeper
      location ^~ /auth {
        internal;
        {{- range .Values.ingress.openUri }}
        if ($request_uri ~ {{ . }}) {
          return 200;
        }
        {{- end }}
        proxy_pass {{ include "identity-gatekeeper.proxyServiceUrl" . }}$request_uri;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Method $request_method;
        proxy_set_header X-Forwarded-URI $request_uri;
        proxy_busy_buffers_size 64k;
        proxy_buffers 8 32k;
        proxy_buffer_size 32k;
      }
  hosts:
    - host: "{{ .Values.targetService.host }}"
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: "{{ .Values.targetService.name }}"
              port:
                number: "{{ .Values.targetService.port.number }}"
  tls:
    - secretName: |-
        {{ include "identity-gatekeeper.fullname" . }}-tls
      hosts:
        - "{{ .Values.targetService.host }}"
autoscaling:
  enabled: false
  minReplicas: 1
  maxReplicas: 3
  targetCPUUtilizationPercentage: 80
  #targetMemoryUtilizationPercentage: 80
pdb:
  create: false
  minAvailable: 1
metrics:
  addPrometheusScrapeAnnotation: false
  serviceMonitor:
    enabled: false
    namespace: um
    additionalLabels: {}
    annotations: {}
    interval:
config:
  client-id: myclient
  discovery-url: https://identity.keycloak.myplatform.eoepca.org/realms/master
  no-redirects: true
  no-proxy: true
  enable-uma: true
  #enable-default-deny: true
  cookie-domain: myplatform.eoepca.org
  cookie-access-name: auth_user_id
  cookie-refresh-name: auth_refresh_token
  #secure-cookie: true
  enable-metrics: true
  enable-logging: true
  enable-request-id: true
  enable-login-handler: true
  enable-refresh-tokens: true
  enable-logout-redirect: true
  listen: :3000
  listen-admin: :4000
secrets:
  clientSecret: ""
  encryptionKey: ""