chore(docs): provide a reproducible example

Release-As: 1.3.0
meysam81 · Nov 3, 2024 · 8d37bc2 · 8d37bc2
1 parent f2b0289
commit 8d37bc2
Show file tree

Hide file tree

Showing 8 changed files with 82 additions and 156 deletions.
diff --git a/default-backend/README.md b/default-backend/README.md
@@ -0,0 +1,12 @@
+# Default Backend
+
+## Usage
+
+```yaml
+# kustomization.yml
+
+resources:
+  - https://github.com/meysam81/kustomizations//default-backend/overlays/default/?ref=v1.3.0
+
+namespace: cert-manager
+```
diff --git a/oathkeeper-maester/README.md b/oathkeeper-maester/README.md
@@ -0,0 +1,12 @@
+# Oathkeeper Maester
+
+## Usage
+
+```yaml
+# kustomization.yml
+
+resources:
+  - https://github.com/meysam81/kustomizations//oathkeeper-maester/overlays/vm/?ref=v1.3.0
+
+namespace: auth
+```
diff --git a/oathkeeper/README.md b/oathkeeper/README.md
@@ -0,0 +1,25 @@
+# Oathkeeper
+
+## Usage
+
+```yaml
+# oathkeeper-server-config.yml
+
+# ... truncated ...
+
+```
+
+```yaml
+# kustomization.yml
+
+configMapGenerator:
+  - behavior: replace
+    files:
+      - config.yml=oathkeeper-server-config.yml
+    name: oathkeeper-config
+
+resources:
+  - https://github.com/meysam81/kustomizations//oathkeeper/overlays/vm/?ref=v1.3.0
+
+namespace: auth
+```
diff --git a/oathkeeper/base/deployment.yml b/oathkeeper/base/deployment.yml
@@ -14,8 +14,6 @@ spec:
       containers:
         - args:
             - serve
-            - "--config"
-            - /etc/oathkeeper/config.yml
           command:
             - oathkeeper
           image: oryd/oathkeeper
@@ -71,17 +69,10 @@ spec:
             runAsUser: 65534
             seccompProfile:
               type: RuntimeDefault
-          volumeMounts:
-            - mountPath: /etc/oathkeeper
-              name: oathkeeper-config
-              readOnly: true
+          volumeMounts: []
       securityContext:
         fsGroup: 65534
         fsGroupChangePolicy: Always
       serviceAccountName: oathkeeper
       terminationGracePeriodSeconds: 300
-      volumes:
-        - configMap:
-            defaultMode: 0444
-            name: oathkeeper-config
-          name: oathkeeper-config
+      volumes: []
diff --git a/oathkeeper/base/kustomization.yml b/oathkeeper/base/kustomization.yml
@@ -2,11 +2,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-configMapGenerator:
-  - files:
-      - config.yml=oathkeeper-server-config.yml
-    name: oathkeeper-config
-
 images:
   - name: oryd/oathkeeper
   - name: bitnami/kubectl

diff --git a/oathkeeper/base/oathkeeper-server-config.yml b/oathkeeper/base/oathkeeper-server-config.yml
diff --git a/oathkeeper/overlays/vm/kustomization.yml b/oathkeeper/overlays/vm/kustomization.yml
@@ -1,7 +1,6 @@
 ---
 configMapGenerator:
-  - behavior: replace
-    files:
+  - files:
       - config.yml=oathkeeper-server-config.yml
     name: oathkeeper-config
 
@@ -15,6 +14,36 @@ images:
   - name: bitnami/kubectl
     newTag: 1.31.2
 
+patches:
+  - patch: |
+      - op: add
+        path: /spec/template/spec/containers/0/args/-
+        value: --config=/etc/oathkeeper/config.yml
+    target:
+      kind: Deployment
+      name: oathkeeper
+  - patch: |
+      - op: add
+        path: /spec/template/spec/containers/0/volumeMounts/-
+        value:
+          mountPath: /etc/oathkeeper/config.yml
+          name: oathkeeper-config
+          readOnly: true
+          subPath: config.yml
+      - op: add
+        path: /spec/template/spec/volumes/-
+        value:
+          configMap:
+            defaultMode: 0444
+            items:
+              - key: config.yml
+                path: config.yml
+            name: oathkeeper-config
+          name: oathkeeper-config
+    target:
+      kind: Deployment
+      name: oathkeeper
+
 replacements:
   - source:
       kind: Service

diff --git a/oathkeeper/overlays/vm/oathkeeper-server-config.yml b/oathkeeper/overlays/vm/oathkeeper-server-config.yml
@@ -1,139 +1 @@
 ---
-access_rules:
-  matching_strategy: regexp
-  repositories:
-    - file:///etc/rules/access-rules.json
-authenticators:
-  anonymous:
-    config:
-      subject: guest
-    enabled: true
-  cookie_session:
-    config:
-      check_session_url: http://kratos-public.auth/sessions/whoami
-      extra_from: "@this"
-      force_method: GET
-      only:
-        - ory_kratos_session
-      preserve_path: true
-      preserve_query: true
-      subject_from: identity.id
-    enabled: true
-  bearer_token:
-    enabled: true
-    config:
-      check_session_url: http://kratos-public.auth/sessions/whoami
-      extra_from: "@this"
-      force_method: GET
-      forward_http_headers:
-        - x-session-token
-      preserve_path: true
-      subject_from: identity.id
-      token_from:
-        header: x-session-token
-  oauth2_client_credentials:
-    enabled: true
-    config:
-      token_url: http://hydra-public.auth/oauth2/token
-      retry:
-        give_up_after: 2s
-        max_delay: 1s
-      cache:
-        enabled: true
-        ttl: 60s
-        max_tokens: 300
-      required_scope: []
-  oauth2_introspection:
-    config:
-      introspection_url: http://hydra-admin.auth/admin/oauth2/introspect
-      required_scope: []
-      cache:
-        enabled: true
-        ttl: 300s
-    enabled: true
-  jwt:
-    config:
-      jwks_urls:
-        - http://hydra-public.auth/.well-known/jwks.json
-    enabled: true
-  noop:
-    enabled: true
-  unauthorized:
-    enabled: true
-authorizers:
-  allow:
-    enabled: true
-  deny:
-    enabled: true
-  remote_json:
-    config:
-      payload: ""
-      remote: http://keto-read.auth/relation-tuples/check
-    enabled: true
-errors:
-  fallback:
-    - redirect
-    - json
-  handlers:
-    json:
-      config:
-        verbose: true
-      enabled: true
-    redirect:
-      config:
-        return_to_query_param: return_to
-        to: https://auth.developer-friendly.blog/login
-        when:
-          - error:
-              - unauthorized
-      enabled: true
-log:
-  format: json
-  leak_sensitive_values: true
-  level: debug
-mutators:
-  header:
-    config:
-      headers: {}
-    enabled: true
-  noop:
-    enabled: true
-  id_token:
-    enabled: true
-    config:
-      issuer_url: https://oauth2.developer-friendly.blog
-      jwks_url: http://hydra-public.auth/.well-known/jwks.json
-serve:
-  api:
-    port: 4456
-  prometheus:
-    port: 9000
-  proxy:
-    port: 4455
-    timeout:
-      read: 60m
-      idle: 60m
-      write: 60m
-    cors:
-      enabled: true
-      allowed_headers:
-        - accept
-        - content-type
-      allowed_methods:
-        - GET
-        - POST
-        - PUT
-        - DELETE
-        - PATCH
-      allowed_origins:
-        - https://*.developer-friendly.blog
-      allow_credentials: true
-      debug: false
-# tracing:
-#   provider: jaeger
-#   providers:
-#     jaeger:
-#       local_agent_address: jaeger.monitoring:6831
-#       sampling:
-#         server_url: http://jaeger.monitoring:5778/sampling
-#   service_name: oathkeeper