mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
3f46279b39
Add oauth2-proxy (GitHub provider, org-restricted) as a reverse proxy in front of the dsh-gateway, wired through the Traefik Gateway API. The gateway inherits the authenticated GitHub username via X-Forwarded-User (SSO). - gateway.py: opt-in AUTH_PROXY_HEADER trust, remote_user(), SSO bootstrap (auto-provision claim + mint/rotate token + session cookie), patch_token() - 50-gateway.yaml: AUTH_PROXY_HEADER=X-Forwarded-User, COOKIE_SECURE=true - gateway-api/dsh-demo: oauth2-proxy Deployment/Service + secret example, HTTPRoute backend -> oauth2-proxy:4180 - tests: 10 new SSO cases (106 passing) Placeholders (dsh-demo.example.com, your-github-org) are substituted at apply time. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
31 lines
1.2 KiB
Plaintext
31 lines
1.2 KiB
Plaintext
# EXAMPLE ONLY — do not apply as-is.
|
|
#
|
|
# oauth2-proxy reads its GitHub OAuth credentials and cookie-signing secret from
|
|
# this Secret. Populate real values and apply:
|
|
#
|
|
# kubectl -n dsh-demo create secret generic oauth2-proxy \
|
|
# --from-literal=client-id='<GitHub OAuth App client ID>' \
|
|
# --from-literal=client-secret='<GitHub OAuth App client secret>' \
|
|
# --from-literal=cookie-secret="$(openssl rand -base64 32)"
|
|
#
|
|
# The cookie secret must be a strong random value (16/24/32 bytes, base64).
|
|
# Generate it with: openssl rand -base64 32
|
|
#
|
|
# GitHub OAuth App (https://github.com/settings/developers):
|
|
# Homepage URL https://dsh-demo.example.com
|
|
# Authorization callback https://dsh-demo.example.com/oauth2/callback
|
|
# (replace dsh-demo.example.com with the actual public FQDN)
|
|
#
|
|
# NOTE: the cookie secret should NOT be base64-encoded again when passed via
|
|
# --from-literal (kubectl stores it as-is and the Secret encodes it for you).
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: oauth2-proxy
|
|
namespace: dsh-demo
|
|
type: Opaque
|
|
stringData:
|
|
client-id: "<github-oauth-app-client-id>"
|
|
client-secret: "<github-oauth-app-client-secret>"
|
|
cookie-secret: "<openssl-rand-base64-32>"
|