From 40a90fa661334197c89a857bc7c60c807572d70e Mon Sep 17 00:00:00 2001 From: John Lybeck Date: Wed, 26 Aug 2026 11:55:41 +0200 Subject: [PATCH] EAI-7305: Remove cluster-auth from the stack cluster-auth no longer authenticates anything. The AIM serving routes are covered by the route-scoped workloads-extauth policy and ai-gateway by its gateway-scoped default-deny, and neither the airm nor the aiwb chart has a live reference to it. On app-dev its own counters show 230k checks over 15 days, all fast_path with authenticator=none and zero denies. - drop the cluster-auth and cluster-auth-config apps from root/values.yaml and from enabledApps in all three sizings, plus the medium resources override - delete the cluster-auth (0.5.0, 0.5.9) and cluster-auth-config chart sources - delete the cluster-auth ext_authz SecurityPolicy and its ReferenceGrant - stop writing the OpenBao root token to secrets/cluster-auth-openbao-token, and drop the now-inert INIT_MODE export that only drove that write - drop the security-policy-extauth patch block from the OpenShift installer, which would have aborted the install under set -e once the template is gone - refresh the SBOM and the stale comments that referenced the ext_authz hop --- docs/openshift/install.sh | 9 - root/values.yaml | 16 -- root/values_large.yaml | 2 - root/values_medium.yaml | 8 - root/values_small.yaml | 2 - sbom/SBOM.md | 104 ++++++----- sbom/components.yaml | 8 - .../cluster-auth-config/cluster-auth-es.yaml | 20 --- sources/cluster-auth/0.5.0/.helmignore | 20 --- sources/cluster-auth/0.5.0/Chart.yaml | 19 -- .../cluster-auth/0.5.0/templates/NOTES.txt | 61 ------- .../cluster-auth/0.5.0/templates/_helpers.tpl | 61 ------- .../0.5.0/templates/clusterrole.yaml | 10 -- .../0.5.0/templates/clusterrolebinding.yaml | 14 -- .../0.5.0/templates/configmap.yaml | 12 -- .../0.5.0/templates/deployment.yaml | 101 ----------- .../templates/job-restart-envoygateway.yaml | 20 --- .../0.5.0/templates/namespace.yaml | 8 - .../0.5.0/templates/rbac-restart-job.yaml | 54 ------ .../cluster-auth/0.5.0/templates/service.yaml | 32 ---- .../0.5.0/templates/serviceaccount.yaml | 7 - .../0.5.0/templates/servicemonitor.yaml | 18 -- sources/cluster-auth/0.5.0/values.yaml | 163 ------------------ sources/cluster-auth/0.5.9/.helmignore | 20 --- sources/cluster-auth/0.5.9/Chart.yaml | 18 -- .../cluster-auth/0.5.9/templates/NOTES.txt | 61 ------- .../cluster-auth/0.5.9/templates/_helpers.tpl | 61 ------- .../0.5.9/templates/clusterrole.yaml | 10 -- .../0.5.9/templates/clusterrolebinding.yaml | 14 -- .../0.5.9/templates/configmap.yaml | 12 -- .../0.5.9/templates/deployment.yaml | 101 ----------- .../templates/job-restart-envoygateway.yaml | 20 --- .../0.5.9/templates/namespace.yaml | 8 - .../0.5.9/templates/rbac-restart-job.yaml | 54 ------ .../cluster-auth/0.5.9/templates/service.yaml | 32 ---- .../0.5.9/templates/serviceaccount.yaml | 7 - .../0.5.9/templates/servicemonitor.yaml | 18 -- sources/cluster-auth/0.5.9/values.yaml | 163 ------------------ .../templates/reference-grant-extauth.yaml | 16 -- ...curity-policy-ai-gateway-default-deny.yaml | 3 +- .../templates/security-policy-extauth.yaml | 31 ---- sources/envoy-gateway-config/values.yaml | 3 +- .../templates/openbao-secret-definitions.yaml | 3 - .../templates/openbao-secret-manager-cm.yaml | 11 -- .../0.1.0/templates/cf-init-openbao-job.yaml | 1 - 45 files changed, 53 insertions(+), 1383 deletions(-) delete mode 100644 sources/cluster-auth-config/cluster-auth-es.yaml delete mode 100644 sources/cluster-auth/0.5.0/.helmignore delete mode 100644 sources/cluster-auth/0.5.0/Chart.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/NOTES.txt delete mode 100644 sources/cluster-auth/0.5.0/templates/_helpers.tpl delete mode 100644 sources/cluster-auth/0.5.0/templates/clusterrole.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/clusterrolebinding.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/configmap.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/deployment.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/job-restart-envoygateway.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/namespace.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/rbac-restart-job.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/service.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/serviceaccount.yaml delete mode 100644 sources/cluster-auth/0.5.0/templates/servicemonitor.yaml delete mode 100644 sources/cluster-auth/0.5.0/values.yaml delete mode 100644 sources/cluster-auth/0.5.9/.helmignore delete mode 100644 sources/cluster-auth/0.5.9/Chart.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/NOTES.txt delete mode 100644 sources/cluster-auth/0.5.9/templates/_helpers.tpl delete mode 100644 sources/cluster-auth/0.5.9/templates/clusterrole.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/clusterrolebinding.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/configmap.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/deployment.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/job-restart-envoygateway.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/namespace.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/rbac-restart-job.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/service.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/serviceaccount.yaml delete mode 100644 sources/cluster-auth/0.5.9/templates/servicemonitor.yaml delete mode 100644 sources/cluster-auth/0.5.9/values.yaml delete mode 100644 sources/envoy-gateway-config/templates/reference-grant-extauth.yaml delete mode 100644 sources/envoy-gateway-config/templates/security-policy-extauth.yaml diff --git a/docs/openshift/install.sh b/docs/openshift/install.sh index bba4e29e..c95f35be 100755 --- a/docs/openshift/install.sh +++ b/docs/openshift/install.sh @@ -427,15 +427,6 @@ echo "✅ Sources extracted to ${SOURCES_DIR}" # Apply fixes to cloned sources that have not yet been merged upstream. # ============================================================================ -# Fix: SecurityPolicy extAuth.failOpen must be true for standalone installs. -# Without this, Envoy returns HTTP 500 on every request because it cannot reach -# the gRPC ext-auth service on port 50051 (cluster-auth shim is REST on 8081). -EXTAUTH_TPL="${SOURCES_DIR}/envoy-gateway-config/templates/security-policy-extauth.yaml" -if ! grep -q "failOpen" "${EXTAUTH_TPL}" 2>/dev/null; then - sed -i 's/ extAuth:/ extAuth:\n failOpen: true/' "${EXTAUTH_TPL}" - echo "✅ Patched envoy-gateway-config SecurityPolicy: failOpen=true" -fi - # --- envoy-gateway-config, for the AI gateway on OpenShift ------------------- # The chart is written for RKE2: a LoadBalancer apps gateway owning the whole # domain, and ordinary node sizes. Three lines have to change here. Patching the diff --git a/root/values.yaml b/root/values.yaml index f84cb53b..bbb2158c 100644 --- a/root/values.yaml +++ b/root/values.yaml @@ -321,22 +321,6 @@ apps: syncWave: -40 valuesObject: installCRDs: true - cluster-auth: - namespace: cluster-auth - path: cluster-auth/0.5.9 - syncWave: -25 - valuesFile: values.yaml - cluster-auth-config: - ignoreDifferences: - - group: external-secrets.io - jqPathExpressions: - - ".spec.data[].remoteRef.conversionStrategy" - - ".spec.data[].remoteRef.decodingStrategy" - - ".spec.data[].remoteRef.metadataPolicy" - kind: ExternalSecret - namespace: cluster-auth - path: cluster-auth-config - syncWave: -20 cnpg-operator: namespace: cnpg-system path: cnpg-operator/0.26.0 diff --git a/root/values_large.yaml b/root/values_large.yaml index c9aa50bc..2638e32e 100644 --- a/root/values_large.yaml +++ b/root/values_large.yaml @@ -16,8 +16,6 @@ enabledApps: - argocd - argocd-config - cert-manager - - cluster-auth - - cluster-auth-config - cnpg-operator - external-secrets - external-secrets-config diff --git a/root/values_medium.yaml b/root/values_medium.yaml index 523cf7d1..caf679ab 100644 --- a/root/values_medium.yaml +++ b/root/values_medium.yaml @@ -18,8 +18,6 @@ enabledApps: - argocd - argocd-config - cert-manager - - cluster-auth - - cluster-auth-config - cnpg-operator - external-secrets - external-secrets-config @@ -258,12 +256,6 @@ apps: requests: cpu: "5m" memory: "256Mi" - cluster-auth: - valuesObject: - resources: - requests: - cpu: "100m" - memory: "256Mi" cnpg-operator: valuesObject: resources: diff --git a/root/values_small.yaml b/root/values_small.yaml index 5fdc9fb5..21fcd22c 100644 --- a/root/values_small.yaml +++ b/root/values_small.yaml @@ -23,8 +23,6 @@ enabledApps: - argocd - argocd-config - cert-manager - - cluster-auth - - cluster-auth-config - cnpg-operator - external-secrets - external-secrets-config diff --git a/sbom/SBOM.md b/sbom/SBOM.md index cd1c5175..267394a4 100644 --- a/sbom/SBOM.md +++ b/sbom/SBOM.md @@ -19,34 +19,33 @@ | 13 | appwrapper | [1.1.2](https://github.com/project-codeflare/appwrapper/releases/download/v1.1.2/install.yaml) | https://github.com/project-codeflare/appwrapper | [Apache License 2.0](https://github.com/project-codeflare/appwrapper/blob/main/LICENSE) | | 14 | argocd | [8.3.5](https://argoproj.github.io/argo-helm) | https://github.com/argoproj/argo-cd | [Apache License 2.0](https://github.com/argoproj/argo-cd/blob/master/LICENSE) | | 15 | cert-manager | [1.18.2](oci://quay.io/jetstack/charts/cert-manager) | https://github.com/cert-manager/cert-manager | [Apache License 2.0](https://github.com/cert-manager/cert-manager/blob/master/LICENSE) | -| 16 | cluster-auth | [0.5.9](https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth) | https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | -| 17 | cnpg-operator | [0.26.0](https://cloudnative-pg.github.io/charts) | https://github.com/cloudnative-pg/cloudnative-pg | [Apache License 2.0](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/LICENSE) | -| 18 | envoy-ai-gateway | [0.6.0](oci://docker.io/envoyproxy/ai-gateway-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | -| 19 | envoy-ai-gateway-crds | [0.6.0](oci://docker.io/envoyproxy/ai-gateway-crds-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | -| 20 | envoy-gateway | [1.7.1](oci://docker.io/envoyproxy/gateway-helm) | https://github.com/envoyproxy/gateway | [Apache License 2.0](https://github.com/envoyproxy/gateway/blob/main/LICENSE) | -| 21 | external-secrets | [0.15.1](https://charts.external-secrets.io) | https://github.com/external-secrets/external-secrets | [Apache License 2.0](https://github.com/external-secrets/external-secrets/blob/main/LICENSE) | -| 22 | gitea | [12.3.0](https://dl.gitea.com/charts/) | https://github.com/go-gitea/gitea | [MIT License](https://github.com/go-gitea/gitea/blob/main/LICENSE) | -| 23 | inference-extension-crds | [1.5.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension) | https://github.com/kubernetes-sigs/gateway-api-inference-extension | [Apache License 2.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension/blob/main/LICENSE) | -| 24 | kaiwo | [v0.2.1](oci://ghcr.io/silogen/kaiwo-operator-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | -| 25 | kaiwo-crds | [v0.2.1](oci://ghcr.io/silogen/kaiwo-crds-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | -| 26 | keda | [2.18.1](https://kedacore.github.io/charts) | https://github.com/kedacore/keda | [Apache License 2.0](https://github.com/kedacore/keda/blob/main/LICENSE) | -| 27 | kedify-otel | [0.0.6](oci://ghcr.io/kedify/charts/otel-add-on) | https://github.com/kedify/otel-add-on | [Apache License 2.0](https://github.com/kedify/otel-add-on/blob/main/LICENSE) | -| 28 | keycloak | [keycloak-old](https://codecentric.github.io/helm-charts) | https://github.com/keycloak/keycloak | [Apache License 2.0](https://github.com/keycloak/keycloak/blob/main/LICENSE.txt) | -| 29 | kserve | [0.16.0](oci://ghcr.io/kserve/charts/kserve) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | -| 30 | kserve-crds | [0.16.0](oci://ghcr.io/kserve/charts/kserve-crd) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | -| 31 | kuberay-operator | [1.4.2](https://ray-project.github.io/kuberay-helm/) | https://github.com/ray-project/kuberay | [Apache License 2.0](https://github.com/ray-project/kuberay/blob/master/LICENSE) | -| 32 | kueue | [0.13.0](oci://registry.k8s.io/kueue/charts/kueue) | https://github.com/kubernetes-sigs/kueue | [Apache License 2.0](https://github.com/kubernetes-sigs/kueue/blob/main/LICENSE) | -| 33 | kyverno | [3.5.1](https://kyverno.github.io/kyverno/) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | -| 34 | kyverno-policies-base | [base](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | -| 35 | kyverno-policies-storage-local-path | [storage-local-path](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies/storage-local-path) | https://github.com/silogen/cluster-forge/ | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | -| 36 | metallb | [0.15.2](https://raw.githubusercontent.com/metallb/metallb/v0.15.2/config/manifests/metallb-native.yaml) | https://github.com/metallb/metallb/ | [Apache License 2.0](https://github.com/metallb/metallb/blob/main/LICENSE) | -| 37 | openbao | [0.18.2](https://openbao.github.io/openbao-helm) | https://github.com/openbao/openbao | [Mozilla Public License 2.0](https://github.com/openbao/openbao/blob/main/LICENSE) | -| 38 | opentelemetry-operator | [0.93.1](https://open-telemetry.github.io/opentelemetry-helm-charts) | https://github.com/open-telemetry/opentelemetry-operator | [Apache License 2.0](https://github.com/open-telemetry/opentelemetry-operator/blob/main/LICENSE) | -| 39 | otel-lgtm-stack | [1.0.7](https://github.com/silogen/docker-otel-lgtm) | https://github.com/grafana/docker-otel-lgtm | [Apache License 2.0](https://github.com/grafana/docker-otel-lgtm/blob/main/LICENSE) | -| 40 | prometheus-crds | [23.0.0](https://prometheus-community.github.io/helm-charts) | https://github.com/prometheus-community/helm-charts | [Apache License 2.0](https://github.com/prometheus-community/helm-charts/blob/main/LICENSE) | -| 41 | rabbitmq | [2.15.0](https://github.com/rabbitmq/cluster-operator/releases/download/v2.15.0/cluster-operator.yml) | https://github.com/rabbitmq/cluster-operator/ | [Mozilla Public License 2.0](https://github.com/rabbitmq/cluster-operator/blob/main/LICENSE.txt) | -| 42 | seaweedfs-crds | [0.1.13](https://github.com/seaweedfs/seaweedfs-operator/tree/master/deploy/helm) | https://github.com/seaweedfs/seaweedfs-operator | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | -| 43 | seaweedfs-operator | [0.1.13](https://github.com/seaweedfs/seaweedfs-operator) | https://github.com/seaweedfs/seaweedfs | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | +| 16 | cnpg-operator | [0.26.0](https://cloudnative-pg.github.io/charts) | https://github.com/cloudnative-pg/cloudnative-pg | [Apache License 2.0](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/LICENSE) | +| 17 | envoy-ai-gateway | [1.0.0](oci://docker.io/envoyproxy/ai-gateway-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | +| 18 | envoy-ai-gateway-crds | [1.0.0](oci://docker.io/envoyproxy/ai-gateway-crds-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | +| 19 | envoy-gateway | [1.8.1](oci://docker.io/envoyproxy/gateway-helm) | https://github.com/envoyproxy/gateway | [Apache License 2.0](https://github.com/envoyproxy/gateway/blob/main/LICENSE) | +| 20 | external-secrets | [0.15.1](https://charts.external-secrets.io) | https://github.com/external-secrets/external-secrets | [Apache License 2.0](https://github.com/external-secrets/external-secrets/blob/main/LICENSE) | +| 21 | gitea | [12.3.0](https://dl.gitea.com/charts/) | https://github.com/go-gitea/gitea | [MIT License](https://github.com/go-gitea/gitea/blob/main/LICENSE) | +| 22 | inference-extension-crds | [1.5.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension) | https://github.com/kubernetes-sigs/gateway-api-inference-extension | [Apache License 2.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension/blob/main/LICENSE) | +| 23 | kaiwo | [v0.2.1](oci://ghcr.io/silogen/kaiwo-operator-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | +| 24 | kaiwo-crds | [v0.2.1](oci://ghcr.io/silogen/kaiwo-crds-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | +| 25 | keda | [2.18.1](https://kedacore.github.io/charts) | https://github.com/kedacore/keda | [Apache License 2.0](https://github.com/kedacore/keda/blob/main/LICENSE) | +| 26 | kedify-otel | [0.0.6](oci://ghcr.io/kedify/charts/otel-add-on) | https://github.com/kedify/otel-add-on | [Apache License 2.0](https://github.com/kedify/otel-add-on/blob/main/LICENSE) | +| 27 | keycloak | [keycloak-old](https://codecentric.github.io/helm-charts) | https://github.com/keycloak/keycloak | [Apache License 2.0](https://github.com/keycloak/keycloak/blob/main/LICENSE.txt) | +| 28 | kserve | [0.16.0](oci://ghcr.io/kserve/charts/kserve) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | +| 29 | kserve-crds | [0.16.0](oci://ghcr.io/kserve/charts/kserve-crd) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | +| 30 | kuberay-operator | [1.4.2](https://ray-project.github.io/kuberay-helm/) | https://github.com/ray-project/kuberay | [Apache License 2.0](https://github.com/ray-project/kuberay/blob/master/LICENSE) | +| 31 | kueue | [0.13.0](oci://registry.k8s.io/kueue/charts/kueue) | https://github.com/kubernetes-sigs/kueue | [Apache License 2.0](https://github.com/kubernetes-sigs/kueue/blob/main/LICENSE) | +| 32 | kyverno | [3.5.1](https://kyverno.github.io/kyverno/) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | +| 33 | kyverno-policies-base | [base](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | +| 34 | kyverno-policies-storage-local-path | [storage-local-path](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies/storage-local-path) | https://github.com/silogen/cluster-forge/ | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | +| 35 | metallb | [0.15.2](https://raw.githubusercontent.com/metallb/metallb/v0.15.2/config/manifests/metallb-native.yaml) | https://github.com/metallb/metallb/ | [Apache License 2.0](https://github.com/metallb/metallb/blob/main/LICENSE) | +| 36 | openbao | [0.18.2](https://openbao.github.io/openbao-helm) | https://github.com/openbao/openbao | [Mozilla Public License 2.0](https://github.com/openbao/openbao/blob/main/LICENSE) | +| 37 | opentelemetry-operator | [0.93.1](https://open-telemetry.github.io/opentelemetry-helm-charts) | https://github.com/open-telemetry/opentelemetry-operator | [Apache License 2.0](https://github.com/open-telemetry/opentelemetry-operator/blob/main/LICENSE) | +| 38 | otel-lgtm-stack | [1.0.8](https://github.com/silogen/docker-otel-lgtm) | https://github.com/grafana/docker-otel-lgtm | [Apache License 2.0](https://github.com/grafana/docker-otel-lgtm/blob/main/LICENSE) | +| 39 | prometheus-crds | [23.0.0](https://prometheus-community.github.io/helm-charts) | https://github.com/prometheus-community/helm-charts | [Apache License 2.0](https://github.com/prometheus-community/helm-charts/blob/main/LICENSE) | +| 40 | rabbitmq | [2.15.0](https://github.com/rabbitmq/cluster-operator/releases/download/v2.15.0/cluster-operator.yml) | https://github.com/rabbitmq/cluster-operator/ | [Mozilla Public License 2.0](https://github.com/rabbitmq/cluster-operator/blob/main/LICENSE.txt) | +| 41 | seaweedfs-crds | [0.1.36](https://github.com/seaweedfs/seaweedfs-operator/tree/master/deploy/helm) | https://github.com/seaweedfs/seaweedfs-operator | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | +| 42 | seaweedfs-operator | [0.1.36](https://github.com/seaweedfs/seaweedfs-operator) | https://github.com/seaweedfs/seaweedfs | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | ## Helm Charts @@ -66,31 +65,30 @@ | 12 | amd-gpu-operator | [1.4.1](https://rocm.github.io/gpu-operator) | https://github.com/ROCm/ROCm | [MIT License](https://github.com/ROCm/ROCm/blob/develop/LICENSE) | | 13 | argocd | [8.3.5](https://argoproj.github.io/argo-helm) | https://github.com/argoproj/argo-cd | [Apache License 2.0](https://github.com/argoproj/argo-cd/blob/master/LICENSE) | | 14 | cert-manager | [1.18.2](oci://quay.io/jetstack/charts/cert-manager) | https://github.com/cert-manager/cert-manager | [Apache License 2.0](https://github.com/cert-manager/cert-manager/blob/master/LICENSE) | -| 15 | cluster-auth | [0.5.9](https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth) | https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | -| 16 | cnpg-operator | [0.26.0](https://cloudnative-pg.github.io/charts) | https://github.com/cloudnative-pg/cloudnative-pg | [Apache License 2.0](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/LICENSE) | -| 17 | envoy-ai-gateway | [0.6.0](oci://docker.io/envoyproxy/ai-gateway-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | -| 18 | envoy-ai-gateway-crds | [0.6.0](oci://docker.io/envoyproxy/ai-gateway-crds-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | -| 19 | envoy-gateway | [1.7.1](oci://docker.io/envoyproxy/gateway-helm) | https://github.com/envoyproxy/gateway | [Apache License 2.0](https://github.com/envoyproxy/gateway/blob/main/LICENSE) | -| 20 | external-secrets | [0.15.1](https://charts.external-secrets.io) | https://github.com/external-secrets/external-secrets | [Apache License 2.0](https://github.com/external-secrets/external-secrets/blob/main/LICENSE) | -| 21 | gitea | [12.3.0](https://dl.gitea.com/charts/) | https://github.com/go-gitea/gitea | [MIT License](https://github.com/go-gitea/gitea/blob/main/LICENSE) | -| 22 | inference-extension-crds | [1.5.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension) | https://github.com/kubernetes-sigs/gateway-api-inference-extension | [Apache License 2.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension/blob/main/LICENSE) | -| 23 | kaiwo | [v0.2.1](oci://ghcr.io/silogen/kaiwo-operator-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | -| 24 | kaiwo-crds | [v0.2.1](oci://ghcr.io/silogen/kaiwo-crds-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | -| 25 | keda | [2.18.1](https://kedacore.github.io/charts) | https://github.com/kedacore/keda | [Apache License 2.0](https://github.com/kedacore/keda/blob/main/LICENSE) | -| 26 | kedify-otel | [0.0.6](oci://ghcr.io/kedify/charts/otel-add-on) | https://github.com/kedify/otel-add-on | [Apache License 2.0](https://github.com/kedify/otel-add-on/blob/main/LICENSE) | -| 27 | keycloak | [keycloak-old](https://codecentric.github.io/helm-charts) | https://github.com/keycloak/keycloak | [Apache License 2.0](https://github.com/keycloak/keycloak/blob/main/LICENSE.txt) | -| 28 | kserve | [0.16.0](oci://ghcr.io/kserve/charts/kserve) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | -| 29 | kserve-crds | [0.16.0](oci://ghcr.io/kserve/charts/kserve-crd) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | -| 30 | kuberay-operator | [1.4.2](https://ray-project.github.io/kuberay-helm/) | https://github.com/ray-project/kuberay | [Apache License 2.0](https://github.com/ray-project/kuberay/blob/master/LICENSE) | -| 31 | kueue | [0.13.0](oci://registry.k8s.io/kueue/charts/kueue) | https://github.com/kubernetes-sigs/kueue | [Apache License 2.0](https://github.com/kubernetes-sigs/kueue/blob/main/LICENSE) | -| 32 | kyverno | [3.5.1](https://kyverno.github.io/kyverno/) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | -| 33 | kyverno-policies-base | [base](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | -| 34 | kyverno-policies-storage-local-path | [storage-local-path](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies/storage-local-path) | https://github.com/silogen/cluster-forge/ | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | -| 35 | openbao | [0.18.2](https://openbao.github.io/openbao-helm) | https://github.com/openbao/openbao | [Mozilla Public License 2.0](https://github.com/openbao/openbao/blob/main/LICENSE) | -| 36 | opentelemetry-operator | [0.93.1](https://open-telemetry.github.io/opentelemetry-helm-charts) | https://github.com/open-telemetry/opentelemetry-operator | [Apache License 2.0](https://github.com/open-telemetry/opentelemetry-operator/blob/main/LICENSE) | -| 37 | otel-lgtm-stack | [1.0.7](https://github.com/silogen/docker-otel-lgtm) | https://github.com/grafana/docker-otel-lgtm | [Apache License 2.0](https://github.com/grafana/docker-otel-lgtm/blob/main/LICENSE) | -| 38 | prometheus-crds | [23.0.0](https://prometheus-community.github.io/helm-charts) | https://github.com/prometheus-community/helm-charts | [Apache License 2.0](https://github.com/prometheus-community/helm-charts/blob/main/LICENSE) | -| 39 | seaweedfs-operator | [0.1.36](https://github.com/seaweedfs/seaweedfs-operator) | https://github.com/seaweedfs/seaweedfs | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | +| 15 | cnpg-operator | [0.26.0](https://cloudnative-pg.github.io/charts) | https://github.com/cloudnative-pg/cloudnative-pg | [Apache License 2.0](https://github.com/cloudnative-pg/cloudnative-pg/blob/main/LICENSE) | +| 16 | envoy-ai-gateway | [1.0.0](oci://docker.io/envoyproxy/ai-gateway-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | +| 17 | envoy-ai-gateway-crds | [1.0.0](oci://docker.io/envoyproxy/ai-gateway-crds-helm) | https://github.com/envoyproxy/ai-gateway | [Apache License 2.0](https://github.com/envoyproxy/ai-gateway/blob/main/LICENSE) | +| 18 | envoy-gateway | [1.8.1](oci://docker.io/envoyproxy/gateway-helm) | https://github.com/envoyproxy/gateway | [Apache License 2.0](https://github.com/envoyproxy/gateway/blob/main/LICENSE) | +| 19 | external-secrets | [0.15.1](https://charts.external-secrets.io) | https://github.com/external-secrets/external-secrets | [Apache License 2.0](https://github.com/external-secrets/external-secrets/blob/main/LICENSE) | +| 20 | gitea | [12.3.0](https://dl.gitea.com/charts/) | https://github.com/go-gitea/gitea | [MIT License](https://github.com/go-gitea/gitea/blob/main/LICENSE) | +| 21 | inference-extension-crds | [1.5.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension) | https://github.com/kubernetes-sigs/gateway-api-inference-extension | [Apache License 2.0](https://github.com/kubernetes-sigs/gateway-api-inference-extension/blob/main/LICENSE) | +| 22 | kaiwo | [v0.2.1](oci://ghcr.io/silogen/kaiwo-operator-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | +| 23 | kaiwo-crds | [v0.2.1](oci://ghcr.io/silogen/kaiwo-crds-chart) | https://github.com/silogen/kaiwo/ | [MIT License](https://github.com/silogen/kaiwo/blob/main/LICENSE) | +| 24 | keda | [2.18.1](https://kedacore.github.io/charts) | https://github.com/kedacore/keda | [Apache License 2.0](https://github.com/kedacore/keda/blob/main/LICENSE) | +| 25 | kedify-otel | [0.0.6](oci://ghcr.io/kedify/charts/otel-add-on) | https://github.com/kedify/otel-add-on | [Apache License 2.0](https://github.com/kedify/otel-add-on/blob/main/LICENSE) | +| 26 | keycloak | [keycloak-old](https://codecentric.github.io/helm-charts) | https://github.com/keycloak/keycloak | [Apache License 2.0](https://github.com/keycloak/keycloak/blob/main/LICENSE.txt) | +| 27 | kserve | [0.16.0](oci://ghcr.io/kserve/charts/kserve) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | +| 28 | kserve-crds | [0.16.0](oci://ghcr.io/kserve/charts/kserve-crd) | https://github.com/kserve/kserve | [Apache License 2.0](https://github.com/kserve/kserve/blob/master/LICENSE) | +| 29 | kuberay-operator | [1.4.2](https://ray-project.github.io/kuberay-helm/) | https://github.com/ray-project/kuberay | [Apache License 2.0](https://github.com/ray-project/kuberay/blob/master/LICENSE) | +| 30 | kueue | [0.13.0](oci://registry.k8s.io/kueue/charts/kueue) | https://github.com/kubernetes-sigs/kueue | [Apache License 2.0](https://github.com/kubernetes-sigs/kueue/blob/main/LICENSE) | +| 31 | kyverno | [3.5.1](https://kyverno.github.io/kyverno/) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | +| 32 | kyverno-policies-base | [base](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies) | https://github.com/kyverno/kyverno | [Apache License 2.0](https://github.com/kyverno/kyverno/blob/main/LICENSE) | +| 33 | kyverno-policies-storage-local-path | [storage-local-path](https://github.com/silogen/cluster-forge/tree/main/sources/kyverno-policies/storage-local-path) | https://github.com/silogen/cluster-forge/ | [Apache License 2.0](https://github.com/silogen/cluster-forge/blob/main/LICENSE) | +| 34 | openbao | [0.18.2](https://openbao.github.io/openbao-helm) | https://github.com/openbao/openbao | [Mozilla Public License 2.0](https://github.com/openbao/openbao/blob/main/LICENSE) | +| 35 | opentelemetry-operator | [0.93.1](https://open-telemetry.github.io/opentelemetry-helm-charts) | https://github.com/open-telemetry/opentelemetry-operator | [Apache License 2.0](https://github.com/open-telemetry/opentelemetry-operator/blob/main/LICENSE) | +| 36 | otel-lgtm-stack | [1.0.8](https://github.com/silogen/docker-otel-lgtm) | https://github.com/grafana/docker-otel-lgtm | [Apache License 2.0](https://github.com/grafana/docker-otel-lgtm/blob/main/LICENSE) | +| 37 | prometheus-crds | [23.0.0](https://prometheus-community.github.io/helm-charts) | https://github.com/prometheus-community/helm-charts | [Apache License 2.0](https://github.com/prometheus-community/helm-charts/blob/main/LICENSE) | +| 38 | seaweedfs-operator | [0.1.36](https://github.com/seaweedfs/seaweedfs-operator) | https://github.com/seaweedfs/seaweedfs | [Apache License 2.0](https://github.com/seaweedfs/seaweedfs/blob/master/LICENSE) | ## Kubernetes Manifests diff --git a/sbom/components.yaml b/sbom/components.yaml index b7dbd9f8..ec8d327c 100644 --- a/sbom/components.yaml +++ b/sbom/components.yaml @@ -128,14 +128,6 @@ components: projectUrl: https://github.com/cert-manager/cert-manager license: Apache License 2.0 licenseUrl: https://github.com/cert-manager/cert-manager/blob/master/LICENSE - cluster-auth: - path: cluster-auth/0.5.9 - type: helm - valuesFile: values.yaml - sourceUrl: https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth - projectUrl: https://github.com/silogen/cluster-forge/tree/main/sources/cluster-auth - license: Apache License 2.0 - licenseUrl: https://github.com/silogen/cluster-forge/blob/main/LICENSE cnpg-operator: path: cnpg-operator/0.26.0 type: helm diff --git a/sources/cluster-auth-config/cluster-auth-es.yaml b/sources/cluster-auth-config/cluster-auth-es.yaml deleted file mode 100644 index 94ad8a98..00000000 --- a/sources/cluster-auth-config/cluster-auth-es.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cluster-auth-secrets -spec: - secretStoreRef: - kind: ClusterSecretStore - name: openbao-secret-store - refreshInterval: 5m - target: - name: cluster-auth-secrets - data: - - secretKey: admin-token - remoteRef: - key: cluster-auth-admin-token - property: value - - secretKey: openbao-token - remoteRef: - key: cluster-auth-openbao-token - property: value diff --git a/sources/cluster-auth/0.5.0/.helmignore b/sources/cluster-auth/0.5.0/.helmignore deleted file mode 100644 index b15d0eba..00000000 --- a/sources/cluster-auth/0.5.0/.helmignore +++ /dev/null @@ -1,20 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -*.swp -*.bak -*.tmp -*.orig -*~ -.project -.idea/ -*.tmproj -.vscode/ diff --git a/sources/cluster-auth/0.5.0/Chart.yaml b/sources/cluster-auth/0.5.0/Chart.yaml deleted file mode 100644 index 03f7e823..00000000 --- a/sources/cluster-auth/0.5.0/Chart.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v2 -name: cluster-auth -description: External authorization service for Kubernetes Gateway with OpenBao integration -type: application -version: 0.5.0 -appVersion: "0.5.0" -keywords: - - envoy - - authorization - - openbao - - vault - - gateway-api - - kubernetes -home: https://github.com/silogen/cluster-auth -sources: - - https://github.com/silogen/cluster-auth -maintainers: - - name: Andy - email: andy@silogen.com diff --git a/sources/cluster-auth/0.5.0/templates/NOTES.txt b/sources/cluster-auth/0.5.0/templates/NOTES.txt deleted file mode 100644 index 7141310c..00000000 --- a/sources/cluster-auth/0.5.0/templates/NOTES.txt +++ /dev/null @@ -1,61 +0,0 @@ -Thank you for installing {{ .Chart.Name }}! - -Your release is named {{ .Release.Name }}. - -To verify the deployment: - - kubectl get pods -n {{ .Values.namespace.name }} -l app.kubernetes.io/name={{ include "cluster-auth.name" . }} - -To check the logs: - - kubectl logs -n {{ .Values.namespace.name }} -l app.kubernetes.io/name={{ include "cluster-auth.name" . }} - -To test the health endpoint: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 8080:{{ .Values.service.health.port }} - curl http://localhost:8080/health - -To access the REST API: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 8081:{{ .Values.service.restApi.port }} - curl -H "X-Admin-Token: " http://localhost:8081/apikey/groups | jq - -To access Prometheus metrics: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 9090:{{ .Values.service.metrics.port }} - curl http://localhost:9090/metrics - -{{- if not .Values.existingSecret }} - -WARNING: No existing secret configured! -Please create a secret with OpenBao and admin tokens: - - kubectl create secret generic cluster-auth-secrets \ - --from-literal=openbao-token="" \ - --from-literal=admin-token="" \ - --namespace={{ .Values.namespace.name }} - -Then update your values.yaml: - existingSecret: "cluster-auth-secrets" - -{{- end }} - -{{- if .Values.config.apikey.enabled }} - -API Key Management is enabled. Available endpoints: - - POST /apikey/create - Create API keys - - POST /apikey/revoke - Revoke API keys - - POST /apikey/renew - Renew API keys - - POST /apikey/lookup - Lookup API key metadata - - POST /apikey/group - Create groups - - DELETE /apikey/group - Delete groups - - GET /apikey/groups - List all groups - - POST /apikey/bind - Bind key to group - - POST /apikey/unbind - Unbind key from group - -{{- end }} - -For more information, visit: - https://github.com/silogen/cluster-auth - -Happy authorizing! diff --git a/sources/cluster-auth/0.5.0/templates/_helpers.tpl b/sources/cluster-auth/0.5.0/templates/_helpers.tpl deleted file mode 100644 index 9bbfb343..00000000 --- a/sources/cluster-auth/0.5.0/templates/_helpers.tpl +++ /dev/null @@ -1,61 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "cluster-auth.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -*/}} -{{- define "cluster-auth.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "cluster-auth.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "cluster-auth.labels" -}} -helm.sh/chart: {{ include "cluster-auth.chart" . }} -{{ include "cluster-auth.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "cluster-auth.selectorLabels" -}} -app.kubernetes.io/name: {{ include "cluster-auth.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app: cluster-auth -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "cluster-auth.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "cluster-auth.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/sources/cluster-auth/0.5.0/templates/clusterrole.yaml b/sources/cluster-auth/0.5.0/templates/clusterrole.yaml deleted file mode 100644 index 5d658a56..00000000 --- a/sources/cluster-auth/0.5.0/templates/clusterrole.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "cluster-auth.fullname" . }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -rules: -- apiGroups: ["gateway.networking.k8s.io"] - resources: ["httproutes"] - verbs: ["get", "list", "watch"] diff --git a/sources/cluster-auth/0.5.0/templates/clusterrolebinding.yaml b/sources/cluster-auth/0.5.0/templates/clusterrolebinding.yaml deleted file mode 100644 index 950266a2..00000000 --- a/sources/cluster-auth/0.5.0/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "cluster-auth.fullname" . }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "cluster-auth.fullname" . }} -subjects: -- kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} diff --git a/sources/cluster-auth/0.5.0/templates/configmap.yaml b/sources/cluster-auth/0.5.0/templates/configmap.yaml deleted file mode 100644 index 30129fe2..00000000 --- a/sources/cluster-auth/0.5.0/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "cluster-auth.fullname" . }}-config - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -data: - config.yaml: | -{{ toYaml .Values.config | indent 4 }} - policies.yaml: | -{{ toYaml .Values.policies | indent 4 }} diff --git a/sources/cluster-auth/0.5.0/templates/deployment.yaml b/sources/cluster-auth/0.5.0/templates/deployment.yaml deleted file mode 100644 index ef87daf8..00000000 --- a/sources/cluster-auth/0.5.0/templates/deployment.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: - {{- include "cluster-auth.selectorLabels" . | nindent 6 }} - template: - metadata: - annotations: - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- with .Values.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "cluster-auth.selectorLabels" . | nindent 8 }} - spec: - serviceAccountName: {{ include "cluster-auth.fullname" . }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - {{- with .Values.securityContext }} - securityContext: - {{- toYaml . | nindent 10 }} - {{- end }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: grpc - containerPort: {{ .Values.service.grpc.port }} - protocol: TCP - - name: health - containerPort: {{ .Values.service.health.port }} - protocol: TCP - - name: rest-api - containerPort: {{ .Values.service.restApi.port }} - protocol: TCP - - name: metrics - containerPort: {{ .Values.service.metrics.port }} - protocol: TCP - args: - - "-config" - - "/etc/cluster-auth/config.yaml" - {{- if .Values.existingSecret }} - env: - - name: API_KEY_PREFIX - value: "amd_aim_api_key_" - - name: OPENBAO_TOKEN - valueFrom: - secretKeyRef: - name: {{ .Values.existingSecret }} - key: openbao-token - - name: ADMIN_TOKEN - valueFrom: - secretKeyRef: - name: {{ .Values.existingSecret }} - key: admin-token - {{- end }} - volumeMounts: - - name: config - mountPath: /etc/cluster-auth - {{- with .Values.livenessProbe }} - livenessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.readinessProbe }} - readinessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.resources }} - resources: - {{- toYaml . | nindent 10 }} - {{- end }} - volumes: - - name: config - configMap: - name: {{ include "cluster-auth.fullname" . }}-config - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/sources/cluster-auth/0.5.0/templates/job-restart-envoygateway.yaml b/sources/cluster-auth/0.5.0/templates/job-restart-envoygateway.yaml deleted file mode 100644 index 65704260..00000000 --- a/sources/cluster-auth/0.5.0/templates/job-restart-envoygateway.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway - namespace: {{ .Values.namespace.name }} -spec: - template: - spec: - serviceAccountName: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - containers: - - name: restart - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - kubectl wait deployment {{ include "cluster-auth.fullname" . }} -n {{ .Values.namespace.name }} --for=condition=Available=True --timeout=180s - kubectl rollout restart deployment -l gateway.envoyproxy.io/owning-gateway-name=https -n envoy-gateway-system - restartPolicy: Never diff --git a/sources/cluster-auth/0.5.0/templates/namespace.yaml b/sources/cluster-auth/0.5.0/templates/namespace.yaml deleted file mode 100644 index 86d8d2dc..00000000 --- a/sources/cluster-auth/0.5.0/templates/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ -{{- if .Values.namespace.create -}} -apiVersion: v1 -kind: Namespace -metadata: - name: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -{{- end }} diff --git a/sources/cluster-auth/0.5.0/templates/rbac-restart-job.yaml b/sources/cluster-auth/0.5.0/templates/rbac-restart-job.yaml deleted file mode 100644 index 1f53d6a6..00000000 --- a/sources/cluster-auth/0.5.0/templates/rbac-restart-job.yaml +++ /dev/null @@ -1,54 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-role - namespace: {{ .Values.namespace.name }} -rules: - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["get", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: envoy-gateway-restart-role - namespace: envoy-gateway-system -rules: - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["get", "list", "patch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-binding - namespace: {{ .Values.namespace.name }} -subjects: - - kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} -roleRef: - kind: Role - name: {{ include "cluster-auth.fullname" . }}-restart-role - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: envoy-gateway-restart-binding - namespace: envoy-gateway-system -subjects: - - kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} -roleRef: - kind: Role - name: envoy-gateway-restart-role - apiGroup: rbac.authorization.k8s.io diff --git a/sources/cluster-auth/0.5.0/templates/service.yaml b/sources/cluster-auth/0.5.0/templates/service.yaml deleted file mode 100644 index e1071161..00000000 --- a/sources/cluster-auth/0.5.0/templates/service.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "{{ .Values.service.metrics.port }}" - prometheus.io/path: "/metrics" -spec: - type: {{ .Values.service.type }} - ports: - - name: grpc - port: {{ .Values.service.grpc.port }} - targetPort: grpc - protocol: TCP - - name: health - port: {{ .Values.service.health.port }} - targetPort: health - protocol: TCP - - name: rest-api - port: {{ .Values.service.restApi.port }} - targetPort: rest-api - protocol: TCP - - name: metrics - port: {{ .Values.service.metrics.port }} - targetPort: metrics - protocol: TCP - selector: - {{- include "cluster-auth.selectorLabels" . | nindent 4 }} diff --git a/sources/cluster-auth/0.5.0/templates/serviceaccount.yaml b/sources/cluster-auth/0.5.0/templates/serviceaccount.yaml deleted file mode 100644 index 215ec39a..00000000 --- a/sources/cluster-auth/0.5.0/templates/serviceaccount.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} diff --git a/sources/cluster-auth/0.5.0/templates/servicemonitor.yaml b/sources/cluster-auth/0.5.0/templates/servicemonitor.yaml deleted file mode 100644 index edb9ecd6..00000000 --- a/sources/cluster-auth/0.5.0/templates/servicemonitor.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.serviceMonitor.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "cluster-auth.selectorLabels" . | nindent 6 }} - endpoints: - - port: metrics - interval: {{ .Values.serviceMonitor.interval }} - scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }} - path: /metrics -{{- end }} diff --git a/sources/cluster-auth/0.5.0/values.yaml b/sources/cluster-auth/0.5.0/values.yaml deleted file mode 100644 index af92f2fc..00000000 --- a/sources/cluster-auth/0.5.0/values.yaml +++ /dev/null @@ -1,163 +0,0 @@ -replicaCount: 1 - -image: - repository: ghcr.io/silogen/cluster-auth - pullPolicy: Always - tag: "0.5.8" - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -namespace: - name: cluster-auth - create: true - -existingSecret: "cluster-auth-secrets" - -service: - type: ClusterIP - grpc: - port: 50051 - health: - port: 8080 - restApi: - port: 8081 - metrics: - port: 9090 - -resources: - limits: - cpu: 1000m - memory: 1Gi - requests: - cpu: 500m - memory: 512Mi - -livenessProbe: - httpGet: - path: /health - port: health - initialDelaySeconds: 10 - periodSeconds: 10 - -readinessProbe: - httpGet: - path: /health - port: health - initialDelaySeconds: 5 - periodSeconds: 5 - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -podAnnotations: {} - -podSecurityContext: {} - -securityContext: {} - -serviceMonitor: - enabled: true - interval: 30s - scrapeTimeout: 10s - -config: - server: - grpc: - address: ":50051" - tls: - enabled: false - rest: - enabled: true - address: ":8081" - health: - address: ":8080" - - authentication: - methods: - - type: openbao - name: openbao-default - enabled: true - openbao: - address: "http://openbao.cf-openbao.svc.cluster.local:8200" - token: "${OPENBAO_TOKEN}" - cacheTTL: "15m" - - type: bearer - name: fallback-bearer - enabled: false - staticTokens: {} - failureMode: deny - - apikey: - enabled: true - prefix: "${API_KEY_PREFIX}" - adminTokens: - "${ADMIN_TOKEN}": "default-client" - - authorization: - enabled: true - policyFile: "/etc/cluster-auth/policies.yaml" - defaultAction: allow - - kubernetes: - enabled: true - inCluster: true - cacheDuration: "15m" - - observability: - logging: - level: info - format: json - metrics: - enabled: true - address: ":9090" - tracing: - enabled: false - -policies: - version: "1.0" - policies: - - name: allow-health - description: Allow health check endpoints - priority: 100 - rules: - - effect: allow - paths: - - /health - - /healthz - - /ready - methods: - - GET - requireAuth: false - - - name: httproute-group-based-access - description: Allow access only if HTTPRoute annotation matches user's group - priority: 85 - rules: - - effect: allow - paths: - - /** - methods: - - "*" - requireAuth: true - httpRoute: - annotationMatch: - - key: "cluster-auth/allowed-group" - matchesUserGroup: true - - - name: admin-full-access - description: Admin users have full access - priority: 90 - rules: - - effect: allow - paths: - - /** - methods: - - "*" - roles: - - admin - requireAuth: true diff --git a/sources/cluster-auth/0.5.9/.helmignore b/sources/cluster-auth/0.5.9/.helmignore deleted file mode 100644 index b15d0eba..00000000 --- a/sources/cluster-auth/0.5.9/.helmignore +++ /dev/null @@ -1,20 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -*.swp -*.bak -*.tmp -*.orig -*~ -.project -.idea/ -*.tmproj -.vscode/ diff --git a/sources/cluster-auth/0.5.9/Chart.yaml b/sources/cluster-auth/0.5.9/Chart.yaml deleted file mode 100644 index 04d51182..00000000 --- a/sources/cluster-auth/0.5.9/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v2 -name: cluster-auth -description: External authorization service for Kubernetes Gateway with OpenBao integration -type: application -version: 0.5.9 -appVersion: "0.5.9" -keywords: - - envoy - - authorization - - openbao - - vault - - gateway-api - - kubernetes -home: https://github.com/silogen/cluster-auth -sources: - - https://github.com/silogen/cluster-auth -maintainers: - - name: AMD EAI Platform Team diff --git a/sources/cluster-auth/0.5.9/templates/NOTES.txt b/sources/cluster-auth/0.5.9/templates/NOTES.txt deleted file mode 100644 index 7141310c..00000000 --- a/sources/cluster-auth/0.5.9/templates/NOTES.txt +++ /dev/null @@ -1,61 +0,0 @@ -Thank you for installing {{ .Chart.Name }}! - -Your release is named {{ .Release.Name }}. - -To verify the deployment: - - kubectl get pods -n {{ .Values.namespace.name }} -l app.kubernetes.io/name={{ include "cluster-auth.name" . }} - -To check the logs: - - kubectl logs -n {{ .Values.namespace.name }} -l app.kubernetes.io/name={{ include "cluster-auth.name" . }} - -To test the health endpoint: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 8080:{{ .Values.service.health.port }} - curl http://localhost:8080/health - -To access the REST API: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 8081:{{ .Values.service.restApi.port }} - curl -H "X-Admin-Token: " http://localhost:8081/apikey/groups | jq - -To access Prometheus metrics: - - kubectl port-forward -n {{ .Values.namespace.name }} svc/{{ include "cluster-auth.fullname" . }} 9090:{{ .Values.service.metrics.port }} - curl http://localhost:9090/metrics - -{{- if not .Values.existingSecret }} - -WARNING: No existing secret configured! -Please create a secret with OpenBao and admin tokens: - - kubectl create secret generic cluster-auth-secrets \ - --from-literal=openbao-token="" \ - --from-literal=admin-token="" \ - --namespace={{ .Values.namespace.name }} - -Then update your values.yaml: - existingSecret: "cluster-auth-secrets" - -{{- end }} - -{{- if .Values.config.apikey.enabled }} - -API Key Management is enabled. Available endpoints: - - POST /apikey/create - Create API keys - - POST /apikey/revoke - Revoke API keys - - POST /apikey/renew - Renew API keys - - POST /apikey/lookup - Lookup API key metadata - - POST /apikey/group - Create groups - - DELETE /apikey/group - Delete groups - - GET /apikey/groups - List all groups - - POST /apikey/bind - Bind key to group - - POST /apikey/unbind - Unbind key from group - -{{- end }} - -For more information, visit: - https://github.com/silogen/cluster-auth - -Happy authorizing! diff --git a/sources/cluster-auth/0.5.9/templates/_helpers.tpl b/sources/cluster-auth/0.5.9/templates/_helpers.tpl deleted file mode 100644 index 9bbfb343..00000000 --- a/sources/cluster-auth/0.5.9/templates/_helpers.tpl +++ /dev/null @@ -1,61 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "cluster-auth.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -*/}} -{{- define "cluster-auth.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "cluster-auth.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "cluster-auth.labels" -}} -helm.sh/chart: {{ include "cluster-auth.chart" . }} -{{ include "cluster-auth.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "cluster-auth.selectorLabels" -}} -app.kubernetes.io/name: {{ include "cluster-auth.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -app: cluster-auth -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "cluster-auth.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "cluster-auth.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/sources/cluster-auth/0.5.9/templates/clusterrole.yaml b/sources/cluster-auth/0.5.9/templates/clusterrole.yaml deleted file mode 100644 index 5d658a56..00000000 --- a/sources/cluster-auth/0.5.9/templates/clusterrole.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "cluster-auth.fullname" . }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -rules: -- apiGroups: ["gateway.networking.k8s.io"] - resources: ["httproutes"] - verbs: ["get", "list", "watch"] diff --git a/sources/cluster-auth/0.5.9/templates/clusterrolebinding.yaml b/sources/cluster-auth/0.5.9/templates/clusterrolebinding.yaml deleted file mode 100644 index 950266a2..00000000 --- a/sources/cluster-auth/0.5.9/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "cluster-auth.fullname" . }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "cluster-auth.fullname" . }} -subjects: -- kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} diff --git a/sources/cluster-auth/0.5.9/templates/configmap.yaml b/sources/cluster-auth/0.5.9/templates/configmap.yaml deleted file mode 100644 index 30129fe2..00000000 --- a/sources/cluster-auth/0.5.9/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "cluster-auth.fullname" . }}-config - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -data: - config.yaml: | -{{ toYaml .Values.config | indent 4 }} - policies.yaml: | -{{ toYaml .Values.policies | indent 4 }} diff --git a/sources/cluster-auth/0.5.9/templates/deployment.yaml b/sources/cluster-auth/0.5.9/templates/deployment.yaml deleted file mode 100644 index ef87daf8..00000000 --- a/sources/cluster-auth/0.5.9/templates/deployment.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -spec: - replicas: {{ .Values.replicaCount }} - selector: - matchLabels: - {{- include "cluster-auth.selectorLabels" . | nindent 6 }} - template: - metadata: - annotations: - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - {{- with .Values.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "cluster-auth.selectorLabels" . | nindent 8 }} - spec: - serviceAccountName: {{ include "cluster-auth.fullname" . }} - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.podSecurityContext }} - securityContext: - {{- toYaml . | nindent 8 }} - {{- end }} - containers: - - name: {{ .Chart.Name }} - {{- with .Values.securityContext }} - securityContext: - {{- toYaml . | nindent 10 }} - {{- end }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: grpc - containerPort: {{ .Values.service.grpc.port }} - protocol: TCP - - name: health - containerPort: {{ .Values.service.health.port }} - protocol: TCP - - name: rest-api - containerPort: {{ .Values.service.restApi.port }} - protocol: TCP - - name: metrics - containerPort: {{ .Values.service.metrics.port }} - protocol: TCP - args: - - "-config" - - "/etc/cluster-auth/config.yaml" - {{- if .Values.existingSecret }} - env: - - name: API_KEY_PREFIX - value: "amd_aim_api_key_" - - name: OPENBAO_TOKEN - valueFrom: - secretKeyRef: - name: {{ .Values.existingSecret }} - key: openbao-token - - name: ADMIN_TOKEN - valueFrom: - secretKeyRef: - name: {{ .Values.existingSecret }} - key: admin-token - {{- end }} - volumeMounts: - - name: config - mountPath: /etc/cluster-auth - {{- with .Values.livenessProbe }} - livenessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.readinessProbe }} - readinessProbe: - {{- toYaml . | nindent 10 }} - {{- end }} - {{- with .Values.resources }} - resources: - {{- toYaml . | nindent 10 }} - {{- end }} - volumes: - - name: config - configMap: - name: {{ include "cluster-auth.fullname" . }}-config - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/sources/cluster-auth/0.5.9/templates/job-restart-envoygateway.yaml b/sources/cluster-auth/0.5.9/templates/job-restart-envoygateway.yaml deleted file mode 100644 index 65704260..00000000 --- a/sources/cluster-auth/0.5.9/templates/job-restart-envoygateway.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway - namespace: {{ .Values.namespace.name }} -spec: - template: - spec: - serviceAccountName: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - containers: - - name: restart - image: bitnami/kubectl:latest - command: - - /bin/sh - - -c - - | - kubectl wait deployment {{ include "cluster-auth.fullname" . }} -n {{ .Values.namespace.name }} --for=condition=Available=True --timeout=180s - kubectl rollout restart deployment -l gateway.envoyproxy.io/owning-gateway-name=https -n envoy-gateway-system - restartPolicy: Never diff --git a/sources/cluster-auth/0.5.9/templates/namespace.yaml b/sources/cluster-auth/0.5.9/templates/namespace.yaml deleted file mode 100644 index 86d8d2dc..00000000 --- a/sources/cluster-auth/0.5.9/templates/namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ -{{- if .Values.namespace.create -}} -apiVersion: v1 -kind: Namespace -metadata: - name: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -{{- end }} diff --git a/sources/cluster-auth/0.5.9/templates/rbac-restart-job.yaml b/sources/cluster-auth/0.5.9/templates/rbac-restart-job.yaml deleted file mode 100644 index 1f53d6a6..00000000 --- a/sources/cluster-auth/0.5.9/templates/rbac-restart-job.yaml +++ /dev/null @@ -1,54 +0,0 @@ ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-role - namespace: {{ .Values.namespace.name }} -rules: - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["get", "list"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: envoy-gateway-restart-role - namespace: envoy-gateway-system -rules: - - apiGroups: ["apps"] - resources: ["deployments"] - verbs: ["get", "list", "patch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "cluster-auth.fullname" . }}-restart-binding - namespace: {{ .Values.namespace.name }} -subjects: - - kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} -roleRef: - kind: Role - name: {{ include "cluster-auth.fullname" . }}-restart-role - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: envoy-gateway-restart-binding - namespace: envoy-gateway-system -subjects: - - kind: ServiceAccount - name: {{ include "cluster-auth.fullname" . }}-restart-envoygateway-sa - namespace: {{ .Values.namespace.name }} -roleRef: - kind: Role - name: envoy-gateway-restart-role - apiGroup: rbac.authorization.k8s.io diff --git a/sources/cluster-auth/0.5.9/templates/service.yaml b/sources/cluster-auth/0.5.9/templates/service.yaml deleted file mode 100644 index e1071161..00000000 --- a/sources/cluster-auth/0.5.9/templates/service.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} - annotations: - prometheus.io/scrape: "true" - prometheus.io/port: "{{ .Values.service.metrics.port }}" - prometheus.io/path: "/metrics" -spec: - type: {{ .Values.service.type }} - ports: - - name: grpc - port: {{ .Values.service.grpc.port }} - targetPort: grpc - protocol: TCP - - name: health - port: {{ .Values.service.health.port }} - targetPort: health - protocol: TCP - - name: rest-api - port: {{ .Values.service.restApi.port }} - targetPort: rest-api - protocol: TCP - - name: metrics - port: {{ .Values.service.metrics.port }} - targetPort: metrics - protocol: TCP - selector: - {{- include "cluster-auth.selectorLabels" . | nindent 4 }} diff --git a/sources/cluster-auth/0.5.9/templates/serviceaccount.yaml b/sources/cluster-auth/0.5.9/templates/serviceaccount.yaml deleted file mode 100644 index 215ec39a..00000000 --- a/sources/cluster-auth/0.5.9/templates/serviceaccount.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} diff --git a/sources/cluster-auth/0.5.9/templates/servicemonitor.yaml b/sources/cluster-auth/0.5.9/templates/servicemonitor.yaml deleted file mode 100644 index edb9ecd6..00000000 --- a/sources/cluster-auth/0.5.9/templates/servicemonitor.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.serviceMonitor.enabled -}} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ include "cluster-auth.fullname" . }} - namespace: {{ .Values.namespace.name }} - labels: - {{- include "cluster-auth.labels" . | nindent 4 }} -spec: - selector: - matchLabels: - {{- include "cluster-auth.selectorLabels" . | nindent 6 }} - endpoints: - - port: metrics - interval: {{ .Values.serviceMonitor.interval }} - scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }} - path: /metrics -{{- end }} diff --git a/sources/cluster-auth/0.5.9/values.yaml b/sources/cluster-auth/0.5.9/values.yaml deleted file mode 100644 index 36d70e7a..00000000 --- a/sources/cluster-auth/0.5.9/values.yaml +++ /dev/null @@ -1,163 +0,0 @@ -replicaCount: 1 - -image: - repository: ghcr.io/silogen/cluster-auth - pullPolicy: Always - tag: "0.6.0-rc10" - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -namespace: - name: cluster-auth - create: true - -existingSecret: "cluster-auth-secrets" - -service: - type: ClusterIP - grpc: - port: 50051 - health: - port: 8080 - restApi: - port: 8081 - metrics: - port: 9090 - -resources: - limits: - cpu: 1000m - memory: 1Gi - requests: - cpu: 500m - memory: 512Mi - -livenessProbe: - httpGet: - path: /health - port: health - initialDelaySeconds: 10 - periodSeconds: 10 - -readinessProbe: - httpGet: - path: /health - port: health - initialDelaySeconds: 5 - periodSeconds: 5 - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -podAnnotations: {} - -podSecurityContext: {} - -securityContext: {} - -serviceMonitor: - enabled: true - interval: 30s - scrapeTimeout: 10s - -config: - server: - grpc: - address: ":50051" - tls: - enabled: false - rest: - enabled: true - address: ":8081" - health: - address: ":8080" - - authentication: - methods: - - type: openbao - name: openbao-default - enabled: true - openbao: - address: "http://openbao.cf-openbao.svc.cluster.local:8200" - token: "${OPENBAO_TOKEN}" - cacheTTL: "5m" - - type: bearer - name: fallback-bearer - enabled: false - staticTokens: {} - failureMode: deny - - apikey: - enabled: true - prefix: "${API_KEY_PREFIX}" - adminTokens: - "${ADMIN_TOKEN}": "default-client" - - authorization: - enabled: true - policyFile: "/etc/cluster-auth/policies.yaml" - defaultAction: allow - - kubernetes: - enabled: true - inCluster: true - cacheDuration: "15m" - - observability: - logging: - level: info - format: json - metrics: - enabled: true - address: ":9090" - tracing: - enabled: false - -policies: - version: "1.0" - policies: - - name: allow-health - description: Allow health check endpoints - priority: 100 - rules: - - effect: allow - paths: - - /health - - /healthz - - /ready - methods: - - GET - requireAuth: false - - - name: httproute-group-based-access - description: Allow access only if HTTPRoute annotation matches user's group - priority: 85 - rules: - - effect: allow - paths: - - /** - methods: - - "*" - requireAuth: true - httpRoute: - annotationMatch: - - key: "cluster-auth/allowed-group" - matchesUserGroup: true - - - name: admin-full-access - description: Admin users have full access - priority: 90 - rules: - - effect: allow - paths: - - /** - methods: - - "*" - roles: - - admin - requireAuth: true diff --git a/sources/envoy-gateway-config/templates/reference-grant-extauth.yaml b/sources/envoy-gateway-config/templates/reference-grant-extauth.yaml deleted file mode 100644 index fbcf17a9..00000000 --- a/sources/envoy-gateway-config/templates/reference-grant-extauth.yaml +++ /dev/null @@ -1,16 +0,0 @@ -# ReferenceGrant to allow cross-namespace access -# Required because SecurityPolicy is in envoy-gateway-system but cluster-auth service is in cluster-auth namespace -apiVersion: gateway.networking.k8s.io/v1beta1 -kind: ReferenceGrant -metadata: - name: cluster-auth-extauth-grant - namespace: cluster-auth # cluster-auth service namespace -spec: - from: - - group: gateway.envoyproxy.io - kind: SecurityPolicy - namespace: envoy-gateway-system # SecurityPolicy namespace - to: - - group: "" - kind: Service - name: cluster-auth # cluster-auth service name \ No newline at end of file diff --git a/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml b/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml index cd60d26d..c90c009b 100644 --- a/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml +++ b/sources/envoy-gateway-config/templates/security-policy-ai-gateway-default-deny.yaml @@ -5,8 +5,7 @@ # `https` gateway, whose model-route deny is route-scoped and owned by aim-engine / EAI-7302). # Any request whose HTTPRoute has no per-model apiKeyAuth SecurityPolicy — a keyless/opted-out # model, or a header-less/unmatched request — is refused, instead of falling through -# unauthenticated once cluster-auth ext_authz is removed from this Gateway -# (see security-policy-extauth.yaml, which drops its ai-gateway targetRef under the same switch). +# unauthenticated. This is the sole gateway-scoped backstop. # # Per-model apiKeyAuth SecurityPolicies from ai-gateway-discovery target individual HTTPRoutes; # a route-level SecurityPolicy overrides this gateway-level one for that route (Envoy Gateway diff --git a/sources/envoy-gateway-config/templates/security-policy-extauth.yaml b/sources/envoy-gateway-config/templates/security-policy-extauth.yaml deleted file mode 100644 index 0056fa10..00000000 --- a/sources/envoy-gateway-config/templates/security-policy-extauth.yaml +++ /dev/null @@ -1,31 +0,0 @@ -# Envoy Gateway ExtAuth Configuration -# SecurityPolicy for Gateway-level ExtAuth (equivalent to kgateway global TrafficPolicy) -# Replaces kgateway TrafficPolicy + GatewayExtension with Envoy Gateway SecurityPolicy -apiVersion: gateway.envoyproxy.io/v1alpha1 -kind: SecurityPolicy -metadata: - name: cluster-auth-extauth-policy - namespace: envoy-gateway-system # Envoy Gateway namespace -spec: - # cluster-auth ext_authz targets `https` only. ai-gateway is enforced natively by - # per-model apiKeyAuth policies (ai-gateway-discovery) plus the gateway-scoped - # default-deny backstop (security-policy-ai-gateway-default-deny.yaml) — two - # gateway-scoped SecurityPolicies cannot target the same Gateway, so ext_authz never - # targets ai-gateway. - targetRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: https - - # External Authorization configuration (matches current kgateway GatewayExtension) - extAuth: - # Use gRPC external auth service (plain gRPC, no TLS - matches current setup) - grpc: - # Backend reference to cluster-auth service (exact match to current config) - backendRefs: - - group: '' - kind: Service - name: cluster-auth - namespace: cluster-auth - port: 50051 - weight: 1 \ No newline at end of file diff --git a/sources/envoy-gateway-config/values.yaml b/sources/envoy-gateway-config/values.yaml index 7f7d0668..2689a802 100644 --- a/sources/envoy-gateway-config/values.yaml +++ b/sources/envoy-gateway-config/values.yaml @@ -21,8 +21,7 @@ gatewayDnsService: # Enabling ai-gateway IS the native apiKeyAuth cutover for it (EAI-7304): ai-gateway is # backstopped by a gateway-scoped default-deny SecurityPolicy (any model route without a # per-model apiKeyAuth policy from ai-gateway-discovery is refused, not passed through -# unauthenticated), and cluster-auth ext_authz is removed from ai-gateway (it stays on -# `https`). So only enable it once every model on ai-gateway is natively enforced — the +# unauthenticated). So only enable it once every model on ai-gateway is natively enforced — the # ai-gateway-discovery controller (always-on enforcement) is deployed and keys are # populated (aim-keys- Secrets exist) — or keyed model traffic is denied. aiGateway: diff --git a/sources/openbao-config/0.1.0/templates/openbao-secret-definitions.yaml b/sources/openbao-config/0.1.0/templates/openbao-secret-definitions.yaml index 06ccaac9..77c760b6 100644 --- a/sources/openbao-config/0.1.0/templates/openbao-secret-definitions.yaml +++ b/sources/openbao-config/0.1.0/templates/openbao-secret-definitions.yaml @@ -137,9 +137,6 @@ data: secrets/aiwb-ui-keycloak-secret|random||16 secrets/aiwb-cluster-auth-admin-token|random||16 - # Cluster auth OpenBao token (will be set to actual BAO_TOKEN) - # Note: This is handled specially in the script - # AIWB scoped API-key write token (secrets/aiwb-openbao-token) # Note: minted specially in the script (bao token create, scoped to apikeys-write-policy); # it is a token, not a static/random KV value, so it is not a definitions row here. diff --git a/sources/openbao-config/0.1.0/templates/openbao-secret-manager-cm.yaml b/sources/openbao-config/0.1.0/templates/openbao-secret-manager-cm.yaml index 942daead..5b3f55cc 100644 --- a/sources/openbao-config/0.1.0/templates/openbao-secret-manager-cm.yaml +++ b/sources/openbao-config/0.1.0/templates/openbao-secret-manager-cm.yaml @@ -194,17 +194,6 @@ data: fi fi - # Special case: cluster-auth-openbao-token uses actual BAO_TOKEN (for init job only) - if [ "${INIT_MODE:-}" = "true" ]; then - echo "CREATE: secrets/cluster-auth-openbao-token (special - init mode)" - if bao kv put secrets/cluster-auth-openbao-token value="${BAO_TOKEN}"; then - echo "Initial secret generation completed" - else - echo "ERROR: Failed to create cluster-auth-openbao-token" - failed=$((failed + 1)) - fi - fi - if [ "$failed" -gt 0 ]; then echo "ERROR: $failed secret(s) failed to reconcile, see log above" exit 1 diff --git a/sources/openbao-init-job/0.1.0/templates/cf-init-openbao-job.yaml b/sources/openbao-init-job/0.1.0/templates/cf-init-openbao-job.yaml index 08041073..d8d461d5 100644 --- a/sources/openbao-init-job/0.1.0/templates/cf-init-openbao-job.yaml +++ b/sources/openbao-init-job/0.1.0/templates/cf-init-openbao-job.yaml @@ -28,7 +28,6 @@ spec: fi export BAO_ADDR="http://openbao-internal:8200" export DOMAIN="{{ .Values.domain }}" - export INIT_MODE="true" echo "Running secret management script directly..." /tmp/secret-manager/manage-secrets.sh