a094b7d70a
Configure myks env-data with global repoURL pointing to Forgejo repo, switch destination from cluster name to in-cluster server URL, and disable placeholder cluster Secret generation. Add deploy key init Job that generates an SSH keypair, registers it with Forgejo, and creates the ArgoCD repository secret. Switch job images from bitnami/kubectl to alpine/k8s. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
269 lines
13 KiB
YAML
269 lines
13 KiB
YAML
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
|
controller-gen.kubebuilder.io/version: v0.17.1
|
|
name: apiportalauths.hub.traefik.io
|
|
namespace: traefik
|
|
spec:
|
|
group: hub.traefik.io
|
|
names:
|
|
kind: APIPortalAuth
|
|
listKind: APIPortalAuthList
|
|
plural: apiportalauths
|
|
singular: apiportalauth
|
|
scope: Namespaced
|
|
versions:
|
|
- name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
description: APIPortalAuth defines the authentication configuration for an APIPortal.
|
|
properties:
|
|
apiVersion:
|
|
description: |-
|
|
APIVersion defines the versioned schema of this representation of an object.
|
|
Servers should convert recognized schemas to the latest internal value, and
|
|
may reject unrecognized values.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
type: string
|
|
kind:
|
|
description: |-
|
|
Kind is a string value representing the REST resource this object represents.
|
|
Servers may infer this from the endpoint the client submits requests to.
|
|
Cannot be updated.
|
|
In CamelCase.
|
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: The desired behavior of this APIPortalAuth.
|
|
properties:
|
|
ldap:
|
|
description: LDAP configures the LDAP authentication.
|
|
properties:
|
|
attribute:
|
|
default: cn
|
|
description: |-
|
|
Attribute is the LDAP object attribute used to form a bind DN when sending bind queries.
|
|
The bind DN is formed as <Attribute>=<Username>,<BaseDN>.
|
|
type: string
|
|
attributes:
|
|
description: Attributes configures LDAP attribute mappings for user attributes.
|
|
properties:
|
|
company:
|
|
description: Company is the LDAP attribute for user company.
|
|
type: string
|
|
email:
|
|
description: Email is the LDAP attribute for user email.
|
|
type: string
|
|
firstname:
|
|
description: Firstname is the LDAP attribute for user first name.
|
|
type: string
|
|
lastname:
|
|
description: Lastname is the LDAP attribute for user last name.
|
|
type: string
|
|
userId:
|
|
description: UserID is the LDAP attribute for user ID mapping.
|
|
type: string
|
|
type: object
|
|
baseDn:
|
|
description: BaseDN is the base domain name that should be used for bind and search queries.
|
|
type: string
|
|
bindDn:
|
|
description: |-
|
|
BindDN is the domain name to bind to in order to authenticate to the LDAP server when running in search mode.
|
|
If empty, an anonymous bind will be done.
|
|
type: string
|
|
bindPasswordSecretName:
|
|
description: |-
|
|
BindPasswordSecretName is the name of the Kubernetes Secret containing the password for the bind DN.
|
|
The secret must contain a key named 'password'.
|
|
maxLength: 253
|
|
type: string
|
|
certificateAuthority:
|
|
description: |-
|
|
CertificateAuthority is a PEM-encoded certificate to use to establish a connection with the LDAP server if the
|
|
connection uses TLS but that the certificate was signed by a custom Certificate Authority.
|
|
type: string
|
|
groups:
|
|
description: Groups configures group extraction.
|
|
properties:
|
|
memberOfAttribute:
|
|
default: memberOf
|
|
description: MemberOfAttribute is the LDAP attribute containing group memberships (e.g., "memberOf").
|
|
type: string
|
|
type: object
|
|
insecureSkipVerify:
|
|
description: InsecureSkipVerify controls whether the server's certificate chain and host name is verified.
|
|
type: boolean
|
|
searchFilter:
|
|
description: |-
|
|
SearchFilter is used to filter LDAP search queries.
|
|
Example: (&(objectClass=inetOrgPerson)(gidNumber=500)(uid=%s))
|
|
%s can be used as a placeholder for the username.
|
|
type: string
|
|
startTls:
|
|
description: StartTLS instructs the middleware to issue a StartTLS request when initializing the connection with the LDAP server.
|
|
type: boolean
|
|
syncedAttributes:
|
|
description: SyncedAttributes are the user attributes to synchronize with Hub platform.
|
|
items:
|
|
enum:
|
|
- groups
|
|
- userId
|
|
- firstname
|
|
- lastname
|
|
- email
|
|
- company
|
|
type: string
|
|
maxItems: 6
|
|
type: array
|
|
url:
|
|
description: URL is the URL of the LDAP server, including the protocol (ldap or ldaps) and the port.
|
|
type: string
|
|
x-kubernetes-validations:
|
|
- message: must be a valid LDAP URL
|
|
rule: isURL(self) && (self.startsWith('ldap://') || self.startsWith('ldaps://'))
|
|
required:
|
|
- baseDn
|
|
- url
|
|
type: object
|
|
oidc:
|
|
description: OIDC configures the OIDC authentication.
|
|
properties:
|
|
claims:
|
|
description: Claims configures JWT claim mappings for user attributes.
|
|
properties:
|
|
company:
|
|
description: Company is the JWT claim for user company.
|
|
type: string
|
|
email:
|
|
description: Email is the JWT claim for user email.
|
|
type: string
|
|
firstname:
|
|
description: Firstname is the JWT claim for user first name.
|
|
type: string
|
|
groups:
|
|
description: Groups is the JWT claim for user groups. This field is required for authorization.
|
|
type: string
|
|
lastname:
|
|
description: Lastname is the JWT claim for user last name.
|
|
type: string
|
|
userId:
|
|
description: UserID is the JWT claim for user ID mapping.
|
|
type: string
|
|
required:
|
|
- groups
|
|
type: object
|
|
issuerUrl:
|
|
description: IssuerURL is the OIDC provider issuer URL.
|
|
type: string
|
|
x-kubernetes-validations:
|
|
- message: must be a valid URL
|
|
rule: isURL(self)
|
|
scopes:
|
|
description: Scopes is a list of OAuth2 scopes.
|
|
items:
|
|
type: string
|
|
type: array
|
|
secretName:
|
|
description: SecretName is the name of the Kubernetes Secret containing clientId and clientSecret keys.
|
|
maxLength: 253
|
|
type: string
|
|
syncedAttributes:
|
|
description: SyncedAttributes are the user attributes to synchronize with Hub platform.
|
|
items:
|
|
enum:
|
|
- groups
|
|
- userId
|
|
- firstname
|
|
- lastname
|
|
- email
|
|
- company
|
|
type: string
|
|
maxItems: 6
|
|
type: array
|
|
required:
|
|
- claims
|
|
- issuerUrl
|
|
- secretName
|
|
type: object
|
|
type: object
|
|
x-kubernetes-validations:
|
|
- message: exactly one of oidc or ldap must be specified
|
|
rule: '[has(self.oidc), has(self.ldap)].filter(x, x).size() == 1'
|
|
status:
|
|
description: The current status of this APIPortalAuth.
|
|
properties:
|
|
conditions:
|
|
items:
|
|
description: Condition contains details for one aspect of the current state of this API Resource.
|
|
properties:
|
|
lastTransitionTime:
|
|
description: |-
|
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
|
format: date-time
|
|
type: string
|
|
message:
|
|
description: |-
|
|
message is a human readable message indicating details about the transition.
|
|
This may be an empty string.
|
|
maxLength: 32768
|
|
type: string
|
|
observedGeneration:
|
|
description: |-
|
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
|
with respect to the current state of the instance.
|
|
format: int64
|
|
minimum: 0
|
|
type: integer
|
|
reason:
|
|
description: |-
|
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
|
Producers of specific condition types may define expected values and meanings for this field,
|
|
and whether the values are considered a guaranteed API.
|
|
The value should be a CamelCase string.
|
|
This field may not be empty.
|
|
maxLength: 1024
|
|
minLength: 1
|
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
|
type: string
|
|
status:
|
|
description: status of the condition, one of True, False, Unknown.
|
|
enum:
|
|
- "True"
|
|
- "False"
|
|
- Unknown
|
|
type: string
|
|
type:
|
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
|
maxLength: 316
|
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
|
type: string
|
|
required:
|
|
- lastTransitionTime
|
|
- message
|
|
- reason
|
|
- status
|
|
- type
|
|
type: object
|
|
type: array
|
|
hash:
|
|
description: Hash is a hash representing the APIPortalAuth.
|
|
type: string
|
|
syncedAt:
|
|
format: date-time
|
|
type: string
|
|
version:
|
|
type: string
|
|
type: object
|
|
type: object
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|