46 lines
1.0 KiB
YAML
46 lines
1.0 KiB
YAML
|
# OAuth2-Proxy for Temporal UI — protects with Authentik OIDC
|
||
|
|
# Deployed via Helm: oauth2-proxy/oauth2-proxy chart
|
||
|
|
|
||
|
|
config:
|
||
|
|
clientID: temporal
|
||
|
|
clientSecret: "" # injected from temporal-oidc secret
|
||
|
|
cookieSecret: "" # generated; helm --set will override
|
||
|
|
configFile: ""
|
||
|
|
|
||
|
|
auth:
|
||
|
|
enabled: true
|
||
|
|
|
||
|
|
extraArgs:
|
||
|
|
- --provider=oidc
|
||
|
|
- --oidc-issuer-url=https://authentik.riotpiao.homelab.com/application/o/temporal/
|
||
|
|
- --redirect-url=https://temporal.riotpiao.homelab.com/oauth2/callback
|
||
|
|
- --upstream=http://temporal-web:8080
|
||
|
|
- --cookie-secure=true
|
||
|
|
- --cookie-httponly=true
|
||
|
|
- --cookie-samesite=Lax
|
||
|
|
- --email-domain=*
|
||
|
|
- --skip-auth-regex=^/health
|
||
|
|
- --pass-authorization-header=true
|
||
|
|
- --skip-auth-preflight=true
|
||
|
|
|
||
|
|
service:
|
||
|
|
type: ClusterIP
|
||
|
|
port: 4180
|
||
|
|
targetPort: 4180
|
||
|
|
|
||
|
|
ingress:
|
||
|
|
enabled: false # we'll keep temporal's ingress, just route to oauth2-proxy
|
||
|
|
|
||
|
|
replicaCount: 1
|
||
|
|
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 100m
|
||
|
|
memory: 128Mi
|
||
|
|
limits:
|
||
|
|
cpu: 200m
|
||
|
|
memory: 256Mi
|
||
|
|
|
||
|
|
podAnnotations:
|
||
|
|
secret.reloader.stakater.com/reload: "temporal-oidc"
|