From f985d0fccafc6b81de1460aa3cebbedf81b63ec1 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 16 Jul 2026 15:36:45 +0100 Subject: [PATCH] feat(charts): charts to deploy auth-broker --- charts/apps/Chart.yaml | 2 +- charts/apps/staging-values.yaml | 6 ++ .../templates/auth-broker-application.yaml | 34 +++++++ charts/apps/values.yaml | 6 ++ charts/auth-broker/Chart.lock | 6 ++ charts/auth-broker/Chart.yaml | 11 +++ charts/auth-broker/staging-values.yaml | 3 + charts/auth-broker/templates/_helpers.tpl | 30 ++++++ charts/auth-broker/templates/clusterrole.yaml | 16 +++ .../templates/clusterrolebinding.yaml | 14 +++ .../auth-broker/templates/configpolicy.yaml | 98 +++++++++++++++++++ charts/auth-broker/templates/deployment.yaml | 64 ++++++++++++ charts/auth-broker/templates/service.yaml | 16 +++ .../auth-broker/templates/serviceaccount.yaml | 7 ++ charts/auth-broker/values.yaml | 62 ++++++++++++ charts/workflows-cluster/Chart.lock | 6 +- charts/workflows-cluster/Chart.yaml | 4 +- .../charts/secrets/Chart.yaml | 2 +- .../charts/secrets/templates/auth-keys.yaml | 33 +++++++ charts/workflows-cluster/staging-values.yaml | 2 + charts/workflows-cluster/values.yaml | 2 + 21 files changed, 417 insertions(+), 7 deletions(-) create mode 100644 charts/apps/templates/auth-broker-application.yaml create mode 100644 charts/auth-broker/Chart.lock create mode 100644 charts/auth-broker/Chart.yaml create mode 100644 charts/auth-broker/staging-values.yaml create mode 100644 charts/auth-broker/templates/_helpers.tpl create mode 100644 charts/auth-broker/templates/clusterrole.yaml create mode 100644 charts/auth-broker/templates/clusterrolebinding.yaml create mode 100644 charts/auth-broker/templates/configpolicy.yaml create mode 100644 charts/auth-broker/templates/deployment.yaml create mode 100644 charts/auth-broker/templates/service.yaml create mode 100644 charts/auth-broker/templates/serviceaccount.yaml create mode 100644 charts/auth-broker/values.yaml create mode 100644 charts/workflows-cluster/charts/secrets/templates/auth-keys.yaml diff --git a/charts/apps/Chart.yaml b/charts/apps/Chart.yaml index fa5207dac..53a011662 100644 --- a/charts/apps/Chart.yaml +++ b/charts/apps/Chart.yaml @@ -2,4 +2,4 @@ apiVersion: v2 name: apps description: An argocd app to deploy apps inside the virtual cluster type: application -version: 0.5.9 +version: 0.5.10 diff --git a/charts/apps/staging-values.yaml b/charts/apps/staging-values.yaml index 75ce4a9aa..50cfa3aea 100644 --- a/charts/apps/staging-values.yaml +++ b/charts/apps/staging-values.yaml @@ -106,3 +106,9 @@ openbao: extraValueFiles: - staging-values.yaml valuesObject: {} + +authBroker: + enabled: true + targetRevision: HEAD + extraValuesFiles: [] + valuesObject: {} diff --git a/charts/apps/templates/auth-broker-application.yaml b/charts/apps/templates/auth-broker-application.yaml new file mode 100644 index 000000000..f2c63df84 --- /dev/null +++ b/charts/apps/templates/auth-broker-application.yaml @@ -0,0 +1,34 @@ +{{- if .Values.authBroker.enabled }} +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: auth-broker + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "2" +spec: + destination: + namespace: auth-broker + server: {{ .Values.destination.server }} + project: default + source: + repoURL: https://github.com/DiamondLightSource/workflows.git + path: charts/auth-broker + targetRevision: {{ .Values.authBroker.targetRevision }} + helm: + valueFiles: + - values.yaml + {{- if .Values.authBroker.extraValueFiles }} + {{- .Values.authBroker.extraValueFiles | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.authBroker.valuesObject }} + valuesObject: + {{- .Values.authBroker.valuesObject | toYaml | nindent 8 }} + {{- end }} + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true +{{- end }} diff --git a/charts/apps/values.yaml b/charts/apps/values.yaml index e07c505a8..40c92d25b 100644 --- a/charts/apps/values.yaml +++ b/charts/apps/values.yaml @@ -172,3 +172,9 @@ openbao: targetRevision: HEAD extraValueFiles: [] valuesObject: {} + +authBroker: + enabled: false + targetRevision: HEAD + extraValuesFiles: [] + valuesObject: {} diff --git a/charts/auth-broker/Chart.lock b/charts/auth-broker/Chart.lock new file mode 100644 index 000000000..796083b4e --- /dev/null +++ b/charts/auth-broker/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: oci://docker.io/bitnamicharts + version: 2.23.0 +digest: sha256:c6a6a1cd877a7776095f62977d2fe441ee8b1145d624b6a57bc08dd52aa2611b +generated: "2026-07-17T13:11:00.394346977+01:00" diff --git a/charts/auth-broker/Chart.yaml b/charts/auth-broker/Chart.yaml new file mode 100644 index 000000000..decd22a68 --- /dev/null +++ b/charts/auth-broker/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: auth-broker +description: Token broker service that validates pod identity via Kubernetes TokenReview and serves OIDC access tokens +type: application +version: 0.1.2 +appVersion: 0.1.0 + +dependencies: + - name: common + version: 2.23.0 + repository: oci://docker.io/bitnamicharts diff --git a/charts/auth-broker/staging-values.yaml b/charts/auth-broker/staging-values.yaml new file mode 100644 index 000000000..412badcc5 --- /dev/null +++ b/charts/auth-broker/staging-values.yaml @@ -0,0 +1,3 @@ +image: + tag: drh + pullPolicy: Always diff --git a/charts/auth-broker/templates/_helpers.tpl b/charts/auth-broker/templates/_helpers.tpl new file mode 100644 index 000000000..7b431a242 --- /dev/null +++ b/charts/auth-broker/templates/_helpers.tpl @@ -0,0 +1,30 @@ +{{- define "auth-broker.name" -}} +{{- default "auth-broker" .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "auth-broker.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default "auth-broker" .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "auth-broker.labels" -}} +helm.sh/chart: {{ include "auth-broker.name" . }}-{{ .Chart.Version | replace "+" "_" }} +{{ include "auth-broker.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{- define "auth-broker.selectorLabels" -}} +app.kubernetes.io/name: {{ include "auth-broker.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/auth-broker/templates/clusterrole.yaml b/charts/auth-broker/templates/clusterrole.yaml new file mode 100644 index 000000000..47c8c79ac --- /dev/null +++ b/charts/auth-broker/templates/clusterrole.yaml @@ -0,0 +1,16 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "auth-broker.fullname" . }} + labels: + {{- include "auth-broker.labels" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list"] + - apiGroups: ["argoproj.io"] + resources: ["workflows"] + verbs: ["get"] + - apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["create"] diff --git a/charts/auth-broker/templates/clusterrolebinding.yaml b/charts/auth-broker/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..eea15d5b2 --- /dev/null +++ b/charts/auth-broker/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "auth-broker.fullname" . }} + labels: + {{- include "auth-broker.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "auth-broker.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "auth-broker.fullname" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/auth-broker/templates/configpolicy.yaml b/charts/auth-broker/templates/configpolicy.yaml new file mode 100644 index 000000000..58bbd1d43 --- /dev/null +++ b/charts/auth-broker/templates/configpolicy.yaml @@ -0,0 +1,98 @@ +{{- $policyName := printf "%s-generator" .Values.authBrokerConfig.targetName -}} +{{- $targetName := .Values.authBrokerConfig.targetName -}} +{{- $targetNamespace := .Values.authBrokerConfig.targetNamespace | default .Release.Namespace -}} +{{- $config := .Values.authBrokerConfig.config -}} + +apiVersion: policies.kyverno.io/v1 +kind: GeneratingPolicy +metadata: + name: {{ $policyName | quote }} +spec: + evaluation: + synchronize: + enabled: false + generateExisting: + enabled: false + + matchConstraints: + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: In + values: + - workflows + resourceRules: + - apiGroups: [""] + apiVersions: ["v1"] + operations: ["CREATE", "UPDATE"] + resources: ["secrets"] + + matchConditions: + - name: watched-input-secrets + expression: > + [ +{{- range $key, $value := $config }} +{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }} + { + "namespace": {{ ($value.namespace | default $targetNamespace) | quote }}, + "name": {{ $value.name | quote }} + }, +{{- end }} +{{- end }} + ].exists(s, + object.metadata.namespace == s.namespace && + object.metadata.name == s.name + ) + + variables: +{{- range $key, $value := $config }} +{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }} + - name: {{ printf "secret_%s" $key | replace "-" "_" | quote }} + expression: > + resource.Get( + "v1", + "secrets", + {{ ($value.namespace | default $targetNamespace) | quote }}, + {{ $value.name | quote }} + ) +{{- end }} +{{- end }} + + generate: + - expression: > + generator.Apply( + {{ $targetNamespace | quote }}, + [ + dyn({ + "apiVersion": dyn("v1"), + "kind": dyn("Secret"), + "metadata": dyn({ + "name": dyn({{ $targetName | quote }}), + "namespace": dyn({{ $targetNamespace | quote }}) + }), + "type": dyn("Opaque"), + "stringData": dyn({ + "config.yaml": dyn( +{{- range $key, $value := $config }} +{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }} +{{- $varName := printf "secret_%s" $key | replace "-" "_" -}} +{{- if $value.block }} + {{ printf "%s: |\n " $key | quote }} + + string(base64.decode(variables.{{ $varName }}.data[{{ $value.key | quote }}])) + .replace("\n", "\n ", -1) + + "\n" + +{{- else }} + {{ printf "%s: \"" $key | quote }} + + string(base64.decode(variables.{{ $varName }}.data[{{ $value.key | quote }}])) + + "\"\n" + +{{- end }} +{{- else }} + {{ printf "%s: %v\n" $key $value | quote }} + +{{- end }} +{{- end }} + "" + ) + }) + }) + ] + ) diff --git a/charts/auth-broker/templates/deployment.yaml b/charts/auth-broker/templates/deployment.yaml new file mode 100644 index 000000000..b680714e5 --- /dev/null +++ b/charts/auth-broker/templates/deployment.yaml @@ -0,0 +1,64 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "auth-broker.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "auth-broker.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + {{- include "auth-broker.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "auth-broker.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "auth-broker.fullname" . }} + affinity: + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - weight: 100 + podAffinityTerm: + labelSelector: + matchExpressions: + - key: app.kubernetes.io/name + operator: In + values: + - {{ include "auth-broker.name" . }} + topologyKey: kubernetes.io/hostname + containers: + - name: auth-broker + image: {{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global "chart" .Chart) | quote }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }} + args: + - serve + - --config + - /etc/auth-broker/config.yaml + ports: + - name: http + containerPort: {{ .Values.service.port }} + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + readinessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: 3 + periodSeconds: 5 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: config + mountPath: /etc/auth-broker + readOnly: true + volumes: + - name: config + secret: + secretName: {{ .Values.authBrokerConfig.targetName | default (include "auth-broker.fullname" .) }} diff --git a/charts/auth-broker/templates/service.yaml b/charts/auth-broker/templates/service.yaml new file mode 100644 index 000000000..20b8d91c6 --- /dev/null +++ b/charts/auth-broker/templates/service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "auth-broker.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "auth-broker.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "auth-broker.selectorLabels" . | nindent 4 }} diff --git a/charts/auth-broker/templates/serviceaccount.yaml b/charts/auth-broker/templates/serviceaccount.yaml new file mode 100644 index 000000000..20fda6c76 --- /dev/null +++ b/charts/auth-broker/templates/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "auth-broker.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "auth-broker.labels" . | nindent 4 }} diff --git a/charts/auth-broker/values.yaml b/charts/auth-broker/values.yaml new file mode 100644 index 000000000..6bc2c5092 --- /dev/null +++ b/charts/auth-broker/values.yaml @@ -0,0 +1,62 @@ +replicas: 1 + +image: + registry: "" + repository: ghcr.io/diamondlightsource/workflows-auth-broker + tag: latest + digest: "" + pullPolicy: IfNotPresent + + +service: + port: 8080 + +resources: + requests: + cpu: 250m + memory: 128Mi + limits: + cpu: 500m + memory: 256Mi + +authBrokerConfig: + targetName: auth-broker-config + + config: + oidc_provider_url: https://identity-test.diamond.ac.uk/realms/dls + port: 8080 + graph_url: http://graph-proxy.graph-proxy.svc.cluster.local/ + + client_id: + name: workflows-cluster-client + key: client-id + namespace: workflows + + client_secret: + name: workflows-cluster-client + key: client-secret + namespace: workflows + + postgres_database: auth_service + postgres_hostname: workflows-postgresql-ha-pgpool.workflows.svc.cluster.local + postgres_port: 5432 + + postgres_user: + name: postgres-auth-service-password + key: username + namespace: workflows + + postgres_password: + name: postgres-auth-service-password + key: password + namespace: workflows + + encryption_public_key: + name: auth-keys + key: encryption_public_key + namespace: workflows + + encryption_private_key: + name: auth-keys + key: encryption_private_key + namespace: workflows diff --git a/charts/workflows-cluster/Chart.lock b/charts/workflows-cluster/Chart.lock index 22096b456..1b32d8bd5 100644 --- a/charts/workflows-cluster/Chart.lock +++ b/charts/workflows-cluster/Chart.lock @@ -7,6 +7,6 @@ dependencies: version: 0.28.0 - name: secrets repository: file://./charts/secrets - version: 0.0.16 -digest: sha256:88eb89e7534467439ff4116c9ef06395bc27b67f5e0a16b0d9bdf0b20da69e65 -generated: "2026-07-09T11:50:40.060256152+01:00" + version: 0.0.17 +digest: sha256:b598a84612c28fe34f0900d89602790c2b2e630b9a3d549f16ff202dc0ea0e90 +generated: "2026-07-17T11:25:55.182284912+01:00" diff --git a/charts/workflows-cluster/Chart.yaml b/charts/workflows-cluster/Chart.yaml index fccad1875..2fb03cb97 100644 --- a/charts/workflows-cluster/Chart.yaml +++ b/charts/workflows-cluster/Chart.yaml @@ -3,7 +3,7 @@ name: workflows-cluster description: A virtual cluster for Data Analysis workflows type: application -version: 0.13.16 +version: 0.13.17 dependencies: - name: common version: 2.23.0 @@ -13,5 +13,5 @@ dependencies: version: 0.28.0 - name: secrets repository: file://./charts/secrets - version: 0.0.16 + version: 0.0.17 condition: secrets.enabled diff --git a/charts/workflows-cluster/charts/secrets/Chart.yaml b/charts/workflows-cluster/charts/secrets/Chart.yaml index 3c8f02636..260ea3ec5 100644 --- a/charts/workflows-cluster/charts/secrets/Chart.yaml +++ b/charts/workflows-cluster/charts/secrets/Chart.yaml @@ -3,7 +3,7 @@ name: secrets description: Sealed secrets for the workflows platform type: application -version: 0.0.16 +version: 0.0.17 dependencies: - name: common diff --git a/charts/workflows-cluster/charts/secrets/templates/auth-keys.yaml b/charts/workflows-cluster/charts/secrets/templates/auth-keys.yaml new file mode 100644 index 000000000..f5c9b5cbf --- /dev/null +++ b/charts/workflows-cluster/charts/secrets/templates/auth-keys.yaml @@ -0,0 +1,33 @@ +{{- if eq .Values.cluster "argus" }} +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: auth-keys + namespace: workflows +spec: + encryptedData: + encryption_private_key: AgCnShCyevKH8BNTdoWe6/hhtaeopQekLyF4MYmfX7WdwGGXcQcm+XY4ImslQqZsjNdoLc8pt+nrPHJq3q8OOKjptJTLnh89wyrfzY6ngHGOc0tMN197TL6JNLocFxEIeNZZWtWV0bNECaHEg4T+3YhUbfxn5MCmC3A60Y7TAccvLIBN1HsbVc3rNEmaEFrzqHpoYTonR3NFn/V/8BpW6Aa63CoWLPqRJbPtjA2AL85YOM6Fpwzs7CY6Lqla7Q+mhkwpABivD/wn4cp2uUeydSWs0nw6xYFWumvy28YQ35MeWGK2jH7S1qG3aJVQbM8yvetmGUJkCIbL+HQeoYqyQRzuvxySDXBiHsYOZB+/GtN1BOOZSWsb7Lj1OvOMvzVAM/MwRab1qi1s9eB17pFX6/szGvrh9W0hdBdSj642jWUP5WwNug3R/+qEBm7IjcJTZfDjI1zWs4yYj6VYdliIBVOgMkmbgY970SpIN9zzSwiyAab3zY2e0ZYxGUMhGagunpT9ZGgvdIYG9T/x39WjStSFYRyO2CTJMiymWJXKZ9iSE5Gu1QAvmXBP/x/jHalTGWhpdVco4pQHOSQvOeCPwfyGgD5lJ7HuT/mMG7NnL+AJQ58dbD6iWsUCy74TVabJei9lejnPtc1rQ0U+bbnc2xon/ssot/asbgepDO0rdRBsWUh+rT9q0lvOglzFvLb/rk/ZmKDTB5LOYPGtvTqBnbRYZFCWO32hi5/KKzv06TmHoWNQmFIgJBCBdXlOrQ== + encryption_public_key: AgAqbZBnhxP7lqlHacFFxslMEBd5VXqDWKbuGs8NaxEsU8ak7E0h07DoEXZAoxxAeKtZClBtPrdv0pYC9QZZ12Qzl4YV4iJU3Q+ciX55DH69ZIFG8at8kJb28M4I7OOCwQNggaTHMd6Mh9YoKMfMk4oYOQruv9Xf2mzM1MMLE9elAU+goz986+8+JUOyF8iu6Yf+JYy84+vDga1jiwD09bB2YTF7npR0XmEYS8i3W0U7mzZkKFxgcQdfpSJubevkjeD/PnGgdb88FeaAgdbV8pxg+fQqpEchtH8ix2boQ5ydVDsfl9kQDQeNf/2Wv55Fi/sc3j3vHPZR2WHxgoAZysKJiMC2oTAqdyTstF9jF5CmjOJtSLANI2spWNXqhTZJT5tr/U1Roky2ziIUChyGyTUirBuIO+GYLSaJlOfPrWX1EsAkmWxnCA0Q2XigpttJkCg1tgA4nuTY5WlJLhWD3m2/T+FkGnhDf0WF77CAwXf0eGuilXKY7JDBChljAqfuALRim5TrPuAN5Y8rKZnqji0rOILJYZKm50qcvDckiZ1lHu21L2tj4BYir/OWiA9x9wfW+YGUjKiy1/7gVW1dmdMwyU1+TfTgGqh+BS5JDca3To4UPPFxyD6o+pQU5Tn2HLns5oe47P6nAzECgV8KmqHnEc375f9QoWlgab4c8WbARYyk62/ZdqESKZvu+MZYGEZHo85ijUpdA0zOnjRknsxOi15/+nuJciK0XRZGwRtXdgzZmHB+M1IaEhsCjA== + template: + metadata: + name: auth-keys + namespace: workflows + type: Opaque +{{- else if eq .Values.cluster "pollux" }} +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: auth-keys + namespace: workflows +spec: + encryptedData: + encryption_private_key: AgBLJDrOtH4DhgDEfSTIZiNRQA19npMaw2JKEwUKUbLRkKueweT854spXiPNKS9QGl2yS6MJ0hkc4btV0tXvnHJqvmGhLJT+Xx10gvGGAUgxuUUYQDGwbILZgjITcR17Z7I73bMpkabYmmF6H/dvWHFpQ1yKtGMzMYM0GLkEL5UUbW4ekbViyUDF4lPWsk/deFOfB6B+d2gDd7HYGa3NXO/olqNPXtgEQT6lGawtMF2TJC1ly9azOGXP4unopjrmfLtj0gzxn1Z2nUI71kZ9FOLMHf5Ncf8VOybnucIWcRD5QITuyEohVsIgjur8xK9e9YS0sKon2lziO/tSbcGJSLHkDmyfP100Vv50Z02q9CEjg/TAJ1RU/BgVXcukNZZmlWYnCwvp40ZyIDtTr/FBPq/HlFhV6mpCUxDl2HqfA8eLW4bPbzULmCeuqoQMf99waA5ezUoFNClpHPxrO0kg3j64GU3SY+DCsOynfdvKsCBOLascyCMbDAfPLXVAllzF9T/djBkY+RfE1lZnYaDbc6R5bN/UVKOFHRte5VHWyLanRXpdJA5Kz2PWa9XMywXVG6RV2J1QbwAswD1kbxQ+vvkFPtZx10EmPsOYdMo/BNVaSn7dX/PI+F4kiIpBkJ0EsLpUC29K2QChg7Bj52OjZVNWkhrw8skXYAQGZrQSgMzrgdDsF9CG+Sjmp66zRwpy03q/dXEf3dO/YqLnOu/S8EyasI4AZ6jAFGoPiTW2lxpjqGoM55aVSE8kaD058Q== + encryption_public_key: AgBXNRkPk5MXfOKd7sabwIltG4dEAgJXpd3GBh1Nd/24P9/lF+W6cXQfiNuzr1SJcGRKuDdebZAi9Z0IvdNS0uSaDqZRvhiD5EvJdFo2BSuqq8Akdx20Chun8qAGyalkpqXi9UInwRkcwxP8Rk37JI80xNCr+LEV2sIxz54FjzGpcMEjiFGI8dSRrqdW8XmQ/WLk08qzGroJn+nw8lLGL75Pl7OOMucwXuQXaDDbngkZ+i21RRS+7rRay8b6h78nBY0aieGIsShiy23jjjT85xMiRaDshW09Xci+5BN6Y0NX73fBjNLJhi7tWrUtQbmqqRbiFoIh1CTlTyiuhwlWpUeHv48Aw02W6K061LKYzvgTOAB88QdcnlXFj0+bkqi+/E/obLVl7/Pis2eLzQwVFYt8EpRcK40dOl1CrlJ603AjxRFb/nBtPEcfBvqh+aauEyJ+QkMd6kn5M36cy16Ku5TFCmXIudXfrD3LoojIEHHBT/Med6tWoid4jR5tAdO6ZeREesKwjf5s7skN9Ba/zYN/WdPTJBAAZjsQ1d2kOQYV4HxM7ZoOv3Q6RQd/9pXFzpGJxx0ioPSb6m6eo7iESZjhaw7/wxM1wKbDPDfbIlKc8WLAH8knHaeHZwDBlZNl5PiYfer7oEAMHplPinJmniPM5fCY1k+aAgv4++I9b/27WqRo6vevcP2i51xc+/0cemhBLoy8F71ip8RQ+5mrsgzj0xW04mklehqrxfwJX//V59MKzka2v/N03fCQzA== + template: + metadata: + name: auth-keys + namespace: workflows + type: Opaque +{{- end }} diff --git a/charts/workflows-cluster/staging-values.yaml b/charts/workflows-cluster/staging-values.yaml index cc0760ae0..2e4613422 100644 --- a/charts/workflows-cluster/staging-values.yaml +++ b/charts/workflows-cluster/staging-values.yaml @@ -89,6 +89,8 @@ vcluster: "/graph-proxy-k6-auth": "k6/graph-proxy-k6-auth" "/postgres-auth-service-password": "workflows/postgres-auth-service-password" "/openbao-secret": "openbao/openbao-secret" + "/auth-keys": "workflows/auth-keys" + "/workflows-cluster-client": "workflows/workflows-cluster-client" ingress: secretName: letsencrypt-kubernetes-staging-workflows-diamond-ac-uk diff --git a/charts/workflows-cluster/values.yaml b/charts/workflows-cluster/values.yaml index 947a4c7bc..b5f7819e9 100644 --- a/charts/workflows-cluster/values.yaml +++ b/charts/workflows-cluster/values.yaml @@ -153,6 +153,8 @@ vcluster: "/rclone-config": "workflows/rclone-config" "/graph-proxy-k6-auth": "k6/graph-proxy-k6-auth" "/auth-gateway-config": "workflows/auth-gateway-config" + "/auth-keys": "workflows/auth-keys" + "/workflows-cluster-client": "workflows/workflows-cluster-client" configMaps: enabled: true mappings: