chore(charts): charts to deploy auth-broker

charts/apps/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: apps
 description: An argocd app to deploy apps inside the virtual cluster
 type: application
-version: 0.5.9
+version: 0.5.10

charts/apps/staging-values.yaml

@@ -106,3 +106,9 @@ openbao:
   extraValueFiles:
     - staging-values.yaml
   valuesObject: {}
+
+authBroker:
+  enabled: true
+  targetRevision: HEAD
+  extraValuesFiles: []
+  valuesObject: {}

charts/apps/templates/auth-broker-application.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.authBroker.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: auth-broker
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    namespace: auth-broker
+    server: {{ .Values.destination.server }}
+  project: default
+  source:
+    repoURL: https://github.com/DiamondLightSource/workflows.git
+    path: charts/auth-broker
+    targetRevision: {{ .Values.authBroker.targetRevision }}
+    helm:
+      valueFiles:
+        - values.yaml
+        {{- if .Values.authBroker.extraValueFiles }}
+        {{- .Values.authBroker.extraValueFiles | toYaml | nindent 8 }}
+        {{- end }}
+      {{- if .Values.authBroker.valuesObject }}
+      valuesObject:
+        {{- .Values.authBroker.valuesObject | toYaml | nindent 8 }}
+      {{- end }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+{{- end }}

charts/apps/values.yaml

@@ -172,3 +172,9 @@ openbao:
   targetRevision: HEAD
   extraValueFiles: []
   valuesObject: {}
+
+authBroker:
+  enabled: false
+  targetRevision: HEAD
+  extraValuesFiles: []
+  valuesObject: {}

charts/auth-broker/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: common
+  repository: oci://docker.io/bitnamicharts
+  version: 2.23.0
+digest: sha256:c6a6a1cd877a7776095f62977d2fe441ee8b1145d624b6a57bc08dd52aa2611b
+generated: "2026-07-17T13:11:00.394346977+01:00"

charts/auth-broker/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: auth-broker
+description: Token broker service that validates pod identity via Kubernetes TokenReview and serves OIDC access tokens
+type: application
+version: 0.1.2
+appVersion: 0.1.0
+
+dependencies:
+  - name: common
+    version: 2.23.0
+    repository: oci://docker.io/bitnamicharts

charts/auth-broker/staging-values.yaml

@@ -0,0 +1,3 @@
+image:
+  tag: drh
+  pullPolicy: Always

charts/auth-broker/templates/_helpers.tpl

@@ -0,0 +1,30 @@
+{{- define "auth-broker.name" -}}
+{{- default "auth-broker" .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "auth-broker.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default "auth-broker" .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "auth-broker.labels" -}}
+helm.sh/chart: {{ include "auth-broker.name" . }}-{{ .Chart.Version | replace "+" "_" }}
+{{ include "auth-broker.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{- define "auth-broker.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "auth-broker.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}

charts/auth-broker/templates/clusterrole.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "auth-broker.fullname" . }}
+  labels:
+    {{- include "auth-broker.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list"]
+  - apiGroups: ["argoproj.io"]
+    resources: ["workflows"]
+    verbs: ["get"]
+  - apiGroups: ["authentication.k8s.io"]
+    resources: ["tokenreviews"]
+    verbs: ["create"]

charts/auth-broker/templates/clusterrolebinding.yaml

@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "auth-broker.fullname" . }}
+  labels:
+    {{- include "auth-broker.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "auth-broker.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "auth-broker.fullname" . }}
+    namespace: {{ .Release.Namespace }}

charts/auth-broker/templates/configpolicy.yaml

@@ -0,0 +1,98 @@
+{{- $policyName := printf "%s-generator" .Values.authBrokerConfig.targetName -}}
+{{- $targetName := .Values.authBrokerConfig.targetName -}}
+{{- $targetNamespace := .Values.authBrokerConfig.targetNamespace | default .Release.Namespace -}}
+{{- $config := .Values.authBrokerConfig.config -}}
+
+apiVersion: policies.kyverno.io/v1
+kind: GeneratingPolicy
+metadata:
+  name: {{ $policyName | quote }}
+spec:
+  evaluation:
+    synchronize:
+      enabled: false
+    generateExisting:
+      enabled: false
+
+  matchConstraints:
+    namespaceSelector:
+      matchExpressions:
+        - key: kubernetes.io/metadata.name
+          operator: In
+          values:
+            - workflows
+    resourceRules:
+      - apiGroups: [""]
+        apiVersions: ["v1"]
+        operations: ["CREATE", "UPDATE"]
+        resources: ["secrets"]
+
+  matchConditions:
+    - name: watched-input-secrets
+      expression: >
+        [
+{{- range $key, $value := $config }}
+{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }}
+          {
+            "namespace": {{ ($value.namespace | default $targetNamespace) | quote }},
+            "name": {{ $value.name | quote }}
+          },
+{{- end }}
+{{- end }}
+        ].exists(s,
+          object.metadata.namespace == s.namespace &&
+          object.metadata.name == s.name
+        )
+
+  variables:
+{{- range $key, $value := $config }}
+{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }}
+    - name: {{ printf "secret_%s" $key | replace "-" "_" | quote }}
+      expression: >
+        resource.Get(
+          "v1",
+          "secrets",
+          {{ ($value.namespace | default $targetNamespace) | quote }},
+          {{ $value.name | quote }}
+        )
+{{- end }}
+{{- end }}
+
+  generate:
+    - expression: >
+        generator.Apply(
+          {{ $targetNamespace | quote }},
+          [
+            dyn({
+              "apiVersion": dyn("v1"),
+              "kind": dyn("Secret"),
+              "metadata": dyn({
+                "name": dyn({{ $targetName | quote }}),
+                "namespace": dyn({{ $targetNamespace | quote }})
+              }),
+              "type": dyn("Opaque"),
+              "stringData": dyn({
+                "config.yaml": dyn(
+{{- range $key, $value := $config }}
+{{- if and (kindIs "map" $value) (hasKey $value "name") (hasKey $value "key") }}
+{{- $varName := printf "secret_%s" $key | replace "-" "_" -}}
+{{- if $value.block }}
+                  {{ printf "%s: |\n  " $key | quote }} +
+                  string(base64.decode(variables.{{ $varName }}.data[{{ $value.key | quote }}]))
+                    .replace("\n", "\n  ", -1) +
+                  "\n" +
+{{- else }}
+                  {{ printf "%s: \"" $key | quote }} +
+                  string(base64.decode(variables.{{ $varName }}.data[{{ $value.key | quote }}])) +
+                  "\"\n" +
+{{- end }}
+{{- else }}
+                  {{ printf "%s: %v\n" $key $value | quote }} +
+{{- end }}
+{{- end }}
+                  ""
+                )
+              })
+            })
+          ]
+        )

charts/auth-broker/templates/deployment.yaml

@@ -0,0 +1,64 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "auth-broker.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "auth-broker.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "auth-broker.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "auth-broker.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "auth-broker.fullname" . }}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: app.kubernetes.io/name
+                      operator: In
+                      values:
+                        - {{ include "auth-broker.name" . }}
+                topologyKey: kubernetes.io/hostname
+      containers:
+        - name: auth-broker
+          image: {{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global "chart" .Chart) | quote }}
+          imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }}
+          args:
+            - serve
+            - --config
+            - /etc/auth-broker/config.yaml
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/auth-broker
+              readOnly: true
+      volumes:
+        - name: config
+          secret:
+            secretName: {{ .Values.authBrokerConfig.targetName | default (include "auth-broker.fullname" .) }}

charts/auth-broker/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "auth-broker.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "auth-broker.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "auth-broker.selectorLabels" . | nindent 4 }}

charts/auth-broker/templates/serviceaccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "auth-broker.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "auth-broker.labels" . | nindent 4 }}

charts/auth-broker/values.yaml

@@ -0,0 +1,62 @@
+replicas: 1
+
+image:
+  registry: ""
+  repository: ghcr.io/diamondlightsource/workflows-auth-broker
+  tag: latest
+  digest: ""
+  pullPolicy: IfNotPresent
+
+
+service:
+  port: 8080
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 256Mi
+
+authBrokerConfig:
+  targetName: auth-broker-config
+
+  config:
+    oidc_provider_url: https://identity-test.diamond.ac.uk/realms/dls
+    port: 8080
+    graph_url: http://graph-proxy.graph-proxy.svc.cluster.local/
+
+    client_id:
+      name: workflows-cluster-client
+      key: client-id
+      namespace: workflows
+
+    client_secret:
+      name: workflows-cluster-client
+      key: client-secret
+      namespace: workflows
+
+    postgres_database: auth_service
+    postgres_hostname: workflows-postgresql-ha-pgpool.workflows.svc.cluster.local
+    postgres_port: 5432
+
+    postgres_user:
+      name: postgres-auth-service-password
+      key: username
+      namespace: workflows
+
+    postgres_password:
+      name: postgres-auth-service-password
+      key: password
+      namespace: workflows
+
+    encryption_public_key:
+      name: auth-keys
+      key: encryption_public_key
+      namespace: workflows
+
+    encryption_private_key:
+      name: auth-keys
+      key: encryption_private_key
+      namespace: workflows