helm · kminehart · Apr 19, 2017 · Apr 19, 2017 · Apr 19, 2017 · Apr 19, 2017
diff --git a/incubator/hydra/Chart.yaml b/incubator/hydra/Chart.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+description: A security-first open source OAuth2 and OpenID Connect server for existing and new enterprise infrastructures.
+name: hydra
+version: 0.7.10
+keywords:
+- hdyra
+- authentication
+- authorization
+- auth
+- oauth
+- jwt
+home: https://www.ory.am/products/hydra
+icon: https://github.com/ory/hydra/blob/master/docs/images/logo.png
+sources:
+- https://github.com/ory/hydra
+maintainers:
+- name: Kevin Minehart
+ email: kminehart@wehco.com
diff --git a/incubator/hydra/README.md b/incubator/hydra/README.md
@@ -0,0 +1,53 @@
+# Hydra
+[Hydra](https://github/ory/hdya) offers OAuth 2.0 and OpenID Connect Core 1.0 capabilities as a service. Hydra is different, because it works with any existing authentication infrastructure, not just LDAP or SAML. By implementing a consent app (works with any programming language) you build a bridge between Hydra and your authentication infrastructure.
+
+Hydra is able to securely manage JSON Web Keys, and has a sophisticated policy-based access control you can use if you want to.
+
+This chart comes bundled with an installation of Postgres.
+
+# Prerequesites
+
+* Kubernetes 1.4+ with Beta APIs enabled
+* PV provisioner to support in the underlying infrastructure
+
+# Install
+
+To install the chart:
+
+```
+helm install --name=my-release-name stable/hydra
+```
+
+This will create a deployment, a secret, a service, and optionally a PersistentVolumeClaim, prefixed with `my-release-name`.
+
+# Uninstall
+
+```
+helm delete my-release-name [--purge]
+```
+
+Adding the `--purge` flag will completely remove any trace of your release. (No values will be remembered.)
+
+# Configuring
+
+
+| Parameter | Description | Default |
+|-------------------------------|----------------------------------------------------------------------------------------------------------------------------|--------------------------------|
+| `image` | The path for pulling the docker image (without tag) | `"oryd/hydra"` |
+| `imageTag` | The version of the docker image to pull | `"0.7.10"` |
+| `imagePullPolicy` | When to pull the docker image | `"Always"` |
+| `replicas` | How many replicas of Hydra to create | `2` |
+| `mountPath` | Where in the container to mount the storage volume | `"/root"` |
+| `persistence.enabled` | If false, then use `emptyDir: {}`, otherwise, issue a PVC | `true` |
+| `persistence.accessMode` | [ReadWriteOnce/ReadOnlyMany/ReadWriteMany](https://kubernetes.io/docs/concepts/storage/persistent-volumes/#access-modes-1) | `ReadWriteOnce` |
+| `persistence.size` | How much storage to allocate to the volume | `1Gi` |
+| `postgresql.postgresPassword` | The password of the Postgres User managing Hydra | `hydra` |
+| `postgresql.persistence.size` | How much storage to allocate to the postgres server behind Hydra | `1Gi` |
+| `config.system.secret` | The secret password for encrypting authorization tokens. You should change this. | `"changeme_changeme_changeme"` |
+| `config.consentUrl` | The URL for the consent app | `"https://consent.example.com"`|
+| `config.logLevel` | How detailed should the log output be | `"debug"` |
+| `accessTokenLifespan` | How long should an access token be valid for | `"1h"` |
+| `idTokenLifespan` | How long should an id token be valid for | `"1h"` |
+| `authorizeCodeLifespan` | How long should an authorize code be valid for | `"1h"` |
+
+You can check out the [values.yaml](values.yaml) for any other configuration items not listed here.
diff --git a/incubator/hydra/requirements.lock b/incubator/hydra/requirements.lock
@@ -0,0 +1,10 @@
+dependencies:
+- condition: ""
+ enabled: false
+ import-values: null
+ name: postgresql
+ repository: https://kubernetes-charts.storage.googleapis.com/
+ tags: null
+ version: 0.6.0
+digest: sha256:111f81da579687c7d392e5faf90dee60abcb036acbdbe5d2b31ff813a0aee54c
+generated: 2017-04-19T15:46:03.298854078-05:00
diff --git a/incubator/hydra/requirements.yaml b/incubator/hydra/requirements.yaml
@@ -0,0 +1,4 @@
+dependencies:
+- name: postgresql
+ version: 0.6.0
+ repository: https://kubernetes-charts.storage.googleapis.com/
diff --git a/incubator/hydra/templates/NOTES.txt b/incubator/hydra/templates/NOTES.txt
@@ -0,0 +1,16 @@
+{{- if eq .Values.config.system.secret "this_is_a_secret_change_me" }}
+######################################################################
+# WARNING #
+# You are using the default secret provided with the helm chart when #
+# issuing authorization tokens. This is very insecure. #
+######################################################################
+{{- end }}
+
+Hydra should not be facing the internet itself, so you can access hydra via. 
+the service from other deployments (including the consent app) using the hostname:
+
+{{ template "fullname" . }}-service.{{ $.Release.Namespace }}.svc.cluster.local
+
+Or on the same namespace:
+
+{{ template "fullname" . }}-service
diff --git a/incubator/hydra/templates/_helpers.tpl b/incubator/hydra/templates/_helpers.tpl
@@ -0,0 +1,24 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified postgresql name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "postgresql.fullname" -}}
+{{- printf "%s-%s" .Release.Name "postgresql" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
diff --git a/incubator/hydra/templates/hydra_deployment.yaml b/incubator/hydra/templates/hydra_deployment.yaml
@@ -0,0 +1,69 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+ name: {{ template "fullname" . }}
+ labels:
+ app: {{ template "fullname" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+spec:
+ replicas: {{ .Values.replicas }}
+ selector:
+ matchLabels:
+ app: {{ template "fullname" . }}
+ template:
+ metadata:
+ name: {{ template "fullname" . }}
+ labels:
+ app: {{ template "fullname" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+ spec:
+ volumes:
+ - name: hydra-data
+ {{- if .Values.persistence.enabled }}
+ persistentVolumeClaim:
+ claimName: {{ template "fullname" . }}
+ {{- else }}
+ emptyDir: {}
+ {{- end }}
+ - name: hydra-secret
+ secret:
+ secretName: {{ template "fullname" . }}-secret
+ containers:
+ - name: hydra
+ image: {{ .Values.image }}:{{ .Values.imageTag }}
+ imagePullPolicy: {{ .Values.imagePullPolicy }}
+ command: ["hydra", "host"]
+ volumeMounts:
+ - name: hydra-data
+ mountPath: {{ .Values.mountPath }}
+ ports:
+ - name: service
+ containerPort: 4444
+ - name: service2
+ containerPort: 4445
+ env:
+ - name: SYSTEM_SECRET
+ valueFrom:
+ secretKeyRef:
+ name: {{ template "fullname" . }}-secret
+ key: system.secret
+ - name: DATABASE_URL
+ value: postgres://{{ .Values.postgresql.postgresUser }}:{{ .Values.postgresql.postgresPassword }}@{{ template "postgresql.fullname" . }}:5432/{{ .Values.postgresql.postgresDatabase }}?sslmode=disable
+ - name: HTTPS_ALLOW_TERMINATION_FROM
+ value: {{ .Values.config.httpsAllowTerminationFrom }}
+ - name: LOG_LEVEL
+ value: {{ .Values.config.logLevel }}
+ - name: CONSENT_URL
+ value: {{ .Values.config.consentUrl }}
+ - name: ACCESS_TOKEN_LIFESPAN
+ value: {{ .Values.config.accessTokenLifespan }}
+ - name: ID_TOKEN_LIFESPAN
+ value: {{ .Values.config.idTokenLifespan }}
+ - name: AUTHORIZE_CODE_LIFESPAN
+ value: {{ .Values.config.authorizeCodeLifespan }}
+ resources:
+{{ toYaml .Values.resources | indent 12 }}
diff --git a/incubator/hydra/templates/hydra_pvc.yaml b/incubator/hydra/templates/hydra_pvc.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.persistence.enabled }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+ name: {{ template "fullname" . }}
+ annotations:
+{{- if .Values.persistence.storageClass }}
+ volume.beta.kubernetes.io/storage-class: {{ .Values.persistence.storageClass | quote }}
+{{- else }}
+ volume.alpha.kubernetes.io/storage-class: default
+{{- end }}
+spec:
+ accessModes:
+ - {{ .Values.persistence.accessMode | quote }}
+ resources:
+ requests:
+ storage: {{ .Values.persistence.size | quote }}
+{{- end }}
+
diff --git a/incubator/hydra/templates/hydra_secret.yaml b/incubator/hydra/templates/hydra_secret.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ template "fullname" . }}-secret
+ labels:
+ app: {{ template "fullname" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+type: Opaque
+data:
+ system.secret: {{ .Values.config.system.secret | b64enc }}
diff --git a/incubator/hydra/templates/hydra_service.yaml b/incubator/hydra/templates/hydra_service.yaml
@@ -0,0 +1,18 @@
+kind: Service
+apiVersion: v1
+metadata:
+ name: {{ template "fullname" . }}-service
+ labels:
+ app: {{ template "fullname" . }}
+ chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+ release: "{{ .Release.Name }}"
+ heritage: "{{ .Release.Service }}"
+spec:
+ type: {{ .Values.service.type }}
+ selector:
+ app: {{ template "fullname" . }}
+ ports:
+ - name: service
+ port: {{ .Values.service.port }}
+ targetPort: 4444
+ protocol: TCP
diff --git a/incubator/hydra/values.yaml b/incubator/hydra/values.yaml
@@ -0,0 +1,49 @@
+image: "oryd/hydra"
+imageTag: "v0.7.10"
+imagePullPolicy: "Always"
+
+replicas: 2
+mountPath: "/root"
+
+# Persistent storage.
+persistence:
+ ## If this is false, then emptyDir: {} will be used.
+ ## Setting this to true is highly recommended for production use.
+ ## If this is false, you will lose your data when your pod is destroyed.
+ enabled: true
+ ## If defined, volume.beta.kubernetes.io/storage-class: <storageClass>
+ ## Default: volume.alpha.kubernetes.io/storage-class: default
+ #
+ # storageClass: <storageClass>
+ accessMode: ReadWriteOnce
+ size: 1Gi
+
+postgresql:
+ imageTag: "9.6"
+ memory: 256Mi
+ cpu: 250m
+ postgresUser: hydra
+ postgresPassword: hydra
+ postgresDatabase: hydra
+ persistence:
+ size: 10Gi
+
+config:
+ system:
+ secret: "this_is_a_secret_change_me"
+ consentUrl: "https://consent.example.com"
+ logLevel: "debug"
+ accessTokenLifespan: "1h"
+ idTokenLifespan: "1h"
+ authorizeCodeLifespan: "10m"
+ httpsAllowTerminationFrom: 0.0.0.0/0
+
+service:
+ type: ClusterIP
+ port: 4444
+
+# http://kubernetes.io/docs/user-guide/compute-resources/
+resources:
+ requests:
+ memory: 128Mi
+ cpu: 100m