oauth-proxy.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: auth-system
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: oauth2-proxy
  template:
    metadata:
      labels:
        k8s-app: oauth2-proxy
    spec:
      containers:
      - name: oauth2-proxy   
        image: quay.io/oauth2-proxy/oauth2-proxy:latest
        imagePullPolicy: Always
        ports:
        - containerPort: 4180
          protocol: TCP      
        args:
        - --cookie-secure=false
        - --provider=oidc
        - --client-id=oidc-auth-client
        - --client-secret=secret
        - --oidc-issuer-url=https://auth.172.30.2.2.nip.io:30443/
        - --http-address=0.0.0.0:4180
        - --upstream=file:///dev/null
        - --email-domain=*
        - --set-authorization-header=true
        # For x509 certificate error
        - --ssl-insecure-skip-verify=true
        env:
        # docker run -ti --rm python:3-alpine python -c 'import secrets,base64; print(base64.b64encode(base64.b64encode(secrets.token_bytes(16))));'
        - name: OAUTH2_PROXY_COOKIE_SECRET
          value: L01OS1ZEMUFIdTVsK3Z6dU0xa2REUT09
---
apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: oauth2-proxy
  name: oauth2-proxy
  namespace: auth-system
spec:
  ports:
  - name: http
    port: 4180
    protocol: TCP
    targetPort: 4180
  selector:
    k8s-app: oauth2-proxy
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: oauth-proxy
  namespace: auth-system
  annotations:
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - secretName: k8s-dashboard-external-tls
    hosts:
    - dashboard.172.30.2.2.nip.io
  rules:
  - host: dashboard.172.30.2.2.nip.io
    http:
      paths:
        - path: /oauth2
          pathType: Prefix
          backend:
            service:
              name: oauth2-proxy
              port:
                number: 4180
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-url: "https://$host:30443/oauth2/auth"
    nginx.ingress.kubernetes.io/auth-signin: "https://$host:30443/oauth2/start?rd=$escaped_request_uri"
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/auth-response-headers: "authorization"
  name: k8s-dashboard-external-auth2
  namespace: kubernetes-dashboard
spec:
  ingressClassName: nginx
  rules:
  - host: dashboard.172.30.2.2.nip.io
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: kubernetes-dashboard
            port:
              number: 443