feat(authelia): add Argo CD client

2026-08-25 14:53:19 +00:00 · 2024-11-17 17:03:33 +01:00
parent c88403691b
commit 86395edc1f
5 changed files with 142 additions and 12 deletions
@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  parentRefs:
+    - name: external
+      namespace: gateway
+    - name: internal
+      namespace: gateway
+  hostnames:
+    - "authelia.stonegarden.dev"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: authelia
+          port: 80
@@ -5,6 +5,7 @@ namespace: authelia
 resources:
  - ns.yaml
  - lldap-credentials.yaml
+  - http-route.yaml

 helmCharts:
  - name: authelia
@@ -1,9 +1,13 @@
+# https://github.com/authelia/chartrepo/blob/master/charts/authelia/values.yaml
 image:
  registry: ghcr.io
  repository: authelia/authelia
  tag: 4.38.10 # renovate: docker=ghcr.io/authelia/authelia
  pullPolicy: IfNotPresent

+pod:
+  kind: 'Deployment'
+
 configMap:
  theme: 'dark'

@@ -11,30 +15,30 @@ configMap:
    # upgrade to 'two_factor' later
    default_policy: 'one_factor'
    rules:
-     - domain_regex: '^.*\.stonegarden.dev$'
-       policy: 'one_factor'
+      - domain_regex: '^.*\.stonegarden.dev$'
+        policy: 'one_factor'

  authentication_backend:
    ldap:
      enabled: true
      implementation: 'lldap'
      address: 'ldap://lldap.lldap.svc.cluster.local'
-      base_dn: 'DC=stonegarden,DC=dev'
-      #users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
-      #additional_users_dn: 'OU=people'
-      #groups_filter: '(member={dn})'
-      additional_groups_dn: 'OU=groups'
+      base_dn: 'dc=stonegarden,dc=dev'
+      users_filter: '(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))'
+      additional_users_dn: 'ou=people'
+      groups_filter: '(member={dn})'
+      additional_groups_dn: 'ou=groups'
      user: 'UID=authelia,OU=people,DC=stonegarden,DC=dev'
      password:
        secret_name: 'lldap-auth'
        value: 'password'

-#    file:
-#      enabled: true
+  #    file:
+  #      enabled: true

  session:
    cookies:
-      - subdomain: auth
+      - subdomain: authelia
        domain: stonegarden.dev

  storage:
@@ -49,6 +53,92 @@ configMap:
    filesystem:
      enabled: true

+  identity_providers:
+    oidc:
+      ## Enables this in the config map. Currently in beta stage.
+      ## See https://www.authelia.com/r/openid-connect/
+      enabled: true
+      jwks:
+        - key_id: 'default'
+          algorithm: 'RS256'
+          use: 'sig'
+          # TODO: CHANGE THIS COMPROMISED TEST KEY!
+          key:
+            value: |
+              -----BEGIN PRIVATE KEY-----
+              MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCsOCrc4yP2ziCO
+              MUJoEMA6hIlLgwDNrKviBKHBNjAjQ0EStW3148ZxSHtLZH+xls4HyjenDp79bUDd
+              hm3kh0N8Z+loSRky6JMx+NUyA4XoWzR35MxGbt6ojx3pHdFCJRUu5/DmU2w8RgVy
+              FaC/XWQPg03w80yEsXfT6CFT7avKwn/D8KCbjGVaYlLseWUAMPPyGU/pG/31CLR/
+              VDUaT5rnRHchlM8wsHfAR9rzhWLAn7xefIgK94hkD0l/BrY93g72TkNtkQsS+bgv
+              5404F0o+sILswoAZNvLWhy2AejwIw8HN+/ssaTbvRzfkXWiyvcBWA5kCK7ltpHMN
+              Cg5hcnwzAgMBAAECggEAVRrEg7dzVEl0aRAKouZ0N/a66ifow7qqjdyAGryueR6J
+              D7e8iSBwNhb9ZrpZJ+dAFTVm3xUomE/fGBmQQLhfLyEihLhqzW+FHdK7eCWpjLNV
+              cFIOaFftjBp9S2/Csw8kMrPHpepfuEFZ+5CYiTibc9cNMx7oF0Kj1oIFxjXTCTTX
+              /5G2WN9VsduA6SC5xnZNqyd8sKboQzXmGxgop98BRdiPTE5adZZ+oOozVmayYKMD
+              Y51SAHq+lpAmVW8poAfm59fmyll0gRBsHi3Xrbhpk+1nrWFhWiqS63G6rJ1Y3SQF
+              S1aztbP45z2T96g7OehNZT+98nrPHDzi4lpeiZ6XgQKBgQDmwLEIk/MWMCgv+BUy
+              bOuIyGSP0vLRSsNZpKc2NMCln0huKjpfLcfjre41aqISV6mGkAOfk/Y0NBPCPwQP
+              hO0OXnK/3sORzCyQCTfPW6nCAafjVaMvjCBlsKA/Hjx74Gw9JkrHJiGudrNrDYtQ
+              dQN5paCtauv/vknXVrDDapExkwKBgQC/D/oo+wRlntvP61HaBJt/zF/nLo7KF9wW
+              D2HC3lohVcF35KtgB1PbzZrTjQOPFVXbMs7t88g3nBSoc+6czPGkoevvS9UeYoH9
+              dhTDooiSVn6kmH1HgwSliqpZWMVyKpyFuCZTd014++7aKBg/16KJO+DxS9Uka80C
+              48pmvcyu4QKBgHguQcX68G9M85FQPxH9QosB+8YgkxDIRIgqxl/oB7H7DIk7+xzZ
+              RjNhwiAWAoVVHNkVpp11PZSgzu2rTl0a2TBTpqYhym/kDA2Uj3my/u4pWJyBXLWF
+              4NW1sTBOeif2kckjaWzhgkdQUU/fRQDJgN7ZkZ7ggju3itPZtcSBe097AoGAVzxR
+              SRLLgCaXUIiuN7Aw25oSE7kDQyy/tWbSiSoC1wOTsU08Hj1aQZrP3VWeUV85czrw
+              ll7fhNyD5iIAyaEdl8DCu+DQ7u2lUnfupSB54O8TJc3mLZeZsIfunZrVk/n2u2tI
+              PIXVXq8Q8JSr9cJcGPK5ExM/v0BlO7OL/3sbkKECgYBTj5hTKZvBkLQwyfMLMAoY
+              rytwq9T4sOQElWpvwi/6NmT8iYSWlXEjRktBnnGOyNjNXvyoLNr2CmtV/TJ2uG0J
+              fKWga5swZ/Aq4h5kX64+q710r+xGS2s4up6XY8gyT3+WxaF8RpxiQilDFVYCzvee
+              uzpHa9dV3xVGQQK5fEtWQg==
+              -----END PRIVATE KEY-----
+          #  path: '/secrets/oidc.jwk.RS256.pem'
+#          certificate_chain:
+#            value: |
+#              -----BEGIN PUBLIC KEY-----
+#              MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArDgq3OMj9s4gjjFCaBDA
+#              OoSJS4MAzayr4gShwTYwI0NBErVt9ePGcUh7S2R/sZbOB8o3pw6e/W1A3YZt5IdD
+#              fGfpaEkZMuiTMfjVMgOF6Fs0d+TMRm7eqI8d6R3RQiUVLufw5lNsPEYFchWgv11k
+#              D4NN8PNMhLF30+ghU+2rysJ/w/Cgm4xlWmJS7HllADDz8hlP6Rv99Qi0f1Q1Gk+a
+#              50R3IZTPMLB3wEfa84ViwJ+8XnyICveIZA9Jfwa2Pd4O9k5DbZELEvm4L+eNOBdK
+#              PrCC7MKAGTby1octgHo8CMPBzfv7LGk270c35F1osr3AVgOZAiu5baRzDQoOYXJ8
+#              MwIDAQAB
+#              -----END PUBLIC KEY-----
+#          #  path: '/secrets.oidc.jwk.RS256.crt'
+      clients:
+        - client_id: 'argocd'
+          # TODO: CHANGE THIS COMPROMISED TEST KEY!
+          client_secret: #'$pbkdf2-sha512$310000$ms/OlHdUjXSdHDW7xdgVhQ$6HN.cN9/MlttyYmXHMRU4JB0Ngqjs5ErSi1UIkH5k9qmMq2qHnueRrLwUjXTdMmOj6lCOAd1l2pA08VUTScPNw'
+            value: '$pbkdf2-sha512$310000$ms/OlHdUjXSdHDW7xdgVhQ$6HN.cN9/MlttyYmXHMRU4JB0Ngqjs5ErSi1UIkH5k9qmMq2qHnueRrLwUjXTdMmOj6lCOAd1l2pA08VUTScPNw'
+          #  path: '/secrets/oidc.client.argocd.value'
+          client_name: 'Argo CD'
+          public: false
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'https://argocd.stonegarden.dev/auth/callback'
+            - 'https://argocd.stonegarden.dev/applications'
+          #  - 'https://argocd.stonegarden.dev/api/dex/callback'
+          scopes:
+            - 'openid'
+            - 'groups'
+            - 'email'
+            - 'profile'
+          userinfo_signed_response_alg: 'none'
+        - client_id: 'argocd-cli'
+          client_name: 'Argo CD (CLI)'
+          public: true
+          authorization_policy: 'one_factor'
+          redirect_uris:
+            - 'http://localhost:8085/auth/callback'
+          scopes:
+            - 'openid'
+            - 'groups'
+            - 'email'
+            - 'profile'
+            - 'offline_access'
+          userinfo_signed_response_alg: 'none'
+
 secret:
  additionalSecrets:
    lldap-auth:
@@ -7,8 +7,8 @@ metadata:
  namespace: lldap
 spec:
  encryptedData:
-    groups.json: AgBon9QCA1W3I+8QezEBfRFwo942+Uq/Zts6SopexeCtSUOHeP25axCVUyTpNEHNmxtxyntvzvkoR0g96FghfJgtcE4UCieP1L8OwS3voDeRBHgtGMvrE1ND0A01nBL7EW1XVAZC6kx/NU33OsnmeDdKD/brev4q1uXelpwc9JtObKYy2JGqP8Pss9J/mTDTz5lfKQDMvbfu/PBQthUckbGQA92k0tn9M4EHKmNiMZTuAkafMg19T3vN1zUYqpmovanJb+JGHqfnbxQo4hG57ACbQQG7qQsmCu8nFYkwNOxA/BE3VZLDT26gwQrktMiaqJ3XJ9oF3seKSWs0a6dtLT2pXlf4JL//wtMil+ZV6gje8iHc9Hx3HUrBAboLkO9DYTd4Jv6ArqRSPQybKtsWNlHdryghNsbDAVyZcDwRPLz0iCn7l5r4mWxY1UMkQnJNINBzV0x1TXY8UL+jIHcmAE+KomHMkRvPxIBrh7OM4YnJEQuBV6IJZrMvlCBHrGREA72frzL0am16DWjY8/2bPTlBk5w1oZpGJadOusA5dGk32dxmJqkBw+FyGZsWJ6XHHU6oMdJS4PG7B62/fzoZ0eCSvdaVT16l/j6xx6HRKAeGFwawPGn25PmnamKkWL3BIs9l7fDBjKgsfTmy2UZAdIKN4U0YguBqvR67ZFlLx2IYNU8P/aEujtxhtgJijRmzOK1U3ZJGKw8URHyYoFiGTx5k01FdWsdx
-    users.json: AgCREOH7gBZWLNka92/lViVyD8SZ2vh5yPsOSfYAsA/ixIdVhK0lmTXm2NioNc42kQj0MMOo9mHwI7H4CT2UIwJHbzhSJv093z4/yXnt9WBsBKtAUsI9gMBIGIqvUNWsHsilPE0GaegKuMQNnX62tHfrZqPdtb8K8ksRcwH5Fe89sLVglhlitKRS2z2r00m9M5MvawzIgTlWgwT+PuFwnhaqeNH7205hUj32sjuSk8f37ZQxU3iw6nur1HjmxO6dV5eJWtskuBkQzowmIy9ZbapAcHL9XV55xDsM3CXByR5ic8TsIbHt5STgV2RR5WbhbIcX3uV2CTcYOBa2/JR8ieOblzZG3PMzimrMrUQ4mi7PjpSvel1SDuk/XlzOaAoQcm1rkpfin2fAzhnmK+Z6oligWX5nkH0HPQVx6GpW3+iZfgLLNILKs9Yri5lx5GxBmUJUqorWsagfvrpRcMM7W6bXfAJ9A5h/v3N3sONvLgYYbRgz/ClBXP+N7tAyMGmk0tUeMO3xt9ubujk5d1/4yVa1xphUePPr4ndW021oLZ6AKHzrs3TFZ1eehWqGPXHayUdAuo/gOEGpVWQ6j3mzlG+vGPHroO2YH3WpRMvtfCdI3m2TeSpwOtFU6DeWOi77KiB09Z3X64OF7KmGJrLXntz5ekRBz10h/oGxcP0fWxx3GNkStqH8TOWQ/2cbR3zB9OwwGqso8T5wMQ7iLK1bb7EIxM+HCuI2avkhMnXuH29ggnXFMrUouR1wFfZJRhX0mb+vXWFCIDT35oAV3Pf8om8IBxyZ/qNp0H/Gu2TDCDqobcuHVSjxXaZK8yisd1ktae5I9JWZXyOPvNTi+2uwXFveU/XzIOIhzzRxdIxvKbNbQSnNBaoNb6faezLGiHRif+EThIr6BUO2/mxwaii/4qq0GVTrhVqemSzWrDbXS5WJuDnSk/8aP4X9+E4Jxdrgq6tpwC+khc8pi0MAxZZ+xaVJWZv8jt50xTSO8GlZkcENDdgQWc1gzDI4qz+9tZIyRW14GjJaJPYCSGq/Z9VKLfsLFNryv8IXORZjiuizhlJedd/BOsz2vT5GG9jKIX4RJ07C7jSj/vHdDZ9SZPgFAz3QoETsZDqerbkBY6PO+/mU3SG23LhriEvKkHgM8/JiL2u3Rno1LZ1Ovi1AIfXMSR+4KUd7Gg6eQZ/gEK9lj2DTg8VQ7Z/9lo58aS7knytX1d0sv6NyT5JLUE3B/qcRFzRojPmFbaRHGicSbYIB1PAqAGBsQPZKcmKiPMOkxVPoeMlA6DSyAQWUSHLNRStrO26sS04BQZC88BJkvyZf3uq69rrbMh+kCrjg6CDRBg61FhIARDSrxMhLyPVzwF7+fZjL2ivBgZgkCvrgQmqMCE5p0qUg55mFb5+OpSHbGJ+STKBHIMJOEdTjtOc=
+    groups.json: AgCsBk4Vkv6TJ86WW7zrCXgLsM6zelThcVE/+gFRNM0CS1qPIKfaqh9L2ZM7LQOhULzCvnvwp8rWkQIBVZgPhTZi829wdj6nKyzKYkQ3QOiDQJSFnWqS93Qf650gA/HxgdahtVnPzMHO4Icf0l+khjoQu1UDPQv9PZP8c6DbGnD5+d/Hu8MY2V91qP/uUkSBDpUPOlpykg9H97L+eNkyHh3S7SBXMCsM2gl2JmcQ+ojNi7g+RVLfLuLNI8kiqA8y74pSRFhMD2PSiNT3v/Dn50afXEDNv88NGQQZAJG0kuvpfmeQePZayIBEeUl/dC0QbHtlxa31OF6L01eoSalUjsTRTVzY6REMwiSnLGDRRgnNAJ9Q7L8QMBmHcKZFVCzZCTLm7YG8jHdyvTrI1MAHHAX3hrje4zIfWdzpB8iD0Xqb+Y/lRJG8LgpRQuFwDFv4Lm0A5dXi7xOJJwoZqfQzZoUPFUA8xSpIq+in859EdbIiRGcTl132z+AK3TOFH5cdmtBkhoGWTOuvYOh2PB/KsDlAamYardpwrx2r4GXUUpR40b1GssGnTF0pcH20ovw34CG0qfu3cD34hPpOZPLwXctV247dTNM7rrMRk7fH1lLuU2i2M9j0eZnUkuiN3vntwEj+9r/uxfx11fGaj5QouvDof555t4RdOOk9aH8iBwLt92f75GvFVoeKqod1CWfZ6+gkl8ZJVP8XqKRAjpl5Rt2IrvtiCLK5gp3m5TpsLBhCh92UIMkCKCklo8LreOpHt6ROX9ZNHo07xbj9
+    users.json: AgAQ3YsvSBluOwD8g9mJPlaOdiS+4hJdtYJ740If7wmk7tH5weg3GWX3ZGPldt/ykOjScEdthcMqs3GDYRA0eIEChENZ/nUakp/gsGLgNVX1gttZnW850y62fP0tt8cRokf/egfzkNJGt70gLI25MhZB8k1HUDEN1xVmGeKPb1QSTgO8Kf5jAz7oOC4V1cYLGHvyHNbyhVL65oTDsqePE9YPkrI1uXhTZTz8DFD/XL4JxvaDnH63dzecyRPSPUgStuupWYKAWKhnizZuzMl8TAHtlkUVHuyigtvX9Uzmt7pzblO7FsHE+Ga1dKfwB7ep8JiFqEDi83U4C/nT/cQ4pHYLGAEw5Ek0XOB8uTbSZmw0e50LdJyUB+LQ/+SOs7XF7nEj00ycA/k/L8uOthkhYJ0Rwi62Tm4kXjAFgtIN46rHA7vitTKsAgjsI/FBsxR7bUsCLh6IK6sUrbde/NYJ8Yrf+5yoVXqfN6mk1nfrvYEJOmdSbIkSQfg2cmMAYNQJYJBlfJeYPAK8VJ1SkKztMufzj9u+fI+8FkcQQAUfF3X8W6dRXFSnRMyJNSvwGWcYLBEs1MWMPO2CFM/17mxtsE+ThsISVx/njB247Gh0BWhNgEABnzf2fJ50maC+uiNnPieM4p5etxqQv/E7JYTq+bRqahsCSCMiLB48LRcjUhX5oRpHogdsIbHcdNf5GwBOKsfqXauqWUti4Wwv1Esf8h6rKfQ28+Vu+vTe5oGDqyo7BOkhhh3kmTuOWaGCTCiAtElyMgmd1p4qxoxhr8SucXBSyjIRV3LDFSlIlw0nxNivpYK23Xr2UyISWyLwyiZHtLN0u49pViXM4azWRCzJTUEQBiOtNpifhWX8kR8FQQ0tCziQYOddIGK+8B0biKppE+szkZ6OXIt0M4AIGIb1CKKKKxhuto+Un+TwYm506JhUVWqRlrdqTf+QbF+YB61usHY+HTC7QIIFWQANwO8zWTWtwVT6m1LPTkUjqhBSai0988kzhKR9dgHOTDgFAoqs53XdWu/HTJfBR9tvK5pUFsljhnmy+2E3qF3sqXnu0xLeWEHhOixtCNj4roGYw7+z/0juXJkhntu6mV/a/3I6A4uuAv+WHxrnnkCY5/FWjxln5SRrsZg++AcDiCv/kYQUXYyQjAY5zVo3Z2W7slQEVOv0xrpROzAVU92v789D4BXhMWA5lNWKHS63ks5YgBR9Ypbhu+TxYYsYd2AZ9CdeHk1cIBJcliByyY4BW9dvsgic2p3PovNR7y4qbIXbgxho+DG4RqWGkAcFulWy2eP5k5yPLfCUeyLifCfTLsNkOEq7LPQkZVykdlFPdsc2v85JpeMkqqR7EX61CmYAGxgOIYKg9kJ18uP2LAu5MwG0l1h9Qm6YO4SmdXnaU5E0oJpkXyy4c2jfkU3nezgC7nHSy8A=
  template:
    metadata:
      creationTimestamp: null
@@ -1,7 +1,21 @@
+# https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/values.yaml
 configs:
  cm:
    create: true
    application.resourceTrackingMethod: "annotation+label"
+    # TODO: CHANGE THIS COMPROMISED TEST CLIENT SECRET
+    url: 'https://argocd.stonegarden.dev'
+    oidc.config: |
+      name: 'Authelia'
+      issuer: 'https://authelia.stonegarden.dev'
+      clientID: 'argocd'
+      clientSecret: 'kW2GrLDNZwpschHCU496oFKSE-mjRc8yOYbXpafRB6kJp-cF_wcfGaVF55.~rF_qSSEYUcth'
+      cliClientID: 'argocd-cli'
+      requestedScopes:
+        - 'openid'
+        - 'profile'
+        - 'email'
+        - 'groups'
  cmp:
    create: true
    plugins:
@@ -12,6 +26,10 @@ configs:
  params:
    controller.diff.server.side: true
    server.insecure: true
+  rbac:
+    policy.csv: |
+      g, argocd:admin, role:admin
+      g, argocd:read_all, role:readonly

 crds:
  install: true