123 lines
3.5 KiB
YAML
123 lines
3.5 KiB
YAML
{{- if and .Values.oauth2Proxy.enabled ((.Values.auditProxy).enabled) }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Release.Name }}-audit-proxy-config
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
data:
|
|
nginx.conf: |
|
|
worker_processes 2;
|
|
error_log /dev/stderr warn;
|
|
events { worker_connections 1024; }
|
|
http {
|
|
log_format audit '$remote_addr - $http_x_forwarded_email [$time_local] '
|
|
'"$request" $status $body_bytes_sent rt=$request_time';
|
|
access_log /dev/stdout audit;
|
|
server {
|
|
listen 8080;
|
|
client_max_body_size 64m;
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
proxy_connect_timeout 10s;
|
|
proxy_buffering off;
|
|
location / {
|
|
set $user_email $http_x_forwarded_email;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-ClickHouse-Setting-log_comment $user_email;
|
|
proxy_set_header Authorization "";
|
|
proxy_pass_request_headers on;
|
|
if ($request_method = POST) {
|
|
set $args $args&log_comment=$user_email;
|
|
}
|
|
proxy_pass http://{{ .Release.Name }}-clickhouse:8123;
|
|
}
|
|
location /healthz {
|
|
return 200 'ok';
|
|
add_header Content-Type text/plain;
|
|
}
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ .Release.Name }}-audit-proxy
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
spec:
|
|
replicas: {{ (.Values.auditProxy).replicas | default 2 }}
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
annotations:
|
|
checksum/config: {{ .Values.auditProxy | toJson | sha256sum }}
|
|
spec:
|
|
{{- with (.Values.auditProxy).tolerations }}
|
|
tolerations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: nginx
|
|
image: {{ (.Values.auditProxy).image | default "nginx:1.27-alpine" }}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/nginx.conf
|
|
subPath: nginx.conf
|
|
readOnly: true
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 5
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ .Release.Name }}-audit-proxy-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: {{ .Release.Name }}-audit-proxy
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app.kubernetes.io/name: audit-proxy
|
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
|
ports:
|
|
- name: http
|
|
port: 8123
|
|
targetPort: 8080
|
|
{{- end }}
|