feat(cryostat): re-implement basic auth via oauth2-proxy htpasswd config

charts/cryostat/auth_proxy_htpasswd

@@ -0,0 +1 @@
+user:$2y$05$.p1/68oBWKX1FhAtZOArYOoNoMqsB4yuUNXGOeSATHPq3geKqEaZS

charts/cryostat/templates/_helpers.tpl

@@ -114,3 +114,22 @@ Get or generate a default secret key for object storage
 {{- (randAlphaNum 32) | b64enc | quote -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Generate or retrieve a default value for cookieSecret.
+*/}}
+{{- define "cryostat.cookieSecret" -}}
+{{- $secret := (lookup "v1" "Secret" .Release.Namespace (printf "%s-cookie-secret" .Release.Name)) -}}
+{{- if $secret -}}
+{{/*
+   Use the current secret. Do not regenerate.
+*/}}
+{{- $secret.data.COOKIE_SECRET | b64dec | quote -}}
+{{- else -}}
+{{/*
+    Generate a new secret.
+*/}}
+{{- $newSecret := randAlphaNum 24 | b64enc -}}
+{{- $newSecret | quote -}}
+{{- end }}
+{{- end }}

charts/cryostat/templates/alpha_config.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-alpha-config
+data:
+  alpha_config.yaml: |-
+    server:
+      BindAddress: http://0.0.0.0:4180
+    upstreamConfig:
+      proxyRawPath: true
+      upstreams:
+        - id: cryostat
+          path: /
+          uri: http://cryostat:8181
+        - id: grafana
+          path: /grafana/
+          uri: http://grafana:3000
+        - id: storage
+          path: ^/storage/(.*)$
+          rewriteTarget: /$1
+          uri: http://s3:8333
+          passHostHeader: false
+          proxyWebSockets: false
+    providers:
+      - id: dummy
+        name: Unused - Sign In Below
+        clientId: CLIENT_ID
+        clientSecret: CLIENT_SECRET
+        provider: google

charts/cryostat/templates/auth2_proxy.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-auth-proxy-secret
+data:
+  auth_proxy_htpasswd: {{ .Files.Get ".oauth2proxy.htpasswdFile" | b64enc | quote }}

charts/cryostat/templates/deployment.yaml

@@ -194,6 +194,31 @@ spec:
           securityContext:
             {{- toYaml .Values.storage.securityContext | nindent 12 }}
         {{- if not .Values.minimal }}
+        - name: {{ printf "%s-%s" .Chart.Name "oauth2proxy" }}
+          securityContext:
+            {{- toYaml .Values.oauth2Proxy.securityContext | nindent 12 }}
+          image: "{{ .Values.oauth2Proxy.image.repository }}:{{ .Values.oauth2Proxy.image.tag }}"
+          args:
+            - "--alpha-config=/etc/oauth2_proxy/alpha_config/alpha_config.yaml"
+          imagePullPolicy: {{ .Values.oauth2Proxy.image.pullPolicy }}
+          env:
+            - name: OAUTH2_PROXY_REDIRECT_URL
+              value: "http://localhost:8080/oauth2/callback"
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              value: {{ include "cryostat.cookieSecret" . }}
+            - name: OAUTH2_PROXY_EMAIL_DOMAINS
+              value: "*"
+          volumeMounts:
+            - name: auth-proxy-config
+              mountPath: /etc/oauth2_proxy
+              readOnly: true
+            - name: alpha-config
+              mountPath: /etc/oauth2_proxy/alpha_config
+            {{- if .Values.authentication.basicAuth.enabled }}
+            - name: basic-auth-secret
+              mountPath: /etc/oauth2_proxy/basic-auth-secret
+              readOnly: true
+            {{- end }}
         - name: {{ printf "%s-%s" .Chart.Name "grafana" }}
           securityContext:
             {{- toYaml .Values.grafana.securityContext | nindent 12 }}
@@ -257,3 +282,15 @@ spec:
       - name: {{ .Chart.Name }}
         emptyDir: {}
       {{- end }}
+      - name: alpha-config
+        configMap:
+          name: {{ .Release.Name }}-alpha-config
+      - name: auth-proxy-config
+        secret:
+          secretName: {{ .Release.Name }}-auth-proxy-secret
+      {{- if .Values.authentication.basicAuth.enabled }}
+      - name: basic-auth-secret
+        secret:
+          secretName: {{ .Values.authentication.basicAuth.secretName }}
+      {{- end }}
+

charts/cryostat/values.yaml

@@ -59,7 +59,7 @@ core:
     ## @skip core.securityContext.capabilities
     capabilities:
       drop:
-      - ALL
+        - ALL
   ## @param core.databaseSecretName Name of the secret to extract password for credentials database.
   databaseSecretName: ""
 
@@ -82,7 +82,7 @@ db:
     ## @skip db.securityContext.capabilities
     capabilities:
       drop:
-      - ALL
+        - ALL
 
 ## @section Storage Container
 ## @extra Configuration for Cryostat's object storage provider
@@ -103,7 +103,7 @@ storage:
     ## @skip storage.securityContext.capabilities
     capabilities:
       drop:
-      - ALL
+        - ALL
 
 ## @section Grafana Container
 ## @extra grafana Configuration for the customized Grafana instance for Cryostat
@@ -164,7 +164,7 @@ grafana:
     ## @skip grafana.securityContext.capabilities
     capabilities:
       drop:
-      - ALL
+        - ALL
 
 ## @section JFR Data Source Container
 ## @extra datasource Configuration for the JFR Data Source component, which translates recording events into a format consumable by Grafana
@@ -185,7 +185,7 @@ datasource:
     ## @skip datasource.securityContext.capabilities
     capabilities:
       drop:
-      - ALL
+        - ALL
 
 ## @section Authentication
 
@@ -198,6 +198,30 @@ authentication:
     ## @param authentication.basicAuth.filename Key within Secret containing the properties file. The properties file should contain one user per line, with the syntax "user=passHex", where "user" is the username and "passHex" is the SHA-256 hash of the desired password **(Required if basicAuth is enabled)**
     filename: ""
 
+oauth2Proxy:
+  ## @param authentication.oauth2Proxy.enabled Whether Cryostat should use OAuth2 Proxy for authentication. When true, Cryostat will authenticate users via OAuth2 Proxy.
+  enabled: true
+  ## @param authentication.oauth2Proxy.htpasswdFile Path to the htpasswd file for additional user authentication
+  htpasswdFile: "auth_proxy_htpasswd"
+  alphaConfig:
+    enabled: true
+    configFile: "templates/alpha_config.yaml"
+  image:
+    ## @param authentication.oauth2Proxy.image.repository Repository for the OAuth2 Proxy container image
+    repository: "quay.io/oauth2-proxy/oauth2-proxy"
+    ## @param authentication.oauth2Proxy.image.pullPolicy Image pull policy for the OAuth2 Proxy container image
+    pullPolicy: Always
+    ## @param authentication.oauth2Proxy.image.tag Tag for the OAuth2 Proxy container image
+    tag: "latest"
+  ## @param authentication.oauth2proxy.securityContext [object] Security Context for the OAuth2 Proxy container. Defaults to meet "restricted" [Pod Security Standard](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted). See: [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1)
+  securityContext:
+    ## @skip authentication.oauth2proxy.securityContext.allowPrivilegeEscalation
+    allowPrivilegeEscalation: false
+    ## @skip authentication.oauth2proxy.securityContext.capabilities
+    capabilities:
+      drop:
+        - ALL
+
 ## @section Other Parameters
 
 ## @param minimal Specify whether to deploy a Cryostat instance with no Grafana Dashboard or JFR Data Source