Skip to content

Commit a19d508

Browse files
batpadbatpad
authored
Helm chart for stac-auth-proxy (#44)
Creates a Helm Chart for `stac-auth-proxy`. See README in `helm/` folder for instructions on usage.
1 parent 3194bb3 commit a19d508

File tree

11 files changed

+784
-0
lines changed

11 files changed

+784
-0
lines changed

‎.github/workflows/publish-helm.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Publish Helm Chart
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'helm/**'
9+
- '.github/workflows/publish-helm.yaml'
10+
release:
11+
types: [created]
12+
13+
jobs:
14+
publish-helm:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
contents: read
18+
packages: write
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Install Helm
27+
uses: azure/setup-helm@v3
28+
with:
29+
version: v3.12.1
30+
31+
- name: Login to GHCR
32+
uses: docker/login-action@v3
33+
with:
34+
registry: ghcr.io
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Package Helm Chart
39+
run: |
40+
helm package helm/
41+
42+
- name: Push Helm Chart
43+
run: |
44+
helm push *.tgz oci://ghcr.io/${{ github.repository }}/charts

‎helm/Chart.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: stac-auth-proxy
3+
description: A Helm chart for stac-auth-proxy
4+
type: application
5+
version: 0.1.0
6+
appVersion: "1.0.0"

‎helm/README.md

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# STAC Auth Proxy Helm Chart
2+
3+
This Helm chart deploys the STAC Auth Proxy, which provides authentication and authorization for STAC APIs.
4+
5+
## Prerequisites
6+
7+
- Kubernetes 1.19+
8+
- Helm 3.2.0+
9+
- An OIDC provider (e.g., Auth0, Cognito, Keycloak)
10+
- A STAC API endpoint
11+
12+
## Installation
13+
14+
### Add the Helm Repository
15+
16+
```bash
17+
helm registry login ghcr.io
18+
helm pull oci://ghcr.io/developmentseed/stac-auth-proxy/charts/stac-auth-proxy --version 0.1.0
19+
```
20+
21+
### Install the Chart
22+
23+
Basic installation with minimal configuration:
24+
25+
```bash
26+
helm install stac-auth-proxy oci://ghcr.io/developmentseed/stac-auth-proxy/charts/stac-auth-proxy \
27+
--set env.UPSTREAM_URL=https://your-stac-api.com/stac \
28+
--set env.OIDC_DISCOVERY_URL=https://your-auth-server/.well-known/openid-configuration \
29+
--set ingress.host=stac-proxy.your-domain.com
30+
```
31+
32+
### Using a Values File
33+
34+
Create a `values.yaml` file:
35+
36+
```yaml
37+
env:
38+
UPSTREAM_URL: "https://your-stac-api.com/stac"
39+
OIDC_DISCOVERY_URL: "https://your-auth-server/.well-known/openid-configuration"
40+
OIDC_DISCOVERY_INTERNAL_URL: "http://auth-server-internal/.well-known/openid-configuration"
41+
DEFAULT_PUBLIC: "false"
42+
HEALTHZ_PREFIX: "/healthz"
43+
44+
ingress:
45+
enabled: true
46+
host: "stac-proxy.your-domain.com"
47+
tls:
48+
enabled: true
49+
50+
resources:
51+
limits:
52+
cpu: 500m
53+
memory: 512Mi
54+
requests:
55+
cpu: 200m
56+
memory: 256Mi
57+
```
58+
59+
Install using the values file:
60+
61+
```bash
62+
helm install stac-auth-proxy oci://ghcr.io/developmentseed/stac-auth-proxy/charts/stac-auth-proxy -f values.yaml
63+
```
64+
65+
### Using Image Pull Secrets
66+
67+
To use private container registries, you can configure image pull secrets:
68+
69+
```yaml
70+
71+
serviceAccount:
72+
create: true
73+
imagePullSecrets:
74+
name: "my-registry-secret"
75+
```
76+
77+
78+
## Configuration
79+
80+
### Required Values
81+
82+
| Parameter | Description |
83+
|-----------|-------------|
84+
| `env.UPSTREAM_URL` | URL of the STAC API to proxy |
85+
| `env.OIDC_DISCOVERY_URL` | OpenID Connect discovery document URL |
86+
87+
### Optional Values
88+
89+
| Parameter | Description | Default |
90+
|-----------|-------------|---------|
91+
| `env` | Environment variables passed to the container. See [STAC Auth Proxy documentation](https://github.com/developmentseed/stac-auth-proxy#configuration) for details | `{}` |
92+
| `ingress.enabled` | Enable ingress | `true` |
93+
| `ingress.className` | Ingress class name | `nginx` |
94+
| `ingress.host` | Hostname for the ingress | `""` |
95+
| `ingress.tls.enabled` | Enable TLS for ingress | `true` |
96+
| `replicaCount` | Number of replicas | `1` |
97+
98+
For a complete list of values, see the [values.yaml](./values.yaml) file.
99+
100+
## Upgrading
101+
102+
To upgrade the release:
103+
104+
```bash
105+
helm upgrade stac-auth-proxy oci://ghcr.io/developmentseed/stac-auth-proxy/charts/stac-auth-proxy -f values.yaml
106+
```
107+
108+
## Uninstalling
109+
110+
To uninstall/delete the deployment:
111+
112+
```bash
113+
helm uninstall stac-auth-proxy
114+
```
115+
116+
## Development
117+
118+
To test the chart locally:
119+
120+
```bash
121+
helm install stac-auth-proxy ./helm --dry-run --debug
122+
```
123+
124+
## Support
125+
126+
For support, please open an issue in the [STAC Auth Proxy repository](https://github.com/developmentseed/stac-auth-proxy/issues).

‎helm/templates/NOTES.txt

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
Thank you for installing {{ .Chart.Name }}.
2+
3+
Your STAC Auth Proxy has been deployed with the following configuration:
4+
5+
1. Application Access:
6+
{{- if .Values.ingress.enabled }}
7+
{{- if .Values.ingress.host }}
8+
Your proxy is available at:
9+
{{- if .Values.ingress.tls.enabled }}
10+
https://{{ .Values.ingress.host }}
11+
{{- else }}
12+
http://{{ .Values.ingress.host }}
13+
{{- end }}
14+
{{- end }}
15+
{{- else if contains "NodePort" .Values.service.type }}
16+
Get the application URL by running these commands:
17+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "stac-auth-proxy.fullname" . }})
18+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
19+
echo http://$NODE_IP:$NODE_PORT
20+
{{- else if contains "LoadBalancer" .Values.service.type }}
21+
Get the application URL by running these commands:
22+
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
23+
You can watch the status by running:
24+
kubectl get svc --namespace {{ .Release.Namespace }} {{ include "stac-auth-proxy.fullname" . }} -w
25+
26+
Once ready, get the external IP/hostname with:
27+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "stac-auth-proxy.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
28+
echo http://$SERVICE_IP:{{ .Values.service.port }}
29+
{{- else }}
30+
The service is accessible within the cluster at:
31+
{{ include "stac-auth-proxy.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}
32+
{{- end }}
33+
34+
2. Configuration Details:
35+
- Upstream STAC API: {{ .Values.env.UPSTREAM_URL }}
36+
- OIDC Discovery URL: {{ .Values.env.OIDC_DISCOVERY_URL }}
37+
- Health Check Endpoint: {{ .Values.env.HEALTHZ_PREFIX | default "/healthz" }}
38+
- Default Public Access: {{ .Values.env.DEFAULT_PUBLIC | default "false" }}
39+
40+
3. Verify the deployment:
41+
kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "stac-auth-proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}"
42+
43+
4. View the logs:
44+
kubectl logs --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "stac-auth-proxy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}"
45+
46+
5. Health check:
47+
{{- if .Values.ingress.enabled }}
48+
{{- if .Values.ingress.host }}
49+
{{- if .Values.ingress.tls.enabled }}
50+
curl https://{{ .Values.ingress.host }}{{ .Values.env.HEALTHZ_PREFIX | default "/healthz" }}
51+
{{- else }}
52+
curl http://{{ .Values.ingress.host }}{{ .Values.env.HEALTHZ_PREFIX | default "/healthz" }}
53+
{{- end }}
54+
{{- end }}
55+
{{- else }}
56+
kubectl port-forward --namespace {{ .Release.Namespace }} service/{{ include "stac-auth-proxy.fullname" . }} 8000:{{ .Values.service.port }}
57+
curl http://localhost:8000{{ .Values.env.HEALTHZ_PREFIX | default "/healthz" }}
58+
{{- end }}
59+
60+
For more information about STAC Auth Proxy, please visit:
61+
https://github.com/developmentseed/stac-auth-proxy
62+
63+
{{- if or (not .Values.env.UPSTREAM_URL) (not .Values.env.OIDC_DISCOVERY_URL) }}
64+
WARNING: Some required configuration values are not set. Please ensure you have configured:
65+
{{- if not .Values.env.UPSTREAM_URL }}
66+
- env.UPSTREAM_URL
67+
{{- end }}
68+
{{- if not .Values.env.OIDC_DISCOVERY_URL }}
69+
- env.OIDC_DISCOVERY_URL
70+
{{- end }}
71+
{{- end }}

‎helm/templates/_helpers.tpl

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "stac-auth-proxy.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
*/}}
11+
{{- define "stac-auth-proxy.fullname" -}}
12+
{{- if .Values.fullnameOverride }}
13+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
14+
{{- else }}
15+
{{- $name := default .Chart.Name .Values.nameOverride }}
16+
{{- if contains $name .Release.Name }}
17+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
18+
{{- else }}
19+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
20+
{{- end }}
21+
{{- end }}
22+
{{- end }}
23+
24+
{{/*
25+
Create chart name and version as used by the chart label.
26+
*/}}
27+
{{- define "stac-auth-proxy.chart" -}}
28+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
29+
{{- end }}
30+
31+
{{/*
32+
Common labels
33+
*/}}
34+
{{- define "stac-auth-proxy.labels" -}}
35+
helm.sh/chart: {{ include "stac-auth-proxy.chart" . }}
36+
{{ include "stac-auth-proxy.selectorLabels" . }}
37+
{{- if .Chart.AppVersion }}
38+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
39+
{{- end }}
40+
app.kubernetes.io/managed-by: {{ .Release.Service }}
41+
{{- end }}
42+
43+
{{/*
44+
Selector labels
45+
*/}}
46+
{{- define "stac-auth-proxy.selectorLabels" -}}
47+
app.kubernetes.io/name: {{ include "stac-auth-proxy.name" . }}
48+
app.kubernetes.io/instance: {{ .Release.Name }}
49+
{{- end }}
50+
51+
{{/*
52+
Create the name of the service account to use
53+
*/}}
54+
{{- define "stac-auth-proxy.serviceAccountName" -}}
55+
{{- if .Values.serviceAccount.create }}
56+
{{- default (include "stac-auth-proxy.fullname" .) .Values.serviceAccount.name }}
57+
{{- else }}
58+
{{- default "default" .Values.serviceAccount.name }}
59+
{{- end }}
60+
{{- end }}
61+
62+
{{/*
63+
Render env var value based on type
64+
*/}}
65+
{{- define "stac-auth-proxy.envValue" -}}
66+
{{- if kindIs "string" . -}}
67+
{{- . | quote -}}
68+
{{- else -}}
69+
{{- . | toJson | quote -}}
70+
{{- end -}}
71+
{{- end -}}

‎helm/templates/deployment.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "stac-auth-proxy.fullname" . }}
5+
labels:
6+
{{- include "stac-auth-proxy.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "stac-auth-proxy.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
labels:
15+
{{- include "stac-auth-proxy.selectorLabels" . | nindent 8 }}
16+
spec:
17+
serviceAccountName: {{ include "stac-auth-proxy.serviceAccountName" . }}
18+
securityContext:
19+
{{- toYaml .Values.securityContext | nindent 8 }}
20+
containers:
21+
- name: {{ .Chart.Name }}
22+
securityContext:
23+
{{- toYaml .Values.containerSecurityContext | nindent 12 }}
24+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
25+
imagePullPolicy: {{ .Values.image.pullPolicy }}
26+
ports:
27+
- name: http
28+
containerPort: 8000
29+
protocol: TCP
30+
resources:
31+
{{- toYaml .Values.resources | nindent 12 }}
32+
env:
33+
{{- range $key, $value := .Values.env }}
34+
- name: {{ $key }}
35+
value: {{ include "stac-auth-proxy.envValue" $value }}
36+
{{- end }}
37+
38+
{{- with .Values.nodeSelector }}
39+
nodeSelector:
40+
{{- toYaml . | nindent 8 }}
41+
{{- end }}
42+
{{- with .Values.affinity }}
43+
affinity:
44+
{{- toYaml . | nindent 8 }}
45+
{{- end }}
46+
{{- with .Values.tolerations }}
47+
tolerations:
48+
{{- toYaml . | nindent 8 }}
49+
{{- end }}

0 commit comments

Comments
 (0)