hydra_deployment.yaml

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hydra
  labels:
    name: hydra
spec:
  replicas: 1
  selector:
    matchLabels:
      name: hydra
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        name: hydra
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 10100
        seccompProfile:
          type: RuntimeDefault
      initContainers:
      - name: migrate
        args:
        - migrate
        - sql
        - up
        - -e
        - -c
        - /etc/config/hydra/hydra.yml
        - --yes
        envFrom:
        - configMapRef:
            name: pl-db-config
        - configMapRef:
            name: pl-ory-service-config
        env:
        - name: PL_POSTGRES_USERNAME
          valueFrom:
            secretKeyRef:
              name: pl-db-secrets
              key: PL_POSTGRES_USERNAME
        - name: PL_POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: pl-db-secrets
              key: PL_POSTGRES_PASSWORD
        - name: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
          valueFrom:
            secretKeyRef:
              name: pl-hydra-secrets
              key: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
        - name: SECRETS_SYSTEM
          valueFrom:
            secretKeyRef:
              name: pl-hydra-secrets
              key: SECRETS_SYSTEM
        - name: DSN
          # yamllint disable-line rule:line-length
          value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_HYDRA_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
        imagePullPolicy: IfNotPresent
        # yamllint disable-line rule:line-length
        image: ghcr.io/pixie-io/hydra:2.3.0-pl1@sha256:9f0b31b1ca13d22bf14abf0c83251333b9a957a9ade39e3c723a963b84402572
        volumeMounts:
        - mountPath: /etc/config/hydra
          name: config
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 10100
          seccompProfile:
            type: RuntimeDefault
      containers:
      - name: server
        imagePullPolicy: IfNotPresent
        # yamllint disable-line rule:line-length
        image: ghcr.io/pixie-io/hydra:2.3.0-pl1@sha256:9f0b31b1ca13d22bf14abf0c83251333b9a957a9ade39e3c723a963b84402572
        args:
        - serve
        - -c
        - /etc/config/hydra/hydra.yml
        - all
        envFrom:
        - configMapRef:
            name: pl-db-config
        - configMapRef:
            name: pl-ory-service-config
        - configMapRef:
            name: pl-domain-config
        env:
        - name: PL_POSTGRES_USERNAME
          valueFrom:
            secretKeyRef:
              name: pl-db-secrets
              key: PL_POSTGRES_USERNAME
        - name: PL_POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              name: pl-db-secrets
              key: PL_POSTGRES_PASSWORD
        - name: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
          valueFrom:
            secretKeyRef:
              name: pl-hydra-secrets
              key: OIDC_SUBJECT_IDENTIFIERS_PAIRWISE_SALT
        - name: SECRETS_SYSTEM
          valueFrom:
            secretKeyRef:
              name: pl-hydra-secrets
              key: SECRETS_SYSTEM
        - name: DSN
          # yamllint disable-line rule:line-length
          value: postgres://$(PL_POSTGRES_USERNAME):$(PL_POSTGRES_PASSWORD)@$(PL_POSTGRES_HOSTNAME):$(PL_POSTGRES_PORT)/$(PL_HYDRA_DATABASE)?sslmode=disable&max_conns=20&max_idle_conns=4
        - name: SERVE_TLS_ENABLED
          value: "true"
        - name: SERVE_TLS_CERT_PATH
          value: /certs/server.crt
        - name: SERVE_TLS_KEY_PATH
          value: /certs/server.key
        - name: SERVE_PUBLIC_CORS_ALLOWED_ORIGINS_0
          value: https://$(PL_DOMAIN_NAME)
        - name: SERVE_PUBLIC_CORS_ALLOWED_ORIGINS_1
          value: https://work.$(PL_DOMAIN_NAME)
        - name: PL_WORK_DOMAIN
          value: work.$(PL_DOMAIN_NAME)
        - name: PL_OAUTH_DOMAIN
          value: $(PL_WORK_DOMAIN)/oauth
        - name: HYDRA_URL
          value: https://$(PL_OAUTH_DOMAIN)/hydra
        - name: URLS_CONSENT
          value: https://$(PL_OAUTH_DOMAIN)/auth/hydra/consent
        - name: URLS_LOGIN
          value: https://$(PL_WORK_DOMAIN)/api/auth/oauth/login
        - name: URLS_LOGOUT
          value: https://$(PL_OAUTH_DOMAIN)/logout
        - name: URLS_SELF_PUBLIC
          value: $(HYDRA_URL)
        - name: URLS_SELF_ISSUER
          value: $(HYDRA_URL)
        # admin is not exposed to Pixie clients. Requests to this endpoint originate
        # from Pixie services.
        - name: URLS_SELF_ADMIN
          value: $(PL_HYDRA_ADMIN_HOST)
        ports:
        - containerPort: 4444
        - containerPort: 4445
        - containerPort: 5555
        volumeMounts:
        - name: config
          mountPath: /etc/config/hydra
        - name: certs
          mountPath: /certs
        resources: {}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 10100
          seccompProfile:
            type: RuntimeDefault
      - name: client-create-or-update
        imagePullPolicy: IfNotPresent
        # yamllint disable-line rule:line-length
        image: ghcr.io/pixie-io/hydra:2.3.0-alpine-pl1@sha256:8e09f1a6882d37387411dc8ee1647cc3c40ba42c7f74d9a711b0fa1f483a6dba
        command: ['sh', '-c', 'set -x;
          URL="https://localhost:4445/health/ready";
          until [
            $(wget --no-check-certificate --spider --quiet --server-response ${URL} 2>&1 |
              awk ''NR==1{print $2}'') -eq 200
          ]; do
            echo "waiting for ${URL}";
            sleep 2;
          done;
          CMD="hydra update oauth2-client auth-code-client";
          hydra get client auth-code-client
            --endpoint=https://localhost:4445
            --skip-tls-verify;
          if [ $? -ne 0 ]; then
            echo "Creating client";
            CMD="hydra create oauth2-client --id auth-code-client";
          fi;
          ${CMD}
            --endpoint https://localhost:4445
            --secret "${HYDRA_CLIENT_SECRET}"
            --grant-type authorization_code
            --grant-type refresh_token
            --grant-type implicit
            --response-type code
            --response-type id_token
            --response-type token
            --scope openid
            --scope offline
            --scope notifications
            --scope gist
            --scope vizier
            --redirect-uri "https://${PL_DOMAIN_NAME}/oauth/auth/callback"
            --redirect-uri "https://work.${PL_DOMAIN_NAME}/auth/callback"
            --skip-tls-verify;
          sleep infinity;
        ']
        envFrom:
        - configMapRef:
            name: pl-domain-config
        env:
        - name: HYDRA_CLIENT_SECRET
          valueFrom:
            secretKeyRef:
              name: pl-hydra-secrets
              key: CLIENT_SECRET
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: true
          runAsUser: 10100
          seccompProfile:
            type: RuntimeDefault
      restartPolicy: Always
      volumes:
      - name: config
        configMap:
          name: hydra-config
          items:
          - key: hydra.yml
            path: hydra.yml
      - name: certs
        secret:
          secretName: service-tls-certs