Skip to content

Commit ef518d5

Browse files
bjoernwbjoernw
authored
Adding insecure server boolean to chart. (#83)
Signed-off-by: Bjoern Weidlich <bweidlich@ripple.com>
1 parent 70137bd commit ef518d5

7 files changed

Lines changed: 55 additions & 1 deletion

File tree

‎charts/pomerium/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v1
22
name: pomerium
3-
version: 8.3.0
3+
version: 8.4.0
44
appVersion: 0.7.5
55
home: http://www.pomerium.io/
66
icon: https://www.pomerium.io/logo-long.svg

‎charts/pomerium/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
- [Self Provisioned](#self-provisioned-1)
1717
- [Configuration](#configuration)
1818
- [Changelog](#changelog)
19+
- [8.4.0](#840)
1920
- [8.0.0](#800)
2021
- [7.0.0](#700)
2122
- [6.0.0](#600)
@@ -144,6 +145,7 @@ A full listing of Pomerium's configuration variables can be found on the [config
144145
| `config.forceGenerateSigningKey` | Force recreation of generated signing key. You will need to restart your deployments after running | `false` |
145146
| `config.generateTLS` | Generate a dummy Certificate Authority and certs for service communication. Manual CA and certs can be set in values. | `true` |
146147
| `config.forceGenerateTLS` | Force recreation of generated TLS certificates. You will need to restart your deployments after running | `false` |
148+
| `config.insecure` | DANGER, this disables tls between services. Only do this if you know what you are doing. One reason might be that you want to offload tls to a reverse proxy (i.e. istio, traefik) | `false` | | `false` |
147149
| `config.sharedSecret` | 256 bit key to secure service communication. [See more](https://www.pomerium.io/docs/reference/reference.html#shared-secret). | 32 [random ascii chars](http://masterminds.github.io/sprig/strings.html) |
148150
| `config.cookieSecret` | Cookie secret is a 32 byte key used to encrypt user sessions. | 32 [random ascii chars](http://masterminds.github.io/sprig/strings.html) |
149151
| `config.policy` | Base64 encoded string containing the routes, and their access policies. | |
@@ -240,6 +242,10 @@ A full listing of Pomerium's configuration variables can be found on the [config
240242

241243
## Changelog
242244

245+
### 8.4.0
246+
247+
- Add `config.insecure` flag in order to support running Pomerium in non-tls mode to play well with reverse proxy's like Istio's envoy
248+
243249
### 8.0.0
244250

245251
- Pomerium `ConfigMap` and `Secret` were combined into a single `Secret`. See [v8.0.0 Upgrade Nodes](#800-1) to migrate

‎charts/pomerium/templates/NOTES.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,3 +48,11 @@ the official documentation:
4848

4949
https://www.pomerium.io/docs/identity-providers.html
5050
{{- end }}
51+
52+
{{- if .Values.config.insecure }}
53+
##############################################################################
54+
#### DANGER: You have disabled TLS!
55+
####
56+
#### Please only do this if you absolutely know what you are doing.
57+
##############################################################################
58+
{{- end }}

‎charts/pomerium/templates/authenticate-deployment.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,12 @@ spec:
8282
value: "/pomerium/privkey.pem"
8383
- name: CERTIFICATE_AUTHORITY_FILE
8484
value: "/pomerium/ca.pem"
85+
{{- if .Values.config.insecure }}
86+
- name: INSECURE_SERVER
87+
value: "true"
88+
- name: GRPC_INSECURE
89+
value: "true"
90+
{{- end }}
8591
{{- range $name, $value := .Values.extraEnv }}
8692
- name: {{ $name }}
8793
value: {{ quote $value }}
@@ -97,12 +103,20 @@ spec:
97103
httpGet:
98104
path: /ping
99105
port: https
106+
{{- if .Values.config.insecure }}
107+
scheme: HTTP
108+
{{- else }}
100109
scheme: HTTPS
110+
{{- end }}
101111
readinessProbe:
102112
httpGet:
103113
path: /ping
104114
port: https
115+
{{- if .Values.config.insecure }}
116+
scheme: HTTP
117+
{{- else }}
105118
scheme: HTTPS
119+
{{- end }}
106120
resources:
107121
{{ toYaml .Values.resources | indent 10 }}
108122
volumeMounts:

‎charts/pomerium/templates/authorize-deployment.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,12 @@ spec:
7474
value: "/pomerium/privkey.pem"
7575
- name: CERTIFICATE_AUTHORITY_FILE
7676
value: "/pomerium/ca.pem"
77+
{{- if .Values.config.insecure }}
78+
- name: INSECURE_SERVER
79+
value: "true"
80+
- name: GRPC_INSECURE
81+
value: "true"
82+
{{- end }}
7783
{{- range $name, $value := .Values.extraEnv }}
7884
- name: {{ $name }}
7985
value: {{ quote $value }}

‎charts/pomerium/templates/cache-deployment.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,12 @@ spec:
7272
value: "/pomerium/privkey.pem"
7373
- name: CERTIFICATE_AUTHORITY_FILE
7474
value: "/pomerium/ca.pem"
75+
{{- if .Values.config.insecure }}
76+
- name: INSECURE_SERVER
77+
value: "true"
78+
- name: GRPC_INSECURE
79+
value: "true"
80+
{{- end }}
7581
{{- range $name, $value := .Values.extraEnv }}
7682
- name: {{ $name }}
7783
value: {{ quote $value }}

‎charts/pomerium/templates/proxy-deployment.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,12 @@ spec:
8383
value: "/pomerium/privkey.pem"
8484
- name: CERTIFICATE_AUTHORITY_FILE
8585
value: "/pomerium/ca.pem"
86+
{{- if .Values.config.insecure }}
87+
- name: INSECURE_SERVER
88+
value: "true"
89+
- name: GRPC_INSECURE
90+
value: "true"
91+
{{- end }}
8692
{{- range $name, $value := .Values.extraEnv }}
8793
- name: {{ $name }}
8894
value: {{ quote $value }}
@@ -98,12 +104,20 @@ spec:
98104
httpGet:
99105
path: /ping
100106
port: https
107+
{{- if .Values.config.insecure }}
108+
scheme: HTTP
109+
{{- else }}
101110
scheme: HTTPS
111+
{{- end }}
102112
readinessProbe:
103113
httpGet:
104114
path: /ping
105115
port: https
116+
{{- if .Values.config.insecure }}
117+
scheme: HTTP
118+
{{- else }}
106119
scheme: HTTPS
120+
{{- end }}
107121
resources:
108122
{{ toYaml .Values.resources | indent 10 }}
109123
volumeMounts:

0 commit comments

Comments
 (0)