In a Helm release the authentication settings are chart values. What each setting does is described in Overview; this page gives the value it is written under and the shape of its content.

OmniAuth

General parameters

The general parameters are values under global.appConfig.omniauth and keep the names the product reads:

global:
  appConfig:
    omniauth:
      enabled: true
      allowSingleSignOn: ['openid_connect']
      blockAutoCreatedUsers: true
      autoLinkLdapUser: true
      syncProfileAttributes: ['email']

Provider Secrets

A provider entry is stored in a Kubernetes Secret and referenced from the values, so the client secret stays out of values.yaml. Create the Secret with the provider block as its content:

d8 k -n code create secret generic code-omniauth-keycloak \
  --from-file=provider=keycloak.yaml

The file holds the same entry as on the other installation types:

name: 'openid_connect'
label: 'Keycloak'
allowed_groups:
  - 'gitlab'
admin_groups:
  - 'admin'
groups_attribute: 'gitlab_group'
args:
  name: 'openid_connect'
  scope:
    - 'openid'
    - 'profile'
    - 'email'
  response_type: 'code'
  issuer: 'https://keycloak.example.com/realms/example'
  discovery: true
  client_auth_method: 'query'
  uid_field: 'preferred_username'
  send_scope_to_token_endpoint: false
  pkce: true
  client_options:
    identifier: '<client_id>'
    secret: '<client_secret>'
    redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'

Reference the Secret from the values:

global:
  appConfig:
    omniauth:
      providers:
        - secret: code-omniauth-keycloak
          key: provider

LDAP

LDAP servers

The servers are values under global.appConfig.ldap.servers, with the same keys the product reads. The bind password is taken from a Secret:

d8 k -n code create secret generic code-ldap-password \
  --from-literal=password='viewer123'
global:
  appConfig:
    ldap:
      servers:
        main:
          label: 'Head office'
          host: ldap-main.example.com
          port: 3389
          uid: 'cn'
          bind_dn: 'uid=viewer,ou=People,dc=example,dc=com'
          password:
            secret: code-ldap-password
            key: password
          base: 'ou=People,dc=example,dc=com'
          user_filter: '(!(nsAccountLock=TRUE))'
          block_auto_created_users: false
          sync_name: true
          group_sync:
            create_groups: true
            base: 'ou=Groups,dc=example,dc=com'
            filter: '(objectClass=groupOfNames)'
            top_level_group: 'LdapGroups'
            owner: 'root'
            role_mapping:
              - by_name: '.*-developer-.*'
                gitlab_role: 'developer'
        contractors:
          label: 'Contractors'
          host: ldap-contractors.example.com
          port: 3389
          uid: 'cn'
          bind_dn: 'uid=viewer,ou=People,dc=contractors,dc=example,dc=com'
          password:
            secret: code-ldap-password
            key: password
          base: 'ou=People,dc=contractors,dc=example,dc=com'

Synchronization schedule

The schedule of the synchronization job is a value of its own, in cron format:

global:
  appConfig:
    cron_jobs:
      ldap_sync_worker:
        cron: "0 * * * *"

Applying the values

Apply the edited values.yaml to the release:

helm upgrade code deckhouse-code \
  -n code \
  -f values.yaml
←
Authentication / Omnibus Docker
Authentication / Deckhouse Kubernetes Platform module
→