Option to handle dex-core client_secret via k8s secrets + alpine update

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16.4-alpine3.13
+FROM golang:1.17.3-alpine3.14
 
 RUN apk add --no-cache --update alpine-sdk bash
 
@@ -15,7 +15,7 @@ COPY . .
 
 RUN make build
 
-FROM alpine:3.13.5
+FROM alpine:3.14
 
 # Dex connectors, such as GitHub and Google logins require root certificates.
 # Proper installations should manage those certificates, but it's a bad user

charts/dex-k8s-authenticator/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
-appVersion: "v1.4.0"
+appVersion: "v1.4.1"
 description: "Authenticator for using Dex with Kubernetes"
 name: dex-k8s-authenticator
-version: 1.4.0
+version: 1.4.1
 sources:
 - https://github.com/mintel/dex-k8s-authenticator
 maintainers:

charts/dex-k8s-authenticator/templates/ingress.yaml

@@ -2,7 +2,7 @@
 {{- $fullName := include "dex-k8s-authenticator.fullname" . -}}
 {{- $servicePort := .Values.service.port -}}
 {{- $ingressPath := .Values.ingress.path -}}
-apiVersion: extensions/v1beta1
+apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: {{ $fullName }}

charts/dex-k8s-authenticator/templates/secrets.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "dex-k8s-authenticator.fullname" . }}
+  labels:
+    app: {{ template "dex-k8s-authenticator.fullname" . }}
+    env: {{ default "dev" .Values.global.deployEnv }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+data:
+  credentials: {{ default "" .Values.dex-core.client_secret | b64enc }}

charts/dex-k8s-authenticator/values.yaml

@@ -24,13 +24,20 @@ dexK8sAuthenticator:
   - name: my-cluster
     short_description: "My Cluster"
     description: "Example Cluster Long Description..."
+    #"client_secret" can be shifted to secrets.
+    #In order to use the secrets the value of client_secret needs to be replaced
+    #with the following: client_secret: ${client_secret} 
     client_secret: pUBnBOY80SnXgjibTYM9ZWNzY2xreNGQok
     issuer: https://dex.example.com
     k8s_master_uri: https://my-cluster.example.com
     client_id: my-cluster
     redirect_uri: https://login.example.com/callback/my-cluster
     k8s_ca_uri: https://url-to-your-ca.crt
 
+#Will create a secret which then can be used for the "dexK8sAuthenticator->client_secret"
+#dex-core:
+#  client_secret: my-secret-value-plain
+
 service:
   annotations: {}
   type: ClusterIP

docs/config.md

@@ -73,7 +73,7 @@ clusters:
 # A path-prefix from which to serve requests and assets
 web_path_prefix: /dex-auth
 ```
-
+-
 Don't forget to update the Dex `staticClients.redirectURIs` value to include the prefix as well.
 
 ### Helm

entrypoint.sh

@@ -5,5 +5,12 @@ if [ ! -z "$(ls -A /certs)" ]; then
   update-ca-certificates
 fi
 
+credentials_file=/var/run/secrets/dex-k8s-authenticator/credentials/credentials
+if [ -e $credentials_file ]
+then
+  echo "export client_secret" `cat $credentials_file` > /var/tmp/credential_export
+  source /var/tmp/credential_export
+fi
+
 # Execute dex-k8s-authenticator with any argument passed to docker run
-/app/bin/dex-k8s-authenticator $@
+/app/bin/dex-k8s-authenticator $@