apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    k8s-app: kube-oidc-proxy
  name: kube-oidc-proxy
  namespace: kubernetes-dashboard

---

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    k8s-app: kube-oidc-proxy
  name: kube-oidc-proxy
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      k8s-app: kube-oidc-proxy
  template:
    metadata:
      labels:
        k8s-app: kube-oidc-proxy
      annotations:
        deploy-version: v2021-09-28
    spec:
      containers:
        - name: kube-oidc-proxy
          image: gcr.io/pingcap-public/kube-oidc-proxy:v0.1
          resources:
            requests:
              cpu: 40m
              memory: 80Mi
            limits:
              cpu: 60m
              memory: 80Mi
          imagePullPolicy: Always
          ports:
            - containerPort: 9443
              protocol: TCP
          args:
            - serve
            - /etc/kube-oidc-proxy/config.yaml
          volumeMounts:
            - mountPath: /etc/kube-oidc-proxy
              name: config
              readOnly: true
            - mountPath: /etc/kube-oidc-proxy-tls
              name: tls
              readOnly: true
      serviceAccountName: kube-oidc-proxy
      volumes:
        - configMap:
            defaultMode: 420
            name: kube-oidc-proxy-config
          name: config
        - secret:
            defaultMode: 420
            secretName: kube-oidc-proxy-tls
          name: tls
---

kind: Service
apiVersion: v1
metadata:
  labels:
    k8s-app: kube-oidc-proxy
  name: kube-oidc-proxy
  namespace: kubernetes-dashboard
spec:
  ports:
    - port: 9443
      targetPort: 9443
  selector:
    k8s-app: kube-oidc-proxy

---

apiVersion: v1
data:
  config.yaml: |
    # Config format version
    version: "v1"

    web:
      https: "0.0.0.0:9443"
      httpsCert: "/etc/kube-oidc-proxy-tls/server.pem"
      httpsKey: "/etc/kube-oidc-proxy-tls/server-key.pem"

    oidc:
      issuer: {{ .Values.oidc.issuer }}

      usernameClaim: "email"
      # Uncomment to use a groups claim
      # groupsClaim: "groups"

      # OAuth2 client ID that JWTs must be issued for
      allowedClientID: {{ .Values.oidc.allowedClientID }}

      defaultGroups:
      {{- range .Values.oidc.defaultGroups }}
      - {{ . }}
      {{- end }}

    kubernetes:
      # Kubeconfig file that can be used to contact the API server.
      # If not provided, the in-cluster config will be used.
      kubeconfig: ""
kind: ConfigMap
metadata:
  name: kube-oidc-proxy-config
  namespace: kubernetes-dashboard

---

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    k8s-app: kube-oidc-proxy
  name: kube-oidc-proxy
rules:
  # Allow kube-oidc-proxy impersonate
  - apiGroups: [""]
    resources: ["users", "groups", "serviceaccounts"]
    verbs: ["impersonate"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kube-oidc-proxy
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kube-oidc-proxy
subjects:
  - kind: ServiceAccount
    name: kube-oidc-proxy
    namespace: kubernetes-dashboard

---

# TODO(zhengjiajin): auto rotate cert, currently expire is 10year
apiVersion: v1
data:
  server-key.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUFrdldYbEM0emFSV1htalNFMnpiRXl6NlJ6WGlWWjYreWF5Zlo1S1M3bVhvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFeU5EZzVoaXhUVE5uRk11dm9NVldmQ0cwbnpSS2VZTlZUaVZxR3JreFNCSVBpREo5MkF4UApNV0lsRW9LdHJTdXViZTBvUE8vWU9qNW9hZ2liSVR0NXVRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
  server.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ3ekNDQVdtZ0F3SUJBZ0lVS2VCOURhZTgyV1JHTVhJdllZdlFUYTdhbW1rd0NnWUlLb1pJemowRUF3SXcKRlRFVE1CRUdBMVVFQXhNS1pYaGhiWEJzWlMxallUQWVGdzB5TVRBek1UWXhNRE0xTURCYUZ3MHpNVEF6TVRReApNRE0xTURCYU1Ca3hGekFWQmdOVkJBTVREbVY0WVcxd2JHVXRjMlZ5ZG1WeU1Ga3dFd1lIS29aSXpqMENBUVlJCktvWkl6ajBEQVFjRFFnQUV5TkRnNWhpeFRUTm5GTXV2b01WV2ZDRzBuelJLZVlOVlRpVnFHcmt4U0JJUGlESjkKMkF4UE1XSWxFb0t0clN1dWJlMG9QTy9ZT2o1b2FnaWJJVHQ1dWFPQmtqQ0JqekFPQmdOVkhROEJBZjhFQkFNQwpCYUF3RXdZRFZSMGxCQXd3Q2dZSUt3WUJCUVVIQXdFd0RBWURWUjBUQVFIL0JBSXdBREFkQmdOVkhRNEVGZ1FVCmdoN1pBRXVWamFwZ3pxb1NST0R3TzZMNy9RY3dId1lEVlIwakJCZ3dGb0FVTlBMTEovL0llRTZ4eFNlYU91bUwKVFBNWEZzNHdHZ1lEVlIwUkJCTXdFWUlQYTNWaVpTMXZhV1JqTFhCeWIzaDVNQW9HQ0NxR1NNNDlCQU1DQTBnQQpNRVVDSVFDR3BxTFdGNTQrYzI5aTVhZng0RnIzWTBXZ1pJL0tTUFIvdjdjZXIwNWZEUUlnZjVBakYveElFQTA5CmEyK3hXcTU1OXFrdUhPMjJKeFltOFhXSFFWWjg1ZGs9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
kind: Secret
metadata:
  name: kube-oidc-proxy-tls
  namespace: kubernetes-dashboard