use ictsc/traefik-forward-auth

ictsc · Mar 5, 2025 · 3b2ce2a · 3b2ce2a
1 parent 9d73553
commit 3b2ce2a
Show file tree

Hide file tree

Showing 5 changed files with 16 additions and 2 deletions.
diff --git a/manifest/infrastructure/forward-auth/chart/templates/deployment.yaml b/manifest/infrastructure/forward-auth/chart/templates/deployment.yaml
@@ -13,7 +13,7 @@ spec:
     spec:
       containers:
         - name: forward-auth
-          image: thomseddon/traefik-forward-auth:latest
+          image: ghcr.io/ictsc/traefik-forward-auth:latest
           ports:
             - containerPort: 4181
           args:
@@ -23,6 +23,12 @@ spec:
             - --default-provider=oidc
             - --providers.oidc.issuer-url={{ required "A valid issuer is required." .Values.issuer }}
             - --providers.oidc.client-id=dex-client
+{{- if .Values.skipJwtBearerTokens }}
+            - --skip-jwt-bearer-tokens=true
+{{- end }}
+{{- if .Values.tokenPropagation }}
+            - --token-propagation=bearer
+{{- end }}
           env:
             - name: PROVIDERS_OIDC_CLIENT_SECRET
               valueFrom:

diff --git a/manifest/infrastructure/forward-auth/chart/templates/middleware.yaml b/manifest/infrastructure/forward-auth/chart/templates/middleware.yaml
@@ -5,5 +5,7 @@ metadata:
 spec:
   forwardAuth:
     address: http://{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local:4181
+{{- if .Values.tokenPropagation }}
     authResponseHeaders:
-      - X-Forwarded-User
+      - Authorization
+{{- end }}
diff --git a/manifest/infrastructure/forward-auth/chart/values.yaml b/manifest/infrastructure/forward-auth/chart/values.yaml
@@ -6,3 +6,7 @@
 issuer:
 # (required) クッキーを発行したいドメインを配列で指定
 domains:
+# IDトークンをBearerに伝播させるか
+tokenPropagation: false
+# Bearerトークンがあった時、クッキーの検証をスキップするか
+skipJwtBearerTokens: false
diff --git a/manifest/infrastructure/forward-auth/env/dev/forward-auth.yaml b/manifest/infrastructure/forward-auth/env/dev/forward-auth.yaml
@@ -2,3 +2,4 @@ issuer: https://dex.drove-dev.ictsc.net
 domains:
   - drove-dev.ictsc.net
   - contest-dev.ictsc.net
+tokenPropagation: true
diff --git a/manifest/infrastructure/forward-auth/env/prod/forward-auth.yaml b/manifest/infrastructure/forward-auth/env/prod/forward-auth.yaml
@@ -1,3 +1,4 @@
 issuer: https://dex.drove.ictsc.net
 domains:
   - drove.ictsc.net
+tokenPropagation: true