Skip to content

helm.md

Latest commit

 

History

History
149 lines (110 loc) · 5.03 KB

helm.md

File metadata and controls

149 lines (110 loc) · 5.03 KB

Deploying with Helm

This guide walks through installing AuthTranslator on Kubernetes using the Helm chart found in charts/authtranslator/. Helm ≥ 3.9 is assumed. See charts/authtranslator/README.md for a full list of chart values.

Why Helm? Templating secrets, ConfigMaps, and Optional Redis in one place makes day‑2 ops (upgrades, rollbacks) far easier than raw manifests.

1 Quick install

From the repository root:

helm upgrade --install authtranslator charts/authtranslator \
  --namespace authtranslator --create-namespace \
  --set image.tag="$(git rev-parse --short HEAD)"

This:

  • Creates a Deployment running one replica of AuthTranslator.
  • Mounts your config.yaml, allowlist.yaml, and denylist.yaml via a ConfigMap.
  • Exposes port 8080 via a ClusterIP Service called authtranslator.

2 Values reference (excerpt)

Key Default Description
image.repository ghcr.io/winhowes/authtranslator Override to use a private registry.
image.tag latest Image tag or digest.
image.pullPolicy IfNotPresent Image pull policy.
redisAddress "" Address passed to -redis-addr – either host:port or a redis:///rediss:// URL.
redisCA "" CA file for -redis-ca; empty skips TLS verification.
secretRefresh "" Value passed to -secret-refresh.
watch true Run with -watch so projected ConfigMap updates trigger reloads.
resources (object) Pod resource requests/limits.
imagePullSecrets [] Names of image pull secrets.
serviceAccountName "" Pod service account name.
config (string) Raw YAML for config.yaml.
allowlist (string) Raw YAML for allowlist.yaml.
denylist (string) Raw YAML for denylist.yaml.

Full schema lives in charts/authtranslator/values.yaml.

Example values.yaml

image:
  tag: "1.2.3"

redisAddress: "redis://redis:6379/0"

config: |
  integrations:
    - name: slack
      destination: https://slack.com
      outgoing_auth:
        - type: token
          params:
            secrets:
              - env:SLACK_TOKEN
            header: Authorization
            prefix: "Bearer "

allowlist: |
    - integration: slack
      callers:
        - id: demo
          capabilities:
            - name: post_as

denylist: |
  - integration: slack
    callers:
      - id: "*"
        rules:
          - path: /api/chat.postMessage
            methods:
              POST:
                body:
                  channel: forbidden-room

Install with:

helm install authtranslator charts/authtranslator -f values.yaml

3 Upgrading the chart

Helm makes rollbacks trivial:

helm upgrade authtranslator charts/authtranslator -f values.yaml --set image.tag=1.2.4

# If something breaks:
helm rollback authtranslator 1   # roll back to previous revision

4 Chart structure

charts/authtranslator/
  Chart.yaml          # metadata
  values.yaml         # user-tunable defaults
  templates/
    _helpers.tpl
    configmap.yaml
    deployment.yaml
    service.yaml

Feel free to add ingress, PodDisruptionBudget, or HPA templates as your cluster demands.

5 Using an OCI registry (optional)

# Package and push
helm package charts/authtranslator
helm push authtranslator-*.tgz oci://ghcr.io/winhowes/charts

# Later, install via OCI reference
helm install authtranslator oci://ghcr.io/winhowes/charts/authtranslator --version 1.2.3

6 Deploying with Terraform

Example Terraform configurations live in the terraform/ directory:

Set the variables for your environment and run terraform apply inside the chosen folder to create the service. The modules accept optional redis_address and redis_ca variables which map to the container flags.