Skip to content

Commit 8c85447

Browse files
keyvaannkeyvaann
authored
Merge pull request #266 from RADAR-base/ory-kratos
[kratos] Add Ory Kratos service
2 parents 9273f13 + cf30788 commit 8c85447

File tree

5 files changed

+364
-1
lines changed

5 files changed

+364
-1
lines changed

‎etc/base.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,8 @@ management_portal:
184184
replicaCount: 1 # should be 1
185185
postgres:
186186
host: postgresql
187+
user: postgres
188+
port: 5432
187189
ssl:
188190
enabled: false
189191
managementportal:
@@ -192,7 +194,25 @@ management_portal:
192194
oauth_checking_key_aliases_0: radarbase-managementportal-ec
193195
oauth_checking_key_aliases_1: selfsigned
194196
smtp:
197+
username: secret
195198
password: secret
199+
host: localhost
200+
201+
kratos:
202+
_install: true
203+
_chart_version: 0.43.1
204+
_extra_timeout: 0
205+
jdbc:
206+
database: kratos
207+
kratos:
208+
courier:
209+
smtp:
210+
from_address: [email protected]
211+
212+
kratos_ui:
213+
_install: true
214+
_chart_version: 0.43.1
215+
_extra_timeout: 0
196216

197217
app_config:
198218
_install: true

‎etc/kratos/values.yaml‎

Lines changed: 227 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,227 @@
1+
ingress:
2+
admin:
3+
enabled: true
4+
className: "nginx"
5+
annotations:
6+
cert-manager.io/cluster-issuer: letsencrypt-prod
7+
hosts:
8+
- host: localhost
9+
paths:
10+
- path: "/admin/kratos/?(.*)"
11+
pathType: ImplementationSpecific
12+
tls:
13+
- secretName: radar-base-tls
14+
hosts:
15+
- localhost
16+
public:
17+
enabled: true
18+
className: "nginx"
19+
annotations:
20+
nginx.ingress.kubernetes.io/rewrite-target: /$1
21+
cert-manager.io/cluster-issuer: letsencrypt-prod
22+
hosts:
23+
- host: localhost
24+
paths:
25+
- path: "/kratos/?(.*)"
26+
pathType: ImplementationSpecific
27+
tls:
28+
- secretName: kratos-public-tls
29+
hosts:
30+
- localhost
31+
32+
kratos:
33+
# -- Enables database migration
34+
automigration:
35+
enabled: true
36+
37+
# -- You can add multiple identity schemas here. You can pass JSON schema using `--set-file` Helm CLI argument.
38+
identitySchemas:
39+
"identity.user.schema.json": |
40+
{
41+
"$schema": "http://json-schema.org/draft-07/schema#",
42+
"$id": "user",
43+
"title": "user",
44+
"type": "object",
45+
"properties": {
46+
"traits": {
47+
"type": "object",
48+
"properties": {
49+
"email": {
50+
"type": "string",
51+
"format": "email",
52+
"title": "E-Mail",
53+
"minLength": 5,
54+
"ory.sh/kratos": {
55+
"credentials": {
56+
"password": {
57+
"identifier": true
58+
},
59+
"totp": {
60+
"account_name": true
61+
}
62+
},
63+
"verification": {
64+
"via": "email"
65+
},
66+
"recovery": {
67+
"via": "email"
68+
}
69+
}
70+
}
71+
},
72+
"required": [ "email" ]
73+
}
74+
},
75+
"additionalProperties": false
76+
}
77+
"identity.default.schema.json": |
78+
{
79+
"$schema": "http://json-schema.org/draft-07/schema#",
80+
"$id": "default",
81+
"title": "user",
82+
"type": "object",
83+
"properties": {
84+
"traits": {
85+
"type": "object",
86+
"properties": {
87+
"email": {
88+
"type": "string",
89+
"format": "email",
90+
"title": "E-Mail",
91+
"minLength": 5,
92+
"ory.sh/kratos": {
93+
"credentials": {
94+
"password": {
95+
"identifier": true
96+
},
97+
"totp": {
98+
"account_name": true
99+
}
100+
},
101+
"verification": {
102+
"via": "email"
103+
},
104+
"recovery": {
105+
"via": "email"
106+
}
107+
}
108+
}
109+
},
110+
"required": [ "email" ]
111+
}
112+
},
113+
"additionalProperties": false
114+
}
115+
116+
config:
117+
118+
session:
119+
# Defines how long a session is active. Once that lifespan has been reached, the user needs to sign in again.
120+
lifespan: 24h
121+
122+
cookie:
123+
##-- If false, cookie is removed when the browser is closed --##
124+
persistent: false
125+
126+
courier:
127+
smtp:
128+
from_address: [email protected]
129+
130+
serve:
131+
public:
132+
base_url: https://localhost/kratos/
133+
cors:
134+
enabled: true
135+
allowed_origins:
136+
- https://localhost/kratos-ui/
137+
allowed_methods:
138+
- POST
139+
- GET
140+
- PUT
141+
- PATCH
142+
- DELETE
143+
allowed_headers:
144+
- Authorization
145+
- Cookie
146+
- Content-Type
147+
- Accept
148+
exposed_headers:
149+
- Content-Type
150+
- Set-Cookie
151+
- Accept
152+
allow_credentials: true
153+
admin:
154+
base_url: https://localhost/admin/kratos/
155+
156+
selfservice:
157+
default_browser_return_url: https://localhost/managementportal
158+
allowed_return_urls:
159+
- "https://localhost/"
160+
- "http://localhost/"
161+
162+
methods:
163+
password:
164+
config:
165+
haveibeenpwned_enabled: true
166+
max_breaches: 0
167+
ignore_network_errors: false
168+
min_password_length: 12
169+
identifier_similarity_check_enabled: true
170+
enabled: true
171+
totp:
172+
config:
173+
issuer: Radar
174+
enabled: true
175+
link:
176+
enabled: true
177+
178+
flows:
179+
error:
180+
ui_url: https://localhost/kratos-ui/error
181+
182+
settings:
183+
ui_url: https://localhost/kratos-ui/settings
184+
required_aal: highest_available
185+
186+
recovery:
187+
enabled: true
188+
ui_url: https://localhost/kratos-ui/recovery
189+
use: link
190+
191+
verification:
192+
# our current flow necessitates that users reset their password after they activate an account in managementportal,
193+
# this works as verification
194+
ui_url: https://localhost/kratos-ui/verification
195+
enabled: false
196+
use: link
197+
after:
198+
default_browser_return_url: https://localhost/kratos-ui
199+
200+
logout:
201+
after:
202+
default_browser_return_url: https://localhost/kratos-ui/login
203+
204+
login:
205+
ui_url: https://localhost/kratos-ui/login
206+
207+
registration:
208+
ui_url: https://localhost/kratos-ui/registration
209+
after:
210+
password:
211+
hooks:
212+
- hook: session
213+
oidc:
214+
hooks:
215+
- hook: session
216+
217+
identity:
218+
default_schema_id: user
219+
schemas:
220+
# identitySchemas:
221+
- id: user
222+
url: file:///etc/config/identity.user.schema.json
223+
224+
log:
225+
level: debug
226+
format: text
227+
leak_sensitive_values: true

‎etc/kratos_ui/values.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
config:
2+
csrfCookieName: "radar_csrf"
3+
4+
ingress:
5+
enabled: true
6+
className: "nginx"
7+
annotations:
8+
nginx.ingress.kubernetes.io/rewrite-target: /$1
9+
cert-manager.io/cluster-issuer: letsencrypt-prod
10+
hosts:
11+
- host: localhost
12+
paths:
13+
- path: "/kratos-ui/?(.*)"
14+
pathType: ImplementationSpecific
15+
tls:
16+
- secretName: radar-base-tls
17+
hosts:
18+
- localhost
19+
# -- Set this to ORY Kratos's Admin URL
20+
kratosAdminUrl: "kratos-admin"
21+
22+
# -- Set this to ORY Kratos's public URL
23+
kratosPublicUrl: "https://localhost/kratos"
24+
25+
# -- Set this to ORY Kratos's public URL accessible from the outside world.
26+
kratosBrowserUrl: "https://localhost/kratos"
27+
28+
# -- The basePath
29+
basePath: ""
30+
31+
# -- The jwksUrl
32+
jwksUrl: ""
33+
34+
projectName: "SecureApp"

‎etc/postgresql/values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ primary:
114114
##
115115
extraEnvVars:
116116
- name: POSTGRES_MULTIPLE_DATABASES
117-
value: managementportal,restsourceauthorizer,appconfig
117+
value: managementportal,restsourceauthorizer,appconfig,kratos
118118
## @param primary.podAnnotations Map of annotations to add to the pods (postgresql primary)
119119
##
120120
podAnnotations:

‎helmfile.d/10-managementportal.yaml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,85 @@ releases:
8686
value: https://{{ .Values.server_name }}/managementportal/oauth
8787
- name: authCallbackUrl
8888
value: https://{{ .Values.server_name }}/appconfig/login
89+
90+
- name: kratos
91+
chart: radar/kratos
92+
version: {{ .Values.kratos._chart_version }}
93+
installed: {{ .Values.kratos._install }}
94+
timeout: {{ add .Values.base_timeout .Values.kratos._extra_timeout }}
95+
<<: *logFailedRelease
96+
values:
97+
- "../etc/kratos/values.yaml"
98+
- {{ .Values.kratos | toYaml | indent 8 | trim }}
99+
set:
100+
- name: serverName
101+
value: {{ .Values.server_name }}
102+
- name: kratos.config.dsn
103+
value: postgres://{{ .Values.management_portal.postgres.user }}:{{ .Values.management_portal.postgres.password }}@{{ .Values.management_portal.postgres.host }}:{{ .Values.management_portal.postgres.port }}/{{ .Values | get "kratos.jdbc.database" "kratos" }}
104+
- name: kratos.config.courier.smtp.connection_uri
105+
# Note: encoding of "/" in password is necessary for the smtp connection_uri because kratos is not able to handle this.
106+
value: smtp://{{ .Values.management_portal.smtp.username }}:{{ replace "/" "%2F" .Values.management_portal.smtp.password }}@{{ .Values.management_portal.smtp.host }}:{{ .Values | get "management_portal.smtp.port" 587 }}
107+
- name: kratos.config.serve.public.base_url
108+
value: https://{{ .Values.server_name }}/kratos/
109+
- name: kratos.config.serve.admin.base_url
110+
value: https://{{ .Values.server_name }}/admin/kratos/
111+
- name: kratos.config.serve.public.cors.allowed_origins
112+
values:
113+
- https://{{ .Values.server_name }}/kratos-ui/
114+
- name: kratos.config.selfservice.default_browser_return_url
115+
value: https://{{ .Values.server_name }}/managementportal
116+
- name: kratos.config.selfservice.allowed_return_urls
117+
values:
118+
- https://{{ .Values.server_name }}/
119+
# FIXME: http://localhost/ is not a valid return URL for production
120+
- http://{{ .Values.server_name }}/
121+
- name: kratos.config.selfservice.flows.error.ui_url
122+
value: https://{{ .Values.server_name }}/kratos-ui/error
123+
- name: kratos.config.selfservice.flows.settings.ui_url
124+
value: https://{{ .Values.server_name }}/kratos-ui/settings
125+
- name: kratos.config.selfservice.flows.recovery.ui_url
126+
value: https://{{ .Values.server_name }}/kratos-ui/recovery
127+
- name: kratos.config.selfservice.flows.registration.ui_url
128+
value: https://{{ .Values.server_name }}/kratos-ui/registration
129+
- name: kratos.config.selfservice.flows.login.ui_url
130+
value: https://{{ .Values.server_name }}/kratos-ui/login
131+
- name: kratos.config.selfservice.flows.logout.after.default_browser_return_url
132+
value: https://{{ .Values.server_name }}/kratos-ui/login
133+
- name: kratos.config.selfservice.flows.verification.ui_url
134+
value: https://{{ .Values.server_name }}/kratos-ui/verification
135+
- name: kratos.config.selfservice.flows.verification.after.default_browser_return_url
136+
value: https://{{ .Values.server_name }}/kratos-ui
137+
- name: kratos.config.selfservice.flows.settings.ui_url
138+
value: https://{{ .Values.server_name }}/kratos-ui/settings
139+
- name: ingress.public.hosts[0].host
140+
value: {{ .Values.server_name }}
141+
- name: ingress.admin.tls[0].hosts
142+
values:
143+
- {{ .Values.server_name }}
144+
- name: ingress.admin.hosts[0].host
145+
value: {{ .Values.server_name }}
146+
- name: ingress.public.tls[0].hosts
147+
values:
148+
- {{ .Values.server_name }}
149+
150+
- name: kratos-selfservice-ui-node
151+
chart: radar/kratos-selfservice-ui-node
152+
version: {{ .Values.kratos_ui._chart_version }}
153+
installed: {{ .Values.kratos_ui._install }}
154+
timeout: {{ add .Values.base_timeout .Values.kratos_ui._extra_timeout }}
155+
<<: *logFailedRelease
156+
values:
157+
- "../etc/kratos_ui/values.yaml"
158+
- {{ .Values.kratos_ui | toYaml | indent 8 | trim }}
159+
set:
160+
- name: serverName
161+
value: {{ .Values.server_name }}
162+
- name: ingress.hosts[0].host
163+
value: {{ .Values.server_name }}
164+
- name: ingress.tls[0].hosts
165+
values:
166+
- {{ .Values.server_name }}
167+
- name: kratosPublicUrl
168+
value: https://{{ .Values.server_name }}/kratos
169+
- name: kratosBrowserUrl
170+
value: https://{{ .Values.server_name }}/kratos

0 commit comments

Comments
 (0)