LEDfan
commented
2 years ago Hi
This is possible using the kubernetesPodTemplateSpecPatches field of the shinyproxy CRD. First you have to create a configmap containing the keystore. You can do this with a typical yaml file, or you can use kustomize for it:
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
configMapGenerator:
- name: saml-keystore
files:
- shinyproxy-saml-keystore.jksNext, you can mount the configmap into the ShinyProxy pod, using the kubernetesPodTemplateSpecPatches field, for example:
apiVersion: openanalytics.eu/v1alpha1
kind: ShinyProxy
metadata:
name: shinyproxy
spec:
proxy:
title: Open Analytics Shiny Proxy
logo-url: https://www.openanalytics.eu/shinyproxy/logo.png
landing-page: /
heartbeat-rate: 10000
heartbeat-timeout: 60000
port: 8080
authentication: saml
saml:
keystore: /opt/shinyproxy/saml-keystore/keystore.jks
specs:
- id: 01_hello
display-name: Hello Application
description: Application which demonstrates the basics of a Shiny app
container-cmd: ["R", "-e", "shinyproxy::run_01_hello()"]
container-image: openanalytics/shinyproxy-demo
access-groups: [scientists, mathematicians]
- id: 06_tabsets
container-cmd: ["R", "-e", "shinyproxy::run_06_tabsets()"]
container-image: openanalytics/shinyproxy-demo
access-groups: scientists
kubernetesPodTemplateSpecPatches: |
- op: add
path: /spec/volumes/-
value:
name: saml-keystore
configMap:
name: saml-keystore
- op: add
path: /spec/containers/0/volumeMounts/-
value:
name: saml-keystore
mountPath: /opt/shinyproxy/saml-keystore/keystore.jks
subPath: shinyproxy-saml.jks
logging:
file:
name: shinyproxy.logCurrently this is not very well documented, therefore I'll keep this issue open to remind us of improving the documentation.
wccropper
I see there are config options for the application.yaml for saml+jks. I am using Azure AD Enterprise application. The communication is working as I am prompted to login and the correct entity-id is being returned (firefox SAML_tracer). The current error is:
I believe I need to provide as java keystore of the saml signing cert from Azure. I have created this and stored it as a secret, but do no see a way to pass this to the sp-shinyproxy containers.