MLOps - Kubeflow

deploykf_core:

  ## --------------------------------------
  ##             deploykf-auth
  ## --------------------------------------
  deploykf_auth:
    namespace: deploykf-auth

    ## dex configs
    ##
    dex:

      ## dex static passwords
      ##  - a list of users to create in dex's built-in password database
      ##  - each element is a map with keys `email` and `password`,
      ##    the `password` is a map with the following keys:
      ##     - `value`: the password value
      ##     - `existingSecret`: the name of a kubernetes secret containing the password (overrides `value`)
      ##     - `existingSecretKey`: the key in the secret that contains the password
      ##     - `type`: how the password is provided (default: "plain")
      ##         - "plain": the password is provided as plain text
      ##         - "hash": the password is provided as a bcrypt hash
      ##  - a bcrypt hash for "PASSWORD_STRING" can be generated with one of the following:
      ##     - echo "PASSWORD_STRING" | htpasswd -BinC 10 NULL | cut -d: -f2
      ##     - python -c 'import bcrypt; print(bcrypt.hashpw(b"PASSWORD_STRING", bcrypt.gensalt(10)).decode())'
      ##
      staticPasswords:
       - email: "bys@amazon.com"
         password:
           value: "bys"
      #  - email: "user2@example.com"
      #    password:
      #      value: "user2"

      ## dex connectors
      ##  - dex connectors which allow bridging trust to external identity providers
      ##    https://dexidp.io/docs/connectors/
      ##  - not all connector types support refresh tokens, notably "SAML 2.0" and "OAUTH 2.0" do not
      ##    however, most providers support "OpenID Connect" which does support refresh tokens
      ##    without refresh tokens, users will be forced to re-authenticate every `expiry.idToken` period
      ##  - each element is a map with keys `type`, `id`, `name`, and `config` (which are the same aas upstream dex)
      ##    additionally, `configExistingSecret` and `configExistingSecretKey` allow you to set `config`
      ##    from a YAML-formatted string in a kubernetes secret
      ##  - in most cases `config.redirectURI` will be set to "https://{DEPLOYKF_HOST}/dex/callback" (if port is 443)
      ##
      connectors:
        - type: oidc
          id: keycloak
          name: Keycloak
          config:
            issuer: https://keycloak.bys.asia/realms/mlops

            clientID: "bys-keycloak-client"
            clientSecret: ""

            ## replace with your deploykf domain
            ## NOTE: this must be an allowed redirect URI in the Keycloak app
            redirectURI: https://kubeflow.bys.asia/dex/callback

            ## openid scopes to request
            scopes:
              - openid
              - email
              - profile
              ## NOTE: offline_access is required for refresh tokens
              - offline_access

            ## keycloak does not always send the `email_verified` claim
            insecureSkipEmailVerified: true

            ## if your Keycloak uses a self-signed certificate
            #insecureSkipVerify: true

      ## dex OpenID Connect clients
      ##
      clients:
        ## OpenID client for oauth2-proxy (deployKF Dashboard)
        oauth2Proxy:
          clientId: "oauth2-proxy"
          clientSecret:
            existingSecret: "generated--dex-oauth2-proxy-client"
            existingSecretKey: "client_secret"
            generateSecret: true

        ## OpenID client for Minio Console
        minioConsole:
          clientId: "minio-console"
          clientSecret:
            existingSecret: "generated--dex-minio-console-client"
            existingSecretKey: "client_secret"
            generateSecret: true

        ## OpenID client for Argo Server
        argoServer:
          clientId: "argo-server"
          clientSecret:
            existingSecret: "generated--dex-argo-server-client"
            existingSecretKey: "client_secret"
            generateSecret: true

    ## oauth2-proxy configs
    ##
    oauth2Proxy:

      ## oauth2-proxy cookie configs
      ##
      cookie:
        secret:
          existingSecret: "generated--oauth2-proxy-cookie-secret"
          existingSecretKey: "cookie_secret"
          generateSecret: true