helm: Convert the SSO server to be served over SSL.

No issue #

Arvados-DCO-1.1-Signed-off-by: Ward Vandewege <wvandewege@veritasgenetics.com>

diff --git a/arvados/config/api-server/application.yml b/arvados/config/api-server/application.yml
index 08a87c55f65a18e3c65864e65aaa8728d8242193..385c64c7ec51b6a98eeae191915fb9a7b57b9266 100644 (file)
--- a/arvados/config/api-server/application.yml
+++ b/arvados/config/api-server/application.yml
@@ -42,7 +42,7 @@ common:
   # sso-provider).
   sso_app_secret: app_secret
   sso_app_id: arvados-server
-  sso_provider_url: http://{{ .Values.externalIP }}:3002
+  sso_provider_url: https://{{ .Values.externalIP }}:3002
 
   # If this is not false, HTML requests at the API server's root URL
   # are redirected to this location, and it is provided in the text of

diff --git a/arvados/config/sso/nginx.conf b/arvados/config/sso/nginx.conf
index 9b5340eeafaaa38f298d4ca870dc8ebb879e07de..76d653086eb7e97a4a0b309f7bd3b6746dfaf819 100644 (file)
--- a/arvados/config/sso/nginx.conf
+++ b/arvados/config/sso/nginx.conf
@@ -3,8 +3,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 server {
-  listen 0.0.0.0:3002;
-  server_name insecure-sso;
+  listen 127.0.0.1:9000;
+  server_name localhost-sso;
 
   root /var/www/arvados-sso/current/public;
   index  index.html index.htm index.php;
@@ -12,4 +12,40 @@ server {
   passenger_enabled on;
   # If you're using RVM, uncomment the line below.
   passenger_ruby /usr/local/rvm/wrappers/default/ruby;
+
+  # `client_max_body_size` should match the corresponding setting in
+  # the API server's Nginx configuration.
+  client_max_body_size 128m;
+}
+
+upstream sso {
+  server     127.0.0.1:9000  fail_timeout=10s;
+}
+
+proxy_http_version 1.1;
+
+server {
+  listen       0.0.0.0:3002 ssl;
+  server_name  public-sso;
+
+  ssl on;
+  ssl_certificate     /etc/ssl/certs/sso.pem;
+  ssl_certificate_key /etc/ssl/private/sso.key;
+
+  index  index.html index.htm index.php;
+  # `client_max_body_size` should match the corresponding setting in
+  # the API server's Nginx configuration.
+  client_max_body_size 128m;
+
+  location / {
+    proxy_pass            http://sso;
+    proxy_redirect        off;
+    proxy_connect_timeout 90s;
+    proxy_read_timeout    300s;
+
+    proxy_set_header      X-Forwarded-Proto https;
+    proxy_set_header      Host $http_host;
+    proxy_set_header      X-Real-IP $remote_addr;
+    proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+  }
 }

diff --git a/arvados/templates/sso-deployment.yaml b/arvados/templates/sso-deployment.yaml
index 507c4822656453dc06ee64ec2aafe73c16e71d2f..c5912046a7b2fab7696e41c2f0fbdf112ceb1508 100644 (file)
--- a/arvados/templates/sso-deployment.yaml
+++ b/arvados/templates/sso-deployment.yaml
@@ -53,7 +53,17 @@ spec:
             - name: sso-configmap
               mountPath: /init-scripts/92-init-client.sh
               subPath: 92-init-client.sh
+            - name: ssl-configmap
+              mountPath: /etc/ssl/certs/sso.pem
+              subPath: cert
+            - name: ssl-configmap
+              mountPath: /etc/ssl/private/sso.key
+              subPath: key
+
       volumes:
         - name: sso-configmap
           configMap:
             name: arvados-sso-configmap
+        - name: ssl-configmap
+          configMap:
+            name: ssl-configmap