oauth2-proxy

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

global:

# Global registry to pull the images from

imageRegistry: ""

# To help compatibility with other charts which use global.imagePullSecrets.

imagePullSecrets: []

# - name: pullSecret1

# - name: pullSecret2

## Override the deployment namespace

namespaceOverride: ""

# Force the target Kubernetes version (it uses Helm `.Capabilities` if not set).

# This is especially useful for `helm template` as capabilities are always empty

# due to the fact that it doesn't query an actual cluster

kubeVersion:

# Oauth client configuration specifics

config:

# Add config annotations

annotations: {}

# OAuth client ID

clientID: "XXXXXXX"

# OAuth client secret

clientSecret: "XXXXXXXX"

# List of secret keys to include in the secret and expose as environment variables.

# By default, all three secrets are required. To exclude certain secrets

# (e.g., when using federated token authentication), remove them from this list.

# Example to exclude client-secret:

# requiredSecretKeys:

# - client-id

# - cookie-secret

requiredSecretKeys:

- client-id

- client-secret

- cookie-secret

# Create a new secret with the following command

# openssl rand -base64 32 | head -c 32 | base64

# Use an existing secret for OAuth2 credentials (see secret.yaml for required fields)

# Example:

# existingSecret: secret

cookieSecret: "XXXXXXXXXXXXXXXX"

# The name of the cookie that oauth2-proxy will create

# If left empty, it will default to the release name

cookieName: ""

google: {}

# adminEmail: xxxx

# useApplicationDefaultCredentials: true

# targetPrincipal: xxxx

# serviceAccountJson: xxxx

# Alternatively, use an existing secret (see google-secret.yaml for required fields)

# Example:

# existingSecret: google-secret

# groups: []

# Example:

# - group1@example.com

# - group2@example.com

# Configuration file generation precedence

# 1. If configFile is set, it takes precedence over the structured

# config below.

# 2. When alphaConfig.enabled=true and forceLegacyConfig=false,

# both configFile and existingConfig are ignored and the chart

# generates a minimal legacy config from emailDomains only.

# 3. If configFile is empty/not set, the config is auto-generated

# from emailDomains and, when alphaConfig is disabled, upstreams.

configFile: ""

# Email domains allowed to authenticate when the chart generates

# the main oauth2_proxy.cfg.

# This is always included in generated config, including the

# minimal alphaConfig-compatible legacy config.

emailDomains: ["*"]

# Legacy upstream configuration used only when the chart generates

# oauth2_proxy.cfg and alphaConfig is disabled.

# When alphaConfig.enabled is true, define upstreams in

# alphaConfig.configData.upstreamConfig instead.

upstreams: ["file:///dev/null"]

# Behavior when using alphaConfig together with a custom config file

# This flag only has an effect when:

# - alphaConfig.enabled is true, AND

# - you provide a custom config.configFile or config.existingConfig.

# Auto-generated config when alphaConfig.enabled=true is always a

# minimal legacy config (no upstreams), regardless of this flag.

# When true (default): Honor a custom configFile/existingConfig

# even when alphaConfig.enabled=true. If your custom config still

# contains deprecated options (for example 'upstreams'),

# oauth2-proxy may fail with:

# "failed to load core options: '' has invalid keys: upstreams"

# When false: Ignore any custom configFile/existingConfig when

# alphaConfig.enabled=true and instead generate the minimal

# legacy config. This preserves compatibility and avoids

# invalid legacy options such as 'upstreams'.

# If you are using alphaConfig and see the error:

# "failed to load core options: '' has invalid keys: upstreams"

# you have two options:

# 1) Keep forceLegacyConfig: true (default):

# - Continue using your custom legacy config, but ensure it

100

# is alpha-compatible (remove 'upstreams' and any other

101

# keys no longer supported).

102

# 2) Set forceLegacyConfig: false:

103

# - The chart will ignore config.configFile and

104

# config.existingConfig for alphaConfig.

105

# - Define upstreams in alphaConfig.configData.upstreamConfig

106

# instead (see examples below).

107

# - Move any other relevant settings into alphaConfig and/or

108

# flags rather than relying on a custom legacy configFile.

109

forceLegacyConfig: true

110

111

# Custom configuration file: oauth2_proxy.cfg (overrides

112

# emailDomains and upstreams when it is honored)

113

# Example:

114

# configFile: |-

115

# email_domains = [ "*" ]

116

# pass_basic_auth = false

117

# pass_access_token = true

118

# Use an existing config map (see configmap.yaml for required fields)

119

# This is ignored when alphaConfig.enabled=true and

120

# forceLegacyConfig=false.

121

# Example:

122

# existingConfig: config

123

existingConfig: ~

124

alphaConfig:

125

enabled: false

126

# Add config annotations

127

annotations: {}

128

# Arbitrary configuration data to append to the server section

129

serverConfigData: {}

130

# Arbitrary configuration data to append to the metrics section

131

metricsConfigData: {}

132

# Arbitrary configuration data to append

133

configData: {}

134

135

# Example: Multiple upstreams with path-based routing

136

# configData:

137

# upstreamConfig:

138

# upstreams:

139

# - id: service1

140

# path: /

141

# uri: http://service1:8080

142

# flushInterval: 1s

143

# passHostHeader: true

144

# proxyWebSockets: true

145

# - id: service2

146

# path: /api/

147

# uri: http://service2:8081

148

# rewriteTarget: /v1/

149

# injectResponseHeaders:

150

# - name: X-Custom-Header

151

# values:

152

# - value: custom-value

153

# injectResponseHeaders:

154

# - name: X-Auth-Request-Email

155

# values:

156

# - claim: email

157

158

# For more information on alpha config options, see:

159

# https://oauth2-proxy.github.io/oauth2-proxy/configuration/alpha-config

160

161

# Arbitrary configuration to append

162

# This is treated as a Go template and rendered with the root context

163

configFile: ""

164

# Use an existing config map (see secret-alpha.yaml for required fields)

165

existingConfig: ~

166

# Use an existing secret

167

existingSecret: ~

168

169

# NOTE: When using alphaConfig with external secrets (e.g., Azure

170

# Key Vault CSI Driver), you can inject secrets via the top-level

171

# extraEnv (see the extraEnv section below) instead of embedding

172

# them in the config:

173

174

# extraEnv:

175

# - name: OAUTH2_PROXY_CLIENT_ID

176

# valueFrom:

177

# secretKeyRef:

178

# name: external-secret

179

# key: client-id

180

# - name: OAUTH2_PROXY_CLIENT_SECRET

181

# valueFrom:

182

# secretKeyRef:

183

# name: external-secret

184

# key: client-secret

185

image:

186

registry: cgr.dev

187

repository: chainguard-private/oauth2-proxy

188

# appVersion is used by default

189

tag: latest@sha256:0175f2aeabaebdb55b4675a5197ba379c655074958933c2427849ee6b777b63a

190

pullPolicy: "IfNotPresent"

191

command: []

192

# Optionally specify an array of imagePullSecrets.

193

# Secrets must be manually created in the namespace.

194

# ref: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod

195

imagePullSecrets: []

196

# - name: myRegistryKeySecretName

197

198

# Set a custom containerPort if required.

199

# This will default to 4180 if this value is not set and the httpScheme set to http

200

# This will default to 4443 if this value is not set and the httpScheme set to https

201

# containerPort: 4180

202

extraArgs: {}

203

extraEnv: []

204

# Example: Load secrets from an external secret (e.g., Azure Key

205

# Vault via CSI Driver)

206

# extraEnv:

207

# - name: OAUTH2_PROXY_CLIENT_ID

208

# valueFrom:

209

# secretKeyRef:

210

# name: azure-keyvault-secret

211

# key: client-id

212

# - name: OAUTH2_PROXY_CLIENT_SECRET

213

# valueFrom:

214

# secretKeyRef:

215

# name: azure-keyvault-secret

216

# key: client-secret

217

# - name: OAUTH2_PROXY_COOKIE_SECRET

218

# valueFrom:

219

# secretKeyRef:

220

# name: azure-keyvault-secret

221

# key: cookie-secret

222

223

envFrom: []

224

# Load environment variables from a ConfigMap(s) and/or Secret(s)

225

# that already exists (created and managed by you).

226

# ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#configure-all-key-value-pairs-in-a-configmap-as-container-environment-variables

227

228

# PS: Changes in these ConfigMaps or Secrets will not be automatically

229

# detected and you must manually restart the relevant Pods after changes.

230

231

# - configMapRef:

232

# name: special-config

233

# - secretRef:

234

# name: special-config-secret

235

236

# -- Custom labels to add into metadata

237

customLabels: {}

238

# To authorize individual email addresses

239

# That is part of extraArgs but since this needs special treatment we need to do a separate section

240

authenticatedEmailsFile:

241

enabled: false

242

# Defines how the email addresses file will be projected, via a configmap or secret

243

persistence: configmap

244

# template is the name of the configmap what contains the email user list but has been configured without this chart.

245

# It's a simpler way to maintain only one configmap (user list) instead changing it for each oauth2-proxy service.

246

# Be aware the value name in the extern config map in data needs to be named to "restricted_user_access" or to the

247

# provided value in restrictedUserAccessKey field.

248

template: ""

249

# The configmap/secret key under which the list of email access is stored

250

# Defaults to "restricted_user_access" if not filled-in, but can be overridden to allow flexibility

251

restrictedUserAccessKey: ""

252

# One email per line

253

# example:

254

# restricted_access: |-

255

# name1@domain

256

# name2@domain

257

# If you override the config with restricted_access it will configure a user list within this chart what takes care of the

258

# config map resource.

259

restricted_access: ""

260

annotations: {}

261

# helm.sh/resource-policy: keep

262

service:

263

type: ClusterIP

264

# when service.type is ClusterIP ...

265

# clusterIP: 192.0.2.20

266

# when service.type is LoadBalancer ...

267

# loadBalancerIP: 198.51.100.40

268

# loadBalancerSourceRanges: 203.0.113.0/24

269

# when service.type is NodePort ...

270

# nodePort: 80

271

portNumber: 80

272

# Protocol set on the service

273

appProtocol: http

274

annotations: {}

275

# foo.io/bar: "true"

276

# configure externalTrafficPolicy

277

externalTrafficPolicy: ""

278

# configure internalTrafficPolicy

279

internalTrafficPolicy: ""

280

# configure service target port

281

targetPort: ""

282

# Configures the service to use IPv4/IPv6 dual-stack.

283

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/

284

ipDualStack:

285

enabled: false

286

ipFamilies: ["IPv6", "IPv4"]

287

ipFamilyPolicy: "PreferDualStack"

288

# Configure traffic distribution for the service

289

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

290

trafficDistribution: ""

291

## Create or use ServiceAccount

292

serviceAccount:

293

## Specifies whether a ServiceAccount should be created

294

enabled: true

295

## The name of the ServiceAccount to use.

296

## If not set and create is true, a name is generated using the fullname template

297

name:

298

automountServiceAccountToken: true

299

annotations: {}

300

## imagePullSecrets for the service account

301

imagePullSecrets: []

302

# - name: myRegistryKeySecretName

303

# Network policy settings.

304

networkPolicy:

305

create: false

306

ingress: []

307

egress: []

308

ingress:

309

enabled: false

310

# className: nginx

311

path: /

312

# Only used if API capabilities (networking.k8s.io/v1) allow it

313

pathType: ImplementationSpecific

314

# Used to create an Ingress record.

315

# hosts:

316

# - chart-example.local

317

# Extra paths to prepend to every host configuration. This is useful when working with annotation based services.

318

# Warning! The configuration is dependant on your current k8s API version capabilities (networking.k8s.io/v1)

319

# extraPaths:

320

# - path: /*

321

# pathType: ImplementationSpecific

322

# backend:

323

# service:

324

# name: ssl-redirect

325

# port:

326

# name: use-annotation

327

labels: {}

328

# annotations:

329

# kubernetes.io/ingress.class: nginx

330

# kubernetes.io/tls-acme: "true"

331

# tls:

332

# Secrets must be manually created in the namespace.

333

# - secretName: chart-example-tls

334

# hosts:

335

# - chart-example.local

336

# Gateway API HTTPRoute configuration

337

# Ref: https://gateway-api.sigs.k8s.io/api-types/httproute/

338

gatewayApi:

339

enabled: false

340

# The name of the Gateway resource to attach the HTTPRoute to

341

# Example:

342

# gatewayRef:

343

# name: gateway

344

# namespace: gateway-system

345

# sectionName: my-gateway-https-listener-name

346

347

# https://gateway-api.sigs.k8s.io/reference/spec/#parentreference

348

gatewayRef: {}

349

# HTTPRoute rule configuration

350

# rules:

351

# - matches:

352

# - path:

353

# type: PathPrefix

354

# value: /

355

rules: []

356

# Hostnames to match in the HTTPRoute

357

# hostnames:

358

# - chart-example.local

359

hostnames: []

360

# Additional labels to add to the HTTPRoute

361

labels: {}

362

# Additional annotations to add to the HTTPRoute

363

annotations: {}

364

resources: {}

365

# limits:

366

# cpu: 100m

367

# memory: 300Mi

368

# requests:

369

# cpu: 100m

370

# memory: 300Mi

371

372

# Container resize policy for runtime resource updates

373

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/resize-container-resources/

374

resizePolicy: []

375

# - resourceName: cpu

376

# restartPolicy: NotRequired

377

# - resourceName: memory

378

# restartPolicy: RestartContainer

379

380

extraVolumes: []

381

# - name: ca-bundle-cert

382

# secret:

383

# secretName: <secret-name>

384

385

extraVolumeMounts: []

386

# - mountPath: /etc/ssl/certs/

387

# name: ca-bundle-cert

388

389

# Additional containers to be added to the pod.

390

extraContainers: []

391

# - name: my-sidecar

392

# image: nginx:latest

393

394

# Additional Init containers to be added to the pod.

395

extraInitContainers: []

396

# - name: wait-for-idp

397

# image: my-idp-wait:latest

398

# command:

399

# - sh

400

# - -c

401

# - wait-for-idp.sh

402

403

priorityClassName: ""

404

# hostAliases is a list of aliases to be added to /etc/hosts for network name resolution

405

hostAliases: []

406

# - ip: "10.xxx.xxx.xxx"

407

# hostnames:

408

# - "auth.example.com"

409

# - ip: 127.0.0.1

410

# hostnames:

411

# - chart-example.local

412

# - example.local

413

414

# [TopologySpreadConstraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) configuration.

415

# Ref: https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#scheduling

416

# topologySpreadConstraints: []

417

418

# Affinity for pod assignment

419

# Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

420

# affinity: {}

421

422

# Tolerations for pod assignment

423

# Ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/

424

tolerations: []

425

# Node labels for pod assignment

426

# Ref: https://kubernetes.io/docs/user-guide/node-selection/

427

nodeSelector: {}

428

# Whether to use secrets instead of environment values for setting up OAUTH2_PROXY variables

429

proxyVarsAsSecrets: true

430

# Configure Kubernetes liveness and readiness probes.

431

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

432

# Disable both when deploying with Istio 1.0 mTLS. https://istio.io/help/faq/security/#k8s-health-checks

433

livenessProbe:

434

enabled: true

435

initialDelaySeconds: 0

436

timeoutSeconds: 1

437

readinessProbe:

438

enabled: true

439

initialDelaySeconds: 0

440

timeoutSeconds: 5

441

periodSeconds: 10

442

successThreshold: 1

443

# Configure Kubernetes security context for container

444

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

445

securityContext:

446

enabled: true

447

allowPrivilegeEscalation: false

448

capabilities:

449

drop:

450

- ALL

451

readOnlyRootFilesystem: true

452

runAsNonRoot: true

453

runAsUser: 2000

454

runAsGroup: 2000

455

seccompProfile:

456

type: RuntimeDefault

457

deploymentAnnotations: {}

458

podAnnotations: {}

459

podLabels: {}

460

replicaCount: 1

461

revisionHistoryLimit: 10

462

strategy: {}

463

enableServiceLinks: true

464

## PodDisruptionBudget settings

465

## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/

466

## One of maxUnavailable and minAvailable must be set to null.

467

podDisruptionBudget:

468

enabled: true

469

maxUnavailable: null

470

minAvailable: 1

471

# Policy for when unhealthy pods should be considered for eviction.

472

# Valid values are "IfHealthyBudget" and "AlwaysAllow".

473

# Ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/#unhealthy-pod-eviction-policy

474

unhealthyPodEvictionPolicy: ""

475

## Horizontal Pod Autoscaling

476

## ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/

477

autoscaling:

478

enabled: false

479

minReplicas: 1

480

maxReplicas: 10

481

targetCPUUtilizationPercentage: 80

482

# targetMemoryUtilizationPercentage: 80

483

annotations: {}

484

# Configure HPA behavior policies for scaling if needed

485

# Ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#configuring-scaling-behavior

486

behavior: {}

487

# scaleDown:

488

# stabilizationWindowSeconds: 300

489

# policies:

490

# - type: Percent

491

# value: 100

492

# periodSeconds: 15

493

# selectPolicy: Min

494

# scaleUp:

495

# stabilizationWindowSeconds: 0

496

# policies:

497

# - type: Percent

498

# value: 100

499

# periodSeconds: 15

500

# - type: Pods

501

# value: 4

502

# periodSeconds: 15

503

# selectPolicy: Max

504

# Configure Kubernetes security context for pod

505

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

506

podSecurityContext: {}

507

# whether to use http or https

508

httpScheme: http

509

initContainers:

510

# if the redis sub-chart is enabled, wait for it to be ready

511

# before starting the proxy

512

# creates a role binding to get, list, watch, the redis master pod

513

# if service account is enabled

514

waitForRedis:

515

enabled: true

516

image:

517

repository: cgr.dev/chainguard-private/chainguard-base

518

tag: latest@sha256:1bed6b473b5e86693a9aafa4bdbd9f9cbb6df5e26ff7f168880316a90bb66cf9

519

pullPolicy: "IfNotPresent"

520

# uses the kubernetes version of the cluster

521

# the chart is deployed on, if not set

522

kubectlVersion: ""

523

securityContext:

524

enabled: true

525

allowPrivilegeEscalation: false

526

capabilities:

527

drop:

528

- ALL

529

readOnlyRootFilesystem: true

530

runAsNonRoot: true

531

runAsUser: 65534

532

runAsGroup: 65534

533

seccompProfile:

534

type: RuntimeDefault

535

timeout: 180

536

resources: {}

537

# limits:

538

# cpu: 100m

539

# memory: 300Mi

540

# requests:

541

# cpu: 100m

542

# memory: 300Mi

543

# Additionally authenticate against a htpasswd file. Entries must be created with "htpasswd -B" for bcrypt encryption.

544

# Alternatively supply an existing secret which contains the required information.

545

htpasswdFile:

546

enabled: false

547

existingSecret: ""

548

entries: []

549

# One row for each user

550

# example:

551

# entries:

552

# - testuser:$2y$05$gY6dgXqjuzFhwdhsiFe7seM9q9Tile4Y3E.CBpAZJffkeiLaC21Gy

553

# Configure the session storage type, between cookie and redis

554

sessionStorage:

555

# Can be one of the supported session storage cookie|redis

556

type: cookie

557

redis:

558

# Name of the Kubernetes secret containing the redis & redis sentinel password values (see also `sessionStorage.redis.passwordKey`)

559

existingSecret: ""

560

# Redis password value. Applicable for all Redis configurations. Taken from redis subchart secret if not set. `sessionStorage.redis.existingSecret` takes precedence

561

password: ""

562

# Key of the Kubernetes secret data containing the redis password value. If you use the redis sub chart, make sure

563

# this password matches the one used in redis-ha.redisPassword (see below).

564

passwordKey: "redis-password"

565

# Can be one of standalone|cluster|sentinel

566

clientType: "standalone"

567

standalone:

568

# URL of redis standalone server for redis session storage (e.g. `redis://HOST[:PORT]`). Automatically generated if not set

569

connectionUrl: ""

570

cluster:

571

# List of Redis cluster connection URLs. Array or single string allowed.

572

connectionUrls: []

573

# - "redis://127.0.0.1:8000"

574

# - "redis://127.0.0.1:8001"

575

sentinel:

576

# Name of the Kubernetes secret containing the redis sentinel password value (see also `sessionStorage.redis.sentinel.passwordKey`). Default: `sessionStorage.redis.existingSecret`

577

existingSecret: ""

578

# Redis sentinel password. Used only for sentinel connection; any redis node passwords need to use `sessionStorage.redis.password`

579

password: ""

580

# Key of the Kubernetes secret data containing the redis sentinel password value

581

passwordKey: "redis-sentinel-password"

582

# Redis sentinel master name

583

masterName: ""

584

# List of Redis cluster connection URLs. Array or single string allowed.

585

connectionUrls: []

586

# - "redis://127.0.0.1:8000"

587

# - "redis://127.0.0.1:8001"

588

# Enables and configure the automatic deployment of the redis-ha subchart

589

redis-ha:

590

# provision an instance of the redis-ha sub-chart

591

enabled: false

592

# Redis specific helm chart settings, please see:

593

# https://artifacthub.io/packages/helm/dandydev-charts/redis-ha#general-parameters

594

595

# Recommended:

596

597

# redisPassword: xxxxx

598

# replicas: 1

599

600

# IMPORTANT: When using a single replica (replicas: 1), you MUST also configure

601

# min-replicas-to-write to 0 to avoid "NOREPLICAS Not enough good replicas to write" errors.

602

# See: https://stackoverflow.com/a/59737862

603

# redis:

604

# config:

605

# min-replicas-to-write: 0

606

607

# persistentVolume:

608

# enabled: false

609

610

# If you install Redis using this sub chart, make sure that the password of the sub chart matches the password

611

# you set in sessionStorage.redis.password (see above).

612

613

# If you want to use redis in sentinel mode see:

614

# https://artifacthub.io/packages/helm/dandydev-charts/redis-ha#redis-sentinel-parameters

615

# Enables apiVersion deprecation checks

616

checkDeprecation: true

617

# Allows graceful shutdown

618

# terminationGracePeriodSeconds: 65

619

# lifecycle:

620

# preStop:

621

# exec:

622

# command: [ "sh", "-c", "sleep 60" ]

623

metrics:

624

# Enable Prometheus metrics endpoint

625

enabled: true

626

# Serve Prometheus metrics on this port

627

port: 44180

628

# when service.type is NodePort ...

629

# nodePort: 44180

630

# Protocol set on the service for the metrics port

631

service:

632

appProtocol: http

633

serviceMonitor:

634

# Enable Prometheus Operator ServiceMonitor

635

enabled: false

636

# Define the namespace where to deploy the ServiceMonitor resource

637

namespace: ""

638

# Prometheus Instance definition

639

prometheusInstance: default

640

# Prometheus scrape interval

641

interval: 60s

642

# Prometheus scrape timeout

643

scrapeTimeout: 30s

644

# Add custom labels to the ServiceMonitor resource

645

labels: {}

646

## scheme: HTTP scheme to use for scraping. Can be used with `tlsConfig` for example if using istio mTLS.

647

scheme: ""

648

## tlsConfig: TLS configuration to use when scraping the endpoint. For example if using istio mTLS.

649

## Of type: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#tlsconfig

650

tlsConfig: {}

651

## bearerTokenFile: Path to bearer token file.

652

bearerTokenFile: ""

653

## Used to pass annotations that are used by the Prometheus installed in your cluster to select Service Monitors to work with

654

## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec

655

annotations: {}

656

## Metric relabel configs to apply to samples before ingestion.

657

## [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)

658

metricRelabelings: []

659

# - action: keep

660

661

# sourceLabels: [__name__]

662

663

## Relabel configs to apply to samples before ingestion.

664

## [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)

665

relabelings: []

666

# - sourceLabels: [__meta_kubernetes_pod_node_name]

667

# separator: ;

668

# regex: ^(.*)$

669

# targetLabel: nodename

670

# replacement: $1

671

# action: replace

672

# Extra K8s manifests to deploy

673

extraObjects: []

674

# - apiVersion: secrets-store.csi.x-k8s.io/v1

675

# kind: SecretProviderClass

676

# metadata:

677

# name: oauth2-proxy-secrets-store

678

# spec:

679

# provider: aws

680

# parameters:

681

# objects: |

682

# - objectName: "oauth2-proxy"

683

# objectType: "secretsmanager"

684

# jmesPath:

685

# - path: "client_id"

686

# objectAlias: "client-id"

687

# - path: "client_secret"

688

# objectAlias: "client-secret"

689

# - path: "cookie_secret"

690

# objectAlias: "cookie-secret"

691

# secretObjects:

692

# - data:

693

# - key: client-id

694

# objectName: client-id

695

# - key: client-secret

696

# objectName: client-secret

697

# - key: cookie-secret

698

# objectName: cookie-secret

699

# secretName: oauth2-proxy-secrets-store

700

# type: Opaque

701

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

oauth2-proxy

The trusted source for open source

Product

Solutions

Customers

Resources

Company