pomerium Changeset - 021ddfa73806

Changeset - 021ddfa73806

Parent rev.

Child rev.

[Not reviewed]

default

0 2 0

drewp@bigasterisk.com - 18 months ago 2023-04-19 23:36:55
drewp@bigasterisk.com

try things to get sessions that don't quickly expire (fetch requests have CORS errors). these may not be working

2 files changed with 6 insertions and 5 deletions:

20-kube/10-pom-pom.yaml

20-kube/20-pom-deploy.yaml

0 comments (0 inline, 0 general)

20-kube/10-pom-pom.yaml

➞

Show inline comments

 apiVersion: ingress.pomerium.io/v1
 kind: Pomerium
 metadata:
   name: global
 spec:
   secrets: pomerium/bootstrap
   authenticate:
     url: https://authenticate.bigasterisk.com
   cookie:
     expire: 20h
   identityProvider:
     provider: oidc
     url: https://accounts.google.com
     scopes:
       - openid
       - email
       # adds name+locale to user details
       - profile
     secret: pomerium/idp
   storage:
     postgres:
       secret: pomerium/postgres-connection-key
       #  storage:
       #    postgres:
       #      secret: pomerium/postgres-connection-key
   # Note pom won't start up if this cert doesn't exist, so you have to run once
   # with it commented out, then after cert success, run again with it enabled.
   certificates: [pomerium/pomerium-proxy-tls]

20-kube/20-pom-deploy.yaml

➞

Show inline comments

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels: { app.kubernetes.io/name: pomerium }
   name: pomerium
   namespace: pomerium
 spec:
-  replicas: 3
+  replicas: 1
   strategy: { type: RollingUpdate }
   selector:
     matchLabels: { app.kubernetes.io/name: pomerium }
   template:
     metadata:
       labels: { app.kubernetes.io/name: pomerium }
     spec:
       containers:
         - args:
             - all-in-one
             - --pomerium-config=global
             - --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy
             - --metrics-bind-address=$(POD_IP):9090
           env:
             - { name: TMPDIR, value: /tmp }
             - { name: XDG_CACHE_HOME, value: /tmp }
             - name: POMERIUM_NAMESPACE
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.namespace
             - name: POD_IP
               valueFrom:
                 fieldRef:

0 comments (0 inline, 0 general)