apiVersion: ingress.pomerium.io/v1

kind: Pomerium

metadata:

  name: global

spec:

  secrets: pomerium/bootstrap

  authenticate:

    url: https://authenticate.bigasterisk.com

  identityProvider:

    provider: oidc

    url: https://accounts.google.com

    scopes:

      - openid

      - email

      # adds name+locale to user details

      - profile

    secret: pomerium/idp

  # Note pom won't start up if this cert doesn't exist, so you have to run once

  # with it commented out, then after cert success, run again with it enabled.

  certificates: [pomerium/pomerium-proxy-tls]

apiVersion: apps/v1

kind: Deployment

metadata:

  labels: { app.kubernetes.io/name: pomerium }

  name: pomerium

  namespace: pomerium

spec:

  strategy: { type: RollingUpdate }

  selector:

    matchLabels: { app.kubernetes.io/name: pomerium }

  template:

    metadata:

      labels: { app.kubernetes.io/name: pomerium }

    spec:

      containers:

        - args:

            - all-in-one

            - --pomerium-config=global

            - --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy

            - --metrics-bind-address=$(POD_IP):9090

          env:

            - { name: TMPDIR, value: /tmp }

            - { name: XDG_CACHE_HOME, value: /tmp }

            - name: POMERIUM_NAMESPACE

              valueFrom:

                fieldRef:

                  apiVersion: v1

                  fieldPath: metadata.namespace

            - name: POD_IP

              valueFrom:

                fieldRef:

                  fieldPath: status.podIP

          # see https://hub.docker.com/r/pomerium/ingress-controller/tags but idk how to get the version number!

          # It's not even in the startup logs, just this: "pomerium_version":""

          # I think sha-2c8038a is v0.21.3 (by date, https://www.pomerium.com/docs/releases/changelog)

          image: pomerium/ingress-controller:sha-2c8038a

          imagePullPolicy: IfNotPresent

          name: pomerium

          ports:

            - { containerPort: 8443, name: https, protocol: TCP }

            - { containerPort: 8080, name: http, protocol: TCP }

            - { containerPort: 9090, name: metrics, protocol: TCP }

          resources:

            limits: { cpu: 5000m, memory: 1Gi }

            requests: { cpu: 300m, memory: 200Mi }

          securityContext:

            allowPrivilegeEscalation: false

            readOnlyRootFilesystem: true

            runAsGroup: 1000

            runAsNonRoot: true

            runAsUser: 1000

          volumeMounts:

            - { mountPath: /tmp, name: tmp }

            - { mountPath: /data/autocert, name: autocert }

            - { mountPath: /.local, name: autocert }

      nodeSelector:

        kubernetes.io/os: linux

      securityContext:

        runAsNonRoot: true

      serviceAccountName: pomerium-controller

      terminationGracePeriodSeconds: 10

      volumes:

        - { name: tmp, emptyDir: {} }

        - { name: autocert, persistentVolumeClaim: { claimName: autocert-data } }

      affinity:

        nodeAffinity:

          requiredDuringSchedulingIgnoredDuringExecution:

            nodeSelectorTerms:

              - matchExpressions:

                  - key: "kubernetes.io/hostname"

                    operator: In

                    values: ["ditto"]

---

apiVersion: networking.k8s.io/v1

kind: IngressClass

metadata:

  labels:

    app.kubernetes.io/name: pomerium

  name: pomerium

spec:

  controller: pomerium.io/ingress-controller