External auth example

.github/workflows/release.yml

@@ -49,4 +49,3 @@ jobs:
         uses: helm/[email protected]
         env:
           CR_TOKEN: "${{ secrets.CR_TOKEN }}"
-

charts/lakefs/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: lakefs
 description: A Helm chart for running LakeFS on Kubernetes
 type: application
-version: 1.2.8
+version: 1.2.9
 appVersion: 1.18.0
 
 home: https://lakefs.io

charts/lakefs/templates/_env.tpl

@@ -40,6 +40,8 @@ env:
     value: {{ printf "%s/sso/login-saml" .Values.fluffy.sso.saml.lakeFSServiceProviderIngress }}
   - name: LAKEFS_AUTH_UI_CONFIG_LOGOUT_URL
     value: {{ printf "%s/sso/logout-saml" .Values.fluffy.sso.saml.lakeFSServiceProviderIngress }}
+  - name: LAKEFS_AUTH_AUTHENTICATION_API_ENDPOINT
+    value: {{ printf "http://%s/api/v1" (include "fluffy.ssoServiceName" .) | quote }}
   {{- end }}
   {{- if (.Values.fluffy.sso.oidc).enabled }}
   - name: LAKEFS_AUTH_UI_CONFIG_LOGIN_URL

examples/lakefs/enterprise/values-external-aws.yaml

@@ -0,0 +1,41 @@
+ingress:
+  enabled: true
+  ingressClassName: <class-name>
+  hosts:
+    # the ingress that will be created for lakeFS
+    - host: <lakefs.ingress.domain>
+      paths:
+        - /
+
+##################################################
+########### lakeFS enterprise - FLUFFY ###########
+##################################################
+
+fluffy:
+  enabled: true
+  image:
+    repository: treeverse/fluffy
+    tag: '0.3.0'
+    pullPolicy: IfNotPresent
+    privateRegistry:
+      enabled: true
+      secretToken: <dockerhub-token-fluffy-image>
+  fluffyConfig: |
+    auth:
+      external:
+        aws_auth:
+          enabled: true
+        # the maximum age in seconds for the GetCallerIdentity request
+        #get_caller_identity_max_age: 60
+        # headers that must be present by the client when doing login request
+        required_headers:
+          # same host as the lakeFS server ingress
+          X-LakeFS-Server-ID: <lakefs.ingress.domain>
+  secrets:
+    create: true
+  sso:
+    enabled: true
+  rbac:
+    enabled: true
+
+useDevPostgres: true