values_saml.yaml

# Configure ingress to allow access to both gate and deck from your machine:
ingress:
  enabled: true
  host: spinnaker.example.com
  annotations:
    ingress.kubernetes.io/ssl-redirect: 'true'
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
  tls:
  - secretName: deck-tls
    hosts:
    - spinnaker.example.com

ingressGate:
  enabled: true
  host: gate.spinnaker.example.com
  annotations:
    ingress.kubernetes.io/ssl-redirect: 'true'
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
  tls:
  - secretName: gate-tls
    hosts:
    - gate.spinnaker.example.com

# Configure halyard to support saml
halyard:
  # Provide a config map with Hal commands that will be run the core config (storage)
  # The config map should contain a script in the config.sh key
  additionalSecrets:
    create: true
    data:
      keystore.p12: aW4tc2VjcmV0cwo= # base64 encoded keystore in pkcs12 format
      password.txt: aW4tc2VjcmV0cwo= # base64 encoded password for the keystore
      metadata.xml: aW4tc2VjcmV0cwo= # base64 encoded metadata.xml file from your SAML authenticator
  additionalConfigMaps:
    create: true
    data:
      config.src: |-
        KEYSTORE_ALIAS=saml # Alias in the keystore for the cert
        GATE_URL="https://gate.spinnaker.example.com" # URL to access your gate
        DECK_URL="https://spinnaker.example.com" # Url to access your deck

        # Put the keystore, metadata, and keystore password in these files under additioanlSecrets
        KEYSTORE_FILE=/opt/halyard/additionalSecrets/keystore.p12
        PASSWORD_FILE=/opt/halyard/additionalSecrets/password.txt
        METADATA_FILE=/opt/halyard/additionalSecrets/metadata.xml
  additionalScripts:
    create: true
    data:
      configure_saml.sh: |
        # This source file contains these variables:
        # -> GATE_URL DECK_URL KEYSTORE_FILE PASSWORD_FILE METADATA_FILE KEYSTORE_ALIAS
        # I put config.src in additionalConfigMaps so you can break it out into a separate values.yaml file
        # You should create both halyard.additionalConfigMaps.data.config.src AND halyard.additionalConfigMaps.create = true 
        source /opt/halyard/additionalConfigMaps/config.src

        KEYSTORE_PASSWORD="$( cat "$PASSWORD_FILE" )"

        $HAL_COMMAND config security ui edit --override-base-url "$DECK_URL"
        $HAL_COMMAND config security api edit --override-base-url "$GATE_URL"
        $HAL_COMMAND config security authn saml edit \
          --keystore "$KEYSTORE_FILE" \
          --keystore-alias "$KEYSTORE_ALIAS" \
          --keystore-password "$KEYSTORE_PASSWORD" \
          --metadata "$METADATA_FILE" \
          --issuer-id "$GATE_URL" \
          --no-validate \
          --service-address-url "$GATE_URL"
        $HAL_COMMAND config security authn saml enable