---
apiVersion: v1
metadata:
  name: configmap-oauth2-proxy
  namespace: security
kind: ConfigMap
data:
  oauth2_proxy.cfg: |
    ## OAuth2 Proxy Config File
    ## https://github.com/oauth2-proxy/oauth2-proxy

    provider = keycloak-oidc
    provider-display-name = "Keycloak"
    # client-secret=${SECRET_KEYCLOAK_CLIENT_SECRET}
    redirect-url=https://myapp.com/oauth2/callback
    oidc-issuer-url=https://keycloak.${SECRET_DOMAIN}/auth/realms/${SECRET_KEYCLOAK_REALM}
    # allowed-role=<realm role name> // Optional, required realm role
    # allowed-role=kubernetes:admin // Optional, required client role

    cookie_secure = false
    reverse_proxy = true
    email_domains = [ "*" ]
    upstreams = [ "file:///dev/null" ]
    pass_access_token = true
    pass_authorization_header = true
    set_authorization_header = true
    set_xauthrequest = true
    pass_user_headers = true
    cookie_domain = ".${SECRET_DOMAIN}"
    whitelist_domains= [ ".${SECRET_DOMAIN}" ]
