Sub-chart for openfaas ingress

[alexellis]

Description

Create a sub-chart for openfaas ingress records including the OIDC record.

It will make it easier for ArgoCD/Flux users of OpenFaaS to set up ingress records and/or the OIDC plugin.

Context

There is an arkade app for openfaas which templates ingress records and a cert-manager issuer in the openfaas namespace.

https://github.com/alexellis/arkade/blob/master/cmd/apps/openfaas_ingress_app.go
https://github.com/alexellis/arkade/blob/master/cmd/apps/openfaas_ingress_app_test.go

It would be easier to maintain, if a sub-helm chart was created for the ingress records instead, then the arkade app could install the chart instead of maintaining its own templates.

For the hobbyist case where basic auth is being used, or a non-customer, the domain will look like:

• gateway.example.com

When using the OIDC plugin, the chart should be able to generate the two domains required for using the cookies required i.e.:

• gateway.openfaas.example.com
• auth.openfaas.example.com

The key is the common sub-domain, so that the cookie set by the OIDC plugin can be shared with the gateway through the common domain *.openfaas.example.com

The openfaas chart currently has some support for an ingress record, but not both. It could be removed as part of this change. There is also the ability to set a custom TLS cert name for when users are not using cert-manager's annotations support.

https://github.com/openfaas/faas-netes/blob/master/chart/openfaas/values.yaml#L177
https://github.com/openfaas/faas-netes/blob/master/chart/openfaas/templates/ingress.yaml

[ah-f3]

Whats the benafit of a sub-chart over a optional oidc record?

[alexellis]

Hi @ah-f3 it's explained above, reducing duplication between the two, and separating out the ingress into its own chart for maintainability. There are so many ways to configure Ingress, including Istio. Helm templates can get extremely complicated and most of the guides we use for setting up openfaas use port-forwarding because it works everywhere without any additional setup.

Thanks again for your interest. Do you feel like this affects you in some way as an openfaas user?

Alex