Neuvector SSO integration

chart/templates/neuvector/values.yaml

@@ -34,6 +34,13 @@ controller:
           password: {{ $neuvectorMetricsPass }}
           role: reader
           fullname: metrics
+      oidcinitcfg.yaml:
+        always_reload: true
+        enable: {{ .Values.neuvector.sso.enabled }}
+        issuer: {{ default (include "sso.url" .) (tpl (default "" .Values.neuvector.sso.issuer) .) }}
+        client_id: {{ .Values.neuvector.sso.client_id }}
+        client_secret: {{ .Values.neuvector.sso.client_secret }}
+        default_role: {{ .Values.neuvector.sso.default_role }} 
     
 monitor:
   install: true

chart/values.yaml

@@ -596,9 +596,22 @@ neuvector:
   ingress:
     gateway: ""
 
+  sso:
+    # -- Toggle SSO for Neuvector on and off
+    enabled: true
+    
+    # -- OIDC Client ID to use for Neuvector
+    client_id: ""
+
+    # -- OIDC Client Secret to use for Neuvector
+    client_secret: ""
+
+    # -- Default role to use for Neuvector OIDC users. Supports admin, reader, or no default
+    default_role: ""
+
   # -- Flux reconciliation overrides specifically for the Neuvector Package
   flux: {}
-
+  
   # -- Values to passthrough to the Neuvector chart: https://repo1.dso.mil/platform-one/big-bang/apps/sandbox/neuvector.git
   values: {}
 

docs/assets/configs/example/dev-sso-values.yaml

@@ -185,6 +185,14 @@ twistlock:
     enabled: true
     client_id: platform1_a8604cc9-f5e9-4656-802d-d05624370245_bb8-twistlock
 
+neuvector:
+  sso:
+    enabled: true
+    client_id: platform1_a8604cc9-f5e9-4656-802d-d05624370245_bb8-neuvector
+    client_secret: AyAixE3
+    default_role: admin
+    issuer: https://login.dso.mil/auth/realms/baby-yoda
+
 addons:
   authservice:
     enabled: true
@@ -228,6 +236,7 @@ addons:
       enabled: true
       client_id: "platform1_a8604cc9-f5e9-4656-802d-d05624370245_bb8-mattermost"
       client_secret: "no-secret"
+
   nexusRepositoryManager:
     # Nexus requires manual configuration in Keycloak client and cannot be tested with login.dso.mil
     # you must test with your own dev deployment.  Example: keycloak.bigbang.dev