ArtifexTechnologyDevelopment
diff --git a/‎REVIEW_GUIDELINES.md‎
Lines changed: 8 additions & 9 deletions b/‎REVIEW_GUIDELINES.md‎
Lines changed: 8 additions & 9 deletions
diff --git a/‎incubator/aws-alb-ingress-controller/Chart.yaml‎
Lines changed: 1 addition & 1 deletion b/‎incubator/aws-alb-ingress-controller/Chart.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎incubator/aws-alb-ingress-controller/README.md‎
Lines changed: 2 additions & 0 deletions b/‎incubator/aws-alb-ingress-controller/README.md‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎incubator/aws-alb-ingress-controller/templates/deployment.yaml‎
Lines changed: 4 additions & 0 deletions b/‎incubator/aws-alb-ingress-controller/templates/deployment.yaml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎incubator/aws-alb-ingress-controller/values.yaml‎
Lines changed: 8 additions & 0 deletions b/‎incubator/aws-alb-ingress-controller/values.yaml‎
Lines changed: 8 additions & 0 deletions
diff --git a/‎incubator/buzzfeed-sso/Chart.yaml‎
Lines changed: 4 additions & 2 deletions b/‎incubator/buzzfeed-sso/Chart.yaml‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎incubator/buzzfeed-sso/OWNERS‎
Lines changed: 2 additions & 0 deletions b/‎incubator/buzzfeed-sso/OWNERS‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎incubator/buzzfeed-sso/README.md‎
Lines changed: 8 additions & 3 deletions b/‎incubator/buzzfeed-sso/README.md‎
Lines changed: 8 additions & 3 deletions
diff --git a/‎incubator/buzzfeed-sso/templates/auth-deployment.yaml‎
Lines changed: 8 additions & 1 deletion b/‎incubator/buzzfeed-sso/templates/auth-deployment.yaml‎
Lines changed: 8 additions & 1 deletion
diff --git a/‎incubator/buzzfeed-sso/templates/configmap.yaml‎
Lines changed: 1 addition & 1 deletion b/‎incubator/buzzfeed-sso/templates/configmap.yaml‎
Lines changed: 1 addition & 1 deletion
@@ -14,13 +14,13 @@ Note, if a reviewer who is not an approver in an OWNERS file leaves a comment of
 
 ## Immutability
 
-Chart releases must be immutable. Any change to a chart warrants a chart version bump even if it is only changes to the documentation.
+Chart releases must be immutable. Any change to a chart warrants a chart version bump even if it is only changed to the documentation.
 
 ## Versioning
 
 The chart `version` should follow [semver](https://semver.org/).
 
-Stable charts should start at `1.0.0` (for maintainability don't create new PRs for stable charts only to meet this criteria, but when reviewing PRs take the opportunity to ensure that this is met).
+Stable charts should start at `1.0.0` (for maintainability don't create new PRs for stable charts only to meet these criteria, but when reviewing PRs take the opportunity to ensure that this is met).
 
 Any breaking (backwards incompatible) changes to a chart should:
 
@@ -40,7 +40,7 @@ The `Chart.yaml` should be as complete as possible. The following fields are man
 
 ## Dependencies
 
-Stable charts should not depend on charts in incubator.
+Stable charts should not depend on charts in the incubator.
 
 ## Names and Labels
 
@@ -74,7 +74,7 @@ selector:
 If a chart has multiple components, a `component` label should be added to the selector (see above).
 
 `spec.selector.matchLabels` defined in `Deployments`/`StatefulSets`/`DaemonSets` `>=v1/beta2` **must not** contain `helm.sh/chart` label or any label containing a version of the chart, because the selector is immutable.
-The chart label string contains the version, so if it is specified, whenever the the Chart.yaml version changes, Helm's attempt to change this immutable field would cause the upgrade to fail.
+The chart label string contains the version, so if it is specified, whenever the Chart.yaml version changes, Helm's attempt to change this immutable field would cause the upgrade to fail.
 
 #### Fixing Selectors
 
@@ -327,24 +327,24 @@ spec:
 
 ## Documentation
 
-`README.md` and `NOTES.txt` are mandatory. `README.md` should contain a table listing all configuration options. `NOTES.txt` should provide accurate and useful information how the chart can be used/accessed.
+`README.md` and `NOTES.txt` are mandatory. `README.md` should contain a table listing all configuration options. `NOTES.txt` should provide accurate and useful information on how the chart can be used/accessed.
 
 ## Compatibility
 
-We officially support compatibility with the current and the previous minor version of Kubernetes. Generated resources should use the latest possible API versions compatible with these versions. For extended backwards compatibility conditional logic based on capabilities may be used (see [built-in objects](https://github.com/helm/helm/blob/master/docs/chart_template_guide/builtin_objects.md)).
+We officially support compatibility with the current and the previous minor version of Kubernetes. Generated resources should use the latest possible API versions compatible with these versions. For extended backwards compatibility, conditional logic based on capabilities may be used (see [built-in objects](https://github.com/helm/helm/blob/master/docs/chart_template_guide/builtin_objects.md)).
 
 ## Kubernetes Native Workloads
 
 While reviewing Charts that contain workloads such as [Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/), [StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/), [DaemonSets](https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/) and [Jobs](https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/) the below points should be considered.  These are to be seen as best practices rather than strict enforcement.
 
-1. Any workload that are stateless and long running (servers) in nature are to be created as Deployments.  Deployments in turn create ReplicaSets.
+1. Any workload that is stateless and long-running (servers) in nature are to be created as Deployments.  Deployments, in turn, create ReplicaSets.
 2. Unless there is a compelling reason, ReplicaSets or ReplicationControllers should be avoided as workload types.
 3. Workloads that are stateful in nature such as databases, key-value stores, message queues, in-memory caches are to be created as StatefulSets
 4. It is recommended that Deployments and StatefulSets configure their workloads with a [Pod Disruption Budget](https://kubernetes.io/docs/concepts/workloads/pods/disruptions/) for high availability.
 5. For workloads such as databases, KV stores, etc., that replicate data, it is recommended to configure interpod anti-affinity.
 6. It is recommended to have a default workload update strategy configured that is suitable for this chart.
 7. Batch workloads are to be created using Jobs.
-8. It is best to always create workloads with the latest supported [api version](https://v1-8.docs.kubernetes.io/docs/api-reference/v1.8/) as older version are either deprecated or soon to be deprecated.
+8. It is best to always create workloads with the latest supported [api version](https://v1-8.docs.kubernetes.io/docs/api-reference/v1.8/) as the older version are either deprecated or soon to be deprecated.
 9. It is generally not advisable to provide hard [resource limits](https://kubernetes.io/docs/concepts/configuration/manage-compute-resources-container/#resource-requests-and-limits-of-pod-and-container) to workloads and leave it configurable unless the workload requires such quantity bare minimum to function.
 10. As much as possible complex pre-app setups are configured using [init containers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/).
 
@@ -358,4 +358,3 @@ This repository follows a [test procedure](https://github.com/helm/charts/blob/m
 The `ci` directory of a given Chart allows testing different use cases, by allowing you to define different sets of values overriding `values.yaml`, one file per set. See the [documentation](https://github.com/helm/charts/blob/master/test/README.md#providing-custom-test-values) for more information.
 
 This directory MUST exist with at least one test file in it.
-
@@ -1,7 +1,7 @@
 apiVersion: v1
 name: aws-alb-ingress-controller
 description: A Helm chart for AWS ALB Ingress Controller
-version: 0.1.8
+version: 0.1.10
 appVersion: "v1.1.2"
 engine: gotpl
 home: https://github.com/kubernetes-sigs/aws-alb-ingress-controller
 
@@ -58,13 +58,15 @@ The following tables lists the configurable parameters of the alb-ingress-contro
 | `image.pullPolicy`        | controller container image pull policy                                                                         | `IfNotPresent`                                                            |
 | `enableReadinessProbe`    | enable readinessProbe on controller pod                                                                      | `false`                                                                    |
 | `enableLivenessProbe`     | enable livenessProbe on controller pod                                                                         | `false`                                                                   |
+| `livenessProbeTimeout`     | How long to wait before timeout (in seconds) when checking controller liveness                                |    1                                                                      |
 | `extraEnv`                | map of environment variables to be injected into the controller pod                                            | `{}`                                                                      |
 | `volumesMounts`           | volumeMounts into the controller pod                                                                           | `[]`                                                                      |
 | `volumes`                 | volumes the controller pod                                                                                     | `[]`                                                                      |
 | `nodeSelector`            | node labels for controller pod assignment                                                                      | `{}`                                                                      |
 | `tolerations`             | controller pod toleration for taints                                                                           | `{}`                                                                      |
 | `podAnnotations`          | annotations to be added to controller pod                                                                      | `{}`                                                                      |
 | `podLabels`               | labels to be added to controller pod                                                                           | `{}`                                                                      |
+| `priorityClassName`       | set to ensure your pods survive resource shortages                                                             | `""`                                                                      |
 | `resources`               | controller pod resource requests & limits                                                                      | `{}`                                                                      |
 | `rbac.create`             | If true, create & use RBAC resources                                                                           | `true`                                                                    |
 | `rbac.serviceAccountName` | ServiceAccount ALB ingress controller will use (ignored if rbac.create=true)                                   | `default`                                                                 |
 
@@ -26,6 +26,9 @@ spec:
 {{ toYaml .Values.podAnnotations | indent 8}}
     {{- end }}
     spec:
+      {{- if .Values.priorityClassName }}
+      priorityClassName: "{{ .Values.priorityClassName }}"
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -74,6 +77,7 @@ spec:
               scheme: HTTP
             initialDelaySeconds: {{ add .Values.livenessProbeInitialDelay .Values.readinessProbeInitialDelay }}
             periodSeconds: 60
+            timeoutSeconds: {{ .Values.livenessProbeTimeout }}
           {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
 
@@ -63,6 +63,9 @@ enableLivenessProbe: false
 # How long to wait (in seconds) before checking the liveness probe
 livenessProbeInitialDelay: 30
 
+# How long to wait before timeout (in seconds) when checking controller liveness
+livenessProbeTimeout: 1
+
 rbac:
   ## If true, create & use RBAC resources
   ##
@@ -109,3 +112,8 @@ volumes: []
   # - name: aws-iam-credentials
   #   secret:
   #     secretName: alb-ingress-controller-role
+
+# Leverage a PriorityClass to ensure your pods survive resource shortages
+# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+# PriorityClass: system-cluster-critical
+priorityClassName: ""
@@ -1,8 +1,8 @@
 apiVersion: v1
 description: Single sign-on for your Kubernetes services using Google OAuth
 name: buzzfeed-sso
-version: 0.0.1
-appVersion: 1.1.0
+version: 0.0.7
+appVersion: 1.2.0
 home: https://github.com/buzzfeed/sso
 sources:
   - https://hub.docker.com/r/buzzfeed/sso/
@@ -14,3 +14,5 @@ icon: https://user-images.githubusercontent.com/10510566/44476420-a64e5980-a605-
 maintainers:
   - name: darioblanco
     email: dblanco@minddoc.de
+  - name: komljen
+    email: alen.komljen@live.com
@@ -1,4 +1,6 @@
 approvers:
 - darioblanco
+- komljen
 reviewers:
 - darioblanco
+- komljen
@@ -53,8 +53,11 @@ Parameter | Description | Default
 `namespace` | namespace to use | `default`
 `emailDomain` | the sso email domain for authentication | REQUIRED
 `rootDomain` | the parent domain used for protecting your backends | REQUIRED
+`whitelistedEmails` | comma-seperated list of emails which should be whitelisted | OPTIONAL
+`cluster` | the cluster name for SSO | `dev`
 `auth.annotations` | extra annotations for auth pods | `{}`
 `auth.domain` | the auth domain used for OAuth callbacks | REQUIRED
+`auth.extraEnv` | extra auth env vars | `[]`
 `auth.replicaCount` | desired number of auth pods | `1`
 `auth.resources` | resource limits and requests for auth pods | `{ limits: { memory: "256Mi", cpu: "200m" }}`
 `auth.nodeSelector` | node selector logic for auth pods | `{}`
@@ -63,11 +66,12 @@ Parameter | Description | Default
 `auth.service.type` | type of auth service to create | `ClusterIP`
 `auth.service.port` | port for the http auth service | `80`
 `auth.secret` | secrets to be generated randomly with `openssl rand -base64 32 | head -c 32`. | REQUIRED if `auth.customSecret` is not set
-`auth.tls` | tls configuration for central sso auth ingress. | `{ secretName: "sso-auth-tls-secret" }`
+`auth.ingressPath` | auth ingress path. | `/`
+`auth.tls` | tls configuration for central sso auth ingress. | `{}`
 `auth.customSecret` | the secret key to reuse (avoids secret creation via helm) | REQUIRED if `auth.secret` is not set
 `proxy.annotations` | extra annotations for proxy pods | `{}`
 `proxy.providerUrlInternal` | url for split dns deployments |
-`proxy.cluster` | the cluster name for SSO | `dev`
+`proxy.extraEnv` | extra proxy env vars | `[]`
 `proxy.replicaCount` | desired number of proxy pods | `1`
 `proxy.resources` | resource limits and requests for proxy pods | `{ limits: { memory: "256Mi", cpu: "200m" }}`
 `proxy.nodeSelector` | node selector logic for proxy pods | `{}`
@@ -82,9 +86,10 @@ Parameter | Description | Default
 `provider.google.secret` | the Google OAuth secrets | REQUIRED if `provider.google.customSecret` is not set
 `provider.google.customSecret` | the secret key to reuse instead of creating it via helm | REQUIRED if `provider.google.secret` is not set
 `image.repository` | container image repository | `buzzfeed/sso`
-`image.tag` | container image tag | `v1.0.0`
+`image.tag` | container image tag | `v1.2.0`
 `image.pullPolicy` | container image pull policy | `IfNotPresent`
 `ingress.annotations` | ingress load balancer annotations | `{}`
+`ingress.extraLabels` | extra ingress labels | `{}`
 `ingress.hosts` | proxied hosts | `[]`
 `ingress.tls` | tls certificates for the proxied hosts | `[]`
 `upstreams` | configuration of services that use sso | `[]`
 
@@ -57,6 +57,10 @@ spec:
               value: {{ .Values.emailDomain | quote }}
             - name: HOST
               value: {{ $authDomain }}
+            {{- if .Values.whitelistedEmails }}
+            - name: SSO_EMAIL_ADDRESSES
+              value: {{ .Values.whitelistedEmails }}
+            {{- end }}
             - name: REDIRECT_URL
               value: https://{{ $authDomain }}
             - name: PROXY_ROOT_DOMAIN
@@ -95,7 +99,7 @@ spec:
             - name: COOKIE_SECURE
               value: "true"
             - name: CLUSTER
-              value: dev
+              value: {{ .Values.cluster | quote }}
             # Provider variables
           {{- with .Values.provider.google }}
           {{- if .adminEmail }}
@@ -115,6 +119,9 @@ spec:
                   name: {{ $googleSecret }}
                   key: google-client-secret
           {{- end }}
+          {{- if .Values.auth.extraEnv }}
+{{ toYaml .Values.auth.extraEnv | indent 12 }}
+          {{- end }}
           readinessProbe:
             httpGet:
               path: /ping
 
@@ -8,7 +8,7 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 data:
-{{- with .Values.upstreams }}
   upstream_configs.yml: |-
+{{- with .Values.upstreams }}
 {{ toYaml . | indent 4 }}
 {{- end }}