OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors.

Homepage: https://dexidp.io/

helm repo add dex https://charts.dexidp.io
helm install --generate-name --wait dex/dex

Dex requires a minimal configuration in order to work. You can pass configuration to Dex using Helm values:

config:
  # Set it to a valid URL
  issuer: http://my-issuer-url.com

  # See https://dexidp.io/docs/storage/ for more options
  storage:
    type: memory

  # Enable at least one connector
  # See https://dexidp.io/docs/connectors/ for more options
  enablePasswordDB: true

The above configuration won't make Dex automatically available on the configured URL. One (and probably the easiest) way to achieve that is configuring ingress:

ingress:
  enabled: true

  hosts:
    - host: my-issuer-url.com
      paths:
        - path: /

HTTPS is basically mandatory these days, especially for authentication and authorization services. There are several solutions for protecting services with TlS in Kubernetes, but by far the most popular and portable is undoubtedly Cert Manager.

Cert Manager can be installed with a few steps:

helm repo add jetstack https://charts.jetstack.io
helm repo update
kubectl create namespace cert-manager
helm install \
  cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --set installCRDs=true

The next step is setting up an issuer (eg. Let's Encrypt):

cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: acme
spec:
  acme:
    email: YOUR@EMAIL_ADDRESS
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: acme-account-key
    solvers:
    - http01:
       ingress:
         class: YOUR_INGRESS_CLASS
EOF

Finally, change the ingress config to use TLS:

ingress:
  enabled: true

  annotations:
    cert-manager.io/cluster-issuer: acme

  hosts:
    - host: my-issuer-url.com
      paths:
        - path: /

  tls:
    - hosts:
        - my-issuer-url.com
      secretName: dex-cert

This chart is not backwards compatible with the stable/dex (or banzaicloud-stable/dex) chart.

However, Dex itself remains backwards compatible, so you can easily install the new chart in place of the old one and continue using Dex with a minimal downtime.