oauth2-proxy

OIDC reverse proxy that authenticates HTTP requests before they reach an upstream. MIT. linux/amd64.

Pin this image by digest.

published Latest tag v7.15.5-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82

Pull:

podman pull oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82

Published 2026-10-20T04:32:50Z10.6 MiB compressed

Usage

Validated against this published digest: official-chart install, runtime digest, actual nonroot UID 65532, /ping, /ready, unauthenticated /oauth2/auth 401, OIDC login against published hardened Dex, and authenticated /oauth2/auth 202. Functional evidence.

oauth2-proxy runs as UID/GID 65532:65532 (the chart default is 2000). The official chart constructs the image as {{ registry | default "quay.io" }}/{{ repository }}:{{ tag }}; an empty image.registry therefore pulls from quay.io. Production values set registry: oci.thepeoples.io and repository: hardened/oauth2-proxy. Cookie sessions are local to each replica; keep replicaCount: 1 and leave redis-ha disabled. Set clientID, clientSecret and a 16-, 24- or 32-byte cookie secret (or existingSecret) and point extraArgs.oidc-issuer-url plus redirect-url at your IdP before install. A published hardened Dex image is a supported in-cluster IdP.

The Service stays private (ClusterIP), with ingress and HTTPRoute disabled. cookie-secure: "true" assumes TLS in front of any wider exposure. oauth2-proxy needs no Kubernetes API permissions, so the values disable service-account token mounting.

Production Helm values (metrics enabled, image pinned by digest):

# Official oauth2-proxy chart 10.7.1. Replace both image placeholders
# with the tag/digest from the published catalog; a pending recipe is not a release.
# Empty image.registry becomes quay.io, so production must set oci.thepeoples.io.
# Chart default UID/GID 2000 is overridden to 65532. redis-ha stays disabled.
fullnameOverride: oauth2-proxy
replicaCount: 1  # Cookie sessions are local to each replica.
redis-ha: {enabled: false}
sessionStorage: {type: cookie}
initContainers: {waitForRedis: {enabled: false}}
podDisruptionBudget: {enabled: false}
ingress: {enabled: false}
gatewayApi: {enabled: false}
nodeSelector: {kubernetes.io/arch: amd64, kubernetes.io/os: linux}
serviceAccount: {enabled: true, automountServiceAccountToken: false}
image:
  registry: oci.thepeoples.io
  repository: hardened/oauth2-proxy
  tag: "v7.15.5-tpio.1@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82"
  pullPolicy: IfNotPresent
config:
  # Set clientID, clientSecret and cookieSecret, or existingSecret, before install.
  # Cookie secret must be 16, 24 or 32 bytes: openssl rand -base64 32 | head -c 32
  cookieName: _oauth2_proxy
  emailDomains: ["*"]
  # Point upstreams at the in-cluster Service this proxy protects.
  upstreams: ["file:///dev/null"]
  forceLegacyConfig: true
extraArgs:
  provider: oidc
  cookie-secure: "true"
  # Set oidc-issuer-url and redirect-url for your IdP. login-url is only needed
  # when the browser cannot reach the issuer URL.
securityContext:
  enabled: true
  runAsUser: 65532
  runAsGroup: 65532
  runAsNonRoot: true
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities: {drop: [ALL]}
  seccompProfile: {type: RuntimeDefault}
podSecurityContext:
  runAsUser: 65532
  runAsGroup: 65532
  runAsNonRoot: true
  fsGroup: 65532
  seccompProfile: {type: RuntimeDefault}
resources:
  requests: {cpu: 50m, memory: 64Mi}
  limits: {cpu: "1", memory: 256Mi}
service: {type: ClusterIP}
metrics: {enabled: true}

helm repo add oauth2-proxy https://oauth2-proxy.github.io/manifests
helm repo update oauth2-proxy
helm upgrade --install oauth2-proxy oauth2-proxy/oauth2-proxy --version 10.7.1 \
  --namespace auth --create-namespace -f values-hardened.yaml

The example Service is oauth2-proxy.auth.svc:4180. Metrics are on oauth2-proxy.auth.svc:44180. Forward the Service in a separate terminal:

kubectl -n auth port-forward service/oauth2-proxy 4180:4180

Then check liveness, readiness and unauthenticated authorization:

curl -fsS http://127.0.0.1:4180/ping
curl -fsS http://127.0.0.1:4180/ready
curl -sS -o /dev/null -w '%{http_code}' http://127.0.0.1:4180/oauth2/auth

Unauthenticated /oauth2/auth returns 401. After a real OIDC login the same path returns 202. /ping or pod Ready alone is not a functional pass.

For existing Kustomize manifests that use the upstream image, pin this replacement in images:

images:
  - name: quay.io/oauth2-proxy/oauth2-proxy
    newName: oci.thepeoples.io/hardened/oauth2-proxy
    digest: sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82   # v7.15.5-tpio.1

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the OIDC reverse proxy. Depends on Dex (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/oauth2-proxy@sha256:de60fa58ab3c790bacbf536281c1aa36129fd2042e86a56a45c10e514071da82

Rebuild and licence

The recipe rebuilds the binary from the pinned release with a digest-pinned Go toolchain, the standard golang.org/x/net@v0.60.0 bump, and a scratch runtime under UID 65532. Publication requires fresh unsuppressed 0 CRITICAL / 0 HIGH scans and functional validation for the exact digest.

Licence: MIT.

oauth2-proxy is MIT. Corresponding source is the official v7.15.5 tag tarball plus the Containerfile and recorded module changes. Embedded sign-in, error, robots, logo and /static assets ship in that archive.

Upstream source