github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow google service accounts to be passed as kubernetes secrets (#16515)

Browse Source 
This is intended to replace the functionality of
`serviceAccountSecrets` providing a slightly more secure and standard
way of authenticating to google with service accounts. This pattern
mostly follows
https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
and provides significantly more documentation than the previous solution.

Signed-off-by: Kyle Purdon <kylepurdon@gmail.com>
This commit is contained in:
Kyle Purdon
2019-08-26 10:26:25 -07:00
committed by Kubernetes Prow Robot
parent a860457beb
commit 07b589f2eb
4 changed files with 20 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/atlantis/Chart.yaml
+1 -1
View File
@@ -2,7 +2,7 @@ apiVersion: v1
appVersion: "v0.8.2"
description: A Helm chart for Atlantis https://www.runatlantis.io
name: atlantis
version: 3.7.1
version: 3.8.0
keywords:
- terraform
home: https://www.runatlantis.io
stable/atlantis/README.md
+3 -2
View File
@@ -61,8 +61,9 @@ The following options are supported. See [values.yaml](values.yaml) for more de
| `disableApplyAll` | Disables running `atlantis apply` without any flags | `false` |
| `serviceAccount.create` | Whether to create a Kubernetes ServiceAccount if no account matching `serviceAccount.name` exists. | `true` |
| `serviceAccount.name` | Name of the Kubernetes ServiceAccount under which Atlantis should run. If no value is specified and `serviceAccount.create` is `true`, Atlantis will be run under a ServiceAccount whose name is the FullName of the Helm chart's instance, else Atlantis will be run under the `default` ServiceAccount. | n/a |
| `serviceAccountSecrets.credentials` | JSON string representing secrets for a Google Cloud Platform production service account. Only applicable if hosting Atlantis on GKE. | n/a |
| `serviceAccountSecrets.credentials-staging` | JSON string representing secrets for a Google Cloud Platform staging service account. Only applicable if hosting Atlantis on GKE. | n/a |
| `serviceAccountSecrets.credentials` | Deprecated (see googleServiceAccountSecrets) JSON string representing secrets for a Google Cloud Platform production service account. Only applicable if hosting Atlantis on GKE. | n/a |
| `serviceAccountSecrets.credentials-staging` | Deprecated (see googleServiceAccountSecrets) JSON string representing secrets for a Google Cloud Platform staging service account. Only applicable if hosting Atlantis on GKE. | n/a |
| `googleServiceAccountSecrets` | An array of Kubernetes secrets containing Google Service Account credentials. See `values.yaml` for examples and additional documentation. | n/a |
| `service.port` | Port of the `Service`. | `80` |
| `service.loadBalancerSourceRanges` | Array of whitelisted IP addresses for the Atlantis Service. If no value is specified, the Service will allow incoming traffic from all IP addresses (0.0.0.0/0). | n/a |
| `storageClassName` | Storage class of the volume mounted for the Atlantis data directory. | n/a |
stable/atlantis/templates/statefulset.yaml
+10
View File
@@ -49,6 +49,11 @@ spec:
secret:
secretName: {{ $name }}
{{- end }}
{{- range .Values.googleServiceAccountSecrets }}
- name: {{ .name }}
secret:
secretName: {{ .secretName }}
{{- end }}
{{- if .Values.gitconfig }}
- name: gitconfig-volume
secret:
@@ -236,6 +241,11 @@ spec:
readOnly: true
mountPath: /etc/{{ $name }}
{{- end }}
{{- range .Values.googleServiceAccountSecrets }}
- name: {{ .name }}
readOnly: true
mountPath: /var/secrets/{{ .name }}
{{- end }}
{{- if .Values.gitconfig}}
- name: gitconfig-volume
readOnly: true
stable/atlantis/values.yaml
+6
View File
@@ -203,3 +203,9 @@ environmentSecrets: []
# secretKeyRef:
# name: the_k8s_secret_name
# value: the_key_of_the_value_in_the_secret
# Optionally specify google service account credentials as Kubernetes secrets. If you are using the terraform google provider you can specify the credentials as "${file("/var/secrets/some-secret-name/key.json")}".
googleServiceAccountSecrets: []
# googleServiceAccountSecrets:
# - name: some-secret-name
# secretName: the_k8s_secret_name