mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Allow AWS role based authentication to Secrets Manager and Systems Manager (#10237)
* Bumped major chart version Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Added documentation to explain how authentication paramters work. Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Added new keyauth variables and conditionals to match them for secrets manager and systems manager. Session token must now be explictly enabled if used. Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Fixed typo with awsSsm paramter name Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Fixed minor version Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Uncommented session token flag and set default to false. Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz> * Added missing backticks that broke formatting Signed-off-by: Tarek Mokhtar <tareks01@yahoo.co.nz>
This commit is contained in:
tareks
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
1c45a193d8
commit
0cf752adac
@@ -1,5 +1,5 @@
|
||||
name: concourse
|
||||
version: 5.0.1
|
||||
version: 5.1.1
|
||||
appVersion: 5.0.1
|
||||
description: Concourse is a simple and scalable CI system.
|
||||
icon: https://avatars1.githubusercontent.com/u/7809479
|
||||
|
||||
@@ -459,6 +459,8 @@ concourse:
|
||||
|
||||
To use SSM, set `concourse.web.kubernetes.enabled` to false, and set `concourse.web.awsSsm.enabled` to true.
|
||||
|
||||
Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSsm.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSsm.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#ssm.
|
||||
|
||||
For a given Concourse *team*, a pipeline looks for secrets in SSM using either `/concourse/{team}/{secret}` or `/concourse/{team}/{pipeline}/{secret}`; the patterns can be overridden using the `concourse.web.awsSsm.teamSecretTemplate` and `concourse.web.awsSsm.pipelineSecretTemplate` settings.
|
||||
|
||||
Concourse requires AWS credentials which are able to read from SSM for this feature to function. Credentials can be set in the `secrets.awsSsm*` settings; if your cluster is running in a different AWS region, you may also need to set `concourse.web.awsSsm.region`.
|
||||
@@ -489,6 +491,8 @@ Where `<kms-key-arn>` is the ARN of the KMS key used to encrypt the secrets in P
|
||||
|
||||
To use Secrets Manager, set `concourse.web.kubernetes.enabled` to false, and set `concourse.web.awsSecretsManager.enabled` to true.
|
||||
|
||||
Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSecretsManager.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSecretsManger.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#asm.
|
||||
|
||||
For a given Concourse *team*, a pipeline looks for secrets in Secrets Manager using either `/concourse/{team}/{secret}` or `/concourse/{team}/{pipeline}/{secret}`; the patterns can be overridden using the `concourse.web.awsSecretsManager.teamSecretTemplate` and `concourse.web.awsSecretsManager.pipelineSecretTemplate` settings.
|
||||
|
||||
Concourse requires AWS credentials which are able to read from Secrets Manager for this feature to function. Credentials can be set in the `secrets.awsSecretsmanager*` settings; if your cluster is running in a different AWS region, you may also need to set `concourse.web.awsSecretsManager.region`.
|
||||
|
||||
@@ -295,6 +295,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.concourse.web.awsSecretsManager.enabled }}
|
||||
{{- if .Values.concourse.web.awsSecretsManager.keyAuth.enabled }}
|
||||
- name: CONCOURSE_AWS_SECRETSMANAGER_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -305,13 +306,14 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "concourse.concourse.fullname" . }}
|
||||
key: aws-secretsmanager-secret-key
|
||||
{{- if .Values.secrets.awsSecretsManagerSessionToken }}
|
||||
{{- if .Values.concourse.web.awsSecretsManager.keyAuth.useSessionToken }}
|
||||
- name: CONCOURSE_AWS_SECRETSMANAGER_SESSION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "concourse.concourse.fullname" . }}
|
||||
key: aws-secretsmanager-session-token
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate }}
|
||||
- name: CONCOURSE_AWS_SECRETSMANAGER_PIPELINE_SECRET_TEMPLATE
|
||||
value: {{ .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate | quote }}
|
||||
@@ -322,6 +324,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.concourse.web.awsSsm.enabled }}
|
||||
{{- if .Values.concourse.web.awsSsm.keyAuth.enabled }}
|
||||
- name: CONCOURSE_AWS_SSM_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
@@ -332,13 +335,14 @@ spec:
|
||||
secretKeyRef:
|
||||
name: {{ template "concourse.concourse.fullname" . }}
|
||||
key: aws-ssm-secret-key
|
||||
{{- if .Values.secrets.awsSsmSessionToken }}
|
||||
{{- if .Values.concourse.web.awsSsm.keyAuth.useSessionToken }}
|
||||
- name: CONCOURSE_AWS_SSM_SESSION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ template "concourse.concourse.fullname" . }}
|
||||
key: aws-ssm-session-token
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.concourse.web.awsSsm.pipelineSecretTemplate }}
|
||||
- name: CONCOURSE_AWS_SSM_PIPELINE_SECRET_TEMPLATE
|
||||
value: {{ .Values.concourse.web.awsSsm.pipelineSecretTemplate | quote }}
|
||||
|
||||
@@ -261,6 +261,12 @@ concourse:
|
||||
##
|
||||
region:
|
||||
|
||||
## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed.
|
||||
## Session Token can also be enabled, if required.
|
||||
keyAuth:
|
||||
enabled: true
|
||||
useSessionToken: false
|
||||
|
||||
## pipeline-specific template for Secrets Manager parameters, defaults to: /concourse/{team}/{pipeline}/{secret}
|
||||
##
|
||||
pipelineSecretTemplate:
|
||||
@@ -281,6 +287,12 @@ concourse:
|
||||
##
|
||||
region:
|
||||
|
||||
## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed.
|
||||
## Session Token can also be enabled, if required.
|
||||
keyAuth:
|
||||
enabled: true
|
||||
useSessionToken: false
|
||||
|
||||
## pipeline-specific template for SSM parameters, defaults to: /concourse/{team}/{pipeline}/{secret}
|
||||
##
|
||||
pipelineSecretTemplate:
|
||||
|
||||
Reference in New Issue
Block a user