diff --git a/stable/concourse/Chart.yaml b/stable/concourse/Chart.yaml index 4186928176..fed4c6429c 100644 --- a/stable/concourse/Chart.yaml +++ b/stable/concourse/Chart.yaml @@ -1,5 +1,5 @@ name: concourse -version: 5.0.1 +version: 5.1.1 appVersion: 5.0.1 description: Concourse is a simple and scalable CI system. icon: https://avatars1.githubusercontent.com/u/7809479 diff --git a/stable/concourse/README.md b/stable/concourse/README.md index 6b6553e8e7..da3a58c4e9 100644 --- a/stable/concourse/README.md +++ b/stable/concourse/README.md @@ -459,6 +459,8 @@ concourse: To use SSM, set `concourse.web.kubernetes.enabled` to false, and set `concourse.web.awsSsm.enabled` to true. +Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSsm.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSsm.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#ssm. + For a given Concourse *team*, a pipeline looks for secrets in SSM using either `/concourse/{team}/{secret}` or `/concourse/{team}/{pipeline}/{secret}`; the patterns can be overridden using the `concourse.web.awsSsm.teamSecretTemplate` and `concourse.web.awsSsm.pipelineSecretTemplate` settings. Concourse requires AWS credentials which are able to read from SSM for this feature to function. Credentials can be set in the `secrets.awsSsm*` settings; if your cluster is running in a different AWS region, you may also need to set `concourse.web.awsSsm.region`. @@ -489,6 +491,8 @@ Where `` is the ARN of the KMS key used to encrypt the secrets in P To use Secrets Manager, set `concourse.web.kubernetes.enabled` to false, and set `concourse.web.awsSecretsManager.enabled` to true. +Authentication can be configured to use an access key and secret key as well as a session token. This is done by setting `concourse.web.awsSecretsManager.keyAuth.enabled` to `true`. Alternatively, if it set to `false`, AWS IAM role based authentication (instance or pod credentials) is assumed. To use a session token, `concourse.web.awsSecretsManger.useSessionToken` should be set to `true`. The secret values can be managed using the values specified in this helm chart or separately. For more details, see https://concourse-ci.org/creds.html#asm. + For a given Concourse *team*, a pipeline looks for secrets in Secrets Manager using either `/concourse/{team}/{secret}` or `/concourse/{team}/{pipeline}/{secret}`; the patterns can be overridden using the `concourse.web.awsSecretsManager.teamSecretTemplate` and `concourse.web.awsSecretsManager.pipelineSecretTemplate` settings. Concourse requires AWS credentials which are able to read from Secrets Manager for this feature to function. Credentials can be set in the `secrets.awsSecretsmanager*` settings; if your cluster is running in a different AWS region, you may also need to set `concourse.web.awsSecretsManager.region`. diff --git a/stable/concourse/templates/web-deployment.yaml b/stable/concourse/templates/web-deployment.yaml index 13871f992b..51ac31117b 100644 --- a/stable/concourse/templates/web-deployment.yaml +++ b/stable/concourse/templates/web-deployment.yaml @@ -295,6 +295,7 @@ spec: {{- end }} {{- end }} {{- if .Values.concourse.web.awsSecretsManager.enabled }} + {{- if .Values.concourse.web.awsSecretsManager.keyAuth.enabled }} - name: CONCOURSE_AWS_SECRETSMANAGER_ACCESS_KEY valueFrom: secretKeyRef: @@ -305,13 +306,14 @@ spec: secretKeyRef: name: {{ template "concourse.concourse.fullname" . }} key: aws-secretsmanager-secret-key - {{- if .Values.secrets.awsSecretsManagerSessionToken }} + {{- if .Values.concourse.web.awsSecretsManager.keyAuth.useSessionToken }} - name: CONCOURSE_AWS_SECRETSMANAGER_SESSION_TOKEN valueFrom: secretKeyRef: name: {{ template "concourse.concourse.fullname" . }} key: aws-secretsmanager-session-token {{- end }} + {{- end }} {{- if .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate }} - name: CONCOURSE_AWS_SECRETSMANAGER_PIPELINE_SECRET_TEMPLATE value: {{ .Values.concourse.web.awsSecretsManager.pipelineSecretTemplate | quote }} @@ -322,6 +324,7 @@ spec: {{- end }} {{- end }} {{- if .Values.concourse.web.awsSsm.enabled }} + {{- if .Values.concourse.web.awsSsm.keyAuth.enabled }} - name: CONCOURSE_AWS_SSM_ACCESS_KEY valueFrom: secretKeyRef: @@ -332,13 +335,14 @@ spec: secretKeyRef: name: {{ template "concourse.concourse.fullname" . }} key: aws-ssm-secret-key - {{- if .Values.secrets.awsSsmSessionToken }} + {{- if .Values.concourse.web.awsSsm.keyAuth.useSessionToken }} - name: CONCOURSE_AWS_SSM_SESSION_TOKEN valueFrom: secretKeyRef: name: {{ template "concourse.concourse.fullname" . }} key: aws-ssm-session-token {{- end }} + {{- end }} {{- if .Values.concourse.web.awsSsm.pipelineSecretTemplate }} - name: CONCOURSE_AWS_SSM_PIPELINE_SECRET_TEMPLATE value: {{ .Values.concourse.web.awsSsm.pipelineSecretTemplate | quote }} diff --git a/stable/concourse/values.yaml b/stable/concourse/values.yaml index 5954a02747..a7bd588ffa 100644 --- a/stable/concourse/values.yaml +++ b/stable/concourse/values.yaml @@ -261,6 +261,12 @@ concourse: ## region: + ## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed. + ## Session Token can also be enabled, if required. + keyAuth: + enabled: true + useSessionToken: false + ## pipeline-specific template for Secrets Manager parameters, defaults to: /concourse/{team}/{pipeline}/{secret} ## pipelineSecretTemplate: @@ -281,6 +287,12 @@ concourse: ## region: + ## Configure authentication using an access key and secret key. If disabled, IAM role auth is assumed. + ## Session Token can also be enabled, if required. + keyAuth: + enabled: true + useSessionToken: false + ## pipeline-specific template for SSM parameters, defaults to: /concourse/{team}/{pipeline}/{secret} ## pipelineSecretTemplate: