[stable/spinnaker]: Allow kubeconfig to be referenced in encrypted s3 bucket (#16473)

* [stable/spinnaker]: Allow kubeconfig to be referenced from encrypted s3 bucket

Signed-off-by: Brian <briankennethnutt@gmail.com>

* Update README

Signed-off-by: Brian <briankennethnutt@gmail.com>

* Remove whitespace

Signed-off-by: Brian <briankennethnutt@gmail.com>

* Update comments

Signed-off-by: Brian <briankennethnutt@gmail.com>

* Add newline

Signed-off-by: Brian <briankennethnutt@gmail.com>

stable/spinnaker/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.15.0
+version: 1.16.0
 appVersion: 1.12.5
 home: http://spinnaker.io/
 sources:

stable/spinnaker/README.md

@@ -36,6 +36,7 @@ $ helm install --name my-release -f values.yaml stable/spinnaker
 
 ## Adding Kubernetes Clusters to Spinnaker
 
+### Configuring arbitrary clusters with a kubernetes secret
 By default, installing the chart only registers the local cluster as a deploy target
 for Spinnaker. If you want to add arbitrary clusters need to do the following:
 
@@ -45,7 +46,7 @@ for Spinnaker. If you want to add arbitrary clusters need to do the following:
 $ kubectl create secret generic --from-file=$HOME/.kube/config my-kubeconfig
 ```
 
-1. Set the following values of the chart:
+2. Set the following values of the chart:
 
 ```yaml
 kubeConfig:
@@ -60,6 +61,30 @@ kubeConfig:
   deploymentContext: my-context
 ```
 
+### Configuring arbitrary clusters with s3
+By default, installing the chart only registers the local cluster as a deploy target
+for Spinnaker. If you do not want to store your kubeconfig as a secret on the cluster, you
+can also store in s3. Full documentation can be found [here](https://www.spinnaker.io/reference/halyard/secrets/s3-secrets/#secrets-in-s3).
+
+1. Upload your kubeconfig to a s3 bucket that halyard and spinnaker services can access.
+
+
+2. Set the following values of the chart:
+
+```yaml
+kubeConfig:
+  enabled: true
+  # secretName: my-kubeconfig
+  # secretKey: config
+  encryptedKubeconfig: encrypted:s3!r:us-west-2!b:mybucket!f:mykubeconfig
+  contexts:
+  # Names of contexts available in the uploaded kubeconfig
+  - my-context
+  # This is the context from the list above that you would like
+  # to deploy Spinnaker itself to.
+  deploymentContext: my-context
+```
+
 ## Specifying Docker Registries and Valid Images (Repositories)
 
 Spinnaker will only give you access to Docker images that have been whitelisted, if you're using a private registry or a private repository you also need to provide credentials.  Update the following values of the chart to do so:

stable/spinnaker/templates/_helpers.tpl

@@ -55,3 +55,14 @@ Redis base URL for Spinnaker
 {{- printf "redis://%s:%s" .Values.redis.external.host (.Values.redis.external.port | toString) -}}
 {{- end }}
 {{- end }}
+
+{{/*
+Create name of kubeconfig file to use when setting up kubernetes provider
+*/}}
+{{- define "spinnaker.kubeconfig" -}}
+{{- if .Values.kubeconfig.encryptedKubeconfig }}
+{{- printf .Values.kubeconfig.encryptedKubeconfig | toString -}}
+{{- else }}
+{{- printf "/opt/kube/%s" .Values.kubeConfig.secretKey  | toString -}}
+{{- end }}
+{{- end }}

stable/spinnaker/templates/configmap/halyard-config.yaml

@@ -110,7 +110,7 @@ data:
 
     $HAL_COMMAND config provider kubernetes account $PROVIDER_COMMAND {{ $context }} --docker-registries dockerhub \
                 --context {{ $context }} {{ if not $.Values.kubeConfig.enabled }}--service-account true{{ end }} \
-                {{ if $.Values.kubeConfig.enabled }}--kubeconfig-file /opt/kube/{{ $.Values.kubeConfig.secretKey }}{{ end }} \
+                {{ if $.Values.kubeConfig.enabled }}--kubeconfig-file {{ template "spinnaker.kubeconfig" $ }}{{ end }} \
                 {{ if $.Values.kubeConfig.onlySpinnakerManaged.enabled }}--only-spinnaker-managed true{{ end }} \
                 --omit-namespaces={{ template "omittedNameSpaces" $ }} --provider-version v2
     {{- end }}

stable/spinnaker/values.yaml

@@ -117,6 +117,11 @@ kubeConfig:
   enabled: false
   secretName: my-kubeconfig
   secretKey: config
+  # Use this when you want to configure halyard to reference a kubeconfig from s3
+  # This allows you to keep your kubeconfig in an encrypted s3 bucket
+  # For more info visit:
+  #   https://www.spinnaker.io/reference/halyard/secrets/s3-secrets/#secrets-in-s3
+  # encryptedKubeconfig: encrypted:s3!r:us-west-2!b:mybucket!f:mykubeconfig
   # List of contexts from the kubeconfig to make available to Spinnaker
   contexts:
   - default