mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Add support for pre-created secrets and AWS STS session tokens (#10878)
* Add support for pre-created secrets and AWS STS session tokens Signed-off-by: Robbie deMuth <robbie.demuth@appian.com> * Remove unused aws.region value Signed-off-by: Robbie deMuth <robbie.demuth@appian.com> * Update chart version Signed-off-by: Robbie deMuth <robbie.demuth@appian.com>
This commit is contained in:
robbie-demuth
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
7a3e23df6b
commit
1e82f99866
@@ -2,7 +2,7 @@ apiVersion: v1
|
||||
appVersion: "0.5.0"
|
||||
description: A Helm chart for prometheus cloudwatch-exporter
|
||||
name: prometheus-cloudwatch-exporter
|
||||
version: 0.3.0
|
||||
version: 0.4.0
|
||||
home: https://github.com/prometheus/cloudwatch_exporter
|
||||
sources:
|
||||
- https://github.com/prometheus/cloudwatch_exporter
|
||||
|
||||
@@ -14,17 +14,22 @@ This chart bootstraps a [cloudwatch exporter](http://github.com/prometheus/cloud
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- [kube2iam](../../stable/kube2iam) installed to used the **aws.role** config option otherwise configure **aws.aws_access_key_id** and **aws.aws_secret_access_key**
|
||||
- [kube2iam](../../stable/kube2iam) installed to used the **aws.role** config option otherwise configure **aws.aws_access_key_id** and **aws.aws_secret_access_key** or **aws.secret.name**
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ # edit aws.aws_access_key_id and aws.aws_access_key_id with the key/password of a AWS user with a policy to access Cloudwatch
|
||||
$ helm install --name my-release stable/prometheus-cloudwatch-exporter
|
||||
$ # or add a role to aws with the [correct policy](https://github.com/prometheus/cloudwatch_exporter#credentials-and-permissions) to add to cloud watch
|
||||
$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set awsRole=roll_name_here
|
||||
$ # pass AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as values
|
||||
$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set aws.aws_access_key_id=$AWS_ACCESS_KEY_ID,aws.aws_secret_access_key=$AWS_SECRET_ACCESS_KEY
|
||||
|
||||
$ # or store them in a secret and pass its name as a value
|
||||
$ kubectl create secret generic <SECRET_NAME> --from-literal=access_key=$AWS_ACCESS_KEY_ID --from-literal=secret_key=$AWS_SECRET_ACCESS_KEY
|
||||
$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set aws.secret.name=<SECRET_NAME>
|
||||
|
||||
$ # or add a role to aws with the [correct policy](https://github.com/prometheus/cloudwatch_exporter#credentials-and-permissions) to add to cloud watch and pass its name as a value
|
||||
$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set awsRole=<ROLL_NAME>
|
||||
```
|
||||
|
||||
The command deploys Cloudwatch exporter on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
@@ -54,10 +59,11 @@ The following table lists the configurable parameters of the Cloudwatch Exporter
|
||||
| `service.annotations` | Custom annotations for service | `{}` |
|
||||
| `service.labels` | Additional custom labels for the service | `{}` |
|
||||
| `resources` | | `{}` |
|
||||
| `aws.region` | AWS Cloudwatch region | `eu-west-1` |
|
||||
| `aws.role` | AWS IAM Role To Use | |
|
||||
| `aws.aws_access_key_id` | AWS access key id | |
|
||||
| `aws.aws_secret_access_key` | AWS secret access key | |
|
||||
| `aws.secret.name` | The name of a pre-created secret in which AWS credentials are stored | |
|
||||
| `aws.secret.includesSessionToken` | Whether or not the pre-created secret contains an AWS STS session token | |
|
||||
| `config` | Cloudwatch exporter configuration | `example configuration` |
|
||||
| `rbac.create` | If true, create & use RBAC resources | `false` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created. | `true` |
|
||||
@@ -72,7 +78,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm
|
||||
|
||||
```console
|
||||
$ helm install --name my-release \
|
||||
--set aws.region=us-east-1 --set aws.role=my-aws-role \
|
||||
--set aws.role=my-aws-role \
|
||||
stable/prometheus-cloudwatch-exporter
|
||||
```
|
||||
|
||||
|
||||
@@ -25,7 +25,26 @@ spec:
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
{{- if not .Values.aws.role }}
|
||||
{{- if and .Values.aws.aws_secret_access_key .Values.aws.aws_access_key_id }}
|
||||
{{- if .Values.aws.secret.name }}
|
||||
env:
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: access_key
|
||||
name: {{ .Values.aws.secret.name }}
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: secret_key
|
||||
name: {{ .Values.aws.secret.name }}
|
||||
{{- if .Values.aws.secret.includesSessionToken }}
|
||||
- name: AWS_SESSION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: security_token
|
||||
name: {{ .Values.aws.secret.name }}
|
||||
{{- end }}
|
||||
{{- else if and .Values.aws.aws_secret_access_key .Values.aws.aws_access_key_id }}
|
||||
env:
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if not .Values.aws.role }}
|
||||
{{- if and (not .Values.aws.role) (not .Values.aws.secret.name) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
|
||||
@@ -29,9 +29,18 @@ resources: {}
|
||||
# memory: 128Mi
|
||||
|
||||
aws:
|
||||
region: eu-west-1
|
||||
role:
|
||||
# Note: Do not specify the aws_access_key_id abd aws_secret_access_key if you specified role before
|
||||
|
||||
# The name of a pre-created secret in which AWS credentials are stored. When
|
||||
# set, aws_access_key_id is assumed to be in a field called access_key,
|
||||
# aws_secret_access_key is assumed to be in a field called secret_key, and the
|
||||
# session token, if it exists, is assumed to be in a field called
|
||||
# security_token
|
||||
secret:
|
||||
name:
|
||||
includesSessionToken: false
|
||||
|
||||
# Note: Do not specify the aws_access_key_id and aws_secret_access_key if you specified role or secret.name before
|
||||
aws_access_key_id:
|
||||
aws_secret_access_key:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user