From 1e82f99866b546d775ea99aed99417a0149c262a Mon Sep 17 00:00:00 2001 From: robbie-demuth Date: Tue, 29 Jan 2019 11:48:54 -0500 Subject: [PATCH] Add support for pre-created secrets and AWS STS session tokens (#10878) * Add support for pre-created secrets and AWS STS session tokens Signed-off-by: Robbie deMuth * Remove unused aws.region value Signed-off-by: Robbie deMuth * Update chart version Signed-off-by: Robbie deMuth --- .../prometheus-cloudwatch-exporter/Chart.yaml | 2 +- .../prometheus-cloudwatch-exporter/README.md | 20 +++++++++++------- .../templates/deployment.yaml | 21 ++++++++++++++++++- .../templates/secrets.yaml | 2 +- .../values.yaml | 13 ++++++++++-- 5 files changed, 46 insertions(+), 12 deletions(-) diff --git a/stable/prometheus-cloudwatch-exporter/Chart.yaml b/stable/prometheus-cloudwatch-exporter/Chart.yaml index c882188a68..30ac344717 100644 --- a/stable/prometheus-cloudwatch-exporter/Chart.yaml +++ b/stable/prometheus-cloudwatch-exporter/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 appVersion: "0.5.0" description: A Helm chart for prometheus cloudwatch-exporter name: prometheus-cloudwatch-exporter -version: 0.3.0 +version: 0.4.0 home: https://github.com/prometheus/cloudwatch_exporter sources: - https://github.com/prometheus/cloudwatch_exporter diff --git a/stable/prometheus-cloudwatch-exporter/README.md b/stable/prometheus-cloudwatch-exporter/README.md index 426da81968..61234a17c4 100644 --- a/stable/prometheus-cloudwatch-exporter/README.md +++ b/stable/prometheus-cloudwatch-exporter/README.md @@ -14,17 +14,22 @@ This chart bootstraps a [cloudwatch exporter](http://github.com/prometheus/cloud ## Prerequisites -- [kube2iam](../../stable/kube2iam) installed to used the **aws.role** config option otherwise configure **aws.aws_access_key_id** and **aws.aws_secret_access_key** +- [kube2iam](../../stable/kube2iam) installed to used the **aws.role** config option otherwise configure **aws.aws_access_key_id** and **aws.aws_secret_access_key** or **aws.secret.name** ## Installing the Chart To install the chart with the release name `my-release`: ```console -$ # edit aws.aws_access_key_id and aws.aws_access_key_id with the key/password of a AWS user with a policy to access Cloudwatch -$ helm install --name my-release stable/prometheus-cloudwatch-exporter -$ # or add a role to aws with the [correct policy](https://github.com/prometheus/cloudwatch_exporter#credentials-and-permissions) to add to cloud watch -$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set awsRole=roll_name_here +$ # pass AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY as values +$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set aws.aws_access_key_id=$AWS_ACCESS_KEY_ID,aws.aws_secret_access_key=$AWS_SECRET_ACCESS_KEY + +$ # or store them in a secret and pass its name as a value +$ kubectl create secret generic --from-literal=access_key=$AWS_ACCESS_KEY_ID --from-literal=secret_key=$AWS_SECRET_ACCESS_KEY +$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set aws.secret.name= + +$ # or add a role to aws with the [correct policy](https://github.com/prometheus/cloudwatch_exporter#credentials-and-permissions) to add to cloud watch and pass its name as a value +$ helm install --name my-release stable/prometheus-cloudwatch-exporter --set awsRole= ``` The command deploys Cloudwatch exporter on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. @@ -54,10 +59,11 @@ The following table lists the configurable parameters of the Cloudwatch Exporter | `service.annotations` | Custom annotations for service | `{}` | | `service.labels` | Additional custom labels for the service | `{}` | | `resources` | | `{}` | -| `aws.region` | AWS Cloudwatch region | `eu-west-1` | | `aws.role` | AWS IAM Role To Use | | | `aws.aws_access_key_id` | AWS access key id | | | `aws.aws_secret_access_key` | AWS secret access key | | +| `aws.secret.name` | The name of a pre-created secret in which AWS credentials are stored | | +| `aws.secret.includesSessionToken` | Whether or not the pre-created secret contains an AWS STS session token | | | `config` | Cloudwatch exporter configuration | `example configuration` | | `rbac.create` | If true, create & use RBAC resources | `false` | | `serviceAccount.create` | Specifies whether a service account should be created. | `true` | @@ -72,7 +78,7 @@ Specify each parameter using the `--set key=value[,key=value]` argument to `helm ```console $ helm install --name my-release \ - --set aws.region=us-east-1 --set aws.role=my-aws-role \ + --set aws.role=my-aws-role \ stable/prometheus-cloudwatch-exporter ``` diff --git a/stable/prometheus-cloudwatch-exporter/templates/deployment.yaml b/stable/prometheus-cloudwatch-exporter/templates/deployment.yaml index 2282b1ffae..9d5eb5e82a 100644 --- a/stable/prometheus-cloudwatch-exporter/templates/deployment.yaml +++ b/stable/prometheus-cloudwatch-exporter/templates/deployment.yaml @@ -25,7 +25,26 @@ spec: containers: - name: {{ .Chart.Name }} {{- if not .Values.aws.role }} - {{- if and .Values.aws.aws_secret_access_key .Values.aws.aws_access_key_id }} + {{- if .Values.aws.secret.name }} + env: + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + key: access_key + name: {{ .Values.aws.secret.name }} + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + key: secret_key + name: {{ .Values.aws.secret.name }} + {{- if .Values.aws.secret.includesSessionToken }} + - name: AWS_SESSION_TOKEN + valueFrom: + secretKeyRef: + key: security_token + name: {{ .Values.aws.secret.name }} + {{- end }} + {{- else if and .Values.aws.aws_secret_access_key .Values.aws.aws_access_key_id }} env: - name: AWS_ACCESS_KEY_ID valueFrom: diff --git a/stable/prometheus-cloudwatch-exporter/templates/secrets.yaml b/stable/prometheus-cloudwatch-exporter/templates/secrets.yaml index 16d3862853..c49d1db456 100644 --- a/stable/prometheus-cloudwatch-exporter/templates/secrets.yaml +++ b/stable/prometheus-cloudwatch-exporter/templates/secrets.yaml @@ -1,4 +1,4 @@ -{{- if not .Values.aws.role }} +{{- if and (not .Values.aws.role) (not .Values.aws.secret.name) }} apiVersion: v1 kind: Secret metadata: diff --git a/stable/prometheus-cloudwatch-exporter/values.yaml b/stable/prometheus-cloudwatch-exporter/values.yaml index e26ef68762..6117ea9811 100644 --- a/stable/prometheus-cloudwatch-exporter/values.yaml +++ b/stable/prometheus-cloudwatch-exporter/values.yaml @@ -29,9 +29,18 @@ resources: {} # memory: 128Mi aws: - region: eu-west-1 role: - # Note: Do not specify the aws_access_key_id abd aws_secret_access_key if you specified role before + + # The name of a pre-created secret in which AWS credentials are stored. When + # set, aws_access_key_id is assumed to be in a field called access_key, + # aws_secret_access_key is assumed to be in a field called secret_key, and the + # session token, if it exists, is assumed to be in a field called + # security_token + secret: + name: + includesSessionToken: false + + # Note: Do not specify the aws_access_key_id and aws_secret_access_key if you specified role or secret.name before aws_access_key_id: aws_secret_access_key: