From 2a3f736d4c31aac2d81e630178bf42f22830901f Mon Sep 17 00:00:00 2001 From: Aravind Valkodai Date: Wed, 10 Jul 2019 16:12:26 -0400 Subject: [PATCH] [incubator/vault] Add RBAC to vault. (#14344) * Add RBAC to vault. Signed-off-by: Aravind Valkodai * Add RBAC to vault. Signed-off-by: Aravind Valkodai * Updates to RBAC to use create instead of enabled, Signed-off-by: Aravind Valkodai * Bump chart version Signed-off-by: Aravind Valkodai * Enabling serviceAccount to be enabled by default. Signed-off-by: Aravind Valkodai --- incubator/vault/Chart.yaml | 2 +- incubator/vault/README.md | 3 ++- incubator/vault/templates/role.yaml | 20 ++++++++++++++++++++ incubator/vault/values.yaml | 6 +++++- 4 files changed, 28 insertions(+), 3 deletions(-) create mode 100644 incubator/vault/templates/role.yaml diff --git a/incubator/vault/Chart.yaml b/incubator/vault/Chart.yaml index 54af32c1d1..7b1b6edb84 100644 --- a/incubator/vault/Chart.yaml +++ b/incubator/vault/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for Vault, a tool for managing secrets name: vault -version: 0.18.11 +version: 0.18.12 appVersion: 1.1.2 home: https://www.vaultproject.io/ icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg diff --git a/incubator/vault/README.md b/incubator/vault/README.md index bb525921a4..330d430ec6 100644 --- a/incubator/vault/README.md +++ b/incubator/vault/README.md @@ -78,8 +78,9 @@ The following table lists the configurable parameters of the Vault chart and the | `priorityClassName` | Priority class name for pods | `""` | | `minReadySeconds` | Minimum number of seconds that newly created replicas must be ready without any containers crashing | `0` | | `podLabels` | Extra labels for pods | `{}` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | | `serviceAccount.name` | The name of the ServiceAccount to create | Generated from fullname template | +| `rbac.create` | Specifies whether RBAC should be created | `true` | | `consulAgent.join` | If set, start start a consul agent | `nil` | | `consulAgent.repository` | Container image for consul agent | `consul` | | `consulAgent.tag` | Container image tag for consul agent | `1.4.0` | diff --git a/incubator/vault/templates/role.yaml b/incubator/vault/templates/role.yaml new file mode 100644 index 0000000000..17e551381e --- /dev/null +++ b/incubator/vault/templates/role.yaml @@ -0,0 +1,20 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ template "vault.serviceAccountName" . }} + labels: + app: {{ template "vault.name" . }} + chart: {{ template "vault.chart" . }} + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: +- kind: ServiceAccount + name: {{ template "vault.serviceAccountName" . }} + namespace: default +{{- end -}} diff --git a/incubator/vault/values.yaml b/incubator/vault/values.yaml index a6254a01ff..643b087641 100644 --- a/incubator/vault/values.yaml +++ b/incubator/vault/values.yaml @@ -144,7 +144,7 @@ minReadySeconds: 0 serviceAccount: ## Specifies whether a ServiceAccount should be created ## - create: false + create: true ## The name of the ServiceAccount to use. ## If not set and create is true, a name is generated using the fullname template name: @@ -239,3 +239,7 @@ vault: # bucket: "" # # Use a custom secret to mount this file. # credentials_file: "" + +rbac: + ## Enable RBAC + create: true