Add optional vault exporter for Prometheus. (#11185)

Signed-off-by: Dimitri Graf <dgraf@protonmail.ch>

incubator/vault/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.16.1
+version: 0.17.1
 appVersion: 1.0.1
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg

incubator/vault/README.md

@@ -81,6 +81,12 @@ The following table lists the configurable parameters of the Vault chart and the
 | `consulAgent.pullPolicy`          | Container pull policy for consul agent   | `IfNotPresent`                      |
 | `consulAgent.gossipKeySecretName` | k8s secret containing gossip key         | `nil` (see values.yaml for details) |
 | `consulAgent.HttpPort`            | HTTP port for consul agent API           | `8500`                              |
+| `vaultExporter.enabled`           | Enable or disable vault exporter         | `false`                             |
+| `vaultExporter.repository`        | Container image for vault exporter       | `grapeshot/vault_exporter`          |
+| `vaultExporter.tag`               | Container image tag for vault exporter   | `v0.1.2`                            |
+| `vaultExporter.pullPolicy`        | Image pull policy that sould be used     | `IfNotPresent`                      |
+| `vaultExporter.vaultAddress`      | Vault address that exporter should use   | `127.0.0.1:8200`                    |
+| `vaultExporter.tlsCAFile`         | Vault TLS CA certificate mount path      | `/vault/tls/ca.crt`                 |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
 
@@ -108,6 +114,15 @@ are encrypted with a gossip key.  You can configure a secret with the
 same format as that chart and specify it in the
 `consulAgent.gossipKeySecretName` parameter.
 
+## Optional Vault Exporter
+If you want to monitor Vault with Prometheus you can simply enable the Vault exporter
+which then runs as a sidecar container within the same pod as Vault itself. To use the
+exporter just set `vaultExporter.enabled` to true and set the other variables according to
+your needs.
+
+If your Vault is set up with TLS make sure to specify the CA certificate path properly.
+This is done through the parameter `vaultExporter.tlsCAFile`.
+
 ## Using Vault
 
 Once the Vault pod is ready, it can be accessed using a `kubectl

incubator/vault/templates/deployment.yaml

@@ -133,6 +133,29 @@ spec:
               -join={{- .Values.consulAgent.join }} \
               -data-dir=/etc/consul
       {{- end }}
+      {{- if .Values.vaultExporter.enabled }}
+      - name: {{ .Chart.Name }}-exporter
+        image: "{{ .Values.vaultExporter.repository }}:{{ .Values.vaultExporter.tag }}"
+        imagePullPolicy: {{ .Values.vaultExporter.pullPolicy }}
+        securityContext:
+          readOnlyRootFilesystem: true
+        env:
+          - name: VAULT_ADDR
+            {{- if .Values.vault.config.listener.tcp.tls_disable }}
+            value: "http://{{ .Values.vaultExporter.vaultAddress }}"
+            {{- else }}
+            value: "https://{{ .Values.vaultExporter.vaultAddress }}"
+            {{- end }}
+          {{- if .Values.vaultExporter.tlsCAFile }}
+          - name: VAULT_CACERT
+            value: {{ .Values.vaultExporter.tlsCAFile | quote }}
+          {{- end }}
+        {{- range .Values.vault.customSecrets }}
+        volumeMounts:
+        - name: {{ .secretName | replace "." "-"}}
+          mountPath: {{ .mountPath }}
+        {{- end }}
+      {{- end }}
       {{- if .Values.affinity }}
       affinity:
 {{ tpl .Values.affinity . | indent 8 }}

incubator/vault/values.yaml

@@ -9,6 +9,13 @@ image:
   tag:
   pullPolicy: IfNotPresent
 
+vaultExporter:
+  enabled: false
+  repository: grapeshot/vault_exporter
+  tag: v0.1.2
+  pullPolicy: IfNotPresent
+  vaultAddress: 127.0.0.1:8200
+  # tlsCAFile: /vault/tls/ca.crt
 consulAgent:
   repository: consul
   tag: 1.4.0