Add sealed secret chart (#8416)

* Create Initial deployment and service Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add Custom Resource definition Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add option to use custom secret Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add RBAC and service account resources Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add NOTES documentation on how to use sealed secrets Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add README documentation Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add documentation to values file Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add lables to resources Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add missing values for resources & image. Add .helmignore Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Use service account and fullname templates Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Fix linting issues Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Fix image name Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Address code review comments Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Use repository value Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Address code review comments Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Update labels to match new convention Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add helm keep annotation Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Add maintainers and OWNERS Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Use github name Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Remove duplicate namespace Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com> * Make keeping CRD configurable Signed-off-by: Oliver Boyle <olib963@users.noreply.github.com>
2026-08-23 22:37:45 +00:00 · 2018-12-20 02:47:24 -08:00
parent dbefc14cdb
commit 62a1514098
16 changed files with 403 additions and 0 deletions
@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
@@ -0,0 +1,12 @@
+name: sealed-secrets
+description: A Helm chart for Sealed Secrets
+version: 1.0.0
+appVersion: 0.7.0
+kubeVersion: ">=1.9.0-0"
+home: https://github.com/bitnami-labs/sealed-secrets
+apiVersion: v1
+maintainers:
+  - name: stefanprodan
+    email: stefan.prodan@gmail.com
+  - name: olib963
+    email: olib963@gmail.com
@@ -0,0 +1,6 @@
+approvers:
+- olib963
+- stefanprodan
+reviewers:
+- olib963
+- stefanprodan
@@ -0,0 +1,46 @@
+# Sealed Secrets
+
+This chart contains the resources to use [sealed-secrets](https://github.com/bitnami-labs/sealed-secrets).
+
+## Prerequisites
+
+* Kubernetes >= 1.9
+
+## Installing the Chart
+
+To install the chart with the release name `my-release`:
+
+```bash
+$ helm install --namespace kube-system --name my-release stable/sealed-secrets
+```
+
+The command deploys a controller and [CRD](https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/) for sealed secrets on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
+
+## Uninstalling the Chart
+
+To uninstall/delete the `my-release` deployment:
+
+```bash
+$ helm delete [--purge] my-release
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+
+## Configuration
+
+| Parameter | Description | Default |
+|----------:|:------------|:--------|
+| **rbac.create** | `true` if rbac resources should be created | `true` |
+| **serviceAccount.create** | Whether to create a service account or not | `true` |
+| **serviceAccount.name** | The name of the service account to create or use | `"sealed-secrets-controller"` |
+| **secretName** | The name of the TLS secret containing the key used to encrypt secrets | `"sealed-secrets-key"` |
+| **image.tag** | The `Sealed Secrets` image tag | `v0.7.0` |
+| **image.pullPolicy** | The image pull policy for the deployment | `IfNotPresent` |
+| **image.repository** | The repository to get the controller image from | `quay.io/bitnami/sealed-secrets-controller` |
+| **resources** | CPU/Memory resource requests/limits | `{}` |
+| **crd.keep** | `true` if the sealed secret CRD should be kept when the chart is deleted | `true` |
+
+- In the case that **serviceAccount.create** is `false` and **rbac.create** is `true` it is expected for a service account with the name **serviceAccount.name** to exist _in the same namespace as this chart_ before installation.
+- If **serviceAccount.create** is `true` there cannot be an existing service account with the name **serviceAccount.name**.
+- If a secret with name **secretName** does not exist _in the same namespace as this chart_, then on install one will be created. If a secret already exists with this name the keys inside will be used.
@@ -0,0 +1,4 @@
+# CI is running on GKE, it requires the chart to clean up after itself so we cannot keep the CRD
+
+crd:
+  keep: false
@@ -0,0 +1,38 @@
+You should now be able to create sealed secrets.
+
+1. Install client-side tool into /usr/local/bin/
+
+GOOS=$(go env GOOS)
+GOARCH=$(go env GOARCH)
+wget https://github.com/bitnami-labs/sealed-secrets/releases/download/$release/kubeseal-$GOOS-$GOARCH
+sudo install -m 755 kubeseal-$GOOS-$GOARCH /usr/local/bin/kubeseal
+
+2. Create a sealed secret file
+
+# note the use of `--dry-run` - this does not create a secret in your cluster
+kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | kubeseal --format [json|yaml] > mysealedsecret.[json|yaml]
+
+The file mysealedsecret.[json|yaml] is a commitable file.
+
+If you would rather not need access to the cluster to generate the sealed secret you can run
+
+kubeseal --fetch-cert > mycert.pem
+
+to retrieve the public cert used for encryption and store it locally. You can then run 'kubeseal --cert mycert.pem' instead to use the local cert e.g.
+
+kubectl create secret generic secret-name --dry-run --from-literal=foo=bar -o [json|yaml] | kubeseal --format [json|yaml] --cert mycert.pem > mysealedsecret.[json|yaml]
+
+3. Apply the sealed secret
+
+kubectl create -f mysealedsecret.[json|yaml]
+
+Running 'kubectl get secret secret-name -o [json|yaml]' will show the decrypted secret that was generated from the sealed secret.
+
+Both the SealedSecret and generated Secret must have the same name and namespace.
+
+{{ if not (eq .Release.Namespace "kube-system") }}
+--------------------------------------------------------------------------------------------------
+
+Please Note: Since this chart was not installed in the kube-system namespace all kubeseal commands must pass the option `--controller-namespace {{ .Release.Namespace }}`
+
+{{ end }}
@@ -0,0 +1,42 @@
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "sealed-secrets.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "sealed-secrets.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "sealed-secrets.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "sealed-secrets.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "sealed-secrets.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,21 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: secrets-unsealer
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ template "sealed-secrets.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{ end }}
@@ -0,0 +1,29 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secrets-unsealer
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+rules:
+  - apiGroups:
+      - bitnami.com
+    resources:
+      - sealedsecrets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+      - update
+      - delete
+{{ end }}
@@ -0,0 +1,60 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ template "sealed-secrets.serviceAccountName" . }}
+      containers:
+        - name: {{ template "sealed-secrets.fullname" . }}
+          command:
+            - controller
+          args:
+            - "--key-name"
+            - "{{ .Values.secretName }}"
+          image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: 8080
+              name: http
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1001
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
@@ -0,0 +1,21 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: sealed-secrets-key-admin
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ template "sealed-secrets.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{ end }}
@@ -0,0 +1,27 @@
+{{ if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: sealed-secrets-key-admin
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+rules:
+  - apiGroups:
+      - ""
+    resourceNames:
+      - {{ .Values.secretName }}
+    resources:
+      - secrets
+    verbs:
+      - get
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - create
+{{ end }}
@@ -0,0 +1,23 @@
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: sealedsecrets.bitnami.com
+  {{ if .Values.crd.keep }}
+  annotations:
+    "helm.sh/resource-policy": keep
+  {{ end }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+spec:
+  group: bitnami.com
+  names:
+    kind: SealedSecret
+    listKind: SealedSecretList
+    plural: sealedsecrets
+    singular: sealedsecret
+  scope: Namespaced
+  version: v1alpha1
@@ -0,0 +1,12 @@
+{{ if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "sealed-secrets.serviceAccountName" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+{{ end }}
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "sealed-secrets.fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ template "sealed-secrets.name" . }}
+    helm.sh/chart: {{ template "sealed-secrets.chart" . }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/version: {{ .Chart.AppVersion }}
+spec:
+  ports:
+    - port: 8080
+  selector:
+    name: {{ template "sealed-secrets.fullname" . }}
@@ -0,0 +1,26 @@
+image:
+  repository: quay.io/bitnami/sealed-secrets-controller
+  tag: v0.7.0
+  pullPolicy: IfNotPresent
+
+resources: {}
+nodeSelector: {}
+tolerations: []
+affinity: {}
+
+serviceAccount:
+  # serviceAccount.create: Whether to create a service account or not
+  create: true
+  # serviceAccount.name: The name of the service account to create or use
+  name: ""
+
+rbac:
+  # rbac.create: `true` if rbac resources should be created
+  create: true
+
+# secretName: The name of the TLS secret containing the key used to encrypt secrets
+secretName: "sealed-secrets-key"
+
+crd:
+  # crd.keep: `true` if the sealed secret CRD should be kept when the chart is deleted
+  keep: true