From 68aa69cc7574fe07d8d9e9c4a21e3a2e10b68a23 Mon Sep 17 00:00:00 2001
From: Janusz Bialy <jbialy@gmail.com>
Date: Mon, 11 Jun 2018 16:08:26 -0400
Subject: [PATCH] [incubator/vault] Add ability to define sidecar containers
 (#5974)

* add option to add sidecar containers

* bump chart

* fix position of side container section

* limit to one sidecar and associated secrets

* update param list

* fix circle build

* keep extracontainers and extravolumes generic

* update param table
---
 incubator/vault/Chart.yaml                |  2 +-
 incubator/vault/README.md                 |  2 ++
 incubator/vault/templates/deployment.yaml |  6 ++++++
 incubator/vault/values.yaml               | 13 ++++++++++++-
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/incubator/vault/Chart.yaml b/incubator/vault/Chart.yaml
index 2754c69cf3..4dca76eeb0 100644
--- a/incubator/vault/Chart.yaml
+++ b/incubator/vault/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.11.0
+version: 0.12.0
 appVersion: 0.10.1
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg
diff --git a/incubator/vault/README.md b/incubator/vault/README.md
index 0a824bd0f3..ff872dc07b 100644
--- a/incubator/vault/README.md
+++ b/incubator/vault/README.md
@@ -54,6 +54,8 @@ The following table lists the configurable parameters of the Vault chart and the
 | `image.tag`                       | Container image tag to deploy            | `0.10.1`                            |
 | `vault.dev`                       | Use Vault in dev mode                    | true (set to false in production)   |
 | `vault.extraEnv`                  | Extra env vars for Vault pods            | `{}`                                |
+| `vault.extraContainers`           | Sidecar containers to add to the vault pod | `{}`                              |
+| `vault.extraVolumes`              | Additional volumes to the controller pod | `{}`                                |
 | `vault.customSecrets`             | Custom secrets available to Vault        | `[]`                                |
 | `vault.config`                    | Vault configuration                      | No default backend                  |
 | `replicaCount`                    | k8s replicas                             | `3`                                 |
diff --git a/incubator/vault/templates/deployment.yaml b/incubator/vault/templates/deployment.yaml
index ff19498fd9..138112eb4a 100644
--- a/incubator/vault/templates/deployment.yaml
+++ b/incubator/vault/templates/deployment.yaml
@@ -78,6 +78,9 @@ spec:
         - name: {{ .secretName }}
           mountPath: {{ .mountPath }}
         {{- end }}
+{{- if .Values.vault.extraContainers }}
+{{ toYaml .Values.vault.extraContainers | indent 6}}
+{{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
       {{- if .Values.affinity }}
@@ -125,6 +128,9 @@ spec:
           secret:
             secretName: {{ .secretName }}
         {{- end }}
+{{- if .Values.vault.extraVolumes }}
+{{ toYaml .Values.vault.extraVolumes | indent 8}}
+{{- end }}
         {{- if .Values.consulAgent.join }}
         - name: consul-data
           emptyDir: {}
diff --git a/incubator/vault/values.yaml b/incubator/vault/values.yaml
index 3ddb3c454f..0a8fb3d43c 100644
--- a/incubator/vault/values.yaml
+++ b/incubator/vault/values.yaml
@@ -24,7 +24,6 @@ consulAgent:
   #
   # Optionally override the agent's http port
   HttpPort: 8500
-
 service:
   name: vault
   type: ClusterIP
@@ -114,6 +113,18 @@ vault:
   extraEnv: {}
   #   - name: VAULT_API_ADDR
   #     value: "https://vault.internal.domain.name:8200"
+  extraContainers: {}
+  ## Additional containers to be added to the Vault pod
+  # - name: vault-sidecar
+  #   image: vault-sidecar:latest
+  #   volumeMounts:
+  #   - name: some-mount
+  #     mountPath: /some/path
+  extraVolumes: {}
+  ## Additional volumes to the vault pod.
+  # - name: extra-volume
+  #   secret:
+  #     secretName: some-secret
   readiness:
     readyIfSealed: false
     readyIfStandby: true