mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Add incubator/vaultingkube chart (#3902)
* Add incubator/vaultingkube chart * Downgrade deployment's apiVersion to v1beta2 In order to be compatible with both k8s 1.8 and 1.9 we need to use deployment's apiVersion to at most v1beta2. * Do not deploy unless all the required values are provided
This commit is contained in:
Jody Frankowski
committed by
k8s-ci-robot
k8s-ci-robot
parent
9182ccfced
commit
85100f6d3e
@@ -0,0 +1,21 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
appVersion: 0.1.0
|
||||
description: vaultingkube takes config maps and secrets stored inside Hashicorp Vault and syncs them to your Kubernetes cluster.
|
||||
name: vaultingkube
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,52 @@
|
||||
# vaultingkube
|
||||
|
||||
[vaultingkube](https://github.com/sunshinekitty/vaultingkube) takes config maps
|
||||
and secrets stored inside Hashicorp Vault and syncs them to your Kubernetes
|
||||
cluster.
|
||||
|
||||
## TL;DR;
|
||||
|
||||
```console
|
||||
$ helm install incubator/vaultingkube
|
||||
```
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm install --name my-release incubator/vaultingkube
|
||||
```
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes nearly all the Kubernetes components associated with the
|
||||
chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following tables lists the configurable parameters of the vaultingkube chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-------------------------|-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `replicaCount` | Number of replicas of the vaultingkube pod | `1` |
|
||||
| `images.repository` | vaultingkube image repository | `sunshinekitty/vaultingkube` |
|
||||
| `images.tag` | vaultingkube image tag | `v0.1.0` |
|
||||
| `images.pullPolicy` | vaultingkube image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
|
||||
| `vaultAddress` | Address of the Vault that vaultingkube will query | None. You *must* supply one. |
|
||||
| `vaultToken` | Token used by vaultingkube to query Vault | None. You *must* supply one. |
|
||||
| `deleteOld` | Enable deletion of K8s managed secrets that were deleted from Vault | `"true"` |
|
||||
| `syncPeriod` | Frequency at which vaultingkube will check Vault new or removed secrets | `"60"` |
|
||||
| `vaultRootMountPath` | Secret path in Vault that vaultingkube will sync from | None. You *must* supply one |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `tolerations` | List of node taints to tolerate | `[]` |
|
||||
| `affinity` | Affinity settings for pod assignment | `{}` |
|
||||
| `rbac.create` | If `true`, create and use RBAC resources | `true` |
|
||||
| `serviceAccount.create` | If `true`, create a new service account | `true` |
|
||||
| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | `` |
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- if and .Values.vaultAddress .Values.vaultToken .Values.vaultRootMountPath }}
|
||||
vaultingkube is getting provisioned in your cluster. After a few minutes, you can run the following to verify.
|
||||
|
||||
To verify that vaultingkube has started, run:
|
||||
|
||||
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "vaultingkube.name" . }}"
|
||||
|
||||
To verify that vaultingkube is synchronizing run:
|
||||
|
||||
kubectl logs --namespace={{ .Release.Namespace }} -f deployment/{{ template "vaultingkube.fullname" . }}
|
||||
|
||||
{{- else -}}
|
||||
##############################################################################
|
||||
#### ERROR: You are missing required values in the values.yaml file. ####
|
||||
##############################################################################
|
||||
|
||||
This deployment will be incomplete until all the required fields in the values.yaml file have been provided.
|
||||
|
||||
To update, run:
|
||||
|
||||
helm upgrade {{ .Release.Name }} \
|
||||
--set vaultAddress=YOUR-VAULT-ADDRESS,vaultToken=YOUR-VAULT-TOKEN,vaultRootMountPath=YOUR-VAULT-ROOT-MOUNT-PATH stable/vaultingkube
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,43 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "vaultingkube.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "vaultingkube.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "vaultingkube.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "vaultingkube.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "vaultingkube.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,58 @@
|
||||
{{- if and .Values.vaultAddress .Values.vaultToken .Values.vaultRootMountPath }}
|
||||
apiVersion: apps/v1beta2
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "vaultingkube.fullname" . }}
|
||||
labels:
|
||||
app: {{ template "vaultingkube.name" . }}
|
||||
chart: {{ template "vaultingkube.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "vaultingkube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 0
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "vaultingkube.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ default "" .Values.image.pullPolicy | quote }}
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
value: {{ .Values.vaultAddress | quote }}
|
||||
- name: VAULT_TOKEN
|
||||
value: {{ .Values.vaultToken | quote }}
|
||||
- name: VK_DELETE_OLD
|
||||
value: {{ .Values.deleteOld | quote }}
|
||||
- name: VK_SYNC_PERIOD
|
||||
value: {{ .Values.syncPeriod | quote }}
|
||||
- name: VK_VAULT_ROOT_MOUNT_PATH
|
||||
value: {{ .Values.vaultRootMountPath | quote }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml . | indent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "vaultingkube.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.rbac.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "vaultingkube.fullname" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "vaultingkube.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "vaultingkube.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "vaultingkube.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,6 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "vaultingkube.serviceAccountName" . }}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,63 @@
|
||||
# Default values for vaultingkube.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
# replicaCount is the replicas count of the vaultingkube pod. More than 1 is
|
||||
# supported and you can use this to increase the availability of the vaultingkube
|
||||
# agent in case of a pod crash.
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
# Image repository
|
||||
# ref: https://hub.docker.com/r/sunshinekitty/vaultingkube/
|
||||
repository: sunshinekitty/vaultingkube
|
||||
# Image version
|
||||
# ref: https://hub.docker.com/r/sunshinekitty/vaultingkube/tags/
|
||||
tag: v0.1.0
|
||||
# Specify a imagePullPolicy
|
||||
# Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
# ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
# pullPolicy:
|
||||
|
||||
# vaultAddress is the address of the Vault that vaultingkube will query.
|
||||
vaultAddress:
|
||||
# vaultToken is the token used by vaultingkube to query Vault.
|
||||
# You should use a read-only token.
|
||||
vaultToken:
|
||||
# Setting deleteOld to true will make vaultingkube delete K8s managed secrets
|
||||
# that aren't in Vault anymore.
|
||||
deleteOld: "true"
|
||||
# syncPeriod will set the frequency at which vaultingkube will check Vault for
|
||||
# new or removed secrets.
|
||||
syncPeriod: "60"
|
||||
# vaultRootMountPath is the secret path in Vault that vaultingkube will sync
|
||||
# from and must contain the following
|
||||
# structure: vaultRootMountPath/NAMESPACE/(secrets|configmaps)/NAME
|
||||
# ref: https://github.com/sunshinekitty/vaultingkube#how-it-works
|
||||
vaultRootMountPath:
|
||||
|
||||
# CPU and memory limits for the vaultingkube agent
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
nodeSelector: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
rbac:
|
||||
# Specifies whether RBAC resources should be created
|
||||
create: true
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a ServiceAccount should be created
|
||||
create: true
|
||||
# The name of the ServiceAccount to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name:
|
||||
Reference in New Issue
Block a user