From 85100f6d3ed6ee4963db5352d55ecd316a0fa3c0 Mon Sep 17 00:00:00 2001 From: Jody Frankowski Date: Sat, 7 Apr 2018 12:36:08 +0200 Subject: [PATCH] Add incubator/vaultingkube chart (#3902) * Add incubator/vaultingkube chart * Downgrade deployment's apiVersion to v1beta2 In order to be compatible with both k8s 1.8 and 1.9 we need to use deployment's apiVersion to at most v1beta2. * Do not deploy unless all the required values are provided --- incubator/vaultingkube/.helmignore | 21 +++++++ incubator/vaultingkube/Chart.yaml | 5 ++ incubator/vaultingkube/README.md | 52 +++++++++++++++ incubator/vaultingkube/templates/NOTES.txt | 24 +++++++ incubator/vaultingkube/templates/_helpers.tpl | 43 +++++++++++++ .../vaultingkube/templates/deployment.yaml | 58 +++++++++++++++++ incubator/vaultingkube/templates/rbac.yaml | 32 ++++++++++ .../templates/serviceaccount.yaml | 6 ++ incubator/vaultingkube/values.yaml | 63 +++++++++++++++++++ 9 files changed, 304 insertions(+) create mode 100644 incubator/vaultingkube/.helmignore create mode 100644 incubator/vaultingkube/Chart.yaml create mode 100644 incubator/vaultingkube/README.md create mode 100644 incubator/vaultingkube/templates/NOTES.txt create mode 100644 incubator/vaultingkube/templates/_helpers.tpl create mode 100644 incubator/vaultingkube/templates/deployment.yaml create mode 100644 incubator/vaultingkube/templates/rbac.yaml create mode 100644 incubator/vaultingkube/templates/serviceaccount.yaml create mode 100644 incubator/vaultingkube/values.yaml diff --git a/incubator/vaultingkube/.helmignore b/incubator/vaultingkube/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/incubator/vaultingkube/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/incubator/vaultingkube/Chart.yaml b/incubator/vaultingkube/Chart.yaml new file mode 100644 index 0000000000..a6430bb64c --- /dev/null +++ b/incubator/vaultingkube/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +appVersion: 0.1.0 +description: vaultingkube takes config maps and secrets stored inside Hashicorp Vault and syncs them to your Kubernetes cluster. +name: vaultingkube +version: 0.1.0 diff --git a/incubator/vaultingkube/README.md b/incubator/vaultingkube/README.md new file mode 100644 index 0000000000..ff40c17f21 --- /dev/null +++ b/incubator/vaultingkube/README.md @@ -0,0 +1,52 @@ +# vaultingkube + +[vaultingkube](https://github.com/sunshinekitty/vaultingkube) takes config maps +and secrets stored inside Hashicorp Vault and syncs them to your Kubernetes +cluster. + +## TL;DR; + +```console +$ helm install incubator/vaultingkube +``` + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install --name my-release incubator/vaultingkube +``` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes nearly all the Kubernetes components associated with the +chart and deletes the release. + +## Configuration + +The following tables lists the configurable parameters of the vaultingkube chart and their default values. + +| Parameter | Description | Default | +|-------------------------|-------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------| +| `replicaCount` | Number of replicas of the vaultingkube pod | `1` | +| `images.repository` | vaultingkube image repository | `sunshinekitty/vaultingkube` | +| `images.tag` | vaultingkube image tag | `v0.1.0` | +| `images.pullPolicy` | vaultingkube image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `vaultAddress` | Address of the Vault that vaultingkube will query | None. You *must* supply one. | +| `vaultToken` | Token used by vaultingkube to query Vault | None. You *must* supply one. | +| `deleteOld` | Enable deletion of K8s managed secrets that were deleted from Vault | `"true"` | +| `syncPeriod` | Frequency at which vaultingkube will check Vault new or removed secrets | `"60"` | +| `vaultRootMountPath` | Secret path in Vault that vaultingkube will sync from | None. You *must* supply one | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | List of node taints to tolerate | `[]` | +| `affinity` | Affinity settings for pod assignment | `{}` | +| `rbac.create` | If `true`, create and use RBAC resources | `true` | +| `serviceAccount.create` | If `true`, create a new service account | `true` | +| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | `` | diff --git a/incubator/vaultingkube/templates/NOTES.txt b/incubator/vaultingkube/templates/NOTES.txt new file mode 100644 index 0000000000..91fcd76685 --- /dev/null +++ b/incubator/vaultingkube/templates/NOTES.txt @@ -0,0 +1,24 @@ +{{- if and .Values.vaultAddress .Values.vaultToken .Values.vaultRootMountPath }} +vaultingkube is getting provisioned in your cluster. After a few minutes, you can run the following to verify. + +To verify that vaultingkube has started, run: + + kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "vaultingkube.name" . }}" + +To verify that vaultingkube is synchronizing run: + + kubectl logs --namespace={{ .Release.Namespace }} -f deployment/{{ template "vaultingkube.fullname" . }} + +{{- else -}} +############################################################################## +#### ERROR: You are missing required values in the values.yaml file. #### +############################################################################## + +This deployment will be incomplete until all the required fields in the values.yaml file have been provided. + +To update, run: + + helm upgrade {{ .Release.Name }} \ + --set vaultAddress=YOUR-VAULT-ADDRESS,vaultToken=YOUR-VAULT-TOKEN,vaultRootMountPath=YOUR-VAULT-ROOT-MOUNT-PATH stable/vaultingkube + +{{- end }} diff --git a/incubator/vaultingkube/templates/_helpers.tpl b/incubator/vaultingkube/templates/_helpers.tpl new file mode 100644 index 0000000000..ad8bcf1f2d --- /dev/null +++ b/incubator/vaultingkube/templates/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "vaultingkube.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "vaultingkube.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "vaultingkube.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "vaultingkube.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "vaultingkube.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/incubator/vaultingkube/templates/deployment.yaml b/incubator/vaultingkube/templates/deployment.yaml new file mode 100644 index 0000000000..4e820381c6 --- /dev/null +++ b/incubator/vaultingkube/templates/deployment.yaml @@ -0,0 +1,58 @@ +{{- if and .Values.vaultAddress .Values.vaultToken .Values.vaultRootMountPath }} +apiVersion: apps/v1beta2 +kind: Deployment +metadata: + name: {{ template "vaultingkube.fullname" . }} + labels: + app: {{ template "vaultingkube.name" . }} + chart: {{ template "vaultingkube.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ template "vaultingkube.name" . }} + release: {{ .Release.Name }} + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + type: RollingUpdate + template: + metadata: + labels: + app: {{ template "vaultingkube.name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ default "" .Values.image.pullPolicy | quote }} + env: + - name: VAULT_ADDR + value: {{ .Values.vaultAddress | quote }} + - name: VAULT_TOKEN + value: {{ .Values.vaultToken | quote }} + - name: VK_DELETE_OLD + value: {{ .Values.deleteOld | quote }} + - name: VK_SYNC_PERIOD + value: {{ .Values.syncPeriod | quote }} + - name: VK_VAULT_ROOT_MOUNT_PATH + value: {{ .Values.vaultRootMountPath | quote }} + resources: +{{ toYaml .Values.resources | indent 10 }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} + serviceAccountName: {{ template "vaultingkube.serviceAccountName" . }} +{{- end }} diff --git a/incubator/vaultingkube/templates/rbac.yaml b/incubator/vaultingkube/templates/rbac.yaml new file mode 100644 index 0000000000..55980a389c --- /dev/null +++ b/incubator/vaultingkube/templates/rbac.yaml @@ -0,0 +1,32 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ template "vaultingkube.fullname" . }} +rules: +- apiGroups: + - "" + resources: + - configmaps + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ template "vaultingkube.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "vaultingkube.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ template "vaultingkube.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/incubator/vaultingkube/templates/serviceaccount.yaml b/incubator/vaultingkube/templates/serviceaccount.yaml new file mode 100644 index 0000000000..4bf3655ad1 --- /dev/null +++ b/incubator/vaultingkube/templates/serviceaccount.yaml @@ -0,0 +1,6 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "vaultingkube.serviceAccountName" . }} +{{- end -}} diff --git a/incubator/vaultingkube/values.yaml b/incubator/vaultingkube/values.yaml new file mode 100644 index 0000000000..1c1fc513b6 --- /dev/null +++ b/incubator/vaultingkube/values.yaml @@ -0,0 +1,63 @@ +# Default values for vaultingkube. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# replicaCount is the replicas count of the vaultingkube pod. More than 1 is +# supported and you can use this to increase the availability of the vaultingkube +# agent in case of a pod crash. +replicaCount: 1 + +image: + # Image repository + # ref: https://hub.docker.com/r/sunshinekitty/vaultingkube/ + repository: sunshinekitty/vaultingkube + # Image version + # ref: https://hub.docker.com/r/sunshinekitty/vaultingkube/tags/ + tag: v0.1.0 + # Specify a imagePullPolicy + # Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + # ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + # pullPolicy: + +# vaultAddress is the address of the Vault that vaultingkube will query. +vaultAddress: +# vaultToken is the token used by vaultingkube to query Vault. +# You should use a read-only token. +vaultToken: +# Setting deleteOld to true will make vaultingkube delete K8s managed secrets +# that aren't in Vault anymore. +deleteOld: "true" +# syncPeriod will set the frequency at which vaultingkube will check Vault for +# new or removed secrets. +syncPeriod: "60" +# vaultRootMountPath is the secret path in Vault that vaultingkube will sync +# from and must contain the following +# structure: vaultRootMountPath/NAMESPACE/(secrets|configmaps)/NAME +# ref: https://github.com/sunshinekitty/vaultingkube#how-it-works +vaultRootMountPath: + +# CPU and memory limits for the vaultingkube agent +resources: {} + # limits: + # cpu: 100m + # memory: 64Mi + # requests: + # cpu: 100m + # memory: 64Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +rbac: + # Specifies whether RBAC resources should be created + create: true + +serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: