github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[incubator/kubernetes-vault] add RBAC, map values to ConfigMap directly (#5463)

Browse Source
This commit is contained in:
Krzysztof Nazarewski
2018-06-17 05:44:29 -07:00
committed by k8s-ci-robot
parent 14520bba51
commit 992a64875a
8 changed files with 104 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
incubator/kubernetes-vault/Chart.yaml
+2 -3
View File
@@ -2,11 +2,10 @@ name: kubernetes-vault
apiVersion: v1
home: https://github.com/Boostport/kubernetes-vault
description: The Kubernetes-Vault project allows pods to automatically receive a Vault token using Vaults AppRole auth backend.
version: 0.1.0
appVersion: 0.4.8
version: 0.2.0
appVersion: 0.5.2
sources:
- https://github.com/Boostport/kubernetes-vault
maintainers:
- name: bbriggs
email: briggs.brenton@gmail.com
incubator/kubernetes-vault/README.md
+16 -16
View File
@@ -23,22 +23,22 @@ $ helm install --name my-release incubator/kubernetes-vault --set vault.address=
The following tables lists the configurable parameters of the consul chart and their default values.
| Parameter | Description | Default |
| -------------------------- | ---------------------------------- | ---------------------------------------------------------- |
| `image` | Container image name | `boostport/kubernetes-vault` |
| `imageTag` | Container image tag | `0.4.8` |
| `imagePullPolicy` | Container pull policy | `Always` |
| `replicaCount` | k8s pod replicas | `3` |
| `app` | k8s selector key | `kubernetes-vault` |
| `service.dummyPort` | Dummy port to register pod with API. Not actually used. | `80` |
| `vault.address` | URL of Vault server | `http://vault:8200` |
| `vault.token` | Token generated from AppRole backend | `change-this-value` |
| `vault.vaultCertBackend` | Name of CA backend used in Vault | `intermediate-ca` |
| `vault.vaultCertRole` | Name of cert role used in Vault | `kubernetes-vault` |
| `resources.limits.cpu` | CPU limit | `100m` |
| `resources.limits.memory` | Memory limit | `128Mi` |
| `resources.requests.cpu` | CPU resource request | `100m` |
| `resources.requests.memory` | Memory resource request | `128Mi` |
| Parameter | Description | Default |
| -------------------------- | ---------------------------------- | ---------------------------------------------------------- |
| `configMap.*` | Maps directly to [`kubernetes-vault` configuration](https://github.com/Boostport/kubernetes-vault#configuration) | empty |
| `image` | Container image name | `boostport/kubernetes-vault` |
| `imageTag` | Container image tag | `0.5.2` |
| `imagePullPolicy` | Container pull policy | `Always` |
| `replicaCount` | k8s pod replicas | `3` |
| `app` | k8s selector key | `kubernetes-vault` |
| `service.dummyPort` | Dummy port to register pod with API. Not actually used. | `80` |
| `rbac.create` | Should RBAC be created? | `true` |
| `serviceAccount.create` | Should ServiceAccount be created? | `false` |
| `serviceAccount.name` | ServiceAccount name to use (autogenerated if empty) | `null` |
| `resources.limits.cpu` | CPU limit | `100m` |
| `resources.limits.memory` | Memory limit | `128Mi` |
| `resources.requests.cpu` | CPU resource request | `100m` |
| `resources.requests.memory` | Memory resource request | `128Mi` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
incubator/kubernetes-vault/templates/_helpers.tpl
+11
View File
@@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
incubator/kubernetes-vault/templates/configMap.yaml → incubator/kubernetes-vault/templates/config-map.yaml
+2 -13
View File
@@ -1,3 +1,4 @@
{{- $configMap := toYaml .Values.configMap -}}
apiVersion: v1
kind: ConfigMap
metadata:
@@ -10,16 +11,4 @@ metadata:
data:
kubernetes-vault.yml: |
# Dummy comment: https://github.com/kubernetes/helm/blob/master/docs/chart_template_guide/yaml_techniques.md#strings-in-yaml
vault:
addr: {{ .Values.vault.address }}
token: {{ .Values.vault.token }}
kubernetes:
watchNamespace: ${KUBERNETES_NAMESPACE}
serviceNamespace: ${KUBERNETES_NAMESPACE}
service: {{ template "fullname" . }}
prometheus:
tls:
vaultCertBackend: {{ .Values.vault.vaultCertBackend }}
vaultCertRole: {{ .Values.vault.vaultCertRole }}
{{ tpl $configMap . | indent 4 }}
incubator/kubernetes-vault/templates/deployment.yaml
+2 -1
View File
@@ -1,4 +1,4 @@
apiVersion: extensions/v1beta1
apiVersion: apps/v1beta2
kind: Deployment
metadata:
name: {{ template "fullname" . }}
@@ -15,6 +15,7 @@ spec:
app: {{ template "name" . }}
release: {{ .Release.Name }}
spec:
serviceAccountName: {{ template "serviceAccountName" . }}
volumes:
- name: config-volume
configMap:
incubator/kubernetes-vault/templates/rbac.yaml
+40
View File
@@ -0,0 +1,40 @@
{{- if .Values.rbac.create }}
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "fullname" . }}
labels:
app: {{ template "name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
subjects:
- kind: ServiceAccount
name: {{ template "serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ template "fullname" . }}
apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "fullname" . }}
labels:
app: {{ template "name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
- apiGroups: [""]
resources:
- pods
verbs: ["list", "watch"]
- apiGroups: [""]
resources:
- endpoints
verbs: ["get"]
{{- end }}
incubator/kubernetes-vault/templates/service-account.yaml
+12
View File
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ template "name" . }}
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
{{- end }}
incubator/kubernetes-vault/values.yaml
+19 -7
View File
@@ -5,16 +5,29 @@
replicaCount: 3
image:
repository: boostport/kubernetes-vault
tag: v0.4.8
tag: v0.5.2
pullPolicy: Always
app: kubernetes-vault
service:
dummyPort: 80
vault:
address: http://vault:8200
token: change-this-value
vaultCertBackend: intermediate-ca
vaultCertRole: kubernetes-vault
# Maps directly to https://github.com/Boostport/kubernetes-vault#configuration
configMap:
vault:
addr: http://vault:8200
token: change-this-value
kubernetes:
service: "{{ template \"fullname\" . }}"
watchNamespace: ${KUBERNETES_NAMESPACE}
serviceNamespace: ${KUBERNETES_NAMESPACE}
rbac:
create: true
serviceAccount:
create: true
name: ""
resources:
limits:
cpu: 100m
@@ -22,4 +35,3 @@ resources:
requests:
cpu: 100m
memory: 128Mi