From 992a64875a429ae272348da2a0ae54136cf2e0ee Mon Sep 17 00:00:00 2001 From: Krzysztof Nazarewski <3494992+nazarewk@users.noreply.github.com> Date: Sun, 17 Jun 2018 14:44:29 +0200 Subject: [PATCH] [incubator/kubernetes-vault] add RBAC, map values to ConfigMap directly (#5463) --- incubator/kubernetes-vault/Chart.yaml | 5 +-- incubator/kubernetes-vault/README.md | 32 +++++++-------- .../kubernetes-vault/templates/_helpers.tpl | 11 +++++ .../{configMap.yaml => config-map.yaml} | 15 +------ .../templates/deployment.yaml | 3 +- .../kubernetes-vault/templates/rbac.yaml | 40 +++++++++++++++++++ .../templates/service-account.yaml | 12 ++++++ incubator/kubernetes-vault/values.yaml | 26 ++++++++---- 8 files changed, 104 insertions(+), 40 deletions(-) rename incubator/kubernetes-vault/templates/{configMap.yaml => config-map.yaml} (50%) create mode 100644 incubator/kubernetes-vault/templates/rbac.yaml create mode 100644 incubator/kubernetes-vault/templates/service-account.yaml diff --git a/incubator/kubernetes-vault/Chart.yaml b/incubator/kubernetes-vault/Chart.yaml index 8c799a9bdf..4fb2d01f1e 100644 --- a/incubator/kubernetes-vault/Chart.yaml +++ b/incubator/kubernetes-vault/Chart.yaml @@ -2,11 +2,10 @@ name: kubernetes-vault apiVersion: v1 home: https://github.com/Boostport/kubernetes-vault description: The Kubernetes-Vault project allows pods to automatically receive a Vault token using Vaults AppRole auth backend. -version: 0.1.0 -appVersion: 0.4.8 +version: 0.2.0 +appVersion: 0.5.2 sources: - https://github.com/Boostport/kubernetes-vault maintainers: - name: bbriggs email: briggs.brenton@gmail.com - diff --git a/incubator/kubernetes-vault/README.md b/incubator/kubernetes-vault/README.md index f725619a17..a70724a86a 100644 --- a/incubator/kubernetes-vault/README.md +++ b/incubator/kubernetes-vault/README.md @@ -23,22 +23,22 @@ $ helm install --name my-release incubator/kubernetes-vault --set vault.address= The following tables lists the configurable parameters of the consul chart and their default values. -| Parameter | Description | Default | -| -------------------------- | ---------------------------------- | ---------------------------------------------------------- | -| `image` | Container image name | `boostport/kubernetes-vault` | -| `imageTag` | Container image tag | `0.4.8` | -| `imagePullPolicy` | Container pull policy | `Always` | -| `replicaCount` | k8s pod replicas | `3` | -| `app` | k8s selector key | `kubernetes-vault` | -| `service.dummyPort` | Dummy port to register pod with API. Not actually used. | `80` | -| `vault.address` | URL of Vault server | `http://vault:8200` | -| `vault.token` | Token generated from AppRole backend | `change-this-value` | -| `vault.vaultCertBackend` | Name of CA backend used in Vault | `intermediate-ca` | -| `vault.vaultCertRole` | Name of cert role used in Vault | `kubernetes-vault` | -| `resources.limits.cpu` | CPU limit | `100m` | -| `resources.limits.memory` | Memory limit | `128Mi` | -| `resources.requests.cpu` | CPU resource request | `100m` | -| `resources.requests.memory` | Memory resource request | `128Mi` | +| Parameter | Description | Default | +| -------------------------- | ---------------------------------- | ---------------------------------------------------------- | +| `configMap.*` | Maps directly to [`kubernetes-vault` configuration](https://github.com/Boostport/kubernetes-vault#configuration) | empty | +| `image` | Container image name | `boostport/kubernetes-vault` | +| `imageTag` | Container image tag | `0.5.2` | +| `imagePullPolicy` | Container pull policy | `Always` | +| `replicaCount` | k8s pod replicas | `3` | +| `app` | k8s selector key | `kubernetes-vault` | +| `service.dummyPort` | Dummy port to register pod with API. Not actually used. | `80` | +| `rbac.create` | Should RBAC be created? | `true` | +| `serviceAccount.create` | Should ServiceAccount be created? | `false` | +| `serviceAccount.name` | ServiceAccount name to use (autogenerated if empty) | `null` | +| `resources.limits.cpu` | CPU limit | `100m` | +| `resources.limits.memory` | Memory limit | `128Mi` | +| `resources.requests.cpu` | CPU resource request | `100m` | +| `resources.requests.memory` | Memory resource request | `128Mi` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/incubator/kubernetes-vault/templates/_helpers.tpl b/incubator/kubernetes-vault/templates/_helpers.tpl index f0d83d2edb..e95f58c69e 100644 --- a/incubator/kubernetes-vault/templates/_helpers.tpl +++ b/incubator/kubernetes-vault/templates/_helpers.tpl @@ -14,3 +14,14 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this {{- $name := default .Chart.Name .Values.nameOverride -}} {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/incubator/kubernetes-vault/templates/configMap.yaml b/incubator/kubernetes-vault/templates/config-map.yaml similarity index 50% rename from incubator/kubernetes-vault/templates/configMap.yaml rename to incubator/kubernetes-vault/templates/config-map.yaml index b7d7e2a7a1..c10280ff0d 100644 --- a/incubator/kubernetes-vault/templates/configMap.yaml +++ b/incubator/kubernetes-vault/templates/config-map.yaml @@ -1,3 +1,4 @@ +{{- $configMap := toYaml .Values.configMap -}} apiVersion: v1 kind: ConfigMap metadata: @@ -10,16 +11,4 @@ metadata: data: kubernetes-vault.yml: | # Dummy comment: https://github.com/kubernetes/helm/blob/master/docs/chart_template_guide/yaml_techniques.md#strings-in-yaml - vault: - addr: {{ .Values.vault.address }} - token: {{ .Values.vault.token }} - - kubernetes: - watchNamespace: ${KUBERNETES_NAMESPACE} - serviceNamespace: ${KUBERNETES_NAMESPACE} - service: {{ template "fullname" . }} - - prometheus: - tls: - vaultCertBackend: {{ .Values.vault.vaultCertBackend }} - vaultCertRole: {{ .Values.vault.vaultCertRole }} +{{ tpl $configMap . | indent 4 }} diff --git a/incubator/kubernetes-vault/templates/deployment.yaml b/incubator/kubernetes-vault/templates/deployment.yaml index ec43269fe5..1480de5bb0 100644 --- a/incubator/kubernetes-vault/templates/deployment.yaml +++ b/incubator/kubernetes-vault/templates/deployment.yaml @@ -1,4 +1,4 @@ -apiVersion: extensions/v1beta1 +apiVersion: apps/v1beta2 kind: Deployment metadata: name: {{ template "fullname" . }} @@ -15,6 +15,7 @@ spec: app: {{ template "name" . }} release: {{ .Release.Name }} spec: + serviceAccountName: {{ template "serviceAccountName" . }} volumes: - name: config-volume configMap: diff --git a/incubator/kubernetes-vault/templates/rbac.yaml b/incubator/kubernetes-vault/templates/rbac.yaml new file mode 100644 index 0000000000..eb027aa5d0 --- /dev/null +++ b/incubator/kubernetes-vault/templates/rbac.yaml @@ -0,0 +1,40 @@ +{{- if .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +subjects: +- kind: ServiceAccount + name: {{ template "serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ template "fullname" . }} + apiGroup: rbac.authorization.k8s.io + +--- + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +- apiGroups: [""] + resources: + - pods + verbs: ["list", "watch"] +- apiGroups: [""] + resources: + - endpoints + verbs: ["get"] +{{- end }} diff --git a/incubator/kubernetes-vault/templates/service-account.yaml b/incubator/kubernetes-vault/templates/service-account.yaml new file mode 100644 index 0000000000..2c23bf0e11 --- /dev/null +++ b/incubator/kubernetes-vault/templates/service-account.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +{{- end }} diff --git a/incubator/kubernetes-vault/values.yaml b/incubator/kubernetes-vault/values.yaml index 924cf653a1..ba0ed2b237 100644 --- a/incubator/kubernetes-vault/values.yaml +++ b/incubator/kubernetes-vault/values.yaml @@ -5,16 +5,29 @@ replicaCount: 3 image: repository: boostport/kubernetes-vault - tag: v0.4.8 + tag: v0.5.2 pullPolicy: Always app: kubernetes-vault service: dummyPort: 80 -vault: - address: http://vault:8200 - token: change-this-value - vaultCertBackend: intermediate-ca - vaultCertRole: kubernetes-vault + +# Maps directly to https://github.com/Boostport/kubernetes-vault#configuration +configMap: + vault: + addr: http://vault:8200 + token: change-this-value + kubernetes: + service: "{{ template \"fullname\" . }}" + watchNamespace: ${KUBERNETES_NAMESPACE} + serviceNamespace: ${KUBERNETES_NAMESPACE} + +rbac: + create: true + +serviceAccount: + create: true + name: "" + resources: limits: cpu: 100m @@ -22,4 +35,3 @@ resources: requests: cpu: 100m memory: 128Mi -