Spinnaker inline script in values (#8234)

* Added option for hal config to be created by the values.yaml file

Signed-off-by: Oliver Isaac <oisaac@gmail.com>

* Added support for creating scripts, config maps, and secrets from the values.yaml file. Included an example in values_saml.yaml on how to use this functinality to implement saml authentication.

Signed-off-by: Oliver Isaac <oisaac@gmail.com>

* Version bump

Signed-off-by: Oliver Isaac <oisaac@gmail.com>

stable/spinnaker/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.1.3
+version: 1.1.4
 appVersion: 1.9.1
 home: http://spinnaker.io/
 sources:

stable/spinnaker/README.md

@@ -109,10 +109,31 @@ spinnaker@cd-spinnaker-halyard-0:/workdir$ hal version list
 ### Automated
 If you have known set of commands that you'd like to run after the base config steps or if
 you'd like to override some settings before the Spinnaker deployment is applied, you can enable
-the `halyard.additionalConfig.enabled` flag. You will need to create a config map that contains a key
-containing the `hal` commands you'd like to run. You can set the key via the config map name via `halyard.additionalConfig.configMapName` and the key via `halyard.additionalConfig.configMapKey`. The `DAEMON_ENDPOINT` environment variable can be used in your custom commands to
-get a prepopulated URL that points to your Halyard daemon within the cluster. For example:
+the `halyard.additionalScripts.enabled` flag. You will need to create a config map that contains a key
+containing the `hal` commands you'd like to run. You can set the key via the config map name via `halyard.additionalScripts.configMapName` and the key via `halyard.additionalScripts.configMapKey`. The `DAEMON_ENDPOINT` environment variable can be used in your custom commands to
+get a prepopulated URL that points to your Halyard daemon within the cluster. The `HAL_COMMAND` environment variable does this for you. For example:
 
 ```shell
 hal --daemon-endpoint $DAEMON_ENDPOINT config security authn oauth2 enable
+$HAL_COMMAND config security authn oauth2 enable
+```
+
+If you would rather the chart make the config file for you, you can set `halyard.additionalScripts.create` to `true` and then populate `halyard.additionalScripts.data.SCRIPT_NAME.sh` with the bash script you'd like to run. If you need associated configmaps or secrets you can configure those to be created as well:
+
+```yaml
+halyard:
+  additionalScripts:
+    create: true
+    data: 
+      enable_oauth.sh: |-
+        echo "Setting oauth2 security"
+        $HAL_COMMAND config security authn oauth2 enable
+  additionalSecrets:
+    create: true
+    data:
+      password.txt: aHVudGVyMgo=    
+  additionalConfigMaps:
+    create: true
+    data:
+      metadata.xml: <xml><username>admin</username></xml>
 ```

stable/spinnaker/templates/configmap/additional-configmaps.yaml

@@ -0,0 +1,15 @@
+{{ if  .Values.halyard.additionalConfigMaps.create -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "spinnaker.fullname" . }}-additional-config-maps
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+data:
+{{- if  and .Values.halyard.additionalConfigMaps.create .Values.halyard.additionalConfigMaps.data }}
+{{- range $index, $content := .Values.halyard.additionalConfigMaps.data }}
+  {{ $index }}: |-
+{{ $content | indent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}

stable/spinnaker/templates/configmap/additional-scripts.yaml

@@ -0,0 +1,15 @@
+{{ if .Values.halyard.additionalScripts.create -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "spinnaker.fullname" . }}-additional-scripts
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+data:
+{{- if  and .Values.halyard.additionalScripts.create .Values.halyard.additionalScripts.data }}
+{{- range $index, $content := .Values.halyard.additionalScripts.data }}
+  {{ $index }}: |-
+{{ $content | indent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}

stable/spinnaker/templates/configmap/halyard-config.yaml

@@ -15,9 +15,15 @@ data:
 
     bash -xe /opt/halyard/scripts/config.sh
 
-    {{ if .Values.halyard.additionalConfig.enabled }}
-    bash /opt/halyard/additional/{{ .Values.halyard.additionalConfig.configMapKey }}
-    {{ end }}
+    {{- if .Values.halyard.additionalScripts.enabled }}
+    bash /opt/halyard/additional/{{ .Values.halyard.additionalScripts.configMapKey }}
+    {{- end }}
+
+    {{- if  and .Values.halyard.additionalScripts.create .Values.halyard.additionalScripts.data }}
+    {{- range $index, $script := .Values.halyard.additionalScripts.data }}
+    bash -xe /opt/halyard/additionalScripts/{{ $index }}
+    {{- end }}
+    {{- end }}
 
     $HAL_COMMAND deploy apply
   clean.sh: |

stable/spinnaker/templates/hooks/install-using-hal.yaml

@@ -30,10 +30,25 @@ spec:
       - name: halyard-config
         configMap:
           name: {{ template "spinnaker.fullname" . }}-halyard-config
-      {{- if .Values.halyard.additionalConfig.enabled }}
+      {{- if .Values.halyard.additionalScripts.enabled }}
       - name: additional-config
         configMap:
-          name: {{ .Values.halyard.additionalConfig.configMapName }}
+          name: {{ .Values.halyard.additionalScripts.configMapName }}
+      {{- end }}
+      {{- if .Values.halyard.additionalSecrets.create }}
+      - name: additional-secrets
+        secret:
+          secretName: {{ template "spinnaker.fullname" . }}-additional-secrets
+      {{- end }}
+      {{- if .Values.halyard.additionalConfigMaps.create }}
+      - name: additional-config-maps
+        configMap:
+          name: {{ template "spinnaker.fullname" . }}-additional-config-maps
+      {{- end }}
+      {{- if .Values.halyard.additionalScripts.create }}
+      - name: additional-scripts
+        configMap:
+          name: {{ template "spinnaker.fullname" . }}-additional-scripts
       {{- end }}
       {{- if .Values.gcs.enabled }}
       - name: gcs-key
@@ -51,10 +66,22 @@ spec:
         volumeMounts:
         - name: halyard-config
           mountPath: /opt/halyard/scripts
-        {{- if .Values.halyard.additionalConfig.enabled }}
+        {{- if .Values.halyard.additionalScripts.enabled }}
         - name: additional-config
           mountPath: /opt/halyard/additional
         {{- end }}
+        {{- if .Values.halyard.additionalSecrets.create }}
+        - name: additional-secrets
+          mountPath: /opt/halyard/additionalSecrets
+        {{- end }}
+        {{- if .Values.halyard.additionalConfigMaps.create }}
+        - name: additional-config-maps
+          mountPath: /opt/halyard/additionalConfigMaps
+        {{- end }}
+        {{- if .Values.halyard.additionalScripts.create }}
+        - name: additional-scripts
+          mountPath: /opt/halyard/additionalScripts
+        {{- end }}
         {{- if .Values.gcs.enabled }}
         - name: gcs-key
           mountPath: /opt/gcs

stable/spinnaker/templates/ingress/deck.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
 {{ toYaml .Values.ingress.annotations | indent 4 }}
 {{- end }}
-  name: {{ template "spinnaker.fullname" . }}
+  name: {{ template "spinnaker.fullname" . }}-deck
   labels:
 {{ include "spinnaker.standard-labels" . | indent 4 }}
 spec:

stable/spinnaker/templates/ingress/gate.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.ingressGate.enabled }}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+{{- if .Values.ingressGate.annotations }}
+  annotations:
+{{ toYaml .Values.ingressGate.annotations | indent 4 }}
+{{- end }}
+  name: {{ template "spinnaker.fullname" . }}-gate
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+spec:
+  rules:
+  - host: {{ .Values.ingressGate.host | quote }}
+    http:
+      paths:
+      - path: /
+        backend:
+          serviceName: spin-gate
+          servicePort: 8084
+{{- if .Values.ingressGate.tls }}
+  tls:
+{{ toYaml .Values.ingressGate.tls | indent 4 }}
+{{- end }}
+{{- end }}

stable/spinnaker/templates/secrets/additional-secrets.yaml

@@ -0,0 +1,15 @@
+{{ if .Values.halyard.additionalSecrets.create -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "spinnaker.fullname" . }}-additional-secrets
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+data:
+{{- if  and .Values.halyard.additionalSecrets.create .Values.halyard.additionalSecrets.data }}
+{{- range $index, $content := .Values.halyard.additionalSecrets.data }}
+  {{ $index }}: |-
+{{ $content | indent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}

stable/spinnaker/templates/statefulsets/halyard.yaml

@@ -68,6 +68,16 @@ spec:
         secret:
           secretName: {{ template "spinnaker.fullname" . }}-s3
       {{- end }}
+      {{- if .Values.halyard.additionalSecrets.create }}
+      - name: additional-secrets
+        secret:
+          secretName: {{ template "spinnaker.fullname" . }}-additional-secrets
+      {{- end }}
+      {{- if .Values.halyard.additionalConfigMaps.create }}
+      - name: additional-config-maps
+        configMap:
+          name: {{ template "spinnaker.fullname" . }}-additional-config-maps
+      {{- end }}
       - name: halyard-config
         emptyDir: {}
       containers:
@@ -89,6 +99,14 @@ spec:
         - name: kube-config
           mountPath: /opt/kube
         {{- end }}
+        {{- if .Values.halyard.additionalSecrets.create }}
+        - name: additional-secrets
+          mountPath: /opt/halyard/additionalSecrets
+        {{- end }}
+        {{- if .Values.halyard.additionalConfigMaps.create }}
+        - name: additional-config-maps
+          mountPath: /opt/halyard/additionalConfigMaps
+        {{- end }}
         - name: halyard-home
           mountPath: /home/spinnaker
         - name: halyard-config

stable/spinnaker/values.yaml

@@ -5,10 +5,19 @@ halyard:
     tag: 1.9.1
   # Provide a config map with Hal commands that will be run the core config (storage)
   # The config map should contain a script in the config.sh key
-  additionalConfig:
+  additionalScripts:
     enabled: false
     configMapName: my-halyard-config
     configMapKey: config.sh
+    # If you'd rather do an inline script, set create to true and put the content in the data dict like you would a configmap
+    create: false
+    data: {}
+  additionalSecrets:
+    create: false
+    data: {}
+  additionalConfigMaps:
+    create: false
+    data: {}
 
 # Define which registries and repositories you want available in your
 # Spinnaker pipeline definitions
@@ -62,6 +71,18 @@ ingress:
   #    hosts:
   #      - domain.com
 
+ingressGate:
+  enabled: false
+  # host: gate.spinnaker.example.org
+  # annotations:
+    # ingress.kubernetes.io/ssl-redirect: 'true'
+    # kubernetes.io/ingress.class: nginx
+    # kubernetes.io/tls-acme: "true"
+  # tls:
+  #  - secretName: -tls
+  #    hosts:
+  #      - domain.com
+
 # spinnakerFeatureFlags is a list of Spinnaker feature flags to enable
 # Ref: https://www.spinnaker.io/reference/halyard/commands/#hal-config-features-edit
 # spinnakerFeatureFlags:

stable/spinnaker/values_saml.yaml

@@ -0,0 +1,72 @@
+# Configure ingress to allow access to both gate and deck from your machine:
+ingress:
+  enabled: true
+  host: spinnaker.example.com
+  annotations:
+    ingress.kubernetes.io/ssl-redirect: 'true'
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+  tls:
+  - secretName: deck-tls
+    hosts:
+    - spinnaker.example.com
+
+ingressGate:
+  enabled: true
+  host: gate.spinnaker.example.com
+  annotations:
+    ingress.kubernetes.io/ssl-redirect: 'true'
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    certmanager.k8s.io/cluster-issuer: letsencrypt-prod
+  tls:
+  - secretName: gate-tls
+    hosts:
+    - gate.spinnaker.example.com
+
+# Configure halyard to support saml
+halyard:
+  # Provide a config map with Hal commands that will be run the core config (storage)
+  # The config map should contain a script in the config.sh key
+  additionalSecrets:
+    create: true
+    data:
+      keystore.p12: aW4tc2VjcmV0cwo= # base64 encoded keystore in pkcs12 format
+      password.txt: aW4tc2VjcmV0cwo= # base64 encoded password for the keystore
+      metadata.xml: aW4tc2VjcmV0cwo= # base64 encoded metadata.xml file from your SAML authenticator
+  additionalConfigMaps:
+    create: true
+    data:
+      config.src: |-
+        KEYSTORE_ALIAS=saml # Alias in the keystore for the cert
+        GATE_URL="https://gate.spinnaker.example.com" # URL to access your gate
+        DECK_URL="https://spinnaker.example.com" # Url to access your deck
+
+        # Put the keystore, metadata, and keystore password in these files under additioanlSecrets
+        KEYSTORE_FILE=/opt/halyard/additionalSecrets/keystore.p12
+        PASSWORD_FILE=/opt/halyard/additionalSecrets/password.txt
+        METADATA_FILE=/opt/halyard/additionalSecrets/metadata.xml
+  additionalScripts:
+    create: true
+    data:
+      configure_saml.sh: |
+        # This source file contains these variables:
+        # -> GATE_URL DECK_URL KEYSTORE_FILE PASSWORD_FILE METADATA_FILE KEYSTORE_ALIAS
+        # I put config.src in additionalConfigMaps so you can break it out into a separate values.yaml file
+        # You should create both halyard.additionalConfigMaps.data.config.src AND halyard.additionalConfigMaps.create = true 
+        source /opt/halyard/additionalConfigMaps/config.src
+
+        KEYSTORE_PASSWORD="$( cat "$PASSWORD_FILE" )"
+
+        $HAL_COMMAND config security ui edit --override-base-url "$DECK_URL"
+        $HAL_COMMAND config security api edit --override-base-url "$GATE_URL"
+        $HAL_COMMAND config security authn saml edit \
+          --keystore "$KEYSTORE_FILE" \
+          --keystore-alias "$KEYSTORE_ALIAS" \
+          --keystore-password "$KEYSTORE_PASSWORD" \
+          --metadata "$METADATA_FILE" \
+          --issuer-id "$GATE_URL" \
+          --no-validate \
+          --service-address-url "$GATE_URL"
+        $HAL_COMMAND config security authn saml enable