From bd32c5248c21891d35576106f98d7b2a98fc952f Mon Sep 17 00:00:00 2001 From: Oliver Date: Tue, 9 Oct 2018 09:47:51 -0500 Subject: [PATCH] Spinnaker inline script in values (#8234) * Added option for hal config to be created by the values.yaml file Signed-off-by: Oliver Isaac * Added support for creating scripts, config maps, and secrets from the values.yaml file. Included an example in values_saml.yaml on how to use this functinality to implement saml authentication. Signed-off-by: Oliver Isaac * Version bump Signed-off-by: Oliver Isaac --- stable/spinnaker/Chart.yaml | 2 +- stable/spinnaker/README.md | 27 ++++++- .../configmap/additional-configmaps.yaml | 15 ++++ .../configmap/additional-scripts.yaml | 15 ++++ .../templates/configmap/halyard-config.yaml | 12 +++- .../templates/hooks/install-using-hal.yaml | 33 ++++++++- stable/spinnaker/templates/ingress/deck.yaml | 2 +- stable/spinnaker/templates/ingress/gate.yaml | 25 +++++++ .../templates/secrets/additional-secrets.yaml | 15 ++++ .../templates/statefulsets/halyard.yaml | 18 +++++ stable/spinnaker/values.yaml | 23 +++++- stable/spinnaker/values_saml.yaml | 72 +++++++++++++++++++ 12 files changed, 247 insertions(+), 12 deletions(-) create mode 100644 stable/spinnaker/templates/configmap/additional-configmaps.yaml create mode 100644 stable/spinnaker/templates/configmap/additional-scripts.yaml create mode 100644 stable/spinnaker/templates/ingress/gate.yaml create mode 100644 stable/spinnaker/templates/secrets/additional-secrets.yaml create mode 100644 stable/spinnaker/values_saml.yaml diff --git a/stable/spinnaker/Chart.yaml b/stable/spinnaker/Chart.yaml index b776323a1c..9b59d1b82e 100644 --- a/stable/spinnaker/Chart.yaml +++ b/stable/spinnaker/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence. name: spinnaker -version: 1.1.3 +version: 1.1.4 appVersion: 1.9.1 home: http://spinnaker.io/ sources: diff --git a/stable/spinnaker/README.md b/stable/spinnaker/README.md index f1d5da1933..7cdefbd44b 100644 --- a/stable/spinnaker/README.md +++ b/stable/spinnaker/README.md @@ -109,10 +109,31 @@ spinnaker@cd-spinnaker-halyard-0:/workdir$ hal version list ### Automated If you have known set of commands that you'd like to run after the base config steps or if you'd like to override some settings before the Spinnaker deployment is applied, you can enable -the `halyard.additionalConfig.enabled` flag. You will need to create a config map that contains a key -containing the `hal` commands you'd like to run. You can set the key via the config map name via `halyard.additionalConfig.configMapName` and the key via `halyard.additionalConfig.configMapKey`. The `DAEMON_ENDPOINT` environment variable can be used in your custom commands to -get a prepopulated URL that points to your Halyard daemon within the cluster. For example: +the `halyard.additionalScripts.enabled` flag. You will need to create a config map that contains a key +containing the `hal` commands you'd like to run. You can set the key via the config map name via `halyard.additionalScripts.configMapName` and the key via `halyard.additionalScripts.configMapKey`. The `DAEMON_ENDPOINT` environment variable can be used in your custom commands to +get a prepopulated URL that points to your Halyard daemon within the cluster. The `HAL_COMMAND` environment variable does this for you. For example: ```shell hal --daemon-endpoint $DAEMON_ENDPOINT config security authn oauth2 enable +$HAL_COMMAND config security authn oauth2 enable +``` + +If you would rather the chart make the config file for you, you can set `halyard.additionalScripts.create` to `true` and then populate `halyard.additionalScripts.data.SCRIPT_NAME.sh` with the bash script you'd like to run. If you need associated configmaps or secrets you can configure those to be created as well: + +```yaml +halyard: + additionalScripts: + create: true + data: + enable_oauth.sh: |- + echo "Setting oauth2 security" + $HAL_COMMAND config security authn oauth2 enable + additionalSecrets: + create: true + data: + password.txt: aHVudGVyMgo= + additionalConfigMaps: + create: true + data: + metadata.xml: admin ``` diff --git a/stable/spinnaker/templates/configmap/additional-configmaps.yaml b/stable/spinnaker/templates/configmap/additional-configmaps.yaml new file mode 100644 index 0000000000..182005a7dc --- /dev/null +++ b/stable/spinnaker/templates/configmap/additional-configmaps.yaml @@ -0,0 +1,15 @@ +{{ if .Values.halyard.additionalConfigMaps.create -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "spinnaker.fullname" . }}-additional-config-maps + labels: +{{ include "spinnaker.standard-labels" . | indent 4 }} +data: +{{- if and .Values.halyard.additionalConfigMaps.create .Values.halyard.additionalConfigMaps.data }} +{{- range $index, $content := .Values.halyard.additionalConfigMaps.data }} + {{ $index }}: |- +{{ $content | indent 4 }} +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/spinnaker/templates/configmap/additional-scripts.yaml b/stable/spinnaker/templates/configmap/additional-scripts.yaml new file mode 100644 index 0000000000..5cae8cbc2f --- /dev/null +++ b/stable/spinnaker/templates/configmap/additional-scripts.yaml @@ -0,0 +1,15 @@ +{{ if .Values.halyard.additionalScripts.create -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ template "spinnaker.fullname" . }}-additional-scripts + labels: +{{ include "spinnaker.standard-labels" . | indent 4 }} +data: +{{- if and .Values.halyard.additionalScripts.create .Values.halyard.additionalScripts.data }} +{{- range $index, $content := .Values.halyard.additionalScripts.data }} + {{ $index }}: |- +{{ $content | indent 4 }} +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/spinnaker/templates/configmap/halyard-config.yaml b/stable/spinnaker/templates/configmap/halyard-config.yaml index 45ff0dcf1f..3e30f17f88 100644 --- a/stable/spinnaker/templates/configmap/halyard-config.yaml +++ b/stable/spinnaker/templates/configmap/halyard-config.yaml @@ -15,9 +15,15 @@ data: bash -xe /opt/halyard/scripts/config.sh - {{ if .Values.halyard.additionalConfig.enabled }} - bash /opt/halyard/additional/{{ .Values.halyard.additionalConfig.configMapKey }} - {{ end }} + {{- if .Values.halyard.additionalScripts.enabled }} + bash /opt/halyard/additional/{{ .Values.halyard.additionalScripts.configMapKey }} + {{- end }} + + {{- if and .Values.halyard.additionalScripts.create .Values.halyard.additionalScripts.data }} + {{- range $index, $script := .Values.halyard.additionalScripts.data }} + bash -xe /opt/halyard/additionalScripts/{{ $index }} + {{- end }} + {{- end }} $HAL_COMMAND deploy apply clean.sh: | diff --git a/stable/spinnaker/templates/hooks/install-using-hal.yaml b/stable/spinnaker/templates/hooks/install-using-hal.yaml index 450e5c349a..62114657b0 100644 --- a/stable/spinnaker/templates/hooks/install-using-hal.yaml +++ b/stable/spinnaker/templates/hooks/install-using-hal.yaml @@ -30,10 +30,25 @@ spec: - name: halyard-config configMap: name: {{ template "spinnaker.fullname" . }}-halyard-config - {{- if .Values.halyard.additionalConfig.enabled }} + {{- if .Values.halyard.additionalScripts.enabled }} - name: additional-config configMap: - name: {{ .Values.halyard.additionalConfig.configMapName }} + name: {{ .Values.halyard.additionalScripts.configMapName }} + {{- end }} + {{- if .Values.halyard.additionalSecrets.create }} + - name: additional-secrets + secret: + secretName: {{ template "spinnaker.fullname" . }}-additional-secrets + {{- end }} + {{- if .Values.halyard.additionalConfigMaps.create }} + - name: additional-config-maps + configMap: + name: {{ template "spinnaker.fullname" . }}-additional-config-maps + {{- end }} + {{- if .Values.halyard.additionalScripts.create }} + - name: additional-scripts + configMap: + name: {{ template "spinnaker.fullname" . }}-additional-scripts {{- end }} {{- if .Values.gcs.enabled }} - name: gcs-key @@ -51,10 +66,22 @@ spec: volumeMounts: - name: halyard-config mountPath: /opt/halyard/scripts - {{- if .Values.halyard.additionalConfig.enabled }} + {{- if .Values.halyard.additionalScripts.enabled }} - name: additional-config mountPath: /opt/halyard/additional {{- end }} + {{- if .Values.halyard.additionalSecrets.create }} + - name: additional-secrets + mountPath: /opt/halyard/additionalSecrets + {{- end }} + {{- if .Values.halyard.additionalConfigMaps.create }} + - name: additional-config-maps + mountPath: /opt/halyard/additionalConfigMaps + {{- end }} + {{- if .Values.halyard.additionalScripts.create }} + - name: additional-scripts + mountPath: /opt/halyard/additionalScripts + {{- end }} {{- if .Values.gcs.enabled }} - name: gcs-key mountPath: /opt/gcs diff --git a/stable/spinnaker/templates/ingress/deck.yaml b/stable/spinnaker/templates/ingress/deck.yaml index f46ff35bc8..1f87a22fa2 100644 --- a/stable/spinnaker/templates/ingress/deck.yaml +++ b/stable/spinnaker/templates/ingress/deck.yaml @@ -6,7 +6,7 @@ metadata: annotations: {{ toYaml .Values.ingress.annotations | indent 4 }} {{- end }} - name: {{ template "spinnaker.fullname" . }} + name: {{ template "spinnaker.fullname" . }}-deck labels: {{ include "spinnaker.standard-labels" . | indent 4 }} spec: diff --git a/stable/spinnaker/templates/ingress/gate.yaml b/stable/spinnaker/templates/ingress/gate.yaml new file mode 100644 index 0000000000..6423e498dc --- /dev/null +++ b/stable/spinnaker/templates/ingress/gate.yaml @@ -0,0 +1,25 @@ +{{- if .Values.ingressGate.enabled }} +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: +{{- if .Values.ingressGate.annotations }} + annotations: +{{ toYaml .Values.ingressGate.annotations | indent 4 }} +{{- end }} + name: {{ template "spinnaker.fullname" . }}-gate + labels: +{{ include "spinnaker.standard-labels" . | indent 4 }} +spec: + rules: + - host: {{ .Values.ingressGate.host | quote }} + http: + paths: + - path: / + backend: + serviceName: spin-gate + servicePort: 8084 +{{- if .Values.ingressGate.tls }} + tls: +{{ toYaml .Values.ingressGate.tls | indent 4 }} +{{- end }} +{{- end }} diff --git a/stable/spinnaker/templates/secrets/additional-secrets.yaml b/stable/spinnaker/templates/secrets/additional-secrets.yaml new file mode 100644 index 0000000000..b71ce21793 --- /dev/null +++ b/stable/spinnaker/templates/secrets/additional-secrets.yaml @@ -0,0 +1,15 @@ +{{ if .Values.halyard.additionalSecrets.create -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ template "spinnaker.fullname" . }}-additional-secrets + labels: +{{ include "spinnaker.standard-labels" . | indent 4 }} +data: +{{- if and .Values.halyard.additionalSecrets.create .Values.halyard.additionalSecrets.data }} +{{- range $index, $content := .Values.halyard.additionalSecrets.data }} + {{ $index }}: |- +{{ $content | indent 4 }} +{{- end }} +{{- end }} +{{- end }} diff --git a/stable/spinnaker/templates/statefulsets/halyard.yaml b/stable/spinnaker/templates/statefulsets/halyard.yaml index 207921e0b9..9e5549d459 100644 --- a/stable/spinnaker/templates/statefulsets/halyard.yaml +++ b/stable/spinnaker/templates/statefulsets/halyard.yaml @@ -68,6 +68,16 @@ spec: secret: secretName: {{ template "spinnaker.fullname" . }}-s3 {{- end }} + {{- if .Values.halyard.additionalSecrets.create }} + - name: additional-secrets + secret: + secretName: {{ template "spinnaker.fullname" . }}-additional-secrets + {{- end }} + {{- if .Values.halyard.additionalConfigMaps.create }} + - name: additional-config-maps + configMap: + name: {{ template "spinnaker.fullname" . }}-additional-config-maps + {{- end }} - name: halyard-config emptyDir: {} containers: @@ -89,6 +99,14 @@ spec: - name: kube-config mountPath: /opt/kube {{- end }} + {{- if .Values.halyard.additionalSecrets.create }} + - name: additional-secrets + mountPath: /opt/halyard/additionalSecrets + {{- end }} + {{- if .Values.halyard.additionalConfigMaps.create }} + - name: additional-config-maps + mountPath: /opt/halyard/additionalConfigMaps + {{- end }} - name: halyard-home mountPath: /home/spinnaker - name: halyard-config diff --git a/stable/spinnaker/values.yaml b/stable/spinnaker/values.yaml index 7c909393fb..e439c8ae0b 100644 --- a/stable/spinnaker/values.yaml +++ b/stable/spinnaker/values.yaml @@ -5,10 +5,19 @@ halyard: tag: 1.9.1 # Provide a config map with Hal commands that will be run the core config (storage) # The config map should contain a script in the config.sh key - additionalConfig: + additionalScripts: enabled: false configMapName: my-halyard-config configMapKey: config.sh + # If you'd rather do an inline script, set create to true and put the content in the data dict like you would a configmap + create: false + data: {} + additionalSecrets: + create: false + data: {} + additionalConfigMaps: + create: false + data: {} # Define which registries and repositories you want available in your # Spinnaker pipeline definitions @@ -62,6 +71,18 @@ ingress: # hosts: # - domain.com +ingressGate: + enabled: false + # host: gate.spinnaker.example.org + # annotations: + # ingress.kubernetes.io/ssl-redirect: 'true' + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # tls: + # - secretName: -tls + # hosts: + # - domain.com + # spinnakerFeatureFlags is a list of Spinnaker feature flags to enable # Ref: https://www.spinnaker.io/reference/halyard/commands/#hal-config-features-edit # spinnakerFeatureFlags: diff --git a/stable/spinnaker/values_saml.yaml b/stable/spinnaker/values_saml.yaml new file mode 100644 index 0000000000..603ed00300 --- /dev/null +++ b/stable/spinnaker/values_saml.yaml @@ -0,0 +1,72 @@ +# Configure ingress to allow access to both gate and deck from your machine: +ingress: + enabled: true + host: spinnaker.example.com + annotations: + ingress.kubernetes.io/ssl-redirect: 'true' + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" + certmanager.k8s.io/cluster-issuer: letsencrypt-prod + tls: + - secretName: deck-tls + hosts: + - spinnaker.example.com + +ingressGate: + enabled: true + host: gate.spinnaker.example.com + annotations: + ingress.kubernetes.io/ssl-redirect: 'true' + kubernetes.io/ingress.class: nginx + kubernetes.io/tls-acme: "true" + certmanager.k8s.io/cluster-issuer: letsencrypt-prod + tls: + - secretName: gate-tls + hosts: + - gate.spinnaker.example.com + +# Configure halyard to support saml +halyard: + # Provide a config map with Hal commands that will be run the core config (storage) + # The config map should contain a script in the config.sh key + additionalSecrets: + create: true + data: + keystore.p12: aW4tc2VjcmV0cwo= # base64 encoded keystore in pkcs12 format + password.txt: aW4tc2VjcmV0cwo= # base64 encoded password for the keystore + metadata.xml: aW4tc2VjcmV0cwo= # base64 encoded metadata.xml file from your SAML authenticator + additionalConfigMaps: + create: true + data: + config.src: |- + KEYSTORE_ALIAS=saml # Alias in the keystore for the cert + GATE_URL="https://gate.spinnaker.example.com" # URL to access your gate + DECK_URL="https://spinnaker.example.com" # Url to access your deck + + # Put the keystore, metadata, and keystore password in these files under additioanlSecrets + KEYSTORE_FILE=/opt/halyard/additionalSecrets/keystore.p12 + PASSWORD_FILE=/opt/halyard/additionalSecrets/password.txt + METADATA_FILE=/opt/halyard/additionalSecrets/metadata.xml + additionalScripts: + create: true + data: + configure_saml.sh: | + # This source file contains these variables: + # -> GATE_URL DECK_URL KEYSTORE_FILE PASSWORD_FILE METADATA_FILE KEYSTORE_ALIAS + # I put config.src in additionalConfigMaps so you can break it out into a separate values.yaml file + # You should create both halyard.additionalConfigMaps.data.config.src AND halyard.additionalConfigMaps.create = true + source /opt/halyard/additionalConfigMaps/config.src + + KEYSTORE_PASSWORD="$( cat "$PASSWORD_FILE" )" + + $HAL_COMMAND config security ui edit --override-base-url "$DECK_URL" + $HAL_COMMAND config security api edit --override-base-url "$GATE_URL" + $HAL_COMMAND config security authn saml edit \ + --keystore "$KEYSTORE_FILE" \ + --keystore-alias "$KEYSTORE_ALIAS" \ + --keystore-password "$KEYSTORE_PASSWORD" \ + --metadata "$METADATA_FILE" \ + --issuer-id "$GATE_URL" \ + --no-validate \ + --service-address-url "$GATE_URL" + $HAL_COMMAND config security authn saml enable