From cfbfbbcdc7e9e051d0ff3aeb100265ed3d11d24b Mon Sep 17 00:00:00 2001 From: Corey O'Brien Date: Thu, 19 Apr 2018 15:40:00 -0400 Subject: [PATCH] [incubator/vault] Add HA configuration (#4709) * [incubator/vault] Vault enhancements (customization, HA). * Add support for service customization (ports, annotations) * Add support for pod annotations * Add readinessProbe to Vault service (for use in HA) * Add support for Vault in HA mode (detect pod IP) * Update how POD_IP is propagated into VAULT_CLUSTER_ADDR. * [incubator/vault] Improved HA * Use RollingUpdate with maxUnavailable * Add PDB with maxUnavailable * Make readiness default to exclude sealed vaults but configurable * Remove `.Release.Revision` so `helm upgrade` doesn't require unsealing --- incubator/vault/Chart.yaml | 2 +- incubator/vault/templates/configmap.yaml | 2 +- incubator/vault/templates/deployment.yaml | 30 +++++++++++++++++++++-- incubator/vault/templates/pdb.yaml | 10 ++++++++ incubator/vault/templates/service.yaml | 15 +++++++----- incubator/vault/values.yaml | 11 +++++++-- 6 files changed, 58 insertions(+), 12 deletions(-) create mode 100644 incubator/vault/templates/pdb.yaml diff --git a/incubator/vault/Chart.yaml b/incubator/vault/Chart.yaml index 8230db0f86..a35003eaf0 100644 --- a/incubator/vault/Chart.yaml +++ b/incubator/vault/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 description: A Helm chart for Vault, a tool for managing secrets name: vault -version: 0.4.3 +version: 0.5.0 appVersion: 0.9.0 home: https://www.vaultproject.io/ icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg diff --git a/incubator/vault/templates/configmap.yaml b/incubator/vault/templates/configmap.yaml index faa326adfe..8d4072ae37 100644 --- a/incubator/vault/templates/configmap.yaml +++ b/incubator/vault/templates/configmap.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}" + name: "{{ template "vault.fullname" . }}-config" labels: app: "{{ template "vault.name" . }}" release: {{ .Release.Name | quote }} diff --git a/incubator/vault/templates/deployment.yaml b/incubator/vault/templates/deployment.yaml index f29dd61470..68552f1b8e 100644 --- a/incubator/vault/templates/deployment.yaml +++ b/incubator/vault/templates/deployment.yaml @@ -9,11 +9,21 @@ metadata: heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} + strategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 1 template: metadata: labels: app: {{ template "vault.name" . }} release: {{ .Release.Name }} +{{- if .Values.podAnnotations }} + annotations: + {{- range $key, $value := .Values.podAnnotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} spec: containers: - name: {{ .Chart.Name }} @@ -26,18 +36,34 @@ spec: {{- end }} ports: - containerPort: {{ .Values.service.port }} + name: api + - containerPort: 8201 + name: cluster-address livenessProbe: + # Alive if it is listening for clustering traffic tcpSocket: port: {{ .Values.service.port }} readinessProbe: + # Ready depends on preference httpGet: - path: /v1/sys/health + path: /v1/sys/health? + {{- if .Values.vault.readiness.readyIfSealed -}}sealedcode=204&{{- end }} + {{- if .Values.vault.readiness.readyIfStandby -}}standbycode=204&{{- end }} + {{- if .Values.vault.readiness.readyIfUninitialized -}}uninitcode=204&{{- end }} port: {{ .Values.service.port }} + scheme: {{ if .Values.vault.config.listener.tcp.tls_disable -}}HTTP{{- else -}}HTTPS{{- end }} securityContext: readOnlyRootFilesystem: true capabilities: add: - IPC_LOCK + env: + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: VAULT_CLUSTER_ADDR + value: "https://$(POD_IP):8201" volumeMounts: - name: vault-config mountPath: /vault/config/ @@ -56,7 +82,7 @@ spec: volumes: - name: vault-config configMap: - name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}" + name: "{{ template "vault.fullname" . }}-config" - name: vault-root emptyDir: {} {{- range .Values.vault.customSecrets }} diff --git a/incubator/vault/templates/pdb.yaml b/incubator/vault/templates/pdb.yaml new file mode 100644 index 0000000000..c41b25ab40 --- /dev/null +++ b/incubator/vault/templates/pdb.yaml @@ -0,0 +1,10 @@ +apiVersion: policy/v1beta1 +kind: PodDisruptionBudget +metadata: + name: {{ template "vault.fullname" . }} +spec: + maxUnavailable: 1 + selector: + matchLabels: + app: {{ template "vault.name" . }} + release: {{ .Release.Name }} diff --git a/incubator/vault/templates/service.yaml b/incubator/vault/templates/service.yaml index 59c7bae80f..89baa0cba0 100644 --- a/incubator/vault/templates/service.yaml +++ b/incubator/vault/templates/service.yaml @@ -7,19 +7,22 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} +{{- if .Values.service.annotations }} annotations: - {{- range $key, $value := .Values.service.annotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} + {{- range $key, $value := .Values.service.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} spec: type: {{ .Values.service.type }} {{- if .Values.service.clusterIP }} - clusterIP: {{ .Values.service.clusterIP }} + clusterIP: {{ .Values.service.clusterIP }} {{- end }} ports: - - port: {{ .Values.service.port }} + - port: {{ .Values.service.externalPort }} protocol: TCP - name: {{ .Values.service.name }} + targetPort: {{ .Values.service.port }} + name: api selector: app: {{ template "vault.name" . }} release: {{ .Release.Name }} diff --git a/incubator/vault/values.yaml b/incubator/vault/values.yaml index f1b1fc9dff..aec65cf9dd 100644 --- a/incubator/vault/values.yaml +++ b/incubator/vault/values.yaml @@ -1,7 +1,7 @@ # Default values for vault. # This is a YAML-formatted file. # Declare variables to be passed into your templates. -replicaCount: 1 +replicaCount: 3 image: repository: vault tag: 0.9.0 @@ -9,7 +9,9 @@ image: service: name: vault type: ClusterIP + externalPort: 8200 port: 8200 + annotations: {} # clusterIP: None # annotations: # cloud.google.com/load-balancer-type: "Internal" @@ -47,7 +49,7 @@ affinity: | matchLabels: app: {{ template "vault.fullname" . }} release: {{ .Release.Name }} - +podAnnotations: {} vault: # Only used to enable dev mode. When in dev mode, the rest of this config # section below is not used to configure Vault. See @@ -62,12 +64,17 @@ vault: customSecrets: [] # - secretName: vault-tls # mountPath: /vault/tls + readiness: + readyIfSealed: false + readyIfStandby: true + readyIfUninitialized: true config: # A YAML representation of a final vault config.json file. # See https://www.vaultproject.io/docs/configuration/ for more information. listener: tcp: address: '[::]:8200' + cluster_address: '[::]:8201' tls_disable: true # tls_cert_file: /vault/tls/server.crt # tls_key_file: /vault/tls/server.key