From d48a7c0ae22343c2a81182e2e64a4c56eefead08 Mon Sep 17 00:00:00 2001 From: Ash Caire Date: Tue, 16 Apr 2019 09:55:05 +0800 Subject: [PATCH] [stable/magic-namespace] Allow secret storage (#13004) Signed-off-by: Ash Caire --- stable/magic-namespace/Chart.yaml | 2 +- stable/magic-namespace/README.md | 1 + stable/magic-namespace/templates/tiller-deployment.yaml | 6 +++++- stable/magic-namespace/values.yaml | 3 +++ 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/stable/magic-namespace/Chart.yaml b/stable/magic-namespace/Chart.yaml index 45def282d8..6bcda7cb8d 100644 --- a/stable/magic-namespace/Chart.yaml +++ b/stable/magic-namespace/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: magic-namespace -version: 0.4.1 +version: 0.5.0 appVersion: 2.8.1 home: https://github.com/kubernetes/charts/tree/master/stable/magic-namespace description: Elegantly enables a Tiller per namespace in RBAC-enabled clusters diff --git a/stable/magic-namespace/README.md b/stable/magic-namespace/README.md index ba9badd4af..e3c10b92fa 100644 --- a/stable/magic-namespace/README.md +++ b/stable/magic-namespace/README.md @@ -140,6 +140,7 @@ reference the default `values.yaml` to understand further options. | `tiller.role.type` | Identify the name of the `Role` or `ClusterRole` that will be referenced in the role binding for Tiller's service account. There is seldom any reason to override this. | `admin` | | `tiller.includeService` | This deploys a service resource for Tiller. This is not generally needed. Please understand the security implications of this before overriding the default. | `false` | | `tiller.onlyListenOnLocalhost` | This prevents Tiller from binding to `0.0.0.0`. This is generally advisable to close known Tiller-based attack vectors. Please understand the security implications of this before overriding the default. | `true` | +| `tiller.storage` | The storage driver for Tiller to use. One of `configmap`, `memory`, or `secret` | `configmap` | | `tiller.tls.enabled` | Whether to enable TLS encryption between Helm and Tiller. Specify either `tiller.tls.secretName` to mount an existing secret, or `tiller.tls.ca`, `tiller.tls.cert` and `tiller.tls.key` to create a secret from Base64 provided values | `false` | | `tiller.tls.verify` | Whether to verify a remote Tiller certificate. | `true` | | `tiller.tls.secretName` | Mount an existing TLS secret into the Tiller container. The secret must include data keys: `ca.crt`, `tls.crt` and `tls.key` | `nil` | diff --git a/stable/magic-namespace/templates/tiller-deployment.yaml b/stable/magic-namespace/templates/tiller-deployment.yaml index 6a4a2088e4..a4eb6a9144 100644 --- a/stable/magic-namespace/templates/tiller-deployment.yaml +++ b/stable/magic-namespace/templates/tiller-deployment.yaml @@ -53,7 +53,11 @@ spec: value: /etc/certs {{- end }} {{- if .Values.tiller.onlyListenOnLocalhost }} - command: ["/tiller"] + command: + - "/tiller" + {{- if .Values.tiller.storage }} + - --storage={{ .Values.tiller.storage | quote }} + {{- end }} args: ["--listen=127.0.0.1:44134"] {{- else }} ports: diff --git a/stable/magic-namespace/values.yaml b/stable/magic-namespace/values.yaml index 83105233b6..04690aee9e 100644 --- a/stable/magic-namespace/values.yaml +++ b/stable/magic-namespace/values.yaml @@ -23,6 +23,9 @@ tiller: maxHistory: 0 + ## Storage driver to use. One of 'configmap', 'memory', or 'secret' + storage: configmap + tls: ## Enable TLS encryption between Helm and Tiller enabled: false