[incubator/vault] various improvements aimed at production use (#2848)

* incubator/vault: add annotations support to service

This allows various customizations of the behavior of the service,
including the use of GKE internal load balancing [1]

[1] https://cloud.google.com/kubernetes-engine/docs/internal-load-balancing

* incubator/vault: allow injection of custom secrets, facilitating tls and more

This commit allows users of the chart to inject customized secrets
that are needed to leverage various pieces of Vault functionality,
including TLS and storage backends like GCS that require a file.

* incubator/vault: upgrade to latest version 0.9.0

* incubator/vault: bump version for annotations, secrets mounting, upgraded container

* incubator/vault: Update README with new version, customSecrets capability

* incubator/vault: fix comment spacing based on lint failures

incubator/vault/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.2.0
-appVersion: 0.8.3
+version: 0.3.0
+appVersion: 0.9.0
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg
 sources:

incubator/vault/README.md

@@ -49,8 +49,9 @@ The following tables lists the configurable parameters of the vault chart and th
 |-------------------------|-------------------------------------|-----------------------------------------------------|
 | `image.pullPolicy`      | Container pull policy               | `IfNotPresent`                                      |
 | `image.repository`      | Container image to use              | `vault`                                             |
-| `image.tag`             | Container image tag to deploy       | `0.8.2`                                             |
+| `image.tag`             | Container image tag to deploy       | `0.9.0`                                             |
 | `vault.dev`             | Use Vault in dev mode               | true (set to false in production)                   |
+| `vault.customSecrets`   | Custom secrets available to Vault   | `[]`                                                |
 | `vault.config`          | Vault configuration                 | No default backend                                  |
 | `replicaCount`          | k8s replicas                        | `1`                                                 |
 | `resources.limits.cpu`  | Container requested CPU             | `nil`                                               |

incubator/vault/templates/deployment.yaml

@@ -42,6 +42,10 @@ spec:
           mountPath: /vault/config/
         - name: vault-root
           mountPath: /root/
+        {{- range .Values.vault.customSecrets }}
+        - name: {{ .secretName }}
+          mountPath: {{ .mountPath }}
+        {{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
       affinity:
@@ -60,3 +64,8 @@ spec:
             name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}"
         - name: vault-root
           emptyDir: {}
+        {{- range .Values.vault.customSecrets }}
+        - name: {{ .secretName }}
+          secret:
+            secretName: {{ .secretName }}
+        {{- end }}

incubator/vault/templates/service.yaml

@@ -7,6 +7,10 @@ metadata:
     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.service.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
   type: {{ .Values.service.type }}
   ports:

incubator/vault/values.yaml

@@ -4,62 +4,79 @@
 replicaCount: 1
 image:
   repository: vault
-  tag: 0.8.3
+  tag: 0.9.0
   pullPolicy: IfNotPresent
 service:
   name: vault
   type: ClusterIP
   port: 8200
+  # annotations:
+  #   cloud.google.com/load-balancer-type: "Internal"
 ingress:
   enabled: false
   # Used to create Ingress record (should used with service.type: ClusterIP).
-  #hosts:
+  # hosts:
   #  - chart-example.local
-  #annotations:
-    # kubernetes.io/ingress.class: nginx
-    # kubernetes.io/tls-acme: "true"
-  #tls:
-    # Secrets must be manually created in the namespace.
-    # - secretName: chart-example-tls
-    #   hosts:
-    #     - chart-example.local
+  # annotations:
+  #   kubernetes.io/ingress.class: nginx
+  #   kubernetes.io/tls-acme: "true"
+  # tls:
+  #   Secrets must be manually created in the namespace.
+  #   - secretName: chart-example-tls
+  #     hosts:
+  #       - chart-example.local
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious
   # choice for the user. This also increases chances charts run on environments with little
   # resources, such as Minikube. If you do want to specify resources, uncomment the following
   # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
   # limits:
-  #  cpu: 100m
-  #  memory: 128Mi
+  #   cpu: 100m
+  #   memory: 128Mi
   # requests:
-  #  cpu: 100m
-  #  memory: 128Mi
+  #   cpu: 100m
+  #   memory: 128Mi
 vault:
   # Only used to enable dev mode. When in dev mode, the rest of this config
   # section below is not used to configure Vault. See
   # https://www.vaultproject.io/intro/getting-started/dev-server.html for more
   # information.
   dev: true
+  # Allows the mounting of various custom secrets th enable production vault
+  # configurations. The comments show an example usage for mounting a TLS
+  # secret. The two fields required are a secretName indicating the name of
+  # the Kuberentes secret (created outside of this chart), and the mountPath
+  # at which it should be mounted in the Vault container.
+  customSecrets: []
+    # - secretName: vault-tls
+    #   mountPath: /vault/tls
   config:
     # A YAML representation of a final vault config.json file.
     # See https://www.vaultproject.io/docs/configuration/ for more information.
     listener:
       tcp:
         address: '[::]:8200'
-        tls_disable: 1
+        tls_disable: true
+        # tls_cert_file: /vault/tls/server.crt
+        # tls_key_file: /vault/tls/server.key
     # See https://www.vaultproject.io/docs/configuration/storage/ for storage backends
     storage:
-      #consul:
-      #  address: ""
-      #  path: ""
+      # consul:
+      #   address: ""
+      #   path: ""
       #
-      #etcd:
-      #  address: ""
-      #  path: "vault/"
+      # etcd:
+      #   address: ""
+      #   path: "vault/"
       #
-      #s3:
-      #  bucket: ""
-      #  region: ""
-      #  access_key: ""
-      #  secret_key: ""
-      #  endpoint: "" # When not using AWS S3
+      # s3:
+      #   bucket: ""
+      #   region: ""
+      #   access_key: ""
+      #   secret_key: ""
+      #   endpoint: "" # When not using AWS S3
+      #
+      # gcs:
+      #   bucket: ""
+      #   # Use a custom secret to mount this file.
+      #   credentials_file: ""