From d7aa80ce4fb09e76828de444a5a614b75bf70fb2 Mon Sep 17 00:00:00 2001 From: Aaron Taylor Date: Sat, 9 Dec 2017 15:21:13 -0500 Subject: [PATCH] [incubator/vault] various improvements aimed at production use (#2848) * incubator/vault: add annotations support to service This allows various customizations of the behavior of the service, including the use of GKE internal load balancing [1] [1] https://cloud.google.com/kubernetes-engine/docs/internal-load-balancing * incubator/vault: allow injection of custom secrets, facilitating tls and more This commit allows users of the chart to inject customized secrets that are needed to leverage various pieces of Vault functionality, including TLS and storage backends like GCS that require a file. * incubator/vault: upgrade to latest version 0.9.0 * incubator/vault: bump version for annotations, secrets mounting, upgraded container * incubator/vault: Update README with new version, customSecrets capability * incubator/vault: fix comment spacing based on lint failures --- incubator/vault/Chart.yaml | 4 +- incubator/vault/README.md | 3 +- incubator/vault/templates/deployment.yaml | 9 +++ incubator/vault/templates/service.yaml | 4 ++ incubator/vault/values.yaml | 71 ++++++++++++++--------- 5 files changed, 61 insertions(+), 30 deletions(-) diff --git a/incubator/vault/Chart.yaml b/incubator/vault/Chart.yaml index 2964ba3452..d9ecc5f13d 100644 --- a/incubator/vault/Chart.yaml +++ b/incubator/vault/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v1 description: A Helm chart for Vault, a tool for managing secrets name: vault -version: 0.2.0 -appVersion: 0.8.3 +version: 0.3.0 +appVersion: 0.9.0 home: https://www.vaultproject.io/ icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg sources: diff --git a/incubator/vault/README.md b/incubator/vault/README.md index fc4642f61d..9bbb3431ee 100644 --- a/incubator/vault/README.md +++ b/incubator/vault/README.md @@ -49,8 +49,9 @@ The following tables lists the configurable parameters of the vault chart and th |-------------------------|-------------------------------------|-----------------------------------------------------| | `image.pullPolicy` | Container pull policy | `IfNotPresent` | | `image.repository` | Container image to use | `vault` | -| `image.tag` | Container image tag to deploy | `0.8.2` | +| `image.tag` | Container image tag to deploy | `0.9.0` | | `vault.dev` | Use Vault in dev mode | true (set to false in production) | +| `vault.customSecrets` | Custom secrets available to Vault | `[]` | | `vault.config` | Vault configuration | No default backend | | `replicaCount` | k8s replicas | `1` | | `resources.limits.cpu` | Container requested CPU | `nil` | diff --git a/incubator/vault/templates/deployment.yaml b/incubator/vault/templates/deployment.yaml index 63066b83cb..a8512c52c0 100644 --- a/incubator/vault/templates/deployment.yaml +++ b/incubator/vault/templates/deployment.yaml @@ -42,6 +42,10 @@ spec: mountPath: /vault/config/ - name: vault-root mountPath: /root/ + {{- range .Values.vault.customSecrets }} + - name: {{ .secretName }} + mountPath: {{ .mountPath }} + {{- end }} resources: {{ toYaml .Values.resources | indent 10 }} affinity: @@ -60,3 +64,8 @@ spec: name: "{{ template "vault.fullname" . }}-config-{{ .Release.Revision }}" - name: vault-root emptyDir: {} + {{- range .Values.vault.customSecrets }} + - name: {{ .secretName }} + secret: + secretName: {{ .secretName }} + {{- end }} diff --git a/incubator/vault/templates/service.yaml b/incubator/vault/templates/service.yaml index 44907a9844..c717781fb4 100644 --- a/incubator/vault/templates/service.yaml +++ b/incubator/vault/templates/service.yaml @@ -7,6 +7,10 @@ metadata: chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} + annotations: + {{- range $key, $value := .Values.service.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} spec: type: {{ .Values.service.type }} ports: diff --git a/incubator/vault/values.yaml b/incubator/vault/values.yaml index a4e9918020..7460cc2be7 100644 --- a/incubator/vault/values.yaml +++ b/incubator/vault/values.yaml @@ -4,62 +4,79 @@ replicaCount: 1 image: repository: vault - tag: 0.8.3 + tag: 0.9.0 pullPolicy: IfNotPresent service: name: vault type: ClusterIP port: 8200 + # annotations: + # cloud.google.com/load-balancer-type: "Internal" ingress: enabled: false # Used to create Ingress record (should used with service.type: ClusterIP). - #hosts: + # hosts: # - chart-example.local - #annotations: - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - #tls: - # Secrets must be manually created in the namespace. - # - secretName: chart-example-tls - # hosts: - # - chart-example.local + # annotations: + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + # tls: + # Secrets must be manually created in the namespace. + # - secretName: chart-example-tls + # hosts: + # - chart-example.local resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little # resources, such as Minikube. If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi # requests: - # cpu: 100m - # memory: 128Mi + # cpu: 100m + # memory: 128Mi vault: # Only used to enable dev mode. When in dev mode, the rest of this config # section below is not used to configure Vault. See # https://www.vaultproject.io/intro/getting-started/dev-server.html for more # information. dev: true + # Allows the mounting of various custom secrets th enable production vault + # configurations. The comments show an example usage for mounting a TLS + # secret. The two fields required are a secretName indicating the name of + # the Kuberentes secret (created outside of this chart), and the mountPath + # at which it should be mounted in the Vault container. + customSecrets: [] + # - secretName: vault-tls + # mountPath: /vault/tls config: # A YAML representation of a final vault config.json file. # See https://www.vaultproject.io/docs/configuration/ for more information. listener: tcp: address: '[::]:8200' - tls_disable: 1 + tls_disable: true + # tls_cert_file: /vault/tls/server.crt + # tls_key_file: /vault/tls/server.key # See https://www.vaultproject.io/docs/configuration/storage/ for storage backends storage: - #consul: - # address: "" - # path: "" + # consul: + # address: "" + # path: "" # - #etcd: - # address: "" - # path: "vault/" + # etcd: + # address: "" + # path: "vault/" # - #s3: - # bucket: "" - # region: "" - # access_key: "" - # secret_key: "" - # endpoint: "" # When not using AWS S3 + # s3: + # bucket: "" + # region: "" + # access_key: "" + # secret_key: "" + # endpoint: "" # When not using AWS S3 + # + # gcs: + # bucket: "" + # # Use a custom secret to mount this file. + # credentials_file: ""