github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-23 22:37:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

[stable/concourse] provide configuration(s) for integrating Concourse with Vault (#2446)

Browse Source 
* provide configuration(s) for integrating Concourse with Vault

enabled configuring Concourse to use Vault for managing secrets, exposes 3 types of Auth Backends: tokens, approle, and TLS

* provide configuration(s) for integrating Concourse with Vault

enabled configuring Concourse to use Vault for managing secrets, exposes 3 types of Auth Backends: tokens, approle, and TLS
This commit is contained in:
JP Phillips
2017-11-27 11:57:40 -08:00
committed by Vic Iglesias
parent f5c8b4d86d
commit e8b8635780
6 changed files with 174 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
stable/concourse/Chart.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
name: concourse
version: 0.9.0
version: 0.10.0
appVersion: 3.6.0
description: Concourse is a simple and scalable CI system.
icon: https://avatars1.githubusercontent.com/u/7809479
stable/concourse/README.md
+36
View File
@@ -137,6 +137,16 @@ The following tables lists the configurable parameters of the Concourse chart an
| `postgresql.postgresPassword` | PostgreSQL Password for the new user | `concourse` |
| `postgresql.postgresDatabase` | PostgreSQL Database to create | `concourse` |
| `postgresql.persistence.enabled` | Enable PostgreSQL persistence using Persistent Volume Claims | `true` |
| `credentialManager.enabled` | Enable Credential Manager | `false` |
| `credentialManager.vault.url` | Vault Server URL | `nil` |
| `credentialManager.vault.pathPrefix` | Vault path to namespace secrets | `/concourse` |
| `credentialManager.vault.caCert` | CA public certificate when using self-signed TLS with Vault | `nil` |
| `credentialManager.vault.authBackend` | Vault Authentication Backend to use, leave blank when using clientToken | `nil` |
| `credentialManager.vault.clientToken` | Vault periodic client token | `nil` |
| `credentialManager.vault.appRoleId` | Vault AppRole RoleID | `nil` |
| `credentialManager.vault.appRoleSecretId` | Vault AppRole SecretID | `nil` |
| `credentialManager.vault.clientCert` | Vault Client Certificate | `nil` |
| `credentialManager.vault.clientKey` | Vault Client Key | `nil` |
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
@@ -290,3 +300,29 @@ postgresql:
uri: postgres://concourse:changeme@my-postgres.com:5432/concourse?sslmode=require
```
### Credential Management
By default, this chart will not use a [Credential Manager](https://concourse.ci/creds.html).
```yaml
## Configuration values for the Credential Manager.
## ref: https://concourse.ci/creds.html
##
credentialManager:
## Enable Credential Manager using below configuration.
##
enabled: true
## use Hashicorp Vault for Credential Manager.
##
vault:
## URL pointing to vault addr (i.e. http://vault:8200).
##
url: http://vault:8200
## initial periodic token issued for concourse
## ref: https://www.vaultproject.io/docs/concepts/tokens.html#periodic-tokens
##
clientToken: PERIODIC_VAULT_TOKEN
```
stable/concourse/templates/configmap.yaml
+5 -1
View File
@@ -39,4 +39,8 @@ data:
generic-oauth-token-url: {{ default "" .Values.concourse.genericOauthTokenUrl | quote }}
worker-post-stop-delay-seconds: {{ .Values.worker.postStopDelaySeconds | quote }}
worker-fatal-errors: {{ default "" .Values.worker.fatalErrors | quote }}
{{ if .Values.credentialManager.vault }}
vault-url: {{ default "" .Values.credentialManager.vault.url | quote }}
vault-path-prefix: {{ default "/concourse" .Values.credentialManager.vault.pathPrefix | quote }}
vault-auth-backend: {{ default "" .Values.credentialManager.vault.authBackend | quote }}
{{ end }}
stable/concourse/templates/secrets.yaml
+8
View File
@@ -29,3 +29,11 @@ data:
generic-oauth-client-secret: {{ default "" .Values.concourse.genericOauthClientSecret | b64enc | quote }}
encryption-key: {{ default "" .Values.concourse.encryptionKey | b64enc | quote }}
old-encryption-key: {{ default "" .Values.concourse.oldEncryptionKey | b64enc | quote }}
{{ if .Values.credentialManager.vault }}
vault-ca-cert: {{ default "" .Values.credentialManager.vault.caCert | b64enc | quote }}
vault-client-token: {{ default "" .Values.credentialManager.vault.clientToken | b64enc | quote }}
vault-approle-id: {{ default "" .Values.credentialManager.vault.appRoleId | b64enc | quote }}
vault-approle-secret-id: {{ default "" .Values.credentialManager.vault.appRoleSecretId | b64enc | quote }}
vault-client-cert: {{ default "" .Values.credentialManager.vault.clientCert | b64enc | quote }}
vault-client-key: {{ default "" .Values.credentialManager.vault.clientKey | b64enc | quote }}
{{ end }}
stable/concourse/templates/web-deployment.yaml
+70
View File
@@ -22,6 +22,14 @@ spec:
imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
args:
- "web"
{{- if .Values.credentialManager.enabled }}
{{- if default "" .Values.credentialManager.vault.appRoleId }}
- "--vault-auth-param"
- "role_id=${CONCOURSE_VAULT_APPROLE_ID}"
- "--vault-auth-param"
- "secret_id=${CONCOURSE_VAULT_APPROLE_SECRET_ID}"
{{- end }}
{{- end }}
env:
{{ if .Values.postgresql.enabled }}
- name: POSTGRES_HOST
@@ -244,6 +252,50 @@ spec:
value: "/concourse-keys/session_signing_key"
- name: CONCOURSE_TSA_AUTHORIZED_KEYS
value: "/concourse-keys/worker_key.pub"
{{- if .Values.credentialManager.enabled }}
- name: CONCOURSE_VAULT_URL
valueFrom:
configMapKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-url
- name: CONCOURSE_VAULT_PATH_PREFIX
valueFrom:
configMapKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-path-prefix
- name: CONCOURSE_VAULT_AUTH_BACKEND
valueFrom:
configMapKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-auth-backend
- name: CONCOURSE_VAULT_CLIENT_TOKEN
valueFrom:
secretKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-client-token
{{- if .Values.credentialManager.vault.caCert }}
- name: CONCOURSE_VAULT_CA_CERT
value: "/concourse-vault/ca.crt"
{{- end }}
{{- if .Values.credentialManager.vault.clientCert }}
- name: CONCOURSE_VAULT_CLIENT_CERT
value: "/concourse-vault/client.crt"
- name: CONCOURSE_VAULT_CLIENT_KEY
value: "/concourse-vault/client.key"
{{- end }}
{{- if .Values.credentialManager.vault.appRoleId }}
- name: CONCOURSE_VAULT_APPROLE_ID
valueFrom:
secretKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-approle-id
- name: CONCOURSE_VAULT_APPROLE_SECRET_ID
valueFrom:
secretKeyRef:
name: {{ template "concourse.concourse.fullname" . }}
key: vault-approle-secret-id
{{- end }}
{{- end }}
ports:
- name: atc
containerPort: {{ .Values.concourse.atcPort }}
@@ -267,6 +319,11 @@ spec:
- name: concourse-keys
mountPath: /concourse-keys
readOnly: true
{{- if .Values.credentialManager.vault }}
- name: vault-keys
mountPath: /concourse-vault
readOnly: true
{{- end }}
affinity:
{{- if .Values.web.additionalAffinities }}
{{ toYaml .Values.web.additionalAffinities | indent 8 }}
@@ -283,3 +340,16 @@ spec:
path: session_signing_key
- key: worker-key-pub
path: worker_key.pub
{{- if .Values.credentialManager.vault }}
- name: vault-keys
secret:
secretName: {{ template "concourse.concourse.fullname" . }}
defaultMode: 0400
items:
- key: vault-ca-cert
path: ca.cert
- key: vault-client-cert
path: client.cert
- key: vault-client-key
path: client.key
{{- end }}
stable/concourse/values.yaml
+54
View File
@@ -518,3 +518,57 @@ postgresql:
## Enable PostgreSQL persistence using Persistent Volume Claims.
##
enabled: true
## Configuration values for the Credential Manager.
## ref: https://concourse.ci/creds.html
##
credentialManager:
## Enable Credential Manager using below configuration.
##
enabled: false
## use Hashicorp Vault for Credential Manager.
##
# vault:
## URL pointing to vault addr (i.e. http://vault:8200).
##
# url:
## vault path under which to namespace credential lookup, defaults to /concourse.
##
# pathPrefix:
## if the Vault server is using a self-signed certificate, provide the CA public key.
## the value will be written to /concourse-vault/ca.cert
##
# caCert: |-
## vault authentication backend, leave this blank if using an intial periodic token
## currently supported backends: token, approle, cert
##
# authBackend:
## initial periodic token issued for concourse
## ref: https://www.vaultproject.io/docs/concepts/tokens.html#periodic-tokens
##
# clientToken:
## set role_id for [AppRole](https://www.vaultproject.io/docs/auth/approle.html) backend
## make sure to also set authBackend to `approle`.
##
# appRoleId:
## set secret_id for [AppRole](https://www.vaultproject.io/docs/auth/approle.html) backend
## make sure to also set authBackend to `approle`.
##
# appRoleSecretId:
## provide the client certificate for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend
## the value will be written to /concourse-vault/client.cert
## make sure to also set authBackend to `cert`
# clientCert: |-
## provide the client key for authenticating with the [TLS](https://www.vaultproject.io/docs/auth/cert.html) backend
## the value will be written to /concourse-vault/client.key
## make sure to also set authBackend to `cert`
# clientKey: |-