mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Add kube2iam to control AWS IAM policy access (#216)
* kube2iam chart * set hostNetwork at the spec level * fixes from code review h/t @mgoodness * cleanup/style * linter, host needs to be a dictionary * move kube2iam to stable
This commit is contained in:
Michael Haselton
committed by
Lachlan Evenson
Lachlan Evenson
parent
bcc323d57d
commit
ee57eabe71
@@ -0,0 +1,16 @@
|
||||
name: kube2iam
|
||||
version: 0.1.0
|
||||
description: Provide IAM credentials to containers running inside a kubernetes cluster based on annotations.
|
||||
keywords:
|
||||
- kube2iam
|
||||
- aws
|
||||
- iam
|
||||
- security
|
||||
sources:
|
||||
- https://github.com/jtblin/kube2iam
|
||||
maintainers:
|
||||
- name: Josh Carp
|
||||
email: jm.carp@gmail.com
|
||||
- name: Michael Haselton
|
||||
email: michael.haselton@gmail.com
|
||||
engine: gotpl
|
||||
@@ -0,0 +1,71 @@
|
||||
# kube2iam
|
||||
|
||||
* Installs [kube2iam](https://github.com/jtblin/kube2iam) to provide IAM credentials to containers running inside a kubernetes cluster based on annotations.
|
||||
|
||||
## TL;DR;
|
||||
|
||||
```console
|
||||
$ helm install stable/kube2iam
|
||||
```
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a [kube2iam](https://github.com/jtblin/kube2iam) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.4+ with Beta APIs enabled
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
$ helm install --name my-release stable/kube2iam
|
||||
```
|
||||
|
||||
The command deploys kube2iam on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
## Configuration
|
||||
|
||||
The following tables lists the configurable parameters of the kube2iam chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------------------------- | ------------------------------------------ | ---------------------------------------------------------- |
|
||||
| `image` | Image | `jtblin/kube2iam` |
|
||||
| `imageTag` | Image tag | `0.2.2` |
|
||||
| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` |
|
||||
| `resources.limits.cpu` | CPU limit | `100m` |
|
||||
| `resources.limits.memory` | Memory limit | `200Mi` |
|
||||
| `resources.requests.cpu` | CPU request | `100m` |
|
||||
| `resources.requests.memory` | Memory request | `200Mi` |
|
||||
| `containerPort` | Container port | `8181` |
|
||||
| `host.ip` | IP address of host | `$(HOST_IP)` |
|
||||
| `host.iptables` | Add iptables rule | `false` |
|
||||
| `host.interface` | Host interface for proxying AWS metadata | `docker0` |
|
||||
| `extraArgs` | Extra arguments | `nil` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release \
|
||||
--set=extraArgs.base-role-arn=arn:aws:iam::0123456789:role/, \
|
||||
extraArgs.default-role=kube2iam-default, \
|
||||
host.iptables=true,host.interface=cbr0
|
||||
```
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install --name my-release -f values.yaml stable/kube2iam
|
||||
```
|
||||
@@ -0,0 +1,11 @@
|
||||
To verify that kube2iam is working has started, run:
|
||||
|
||||
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "fullname" . }}"
|
||||
|
||||
Add an iam.amazonaws.com/role annotation to your pods with the role that you want to assume for this pod.
|
||||
|
||||
https://github.com/jtblin/kube2iam#kubernetes-annotation
|
||||
|
||||
Verification of the role bound to the deployed pod can be done with `curl`.
|
||||
|
||||
curl 169.254.169.254/latest/meta-data/iam/security-credentials/
|
||||
@@ -0,0 +1,16 @@
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 24 -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 24 -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,47 @@
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
labels:
|
||||
app: {{ template "fullname" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
release: "{{ .Release.Name }}"
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ template "fullname" . }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "fullname" . }}
|
||||
release: "{{ .Release.Name }}"
|
||||
spec:
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: kube2iam
|
||||
image: "{{ .Values.image }}:{{ .Values.imageTag }}"
|
||||
imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
|
||||
args:
|
||||
- --app-port={{ default 8181 .Values.containerPort }}
|
||||
- --iptables={{ default false .Values.host.iptables }}
|
||||
- --host-interface={{ default "docker0" .Values.host.interface | quote }}
|
||||
{{- if .Values.host.iptables }}
|
||||
- --host-ip={{ default "$(HOST_IP)" .Values.host.ip }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.extraArgs }}
|
||||
- --{{ $key }}={{ $value }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: HOST_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
ports:
|
||||
- containerPort: {{ default 8181 .Values.containerPort }}
|
||||
{{- if .Values.host.iptables }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
image: jtblin/kube2iam
|
||||
imageTag: 0.2.2
|
||||
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
# imagePullPolicy:
|
||||
|
||||
## Configure resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
|
||||
##
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 200Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 200Mi
|
||||
|
||||
# containerPort: 8181
|
||||
|
||||
host:
|
||||
# ip: 127.0.0.1
|
||||
iptables: false
|
||||
interface: docker0
|
||||
|
||||
# extraArgs:
|
||||
# base-role-arn: arn:aws:iam::0123456789:role/
|
||||
# default-role: kube2iam-default
|
||||
# api-server: ...
|
||||
# api-token: ...
|
||||
Reference in New Issue
Block a user