diff --git a/stable/kube2iam/Chart.yaml b/stable/kube2iam/Chart.yaml new file mode 100644 index 0000000000..befa9110c5 --- /dev/null +++ b/stable/kube2iam/Chart.yaml @@ -0,0 +1,16 @@ +name: kube2iam +version: 0.1.0 +description: Provide IAM credentials to containers running inside a kubernetes cluster based on annotations. +keywords: +- kube2iam +- aws +- iam +- security +sources: +- https://github.com/jtblin/kube2iam +maintainers: +- name: Josh Carp + email: jm.carp@gmail.com +- name: Michael Haselton + email: michael.haselton@gmail.com +engine: gotpl diff --git a/stable/kube2iam/README.md b/stable/kube2iam/README.md new file mode 100644 index 0000000000..886ab0662c --- /dev/null +++ b/stable/kube2iam/README.md @@ -0,0 +1,71 @@ +# kube2iam + +* Installs [kube2iam](https://github.com/jtblin/kube2iam) to provide IAM credentials to containers running inside a kubernetes cluster based on annotations. + +## TL;DR; + +```console +$ helm install stable/kube2iam +``` + +## Introduction + +This chart bootstraps a [kube2iam](https://github.com/jtblin/kube2iam) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.4+ with Beta APIs enabled + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install --name my-release stable/kube2iam +``` + +The command deploys kube2iam on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following tables lists the configurable parameters of the kube2iam chart and their default values. + +| Parameter | Description | Default | +| --------------------------- | ------------------------------------------ | ---------------------------------------------------------- | +| `image` | Image | `jtblin/kube2iam` | +| `imageTag` | Image tag | `0.2.2` | +| `imagePullPolicy` | Image pull policy | `Always` if `imageTag` is `latest`, else `IfNotPresent` | +| `resources.limits.cpu` | CPU limit | `100m` | +| `resources.limits.memory` | Memory limit | `200Mi` | +| `resources.requests.cpu` | CPU request | `100m` | +| `resources.requests.memory` | Memory request | `200Mi` | +| `containerPort` | Container port | `8181` | +| `host.ip` | IP address of host | `$(HOST_IP)` | +| `host.iptables` | Add iptables rule | `false` | +| `host.interface` | Host interface for proxying AWS metadata | `docker0` | +| `extraArgs` | Extra arguments | `nil` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install --name my-release \ + --set=extraArgs.base-role-arn=arn:aws:iam::0123456789:role/, \ + extraArgs.default-role=kube2iam-default, \ + host.iptables=true,host.interface=cbr0 +``` + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install --name my-release -f values.yaml stable/kube2iam +``` diff --git a/stable/kube2iam/templates/NOTES.txt b/stable/kube2iam/templates/NOTES.txt new file mode 100644 index 0000000000..20db61ad7e --- /dev/null +++ b/stable/kube2iam/templates/NOTES.txt @@ -0,0 +1,11 @@ +To verify that kube2iam is working has started, run: + + kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "fullname" . }}" + +Add an iam.amazonaws.com/role annotation to your pods with the role that you want to assume for this pod. + + https://github.com/jtblin/kube2iam#kubernetes-annotation + +Verification of the role bound to the deployed pod can be done with `curl`. + + curl 169.254.169.254/latest/meta-data/iam/security-credentials/ diff --git a/stable/kube2iam/templates/_helpers.tpl b/stable/kube2iam/templates/_helpers.tpl new file mode 100644 index 0000000000..234480de71 --- /dev/null +++ b/stable/kube2iam/templates/_helpers.tpl @@ -0,0 +1,16 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 24 -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 24 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "fullname" -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 24 -}} +{{- end -}} diff --git a/stable/kube2iam/templates/daemonset.yaml b/stable/kube2iam/templates/daemonset.yaml new file mode 100644 index 0000000000..b998f6e49e --- /dev/null +++ b/stable/kube2iam/templates/daemonset.yaml @@ -0,0 +1,47 @@ +apiVersion: extensions/v1beta1 +kind: DaemonSet +metadata: + name: {{ template "fullname" . }} + labels: + app: {{ template "fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + heritage: "{{ .Release.Service }}" + release: "{{ .Release.Name }}" +spec: + selector: + matchLabels: + app: {{ template "fullname" . }} + template: + metadata: + labels: + app: {{ template "fullname" . }} + release: "{{ .Release.Name }}" + spec: + hostNetwork: true + containers: + - name: kube2iam + image: "{{ .Values.image }}:{{ .Values.imageTag }}" + imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }} + args: + - --app-port={{ default 8181 .Values.containerPort }} + - --iptables={{ default false .Values.host.iptables }} + - --host-interface={{ default "docker0" .Values.host.interface | quote }} + {{- if .Values.host.iptables }} + - --host-ip={{ default "$(HOST_IP)" .Values.host.ip }} + {{- end }} + {{- range $key, $value := .Values.extraArgs }} + - --{{ $key }}={{ $value }} + {{- end }} + env: + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + resources: +{{ toYaml .Values.resources | indent 10 }} + ports: + - containerPort: {{ default 8181 .Values.containerPort }} + {{- if .Values.host.iptables }} + securityContext: + privileged: true + {{- end }} diff --git a/stable/kube2iam/values.yaml b/stable/kube2iam/values.yaml new file mode 100644 index 0000000000..884eae2c6b --- /dev/null +++ b/stable/kube2iam/values.yaml @@ -0,0 +1,32 @@ +image: jtblin/kube2iam +imageTag: 0.2.2 + +## Specify a imagePullPolicy +## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' +## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images +## +# imagePullPolicy: + +## Configure resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + limits: + cpu: 100m + memory: 200Mi + requests: + cpu: 100m + memory: 200Mi + +# containerPort: 8181 + +host: + # ip: 127.0.0.1 + iptables: false + interface: docker0 + +# extraArgs: +# base-role-arn: arn:aws:iam::0123456789:role/ +# default-role: kube2iam-default +# api-server: ... +# api-token: ...