Vault: Adding ability to open cluster ip in k8s service (#8054)

* Vault: Adding ability to open cluster ip in k8s service

Signed-off-by: Charles Cantoni <charles.cantoni@gmail.com>

* Adding conditional block around exposing the cluster port

Signed-off-by: ccantoni <ccantoni@secureauth.com>

* Bumping chart version

Signed-off-by: ccantoni <ccantoni@secureauth.com>

incubator/vault/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: A Helm chart for Vault, a tool for managing secrets
 name: vault
-version: 0.14.8
+version: 0.14.9
 appVersion: 1.0.1
 home: https://www.vaultproject.io/
 icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg

incubator/vault/README.md

@@ -65,6 +65,10 @@ The following table lists the configurable parameters of the Vault chart and the
 | `service.loadBalancerIP`          | Assign a static IP to the loadbalancer   | `nil`                               |
 | `service.loadBalancerSourceRanges`| IP whitelist for service type loadbalancer   | `[]`                            |
 | `service.annotations`             | Annotations for service                  | `{}`                                |
+| `service.externalPort`            | External port for the service            | `8200`                              |
+| `service.port`                    | The API port Vault is using              | `8200`                              |
+| `service.clusterExternalPort`     | External cluster port for the service    | `nil`                               |
+| `service.clusterPort`             | The cluster port Vault is using          | `8201`                              |
 | `annotations`                     | Annotations for deployment               | `{}`                                |
 | `labels`                          | Extra labels for deployment              | `{}`                                |
 | `ingress.labels`                  | Labels for ingress                       | `{}`                                |

incubator/vault/templates/deployment.yaml

@@ -45,7 +45,7 @@ spec:
         ports:
         - containerPort: {{ .Values.service.port }}
           name: api
-        - containerPort: 8201
+        - containerPort: {{ .Values.service.clusterPort }}
           name: cluster-address
         livenessProbe:
           # Alive if it is listening for clustering traffic

incubator/vault/templates/service.yaml

@@ -30,6 +30,12 @@ spec:
     protocol: TCP
     targetPort: {{ .Values.service.port }}
     name: api
+  {{- if .Values.service.clusterExternalPort }}
+  - port: {{ .Values.service.clusterExternalPort }}
+    protocol: TCP
+    targetPort: {{ .Values.service.clusterPort }}
+    name: cluster
+  {{- end }}
   selector:
     app: {{ template "vault.name" . }}
     release: {{ .Release.Name }}

incubator/vault/values.yaml

@@ -35,6 +35,8 @@ service:
   #  - 130.211.204.2/32
   externalPort: 8200
   port: 8200
+  # clusterExternalPort: 8201
+  clusterPort: 8201
   # clusterIP: None
   annotations: {}
   #   cloud.google.com/load-balancer-type: "Internal"