[stable/kube2iam] Allow setting a custom secret name to use for AWS credentials (#21265)

* Allow setting a custom secret name to use for AWS credentials in the event that the secret is populated from outside of helm for security purposes

Signed-off-by: Mike Tougeron <tougeron@adobe.com>

* [stable/kube2iam] call the variable existingSecret

Signed-off-by: Mike Tougeron <tougeron@adobe.com>

* Bump minor version for new feature

Signed-off-by: Reinhard Nägele <unguiculus@gmail.com>

Co-authored-by: Reinhard Nägele <unguiculus@gmail.com>

stable/kube2iam/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: kube2iam
-version: 2.1.0
+version: 2.2.0
 appVersion: 0.10.7
 description: Provide IAM credentials to pods based on annotations.
 keywords:

stable/kube2iam/README.md

@@ -67,6 +67,10 @@ Parameter | Description | Default
 `updateStrategy` | Strategy for DaemonSet updates (requires Kubernetes 1.6+) | `OnDelete`
 `verbose` | Enable verbose output | `false`
 `tolerations` | List of node taints to tolerate (requires Kubernetes 1.6+) | `[]`
+`aws.secret_key` | The value to use for AWS_SECRET_ACCESS_KEY | `""`
+`aws.access_key` | The value to use for AWS_ACCESS_KEY_ID | `""`
+`aws.region` | The AWS region to use | `""`
+`existingSecret` | Set the AWS credentials using an existing secret | `""`
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
 

stable/kube2iam/templates/daemonset.yaml

@@ -62,16 +62,16 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: spec.nodeName
-          {{- if and .Values.aws.secret_key .Values.aws.access_key }}
+          {{- if or .Values.existingSecret (and .Values.aws.secret_key .Values.aws.access_key) }}
             - name: AWS_ACCESS_KEY_ID
               valueFrom:
                 secretKeyRef:
-                  name: {{ template "kube2iam.fullname" . }}
+                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "kube2iam.fullname" . }}{{ end }}
                   key: aws_access_key_id
             - name: AWS_SECRET_ACCESS_KEY
               valueFrom:
                 secretKeyRef:
-                  name: {{ template "kube2iam.fullname" . }}
+                  name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "kube2iam.fullname" . }}{{ end }}
                   key: aws_secret_access_key
           {{- end }}
           {{- if .Values.aws.region }}

stable/kube2iam/values.yaml

@@ -50,6 +50,8 @@ aws:
   access_key: ""
   region: ""
 
+existingSecret: ""
+
 ## Node labels for pod assignment
 ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
 ##