From fd208fc47086c4841cd88ed0ca56400212b12b71 Mon Sep 17 00:00:00 2001 From: Mike Tougeron Date: Tue, 14 Apr 2020 08:34:13 -0700 Subject: [PATCH] [stable/kube2iam] Allow setting a custom secret name to use for AWS credentials (#21265) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Allow setting a custom secret name to use for AWS credentials in the event that the secret is populated from outside of helm for security purposes Signed-off-by: Mike Tougeron * [stable/kube2iam] call the variable existingSecret Signed-off-by: Mike Tougeron * Bump minor version for new feature Signed-off-by: Reinhard Nägele Co-authored-by: Reinhard Nägele --- stable/kube2iam/Chart.yaml | 2 +- stable/kube2iam/README.md | 4 ++++ stable/kube2iam/templates/daemonset.yaml | 6 +++--- stable/kube2iam/values.yaml | 2 ++ 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/stable/kube2iam/Chart.yaml b/stable/kube2iam/Chart.yaml index dab13cd300..5fd9b812de 100644 --- a/stable/kube2iam/Chart.yaml +++ b/stable/kube2iam/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: kube2iam -version: 2.1.0 +version: 2.2.0 appVersion: 0.10.7 description: Provide IAM credentials to pods based on annotations. keywords: diff --git a/stable/kube2iam/README.md b/stable/kube2iam/README.md index d940e2efc2..022ee1fcc0 100644 --- a/stable/kube2iam/README.md +++ b/stable/kube2iam/README.md @@ -67,6 +67,10 @@ Parameter | Description | Default `updateStrategy` | Strategy for DaemonSet updates (requires Kubernetes 1.6+) | `OnDelete` `verbose` | Enable verbose output | `false` `tolerations` | List of node taints to tolerate (requires Kubernetes 1.6+) | `[]` +`aws.secret_key` | The value to use for AWS_SECRET_ACCESS_KEY | `""` +`aws.access_key` | The value to use for AWS_ACCESS_KEY_ID | `""` +`aws.region` | The AWS region to use | `""` +`existingSecret` | Set the AWS credentials using an existing secret | `""` Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, diff --git a/stable/kube2iam/templates/daemonset.yaml b/stable/kube2iam/templates/daemonset.yaml index ec3ab7456b..8beee3bea3 100644 --- a/stable/kube2iam/templates/daemonset.yaml +++ b/stable/kube2iam/templates/daemonset.yaml @@ -62,16 +62,16 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - {{- if and .Values.aws.secret_key .Values.aws.access_key }} + {{- if or .Values.existingSecret (and .Values.aws.secret_key .Values.aws.access_key) }} - name: AWS_ACCESS_KEY_ID valueFrom: secretKeyRef: - name: {{ template "kube2iam.fullname" . }} + name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "kube2iam.fullname" . }}{{ end }} key: aws_access_key_id - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: - name: {{ template "kube2iam.fullname" . }} + name: {{ if .Values.existingSecret }}{{ .Values.existingSecret }}{{ else }}{{ template "kube2iam.fullname" . }}{{ end }} key: aws_secret_access_key {{- end }} {{- if .Values.aws.region }} diff --git a/stable/kube2iam/values.yaml b/stable/kube2iam/values.yaml index c5d48c3889..c8bbdcc1d7 100644 --- a/stable/kube2iam/values.yaml +++ b/stable/kube2iam/values.yaml @@ -50,6 +50,8 @@ aws: access_key: "" region: "" +existingSecret: "" + ## Node labels for pod assignment ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ ##