Skip to content

Commit b3e1b53

Browse files
wallrjwallrj
committed
Add missing VenafiConnection templates and values to the Helm chart
Signed-off-by: Richard Wall <richard.wall@venafi.com>
1 parent 76f9742 commit b3e1b53

File tree

10 files changed

+284
-32
lines changed

10 files changed

+284
-32
lines changed

‎deploy/charts/venafi-kubernetes-agent/templates/_venafi-connection.tpl‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{/*
2+
Create chart name and version as used by the chart label.
3+
*/}}
4+
{{- define "venafi-connection.chart" -}}
5+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Common labels
10+
*/}}
11+
{{- define "venafi-connection.labels" -}}
12+
helm.sh/chart: {{ include "venafi-connection.chart" . }}
13+
{{ include "venafi-connection.selectorLabels" . }}
14+
{{- if .Chart.AppVersion }}
15+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
16+
{{- end }}
17+
app.kubernetes.io/managed-by: {{ .Release.Service }}
18+
{{- end }}
19+
20+
{{/*
21+
Selector labels
22+
*/}}
23+
{{- define "venafi-connection.selectorLabels" -}}
24+
app.kubernetes.io/name: "venafi-connection"
25+
app.kubernetes.io/instance: {{ .Release.Name }}
26+
{{- end }}

‎deploy/charts/venafi-kubernetes-agent/templates/deployment.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,15 @@ spec:
5757
- "agent"
5858
- "-c"
5959
- "/etc/venafi/agent/config/{{ default "config.yaml" .Values.config.configmap.key }}"
60-
- "--client-id"
61-
- "{{ .Values.config.clientId }}"
6260
- "-p"
6361
- "0h1m0s"
62+
{{- if .Values.config.venafiConnectionName }}
63+
- --venafi-connection
64+
- {{ .Values.config.venafiConnectionName | quote }}
65+
{{- else }}
66+
- --client-id
67+
- {{ .Values.config.clientId | quote }}
68+
{{- end }}
6469
- --venafi-cloud
6570
{{- if .Values.metrics.enabled }}
6671
- --enable-metrics

‎deploy/charts/venafi-kubernetes-agent/templates/rbac.yaml‎

Lines changed: 0 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,5 @@
11
---
22
apiVersion: rbac.authorization.k8s.io/v1
3-
kind: ClusterRole
4-
metadata:
5-
name: {{ include "venafi-kubernetes-agent.fullname" . }}-venaficonnection
6-
labels:
7-
{{- include "venafi-kubernetes-agent.labels" . | nindent 4 }}
8-
rules:
9-
- apiGroups: ["jetstack.io"]
10-
resources:
11-
- venaficonnections
12-
verbs: ["get", "list", "watch", "update"]
13-
---
14-
apiVersion: rbac.authorization.k8s.io/v1
15-
kind: ClusterRoleBinding
16-
metadata:
17-
name: {{ include "venafi-kubernetes-agent.fullname" . }}-venaficonnection
18-
labels:
19-
{{- include "venafi-kubernetes-agent.labels" . | nindent 4 }}
20-
roleRef:
21-
kind: ClusterRole
22-
name: {{ include "venafi-kubernetes-agent.fullname" . }}-venaficonnection
23-
apiGroup: rbac.authorization.k8s.io
24-
subjects:
25-
- kind: ServiceAccount
26-
name: {{ include "venafi-kubernetes-agent.serviceAccountName" . }}
27-
namespace: {{ .Release.Namespace }}
28-
---
29-
apiVersion: rbac.authorization.k8s.io/v1
303
kind: ClusterRoleBinding
314
metadata:
325
name: {{ include "venafi-kubernetes-agent.fullname" . }}-cluster-viewer

‎deploy/charts/venafi-kubernetes-agent/templates/venafi-connection-crd.without-validations.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
1-
---
1+
{{- if .Values.venafiConnection.include }}
2+
{{- if (or (semverCompare "<1.25" .Capabilities.KubeVersion.GitVersion) .Values.crds.forceRemoveValidationAnnotations) }}
23
apiVersion: apiextensions.k8s.io/v1
34
kind: CustomResourceDefinition
45
metadata:
56
annotations:
67
controller-gen.kubebuilder.io/version: v0.14.0
8+
# This annotation prevents the CRD from being pruned by Helm when this chart is deleted.
9+
"helm.sh/resource-policy": keep
710
name: venaficonnections.jetstack.io
11+
labels:
12+
{{- include "venafi-connection.labels" $ | nindent 4 }}
813
spec:
914
group: jetstack.io
1015
names:
@@ -1114,3 +1119,5 @@ spec:
11141119
storage: true
11151120
subresources:
11161121
status: {}
1122+
{{- end }}
1123+
{{- end }}

‎deploy/charts/venafi-kubernetes-agent/templates/venafi-connection-crd.yaml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,15 @@
1-
---
1+
{{- if .Values.venafiConnection.include }}
2+
{{- if not (or (semverCompare "<1.25" .Capabilities.KubeVersion.GitVersion) .Values.crds.forceRemoveValidationAnnotations) }}
23
apiVersion: apiextensions.k8s.io/v1
34
kind: CustomResourceDefinition
45
metadata:
56
annotations:
67
controller-gen.kubebuilder.io/version: v0.14.0
8+
# This annotation prevents the CRD from being pruned by Helm when this chart is deleted.
9+
"helm.sh/resource-policy": keep
710
name: venaficonnections.jetstack.io
11+
labels:
12+
{{- include "venafi-connection.labels" $ | nindent 4 }}
813
spec:
914
group: jetstack.io
1015
names:
@@ -1138,3 +1143,5 @@ spec:
11381143
storage: true
11391144
subresources:
11401145
status: {}
1146+
{{- end }}
1147+
{{- end }}

‎deploy/charts/venafi-kubernetes-agent/templates/venafi-connection-rbac.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copied from approver-policy-enterprise
2+
# https://github.com/jetstack/approver-policy-enterprise/blob/main/deploy/charts/approver-policy-enterprise/templates/venafi-connection-rbac.yaml
3+
---
4+
{{- with .Values.venafiConnection }}
5+
{{- if .include }}
6+
# The 'venafi-connection' service account is used by multiple
7+
# controllers. When configuring which resources a VenafiConnection
8+
# can access, the RBAC rules you create manually must point to this SA.
9+
apiVersion: v1
10+
kind: ServiceAccount
11+
metadata:
12+
name: venafi-connection
13+
namespace: {{ $.Release.Namespace | quote }}
14+
labels:
15+
{{- include "venafi-connection.labels" $ | nindent 4 }}
16+
---
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: ClusterRole
19+
metadata:
20+
name: venafi-connection-role
21+
labels:
22+
{{- include "venafi-connection.labels" $ | nindent 4 }}
23+
rules:
24+
- apiGroups: [ "" ]
25+
resources: [ "namespaces" ]
26+
verbs: [ "get", "list", "watch" ]
27+
28+
- apiGroups: [ "jetstack.io" ]
29+
resources: [ "venaficonnections" ]
30+
verbs: [ "get", "list", "watch" ]
31+
32+
- apiGroups: [ "jetstack.io" ]
33+
resources: [ "venaficonnections/status" ]
34+
verbs: [ "get", "patch" ]
35+
---
36+
apiVersion: rbac.authorization.k8s.io/v1
37+
kind: ClusterRoleBinding
38+
metadata:
39+
name: venafi-connection-rolebinding
40+
labels:
41+
{{- include "venafi-connection.labels" $ | nindent 4 }}
42+
roleRef:
43+
apiGroup: rbac.authorization.k8s.io
44+
kind: ClusterRole
45+
name: venafi-connection-role
46+
subjects:
47+
- kind: ServiceAccount
48+
name: venafi-connection
49+
namespace: {{ $.Release.Namespace | quote }}
50+
{{- end }}
51+
{{- end }}

‎deploy/charts/venafi-kubernetes-agent/templates/venafi-rbac.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Copied from approver-policy-enterprise
2+
# https://github.com/jetstack/approver-policy-enterprise/blob/028fd7e0c57cb059d0ba7d03b6899b448285a240/deploy/charts/approver-policy-enterprise/templates/venafi-rbac.yaml
3+
---
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
kind: Role
6+
metadata:
7+
name: venafi-kubernetes-agent-impersonate-role
8+
namespace: {{ $.Release.Namespace | quote }}
9+
labels:
10+
{{- include "venafi-kubernetes-agent.labels" . | nindent 4 }}
11+
rules:
12+
- apiGroups: [ "" ]
13+
resources: [ "serviceaccounts" ]
14+
verbs: [ "impersonate" ]
15+
resourceNames: [ "venafi-connection" ]
16+
---
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: RoleBinding
19+
metadata:
20+
name: venafi-kubernetes-agent-impersonate-rolebinding
21+
namespace: {{ $.Release.Namespace | quote }}
22+
labels:
23+
{{- include "venafi-kubernetes-agent.labels" . | nindent 4 }}
24+
roleRef:
25+
apiGroup: rbac.authorization.k8s.io
26+
kind: Role
27+
name: venafi-kubernetes-agent-impersonate-role
28+
subjects:
29+
- kind: ServiceAccount
30+
name: {{ include "venafi-kubernetes-agent.serviceAccountName" . }}
31+
namespace: {{ $.Release.Namespace | quote }}

‎deploy/charts/venafi-kubernetes-agent/values.yaml‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ image:
5757
# -- Defaults to only pull if not already present
5858
pullPolicy: IfNotPresent
5959
# -- Overrides the image tag whose default is the chart appVersion
60-
tag: "v0.1.49"
60+
# tag: "v0.1.49-alpha.0"
6161

6262
# -- Specify image pull credentials if using a private registry
6363
# example: - name: my-pull-secret
@@ -192,6 +192,10 @@ config:
192192
name:
193193
key:
194194

195+
# -- The name of a VenafiConnection resource which contains the configuration
196+
# for authenticating to Venafi.
197+
venafiConnectionName: venafi-components
198+
195199
# -- Configure a PodDisruptionBudget for the agent's Deployment. If running with multiple
196200
# replicas, consider setting podDisruptionBudget.enabled to true.
197201
podDisruptionBudget:
@@ -208,3 +212,22 @@ podDisruptionBudget:
208212
# an integer (e.g. 1) or a percentage value (e.g. 25%).
209213
# Cannot be used if `minAvailable` is set.
210214
# maxUnavailable: 1
215+
216+
# +docs:section=CRDs
217+
# The CRDs installed by this chart are annotated with "helm.sh/resource-policy: keep", this
218+
# prevents them from being accidentally removed by Helm when this chart is deleted. After
219+
# deleting the installed chart, the user still has to manually remove the remaining CRDs.
220+
crds:
221+
# The 'x-kubernetes-validations' annotation is not supported in Kubernetes 1.22 and below.
222+
# This annotation is used by CEL, which is a feature introduced in Kubernetes 1.25 that
223+
# improves how validation is performed.
224+
# This option allows to force the 'x-kubernetes-validations' annotation to be excluded,
225+
# even on Kubernetes 1.25+ clusters.
226+
forceRemoveValidationAnnotations: false
227+
228+
# +docs:section=Venafi Connection
229+
venafiConnection:
230+
# When set to false, the rendered output does not contain the
231+
# VenafiConnection CRDs and RBAC. This is useful for when the
232+
# Venafi Connection resources are already installed separately.
233+
include: true

‎test.sh‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/usr/bin/env bash
2+
3+
# Prerequisites
4+
# * https://github.com/ko-build/ko/releases/tag/v0.16.0
5+
6+
set -o nounset
7+
set -o errexit
8+
set -o pipefail
9+
set -o xtrace
10+
11+
: ${VEN_API_KEY?}
12+
: ${VEN_OWNING_TEAM?}
13+
14+
script_dir=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
15+
root_dir=$(cd "${script_dir}/.." && pwd)
16+
17+
cd "${script_dir}"
18+
19+
export VERSION=0.1.49
20+
export TERM=dumb
21+
OCI_BASE=ttl.sh/63773370-0bcf-4ac0-bd42-5515616089ff
22+
export KO_DOCKER_REPO=$OCI_BASE/images/venafi-agent
23+
24+
ko build . --bare --tags "v${VERSION}"
25+
helm package deploy/charts/venafi-kubernetes-agent --version "${VERSION}"
26+
helm push venafi-kubernetes-agent-${VERSION}.tgz "oci://${OCI_BASE}/charts"
27+
28+
kind create cluster || true
29+
30+
kubectl create ns venafi || true
31+
32+
# Pull secret for Venafi OCI registry
33+
if ! kubectl get secret venafi-image-pull-secret -n venafi; then
34+
venctl iam service-accounts registry create \
35+
--no-prompts \
36+
--owning-team "${VEN_OWNING_TEAM}" \
37+
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
38+
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
39+
| jq '{
40+
"apiVersion": "v1",
41+
"kind": "Secret",
42+
"metadata": {
43+
"name": "venafi-image-pull-secret"
44+
},
45+
"type": "kubernetes.io/dockerconfigjson",
46+
"stringData": {
47+
".dockerconfigjson": {
48+
"auths": {
49+
"\(.oci_registry)": {
50+
"username": .username,
51+
"password": .password
52+
}
53+
}
54+
} | tostring
55+
}
56+
}' \
57+
| kubectl create -n venafi -f -
58+
fi
59+
60+
# Service account credentials for venafi-kubernetes-agent
61+
if ! kubectl get secret agent-credentials -n venafi; then
62+
venctl iam service-account agent create \
63+
--no-prompts \
64+
--owning-team "${VEN_OWNING_TEAM}" \
65+
--name "venafi-kubernetes-agent-e2e-agent-${RANDOM}" \
66+
| jq '{
67+
"apiVersion": "v1",
68+
"kind": "Secret",
69+
"metadata": {
70+
"name": "agent-credentials"
71+
},
72+
"stringData": {
73+
"privatekey.pem": .private_key,
74+
"client-id": .client_id
75+
}
76+
}' \
77+
| kubectl create -n venafi -f -
78+
fi
79+
80+
# export VENAFI_KUBERNETES_AGENT_CLIENT_ID=$(kubectl get secret -n venafi agent-credentials -o jsonpath='{.data.client-id}' | base64 -d)
81+
export VENAFI_KUBERNETES_AGENT_CLIENT_ID="not-used-but-required-by-venctl"
82+
venctl components kubernetes apply \
83+
--venafi-kubernetes-agent \
84+
--venafi-kubernetes-agent-version "$VERSION" \
85+
--venafi-kubernetes-agent-values-files "${script_dir}/values.venafi-kubernetes-agent.yaml" \
86+
--venafi-kubernetes-agent-custom-image-registry "${OCI_BASE}/images" \
87+
--venafi-kubernetes-agent-custom-chart-repository "oci://${OCI_BASE}/charts"
88+
89+
envsubst < venafi-components.yaml | kubectl apply -n venafi -f -

‎venafi-components.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: jetstack.io/v1alpha1
2+
kind: VenafiConnection
3+
metadata:
4+
name: venafi-components
5+
spec:
6+
vcp:
7+
apiKey:
8+
- secret:
9+
name: venafi-credentials
10+
fields: ["api-key"]
11+
---
12+
apiVersion: rbac.authorization.k8s.io/v1
13+
kind: Role
14+
metadata:
15+
name: get-venafi-credentials
16+
rules:
17+
- apiGroups: [ "" ]
18+
resources: [ "secrets" ]
19+
verbs: [ "get" ]
20+
resourceNames: [ "venafi-credentials" ]
21+
---
22+
apiVersion: rbac.authorization.k8s.io/v1
23+
kind: RoleBinding
24+
metadata:
25+
name: application-team-1-secret-rolebinding
26+
roleRef:
27+
apiGroup: rbac.authorization.k8s.io
28+
kind: Role
29+
name: get-venafi-credentials
30+
subjects:
31+
- kind: ServiceAccount
32+
name: venafi-connection
33+
namespace: venafi
34+
---
35+
apiVersion: v1
36+
kind: Secret
37+
metadata:
38+
name: venafi-credentials
39+
stringData:
40+
api-key: ${VEN_API_KEY}

0 commit comments

Comments
 (0)