From 82b82b3c75d9e0ba798ae3325e6fed0d7e1e4a41 Mon Sep 17 00:00:00 2001 From: Sergio Rua Date: Fri, 21 Jan 2022 14:23:48 +0000 Subject: [PATCH] Update Vals-Operator to 0.3.0 - make charts --- assets/vals-operator/vals-operator-0.3.1.tgz | Bin 0 -> 5913 bytes .../vals-operator/0.3.1/.gitignore | 49 +++++++ .../vals-operator/0.3.1/Chart.yaml | 16 +++ .../vals-operator/0.3.1/README.md | 35 +++++ .../vals-operator/0.3.1/app-readme.md | 9 ++ .../vals-operator/0.3.1/crds/valssecrets.yaml | 130 ++++++++++++++++++ .../vals-operator/0.3.1/questions.yaml | 26 ++++ .../vals-operator/0.3.1/templates/NOTES.txt | 0 .../0.3.1/templates/_helpers.tpl | 62 +++++++++ .../vals-operator/0.3.1/templates/crds.yaml | 6 + .../0.3.1/templates/deployment.yaml | 73 ++++++++++ .../0.3.1/templates/serviceaccount.yaml | 64 +++++++++ .../0.3.1/templates/servicemonitor.yaml | 37 +++++ .../vals-operator/0.3.1/values.yaml | 106 ++++++++++++++ 14 files changed, 613 insertions(+) create mode 100644 assets/vals-operator/vals-operator-0.3.1.tgz create mode 100644 charts/vals-operator/vals-operator/0.3.1/.gitignore create mode 100644 charts/vals-operator/vals-operator/0.3.1/Chart.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/README.md create mode 100644 charts/vals-operator/vals-operator/0.3.1/app-readme.md create mode 100644 charts/vals-operator/vals-operator/0.3.1/crds/valssecrets.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/questions.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/NOTES.txt create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/_helpers.tpl create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/crds.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/deployment.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/serviceaccount.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/templates/servicemonitor.yaml create mode 100644 charts/vals-operator/vals-operator/0.3.1/values.yaml diff --git a/assets/vals-operator/vals-operator-0.3.1.tgz b/assets/vals-operator/vals-operator-0.3.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5eb4668d53f3e882509ea24fa4f16b65f4007ef3 GIT binary patch literal 5913 zcmV+!7v|_6iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBha~n6ZXujV06S5WJRoS{;S-a834_!;KYmX~s zgELJM5eAq57}AX8|9%R+U>S`@qr-y(`+qbVwg2yq9*@4+J=lG`_vm1BIC}ieXm|hdH}lQCpOYL2qAT0&LE$SUL{ z#WB1wqv};LsygdSWJnYi^&6uwAQ^pwQc=Oju-FSomQ`Oz(Lpo{5>&CInYPc)=TyNQ zSqiZkzCgLsgfRtrj_{1ms3wdmOA~mSKnq9-Co=@K;xQF9L7>) z875&#R`_Ul@8hH0z3}fW$M@Zj!~MOF`+HHwXTe22!BQAIfBPPGquu|z6QqQ4O(;jH z#z6>}63WIv`BePBI%NTXlXr%|KCQDXs7s*$hjWFZV=Fv%+M?a5;LKw7IHO) zQi&uYzCb%pYRUp2%NaWrjK-@moJ?N|eJW8Q*8#vic(p(&X@X86Tlk>K43=}D5E7h{ zoN1u$wNv4h%8vptmB%m`6ttb@jGZ}kJ%)EbTlM8p*lN?9v9*VRLb;$ZK8<6`s-^5K z!`Q5C3YK%!bCf`!s0YMV1T_~qOJIT!OC%Z-vz*yaW6&~33+QRJikg*$B#HTF_-TO) z0O~6)eEMwLpU=^1W)Rb^Rt8wEFtT+|roe>;g&GJ?3Rs3ba^^b15EtUdnB|FE z*HuPhRG_q^d}dz*{GTI{rbfycakMe2v|+o}KntKVE@Z)QI7hj zuQ*$Q#9wnNF#$RSk?T-Q!}uf|zRLZq8S%p948sWiEpmtnhXuu@p(=$X)pOV1nt`)8Cm6wr zhLo&;FeQvuNT@P>nZS&R31MtyXC-p?Fhl84E-10wR`VZr8Vp7aBhv9ShJl%ggPn?N z^S$6(8^ZcUDmf4JoE0FUKX(@%(yIcTRMx+iaIw$i)c!jbveh3uGSd zGxJ4cMzz2Tk(6tK`VM(45|rP^f-AxB*nNG-#O%3g^ZhfNiILRK zL)bA+f%%VyrJaX{48m8&y}_Ah0saOfSk7rYhge97DidzTL!2uuQn1j#lBo=M%FQxl zSDBKUiX|&eZKQcMXT+^&WFi(=ps$)LAQB-ana+*2Err?UXD1_^#yj_;APA5zs1)1` zEN3yeW$qrFA(pP&jOuwliDHos7erFRb%G0P;RN^Wlrb1&>SnCqX5rO_(L95d$YnXZ zYRDpkxmpv8752^3pPrw;Kl}0I^!=OT*C+q@cOd~Q4L{M1p<*aKZUAu4UgLCJwDGGp zS*kFWn5ZCF2$rX)*3i1wu9<^V0de17+Iq9tfkLjSVcx-eVeF5qfu^R4St7?UbO4JN z5=mm#NN-F8nMlqs&L!2WBjX@{)TIS9RsWPC&&IGf8jY+FI;+JbBNNJ~rl>p{i4>Xt z9KzG*&+TWA{IwAJAC#e5DUE5(W|KL8s$L3iDzqQ}q)?7w*OF2!n5RPOF_=}(o02aC zH|DWJ{dSIaXjr>X=5}UsW3&N*vqpV4ftgwJix{Zw@OpSS)8$=FVDbO=Ra$$X19o_}LvVjxKm{_4PZ*B9k z+1RVs66#zmVQQ=+^c?CX`L|L?s5HGKK%{P--= zAN393*x>)$&rSdT(ZS)PJOBSSN?-rKpCijqsz_(o-U`~#|N94rd#(OI+<$!6|F=>; zeHuOpjz4C`@Y1ba2)h>(1rLUwKL?*ag+{|ujxcC?EvCf)!m5t7kRx}LWK0W)-nebW z`lbwAnq`v5aJX+j()28!PU%M&gaasG8LR5^=OC~&9=UxEQev3q#@YHcC(IsC0Ld~- zeH6S!2iw-y27}?mID9cNYp4<_*0%B;&r^ylaYiPiDb-kP;ZOzNO;+wK;pLgBYm7g$ zw%(6|lPMGj84if?WC`V}*v4`@G1|F66Eq8W0z?6^#23_V5U<~{sYFbtr9|6XU0!m% z@3)aUQze{lEeGT8x9`@9#!?mzNc7qX%C+@$HXeQAaS*NZQZJ4+YHrZ?LHTqqHqZkGiI!{!Cwb3ct7~^ z=_Jxr@WLA0M5n9e2%RHKBQ+md+Q;zelX3o7p7b#nIrM$CRAHq(FHl6a5mYe!wA>6f z??{$K7v4dMnV&81(v;Sh5+}JtbCi{PHcg_Akd~|qc|J_DuP0s2B zsGPcz@EO9l8PW5H@a<$}ET-}I5ZO(Y=$}kXU|>ee@PQpK#c~7R`Ud#a9=D*wMv74FK)&d*m|G~kdgVy|iyt{XI{(mc_9&1IiObr*i!3E{X7@n0QAV^V@ zglIA@PmBA_liCVx=5@K@7ytlRZPVS3l?LD?aLN{X{6h*ZB9a?Ix>No0&-JApjPHDXr+bsi)6tw#HYlEY9W>}kePexBhO@-LdyY)k>s#@bH>pJ>&4WB;&t1ValOzcMS z)Q;Y&TJ`g|>tb6QDm6U*RQ#$1!8h83@oU>^e?;lC|BLmu*a5np53s@h-`n4R)VBX0 zKia#q|8JvgwK?ZDDl11pPDmV)T+fB1zu8F~T|9AnvEF+)axsvv1;Y;ap&dVbT^~W_ z4DHPal2IE+Vqt|a7zC}gDTG0B*TcM8pq%)}Gt>k3iBaW0+PJmivkRRoz9h)7{Nltk z*b={sV{D`MFzlDip2%$GRsR}gjG{^&3Y zT8f6Wz2`O0xyLrB!N1#7{2gV(`k%T8us?SF-`jiKT>tk*qtRXb$E}p^^}h)Gi+mV6 zviLI$HM@hBa_~|*9Zn;HQi;36Qk+s!kt2Q-kek0M}4Jnj$ z2%5+lYUdaa3U_$W?X$Iz`B>1}wqqF`+E3zot4*$A3qT{Pw6?L>3^wg2pr`#B6`2c^ zt|EW^_QDr$AZVtJ>_vdexux80CgRxz&EBA-(^VPST=wDF`p&tvEj*O4-|YB3BjG?{O6Wbs$ zwkob;CNQN8jRw;wxr%~&_SRex&hM@U(cjPoP1?(0MEM*76NaFLyD^hVVZ12Q{y7rK zAr%sVOpM~JM&LMbcU1g6o#k>F5zUBFlyGZr%%~pf+}I(6si7hZ%4hx(;IM=f1oz;j zNDPabPD!jS7s}odc%OYl}=ZBE;vk9 z8e@@Q@F2=o?_!bsY-&9hv$81@GxO+_#1~|S<>Oz7G>>191@geHnKfGeh5GN(#!#L- zI}Re6AhFMX;#7l1rR^ncsa0@(e0KgI`j|5F`k&>+-^mJIkoeVE5IsA4f2Ip*G~U0Z zJP}J3oX_)gqM~GCYCNqHKNu=WmIV(Y{Al=FI*OkgS|P=Rl9HJ;I|v>`nog&t&4LCG zqA6RL7sC8qri(kh{-0Kw`v3Lu(`PS^qcpiu92@<=HT}Q8zklcd-AZZhZ+%}c!3`$X z**dLGaFk1FEJBCU2U$}EA4buBH2M$(!M%H6kFdcR%Rz7nKjI25;e3@LT*9-$TsEJ| zJV9_7T!yB&zy4q2ll>N4mgit_3Bqpp!6kh7^!Wo^0@(NNgxW4~m+;};&*d9;blUNv zBNE?Tt~T`sgR^kQlOu*dRRy&pS1wOOPC13%zNX4 zlr^@ILgOg3rxQBEI67HiFmG*+t*5P#9S!@--TXZQ`Op|v-t*}UK(}`T?$Tc0d zs@@0TZqV26|5dThh9*}rf)lPXo7l%)>{1ANDPSphf^wQO%Y!lv=44SOhjPAex#blE z4;mBffi;R$(<&l-)nvPFC#}9fylrF3=Bil=d7;3jz)>`%j7TT#Yst{x7BxPvvCT-V zbDR5SLKG%O#8gM{)+Q&?b6i0}r&E+J$rsT;wasDmORltMR>2QM&FPVl8N9LP+a%Yf zGgcsMYOaQeRAkM-7gS1n3{fU<4Bi$UVh0OJ5_FWhtPv}hd?Bj@K0&=iXbW6*=21g z*=;K)|M|*4czxVd;?*H6MSqmi~8O4tpx%sBn z!#V6G-|NC)eumahqJlTh_}0$us{~)+47t6sILRqXP&V#w+T^agw#C3-Go1@@F&INE zldy0<*WZUOSS8G?$21tjV1iR2F|;qOW~PDe5sADMgVOC=Z+z(aQ5BxQst9dnPai3MMv)F3eyGfsaiVJn}s(S|_i7EF7>$VrjC>Y-f&Q?dey)(gsc4PKE) z6<(Otobss{*V9e;Srv;k%{kSpp`9Rfl4~K=(B?)PDmn{^jOSEitaFJ&lF`tT&h5;K z(&S$0xb8G)b;*0n+-<(tp?O6Qm=S6hbMG{|TwtZ3eGbXj$7koI&ulxREq&(~mJLV6kXK7DBySD_)W<9W|` z-T2ZBD$`XRqk?Kof7eh-Bwe7~s!yKPXGlScCHMCZhPhDfOCdd|pBI@jZHppi=2MFia;_<}o`lNd7+p5LuF@;nEt&LHh?Hd2S%Zlg$|20%BBGUjS$-2DlKxnUZ}ZUWiAXeaUYg3II%mQxB_qu{}r{i z5IjIelv)az{D`ZqS@{uHUd9wh>Ws%&L$d`?5BVAP1Q&IK< zg(CH#k1t?iW|=}{BO7G5 z)k5JhnijzGbYg$>q#tRKJh!usq521*w!{3BLYJob#p>+;KetJ}?fPIB4*UBnr2%wZ zX>2j3ze+z{ZIHO-zVnq`TRY!eJ@B`%X1dls-l^`cU`}hcUf&slb_5+B^g!z#UH0Af z_`Ag#+Fskr8PP=NYCCttR&6*WVxo)#xY;A=#J={>0V_jW!R`s$2)H1f|j~) zxFpV~(iTulbJ-w+F`U?Hud8as2JGO--@SKL)S!bXkIJY&v zfPh-COoNU!3W^2Q{VfC|HQq^%{cxSF=XdFP6cd{M$|dvHD@e&fV0 v8dTJ~YYR}KZ}I5)ICGiy)!= 1.19' +maintainers: +- email: info@digitalis.io + name: Digitalis.IO +name: vals-operator +type: application +version: 0.3.1 diff --git a/charts/vals-operator/vals-operator/0.3.1/README.md b/charts/vals-operator/vals-operator/0.3.1/README.md new file mode 100644 index 000000000..671ae9ceb --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/README.md @@ -0,0 +1,35 @@ +vals-operator +============= +This helm chart installs the Digitalis Vals Operator to manage sync secrets from supported backends into Kubernetes + +Current chart version is `0.3.0` + + +## Chart Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| args | list | `[]` | | +| env | list | `[]` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.repository | string | `"digitalisdocker/vals-operator"` | | +| image.tag | string | `""` | | +| imagePullSecrets | list | `[]` | | +| manageCrds | bool | `true` | | +| nameOverride | string | `""` | | +| nodeSelector | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| secretEnv | list | `[]` | | +| securityContext | object | `{}` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| serviceMonitor.enabled | bool | `false` | | +| serviceMonitor.labels | object | `{}` | | +| tolerations | list | `[]` | | +| volumeMounts | list | `[]` | | +| volumes | list | `[]` | | diff --git a/charts/vals-operator/vals-operator/0.3.1/app-readme.md b/charts/vals-operator/vals-operator/0.3.1/app-readme.md new file mode 100644 index 000000000..3458f2059 --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/app-readme.md @@ -0,0 +1,9 @@ +# Vals-Operator + +Here at [Digitalis](https://digitalis.io) we love [vals](https://github.com/variantdev/vals), it's a tool we use daily to keep secrets stored securely. We also use [secrets-manager](https://github.com/tuenti/secrets-manager) on the Kubernetes deployment we manage. Inspired by these two wonderful tools we have created this operator. + +*vals-operator* syncs secrets from any secrets store supported by [vals](https://github.com/variantdev/vals) into Kubernetes. It works very similarly to [secrets-manager](https://github.com/tuenti/secrets-manager) and the code is actually based on it. Where they differ is that it not just supports HashiCorp Vault but many other secrets stores. + +## Mirroring secrets + +We have also added the ability to copy secrets between namespaces. It uses the format `ref+k8s://namespace/secret#key`. This way you can keep secrets generated in one namespace in sync with any other namespace in the cluster. diff --git a/charts/vals-operator/vals-operator/0.3.1/crds/valssecrets.yaml b/charts/vals-operator/vals-operator/0.3.1/crds/valssecrets.yaml new file mode 100644 index 000000000..406ba1e83 --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/crds/valssecrets.yaml @@ -0,0 +1,130 @@ + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.4.1 + "helm.sh/hook": crd-install + "helm.sh/hook-delete-policy": "before-hook-creation" + creationTimestamp: null + name: valssecrets.digitalis.io +spec: + group: digitalis.io + names: + kind: ValsSecret + listKind: ValsSecretList + plural: valssecrets + singular: valssecret + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + description: ValsSecret is the Schema for the valssecrets API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ValsSecretSpec defines the desired state of ValsSecret + properties: + data: + additionalProperties: + properties: + encoding: + description: Encoding type for the secret. Only base64 supported. + Optional + type: string + ref: + description: Ref value to the secret in the format ref+backend://path + https://github.com/variantdev/vals + type: string + required: + - ref + type: object + type: object + databases: + items: + properties: + driver: + description: Defines the database type + type: string + hosts: + description: List of hosts to connect to, they'll be tried in + sequence until one succeeds + items: + type: string + type: array + loginCredentials: + description: Credentials to access the database + properties: + namespace: + description: Optional namespace of the secret, default current + namespace + type: string + passwordKey: + description: Key in the secret containing the database username + type: string + secretName: + description: Name of the secret containing the credentials + to be able to log in to the database + type: string + usernameKey: + description: Key in the secret containing the database username + type: string + required: + - passwordKey + - secretName + type: object + passwordKey: + description: Key in the secret containing the database username + type: string + port: + description: Database port number + type: integer + userHost: + description: Used for MySQL only, the host part for the username + type: string + usernameKey: + description: Key in the secret containing the database username + type: string + required: + - driver + - hosts + - passwordKey + type: object + type: array + name: + type: string + ttl: + format: int64 + type: integer + type: + type: string + required: + - data + type: object + status: + description: ValsSecretStatus defines the observed state of ValsSecret + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/vals-operator/vals-operator/0.3.1/questions.yaml b/charts/vals-operator/vals-operator/0.3.1/questions.yaml new file mode 100644 index 000000000..7976cff0c --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/questions.yaml @@ -0,0 +1,26 @@ +questions: +#image configurations +- variable: image.repository + default: "digitalisdocker/vals-operator" + description: image registry + type: string + label: Image Registry + group: "Container Images" +- variable: image.tag + default: "v0.3.0" + description: Image tag + type: string + label: Image Tag + group: "Container Images" +- variable: imagePullSecrets + default: "" + description: secret name to pull image + type: string + label: Image Pull Secrets + group: "Container Images" +- variable: environmentSecret + default: "" + description: "The secret containing env variables to access the backend secrets store." + label: Config Secret + type: string + group: "Settings" diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/NOTES.txt b/charts/vals-operator/vals-operator/0.3.1/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/_helpers.tpl b/charts/vals-operator/vals-operator/0.3.1/templates/_helpers.tpl new file mode 100644 index 000000000..dcd31f04a --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "vals-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "vals-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "vals-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "vals-operator.labels" -}} +helm.sh/chart: {{ include "vals-operator.chart" . }} +{{ include "vals-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "vals-operator.selectorLabels" -}} +app.kubernetes.io/name: {{ include "vals-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "vals-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "vals-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/crds.yaml b/charts/vals-operator/vals-operator/0.3.1/templates/crds.yaml new file mode 100644 index 000000000..0b71ef8c6 --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/templates/crds.yaml @@ -0,0 +1,6 @@ +{{- if .Values.manageCrds -}} +{{- range $path, $bytes := .Files.Glob "crds/*.yaml" }} +{{ $.Files.Get $path }} +--- +{{- end }} +{{- end }} diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/deployment.yaml b/charts/vals-operator/vals-operator/0.3.1/templates/deployment.yaml new file mode 100644 index 000000000..334c566e7 --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/templates/deployment.yaml @@ -0,0 +1,73 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "vals-operator.fullname" . }} + labels: + {{- include "vals-operator.labels" . | nindent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + {{- include "vals-operator.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "vals-operator.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "vals-operator.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.args }} + args: + {{- toYaml .Values.args | nindent 12 }} + {{- end }} + {{- if .Values.environmentSecret }} + envFrom: + - secretRef: + name: "{{ .Values.environmentSecret }}" + {{- else }} + envFrom: + {{- toYaml .Values.secretEnv | nindent 12 }} + {{- end }} + {{- if .Values.env }} + env: + {{- toYaml .Values.env | nindent 12 }} + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.volumeMounts }} + volumeMounts: + {{- toYaml .Values.volumeMounts | nindent 12 }} + {{- end }} + ports: + - containerPort: {{ .Values.metricsPort | default 8080 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.volumes }} + volumes: + {{- toYaml .Values.volumes | nindent 8 }} + {{- end }} diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/serviceaccount.yaml b/charts/vals-operator/vals-operator/0.3.1/templates/serviceaccount.yaml new file mode 100644 index 000000000..67f271063 --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/templates/serviceaccount.yaml @@ -0,0 +1,64 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: vals-operator + labels: + {{- include "vals-operator.labels" . | nindent 4 }} +rules: +- apiGroups: + - "" + resources: + - "secrets" + verbs: + - "get" + - "list" + - "watch" + - "update" + - "delete" + - "create" +- apiGroups: + - "" + resources: + - "events" + verbs: + - "create" + - "patch" +- apiGroups: + - "digitalis.io" + resources: + - "valssecrets" + verbs: + - "get" + - "list" + - "watch" + - "update" + - "delete" + - "create" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: vals-operator + labels: + {{- include "vals-operator.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: vals-operator +subjects: + - kind: ServiceAccount + name: {{ include "vals-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "vals-operator.serviceAccountName" . }} + labels: + {{- include "vals-operator.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/vals-operator/vals-operator/0.3.1/templates/servicemonitor.yaml b/charts/vals-operator/vals-operator/0.3.1/templates/servicemonitor.yaml new file mode 100644 index 000000000..4b6e11eeb --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/templates/servicemonitor.yaml @@ -0,0 +1,37 @@ +{{- if .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "vals-operator.fullname" . }} + labels: + {{- if .Values.serviceMonitor.labels }} + {{ toYaml .Values.serviceMonitor.labels | nindent 4 }} + {{- else }} + app: {{ template "vals-operator.name" . }} + chart: {{ template "vals-operator.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + {{- end }} + {{- if .Values.serviceMonitor.namespace }} + namespace: {{ .Values.serviceMonitor.namespace }} + {{- end }} +spec: + endpoints: + - targetPort: "metrics" + {{- if .Values.serviceMonitor.interval }} + interval: {{ .Values.serviceMonitor.interval }} + {{- end }} + {{- if .Values.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }} + {{- end }} + path: /metrics + port: {{ .Values.metricsPort | default 8080 }} + tlsConfig: + insecureSkipVerify: true + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: + {{- include "vals-operator.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/charts/vals-operator/vals-operator/0.3.1/values.yaml b/charts/vals-operator/vals-operator/0.3.1/values.yaml new file mode 100644 index 000000000..5bc2d97ad --- /dev/null +++ b/charts/vals-operator/vals-operator/0.3.1/values.yaml @@ -0,0 +1,106 @@ +replicaCount: 1 + +image: + repository: digitalisdocker/vals-operator + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +manageCrds: true + +# additional arguments to operator +args: [] + # -exclude-namespaces string + # Comma separated list of namespaces to ignore. + # -health-probe-bind-address string + # The address the probe endpoint binds to. (default ":8081") + # -kubeconfig string + # Paths to a kubeconfig. Only required if out-of-cluster. + # -leader-elect + # Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager. + # -metrics-bind-address string + # The address the metric endpoint binds to. (default ":8080") + # -reconcile-period duration + # How often the controller will re-queue vals-operator events. (default 5s) + # -record-changes + # Records every time a secret has been updated. You can view them with kubectl describe. It may also be disabled globally and enabled per secret via the annotation 'vals-operator.digitalis.io/record: "true"' (default true) + # -ttl duration + # How often to check backend for updates. (default 5m0s) + # -watch-namespaces string + # Comma separated list of namespaces that vals-operator will watch. + # -zap-devel + # Development Mode defaults(encoder=consoleEncoder,logLevel=Debug,stackTraceLevel=Warn). Production Mode defaults(encoder=jsonEncoder,logLevel=Info,stackTraceLevel=Error) (default true) + # -zap-encoder value + # Zap log encoding (one of 'json' or 'console') + # -zap-log-level value + # Zap Level to configure the verbosity of logging. Can be one of 'debug', 'info', 'error', or any integer value > 0 which corresponds to custom debug levels of increasing verbosity + # -zap-stacktrace-level value + # Zap Level at and above which stacktraces are captured (one of 'info', 'error', 'panic'). + + +environmentSecret: "" + +# See https://github.com/variantdev/vals +# for information on setting up your backend environment. +env: [] + # - name: VAULT_SKIP_VERIFY + # value: "true" + +secretEnv: [] + # - secretRef: + # name: aws-creds + +volumes: [] + # - name: creds + # secret: + # secretName: gcs-credentials +volumeMounts: [] + # - name: creds + # mountPath: /secret + # readOnly: true + + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +metricsPort: 8080 +serviceMonitor: + # When set to true then use a ServiceMonitor to collect metrics + enabled: false + # Custom labels to use in the ServiceMonitor to be matched with a specific Prometheus + labels: {} + # Set the namespace the ServiceMonitor should be deployed to + # namespace: default + # Set how frequently Prometheus should scrape + # interval: 30s + # Set timeout for scrape + # scrapeTimeout: 10s + +resources: {} + +nodeSelector: {} + +tolerations: [] + +affinity: {}