Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 440f568

Browse files
tvorantvoran
committedOct 21, 2021
Merge remote-tracking branch 'origin/main' into ingressClassName-continued
2 parents 018ebf6 + 6914c4d commit 440f568

35 files changed

+574
-148
lines changed
 

‎.circleci/config.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ workflows:
9494
- bats-unit-test
9595
filters:
9696
branches:
97-
only: master
97+
only: main
9898
update-helm-charts-index:
9999
jobs:
100100
- update-helm-charts-index:

‎CHANGELOG.md

+21
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,28 @@
11
## Unreleased
22

3+
Improvements:
4+
* Support Ingress stable networking API [GH-590](https://github.com/hashicorp/vault-helm/pull/590)
5+
6+
## 0.16.1 (September 29th, 2021)
7+
8+
CHANGES:
9+
* Vault image default 1.8.3
10+
* Vault K8s image default 0.13.1
11+
12+
## 0.16.0 (September 16th, 2021)
13+
14+
CHANGES:
15+
* Support for deploying a leader-elector container with the [vault-k8s injector](https://github.com/hashicorp/vault-k8s) injector will be removed in version 0.18.0 of this chart since vault-k8s now uses an internal mechanism to determine leadership. To enable the deployment of the leader-elector container for use with vault-k8s 0.12.0 and earlier, set `useContainer=true`.
16+
17+
Improvements:
18+
* Make CSI provider `hostPaths` configurable via `csi.daemonSet.providersDir` and `csi.daemonSet.kubeletRootDir` [GH-603](https://github.com/hashicorp/vault-helm/pull/603)
19+
* Support vault-k8s internal leader election [GH-568](https://github.com/hashicorp/vault-helm/pull/568) [GH-607](https://github.com/hashicorp/vault-helm/pull/607)
20+
21+
## 0.15.0 (August 23rd, 2021)
22+
323
Improvements:
424
* Add imagePullSecrets on server test [GH-572](https://github.com/hashicorp/vault-helm/pull/572)
25+
* Add injector.webhookAnnotations chart option [GH-584](https://github.com/hashicorp/vault-helm/pull/584)
526

627
## 0.14.0 (July 28th, 2021)
728

‎CONTRIBUTING.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ quickly merge or address your contributions.
2626

2727
* Make sure you test against the latest released version. It is possible
2828
we already fixed the bug you're experiencing. Even better is if you can test
29-
against `master`, as bugs are fixed regularly but new versions are only
29+
against `main`, as bugs are fixed regularly but new versions are only
3030
released every few months.
3131

3232
* Provide steps to reproduce the issue, and if possible include the expected
@@ -121,7 +121,7 @@ may not be properly cleaned up. We recommend recycling the Kubernetes cluster to
121121
start from a clean slate.
122122

123123
**Note:** There is a Terraform configuration in the
124-
[`test/terraform/`](https://github.com/hashicorp/vault-helm/tree/master/test/terraform) directory
124+
[`test/terraform/`](https://github.com/hashicorp/vault-helm/tree/main/test/terraform) directory
125125
that can be used to quickly bring up a GKE cluster and configure
126126
`kubectl` and `helm` locally. This can be used to quickly spin up a test
127127
cluster for acceptance tests. Unit tests _do not_ require a running Kubernetes

‎Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: vault
3-
version: 0.14.0
4-
appVersion: 1.8.0
3+
version: 0.16.1
4+
appVersion: 1.8.3
55
kubeVersion: ">= 1.14.0-0"
66
description: Official HashiCorp Vault Chart
77
home: https://www.vaultproject.io

‎Makefile

+1
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ else
4040
-e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
4141
-e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
4242
-e KUBECONFIG=/helm-test/.kube/config \
43+
-e VAULT_LICENSE_CI=${VAULT_LICENSE_CI} \
4344
-w /helm-test \
4445
$(TEST_IMAGE) \
4546
make acceptance

‎templates/_helpers.tpl

+50
Original file line numberDiff line numberDiff line change
@@ -353,6 +353,21 @@ Sets extra injector service annotations
353353
{{- end }}
354354
{{- end -}}
355355

356+
{{/*
357+
Sets extra injector webhook annotations
358+
*/}}
359+
{{- define "injector.webhookAnnotations" -}}
360+
{{- if .Values.injector.webhookAnnotations }}
361+
annotations:
362+
{{- $tp := typeOf .Values.injector.webhookAnnotations }}
363+
{{- if eq $tp "string" }}
364+
{{- tpl .Values.injector.webhookAnnotations . | nindent 4 }}
365+
{{- else }}
366+
{{- toYaml .Values.injector.webhookAnnotations | nindent 4 }}
367+
{{- end }}
368+
{{- end }}
369+
{{- end -}}
370+
356371
{{/*
357372
Sets extra ui service annotations
358373
*/}}
@@ -640,3 +655,38 @@ imagePullSecrets:
640655
{{- end -}}
641656
{{- end -}}
642657
{{- end -}}
658+
659+
{{/*
660+
externalTrafficPolicy sets a Service's externalTrafficPolicy if applicable.
661+
Supported inputs are Values.server.service and Values.ui
662+
*/}}
663+
{{- define "service.externalTrafficPolicy" -}}
664+
{{- $type := "" -}}
665+
{{- if .serviceType -}}
666+
{{- $type = .serviceType -}}
667+
{{- else if .type -}}
668+
{{- $type = .type -}}
669+
{{- end -}}
670+
{{- if and .externalTrafficPolicy (or (eq $type "LoadBalancer") (eq $type "NodePort")) }}
671+
externalTrafficPolicy: {{ .externalTrafficPolicy }}
672+
{{- else }}
673+
{{- end }}
674+
{{- end -}}
675+
676+
{{/*
677+
loadBalancer configuration for the the UI service.
678+
Supported inputs are Values.ui
679+
*/}}
680+
{{- define "service.loadBalancer" -}}
681+
{{- if eq (.serviceType | toString) "LoadBalancer" }}
682+
{{- if .loadBalancerIP }}
683+
loadBalancerIP: {{ .loadBalancerIP }}
684+
{{- end }}
685+
{{- with .loadBalancerSourceRanges }}
686+
loadBalancerSourceRanges:
687+
{{- range . }}
688+
- {{ . }}
689+
{{- end }}
690+
{{- end -}}
691+
{{- end }}
692+
{{- end -}}

‎templates/csi-daemonset.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ spec:
4444
- name: providervol
4545
mountPath: "/provider"
4646
- name: mountpoint-dir
47-
mountPath: /var/lib/kubelet/pods
47+
mountPath: {{ .Values.csi.daemonSet.kubeletRootDir }}/pods
4848
mountPropagation: HostToContainer
4949
{{- if .Values.csi.volumeMounts }}
5050
{{- toYaml .Values.csi.volumeMounts | nindent 12}}
@@ -70,10 +70,10 @@ spec:
7070
volumes:
7171
- name: providervol
7272
hostPath:
73-
path: "/etc/kubernetes/secrets-store-csi-providers"
73+
path: {{ .Values.csi.daemonSet.providersDir }}
7474
- name: mountpoint-dir
7575
hostPath:
76-
path: /var/lib/kubelet/pods
76+
path: {{ .Values.csi.daemonSet.kubeletRootDir }}/pods
7777
{{- if .Values.csi.volumes }}
7878
{{- toYaml .Values.csi.volumes | nindent 8}}
7979
{{- end }}

‎templates/injector-certs-secret.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ metadata:
77
app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
88
app.kubernetes.io/instance: {{ .Release.Name }}
99
app.kubernetes.io/managed-by: {{ .Release.Service }}
10-
{{- end }}
10+
{{- end }}

‎templates/injector-deployment.yaml

+11-7
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,10 @@ spec:
110110
- name: AGENT_INJECT_TEMPLATE_CONFIG_EXIT_ON_RETRY_FAILURE
111111
value: "{{ .Values.injector.agentDefaults.templateConfig.exitOnRetryFailure }}"
112112
{{- include "vault.extraEnvironmentVars" .Values.injector | nindent 12 }}
113+
- name: POD_NAME
114+
valueFrom:
115+
fieldRef:
116+
fieldPath: metadata.name
113117
args:
114118
- agent-inject
115119
- 2>&1
@@ -133,13 +137,7 @@ spec:
133137
periodSeconds: 2
134138
successThreshold: 1
135139
timeoutSeconds: 5
136-
{{- if .Values.injector.certs.secretName }}
137-
volumeMounts:
138-
- name: webhook-certs
139-
mountPath: /etc/webhook/certs
140-
readOnly: true
141-
{{- end }}
142-
{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
140+
{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) (eq (.Values.injector.leaderElector.useContainer | toString) "true") }}
143141
- name: leader-elector
144142
image: {{ .Values.injector.leaderElector.image.repository }}:{{ .Values.injector.leaderElector.image.tag }}
145143
args:
@@ -168,6 +166,12 @@ spec:
168166
successThreshold: 1
169167
timeoutSeconds: 5
170168
{{- end }}
169+
{{- if .Values.injector.certs.secretName }}
170+
volumeMounts:
171+
- name: webhook-certs
172+
mountPath: /etc/webhook/certs
173+
readOnly: true
174+
{{- end }}
171175
{{- if .Values.injector.certs.secretName }}
172176
volumes:
173177
- name: webhook-certs

‎templates/injector-leader-endpoint.yaml

+4-2
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,14 @@
1-
{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
1+
{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) (eq (.Values.injector.leaderElector.useContainer | toString) "true")}}
22
# This is created here so it can be cleaned up easily, since if
33
# the endpoint is left around the leader won't expire for about a minute.
44
apiVersion: v1
55
kind: Endpoints
66
metadata:
77
name: {{ template "vault.fullname" . }}-agent-injector-leader
8+
annotations:
9+
deprecated: "true"
810
labels:
911
app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
1012
app.kubernetes.io/instance: {{ .Release.Name }}
1113
app.kubernetes.io/managed-by: {{ .Release.Service }}
12-
{{- end }}
14+
{{- end }}

‎templates/injector-mutating-webhook.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ metadata:
1111
app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
1212
app.kubernetes.io/instance: {{ .Release.Name }}
1313
app.kubernetes.io/managed-by: {{ .Release.Service }}
14+
{{- template "injector.webhookAnnotations" . }}
1415
webhooks:
1516
- name: vault.hashicorp.com
1617
sideEffects: None

‎templates/injector-role.yaml

+8-2
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,17 @@ metadata:
99
app.kubernetes.io/managed-by: {{ .Release.Service }}
1010
rules:
1111
- apiGroups: [""]
12-
resources: ["endpoints", "secrets"]
12+
resources: ["secrets", "configmaps", "endpoints"]
1313
verbs:
1414
- "create"
1515
- "get"
1616
- "watch"
1717
- "list"
1818
- "update"
19-
{{- end }}
19+
- apiGroups: [""]
20+
resources: ["pods"]
21+
verbs:
22+
- "get"
23+
- "patch"
24+
- "delete"
25+
{{- end }}

‎templates/injector-rolebinding.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@ subjects:
1515
- kind: ServiceAccount
1616
name: {{ template "vault.fullname" . }}-agent-injector
1717
namespace: {{ .Release.Namespace }}
18-
{{- end }}
18+
{{- end }}

‎templates/server-ha-active-service.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ spec:
2121
{{- if .Values.server.service.clusterIP }}
2222
clusterIP: {{ .Values.server.service.clusterIP }}
2323
{{- end }}
24+
{{- include "service.externalTrafficPolicy" .Values.server.service }}
2425
publishNotReadyAddresses: true
2526
ports:
2627
- name: {{ include "vault.scheme" . }}

‎templates/server-ha-standby-service.yaml

+2-1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ spec:
2121
{{- if .Values.server.service.clusterIP }}
2222
clusterIP: {{ .Values.server.service.clusterIP }}
2323
{{- end }}
24+
{{- include "service.externalTrafficPolicy" .Values.server.service }}
2425
publishNotReadyAddresses: true
2526
ports:
2627
- name: {{ include "vault.scheme" . }}
@@ -38,4 +39,4 @@ spec:
3839
component: server
3940
vault-active: "false"
4041
{{- end }}
41-
{{- end }}
42+
{{- end }}

‎templates/server-ingress.yaml

+11-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@
88
{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
99
{{- end }}
1010
{{- $servicePort := .Values.server.service.port -}}
11-
{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
11+
{{- $kubeVersion := .Capabilities.KubeVersion.Version }}
12+
{{ if semverCompare ">= 1.19.0-0" $kubeVersion }}
13+
apiVersion: networking.k8s.io/v1
14+
{{ else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
1215
apiVersion: networking.k8s.io/v1beta1
1316
{{ else }}
1417
apiVersion: extensions/v1beta1
@@ -51,8 +54,15 @@ spec:
5154
{{- range (.paths | default (list "/")) }}
5255
- path: {{ . }}
5356
backend:
57+
{{ if semverCompare ">= 1.19.0-0" $kubeVersion }}
58+
service:
59+
name: {{ $serviceName }}
60+
port:
61+
number: {{ $servicePort }}
62+
{{ else }}
5463
serviceName: {{ $serviceName }}
5564
servicePort: {{ $servicePort }}
65+
{{ end }}
5666
{{- end }}
5767
{{- end }}
5868
{{- end }}

‎templates/server-service.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ spec:
2121
{{- if .Values.server.service.clusterIP }}
2222
clusterIP: {{ .Values.server.service.clusterIP }}
2323
{{- end }}
24+
{{- include "service.externalTrafficPolicy" .Values.server.service }}
2425
# We want the servers to become available even if they're not ready
2526
# since this DNS is also used for join operations.
2627
publishNotReadyAddresses: true

‎templates/ui-service.yaml

+2-10
Original file line numberDiff line numberDiff line change
@@ -30,16 +30,8 @@ spec:
3030
nodePort: {{ .Values.ui.serviceNodePort }}
3131
{{- end }}
3232
type: {{ .Values.ui.serviceType }}
33-
{{- if and (eq (.Values.ui.serviceType | toString) "LoadBalancer") (.Values.ui.loadBalancerSourceRanges) }}
34-
loadBalancerSourceRanges:
35-
{{- range $cidr := .Values.ui.loadBalancerSourceRanges }}
36-
- {{ $cidr }}
37-
{{- end }}
38-
{{- end }}
39-
{{- if and (eq (.Values.ui.serviceType | toString) "LoadBalancer") (.Values.ui.loadBalancerIP) }}
40-
loadBalancerIP: {{ .Values.ui.loadBalancerIP }}
41-
{{- end }}
33+
{{- include "service.externalTrafficPolicy" .Values.ui }}
34+
{{- include "service.loadBalancer" .Values.ui }}
4235
{{- end -}}
43-
4436
{{- end }}
4537
{{- end }}

‎test/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
The Makefile at the top level of this repo contains a few target that should help with running acceptance tests in your own GKE instance or in a kind cluster.
66

7+
Note that for the Vault Enterprise tests to pass, a `VAULT_LICENSE_CI` environment variable needs to be set to the contents of a valid Vault Enterprise license.
8+
79
### Running in a GKE cluster
810

911
* Set the `GOOGLE_CREDENTIALS` and `CLOUDSDK_CORE_PROJECT` variables at the top of the file. `GOOGLE_CREDENTIALS` should contain the local path to your Google Cloud Platform account credentials in JSON format. `CLOUDSDK_CORE_PROJECT` should be set to the ID of your GCP project.

‎test/acceptance/csi.bats

+2-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ load _helpers
99
kubectl create namespace acceptance
1010

1111
# Install Secrets Store CSI driver
12-
helm install secrets-store-csi-driver https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/master/charts/secrets-store-csi-driver-0.0.20.tgz?raw=true \
12+
CSI_DRIVER_VERSION=0.2.0
13+
helm install secrets-store-csi-driver https://github.com/kubernetes-sigs/secrets-store-csi-driver/blob/v${CSI_DRIVER_VERSION}/charts/secrets-store-csi-driver-${CSI_DRIVER_VERSION}.tgz?raw=true \
1314
--wait --timeout=5m \
1415
--namespace=acceptance \
1516
--set linux.image.pullPolicy="IfNotPresent"

‎test/acceptance/injector-leader-elector.bats

+13-11
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ load _helpers
1212
helm install "$(name_prefix)" \
1313
--wait \
1414
--timeout=5m \
15-
--set="injector.replicas=3" .
15+
--set="injector.replicas=3" \
16+
--set="injector.leaderElector.useContainer=true" .
1617
kubectl wait --for condition=Ready pod -l app.kubernetes.io/name=vault-agent-injector --timeout=5m
1718

1819
pods=($(kubectl get pods -l app.kubernetes.io/name=vault-agent-injector -o json | jq -r '.items[] | .metadata.name'))
@@ -22,21 +23,22 @@ load _helpers
2223
tries=0
2324
until [ $tries -ge 60 ]
2425
do
25-
leader="$(echo "$(kubectl exec ${pods[0]} -c sidecar-injector -- wget --quiet --output-document - localhost:4040)" | jq -r .name)"
26-
[ -n "${leader}" ] && break
27-
((tries++))
26+
## The new internal leader mechanism uses a ConfigMap
27+
owner=$(kubectl get configmaps vault-k8s-leader -o json | jq -r .metadata.ownerReferences\[0\].name)
28+
leader=$(kubectl get pods $owner -o json | jq -r .metadata.name)
29+
[ -n "${leader}" ] && [ "${leader}" != "null" ] && break
30+
31+
## Also check the old leader-elector container
32+
old_leader="$(echo "$(kubectl exec ${pods[0]} -c sidecar-injector -- wget --quiet --output-document - localhost:4040)" | jq -r .name)"
33+
[ -n "${old_leader}" ] && break
34+
35+
((++tries))
2836
sleep .5
2937
done
3038

3139
# Check the leader name is valid - i.e. one of the 3 pods
32-
[[ " ${pods[@]} " =~ " ${leader} " ]]
40+
[[ " ${pods[@]} " =~ " ${leader} " || " ${pods[@]} " =~ " ${old_leader} " ]]
3341

34-
# Check every pod agrees on who the leader is
35-
for pod in "${pods[@]}"
36-
do
37-
pod_leader="$(echo "$(kubectl exec $pod -c sidecar-injector -- wget --quiet --output-document - localhost:4040)" | jq -r .name)"
38-
[ "${pod_leader}" == "${leader}" ]
39-
done
4042
}
4143

4244
setup() {

0 commit comments

Comments
 (0)
Please sign in to comment.