Michal.Wrobel/openbao-helm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support selectively disabling active/standby services and service discovery role (#811)

Browse source
This commit is contained in:
Tom Proctor 2022-11-14 14:10:21 +00:00 committed by GitHub
parent 0110f977b2
commit 21ce5245a3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
12 changed files with 155 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -2,6 +2,8 @@
Features:
* server: Add `extraLabels` for Vault server serviceAccount [GH-806](https://github.com/hashicorp/vault-helm/pull/806)
* server: Add `server.service.active.enabled` and `server.service.standby.enabled` options to selectively disable additional services [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
* server: Add `server.serviceAccount.serviceDiscovery.enabled` option to selectively disable a Vault service discovery role and role binding [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
Bugs:
* server: Quote `.server.ha.clusterAddr` value [GH-810](https://github.com/hashicorp/vault-helm/pull/810)

2
templates/server-discovery-role.yaml
View file

@ -1,7 +1,7 @@
{{ template "vault.mode" . }}
{{- if ne .mode "external" }}
{{- if .serverEnabled -}}
{{- if eq .mode "ha" }}
{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:

2
templates/server-discovery-rolebinding.yaml
View file

@ -1,7 +1,7 @@
{{ template "vault.mode" . }}
{{- if ne .mode "external" }}
{{- if .serverEnabled -}}
{{- if eq .mode "ha" }}
{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
apiVersion: rbac.authorization.k8s.io/v1
{{- else }}

2
templates/server-ha-active-service.yaml
View file

@ -3,6 +3,7 @@
{{- template "vault.serverServiceEnabled" . -}}
{{- if .serverServiceEnabled -}}
{{- if eq .mode "ha" }}
{{- if eq (.Values.server.service.active.enabled | toString) "true" }}
# Service for active Vault pod
apiVersion: v1
kind: Service
@ -44,3 +45,4 @@ spec:
{{- end }}
{{- end }}
{{- end }}
{{- end }}

4
templates/server-ha-standby-service.yaml
View file

@ -3,6 +3,7 @@
{{- template "vault.serverServiceEnabled" . -}}
{{- if .serverServiceEnabled -}}
{{- if eq .mode "ha" }}
{{- if eq (.Values.server.service.standby.enabled | toString) "true" }}
# Service for standby Vault pod
apiVersion: v1
kind: Service
@ -42,4 +43,5 @@ spec:
vault-active: "false"
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

1
templates/server-statefulset.yaml
View file

@ -52,7 +52,6 @@ spec:
{{- if not .Values.global.openshift }}
hostNetwork: {{ .Values.server.hostNetwork }}
{{- end }}
volumes:
{{ template "vault.volumes" . }}
- name: home

41
test/unit/server-discovery-role.bats Executable file
View file

@ -0,0 +1,41 @@
#!/usr/bin/env bats
load _helpers
@test "server/DiscoveryRole: enabled by default with ha" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-role.yaml \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
local actual=$( (helm template \
--show-only templates/server-discovery-role.yaml \
--set 'server.ha.enabled=true' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}
@test "server/DiscoveryRole: can disable with server.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-role.yaml \
--set 'server.enabled=false' \
--set 'server.ha.enabled=true' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/DiscoveryRole: can disable with server.serviceAccount.serviceDiscovery.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-role.yaml \
--set 'server.ha.enabled=true' \
--set 'server.serviceAccount.serviceDiscovery.enabled=false' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}

41
test/unit/server-discovery-rolebinding.bats Executable file
View file

@ -0,0 +1,41 @@
#!/usr/bin/env bats
load _helpers
@test "server/DiscoveryRoleBinding: enabled by default with ha" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-rolebinding.yaml \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
local actual=$( (helm template \
--show-only templates/server-discovery-rolebinding.yaml \
--set 'server.ha.enabled=true' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}
@test "server/DiscoveryRoleBinding: can disable with server.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-rolebinding.yaml \
--set 'server.enabled=false' \
--set 'server.ha.enabled=true' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/DiscoveryRoleBinding: can disable with server.serviceAccount.serviceDiscovery.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-discovery-rolebinding.yaml \
--set 'server.ha.enabled=true' \
--set 'server.serviceAccount.serviceDiscovery.enabled=false' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}

12
test/unit/server-ha-active-service.bats
View file

@ -35,6 +35,18 @@ load _helpers
[ "${actual}" = "false" ]
}
@test "server/ha-active-Service: disable with server.service.active.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-ha-active-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.enabled=true' \
--set 'server.service.active.enabled=false' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/ha-active-Service: type empty by default" {
cd `chart_dir`
local actual=$(helm template \

12
test/unit/server-ha-standby-service.bats
View file

@ -46,6 +46,18 @@ load _helpers
[ "${actual}" = "false" ]
}
@test "server/ha-standby-Service: disable with server.service.standby.enabled false" {
cd `chart_dir`
local actual=$( (helm template \
--show-only templates/server-ha-standby-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.enabled=true' \
--set 'server.service.standby.enabled=false' \
. || echo "---") | tee /dev/stderr |
yq 'length > 0' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/ha-standby-Service: type empty by default" {
cd `chart_dir`
local actual=$(helm template \

27
values.schema.json
View file

@ -851,6 +851,14 @@
"service": {
"type": "object",
"properties": {
"active": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
}
},
"annotations": {
"type": [
"object",
@ -869,6 +877,14 @@
"publishNotReadyAddresses": {
"type": "boolean"
},
"standby": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
}
},
"targetPort": {
"type": "integer"
},
@ -895,8 +911,19 @@
"create": {
"type": "boolean"
},
"extraLabels": {
"type": "object"
},
"name": {
"type": "string"
},
"serviceDiscovery": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean"
}
}
}
}
},

13
values.yaml
View file

@ -596,6 +596,14 @@ server:
# Enables a headless service to be used by the Vault Statefulset
service:
enabled: true
# Enable or disable the vault-active service, which selects Vault pods that
# have labelled themselves as the cluster leader with `vault-active: "true"`
active:
enabled: true
# Enable or disable the vault-standby service, which selects Vault pods that
# have labelled themselves as a cluster follower with `vault-active: "false"`
standby:
enabled: true
# clusterIP controls whether a Cluster IP address is attached to the
# Vault service within Kubernetes. By default, the Vault service will
# be given a Cluster IP address, set to None to disable. When disabled
@ -854,6 +862,11 @@ server:
# Extra labels to attach to the serviceAccount
# This should be a YAML map of the labels to apply to the serviceAccount
extraLabels: {}
# Enable or disable a service account role binding with the permissions required for
# Vault's Kubernetes service_registration config option.
# See https://developer.hashicorp.com/vault/docs/configuration/service-registration/kubernetes
serviceDiscovery:
enabled: true
# Settings for the statefulSet used to run Vault.
statefulSet: