Michal.Wrobel/openbao-helm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Allow additional annotations for standby and active services via config (#896)

Browse source 
* Allow additional annotations for standby and active services via config
Co-authored-by: Kyle Schochenmaier <kschoche@gmail.com>
This commit is contained in:
tekicat 2023-09-26 21:28:54 +01:00 committed by GitHub
parent 0f47d83f36
commit 7728f8c650
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
7 changed files with 114 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
templates/_helpers.tpl
View file

@ -710,6 +710,33 @@ Sets extra vault server Service annotations
{{- end }}
{{- end -}}
{{/*
Sets extra vault server Service (active) annotations
*/}}
{{- define "vault.service.active.annotations" -}}
{{- if .Values.server.service.active.annotations }}
{{- $tp := typeOf .Values.server.service.active.annotations }}
{{- if eq $tp "string" }}
{{- tpl .Values.server.service.active.annotations . | nindent 4 }}
{{- else }}
{{- toYaml .Values.server.service.active.annotations | nindent 4 }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Sets extra vault server Service annotations
*/}}
{{- define "vault.service.standby.annotations" -}}
{{- if .Values.server.service.standby.annotations }}
{{- $tp := typeOf .Values.server.service.standby.annotations }}
{{- if eq $tp "string" }}
{{- tpl .Values.server.service.standby.annotations . | nindent 4 }}
{{- else }}
{{- toYaml .Values.server.service.standby.annotations | nindent 4 }}
{{- end }}
{{- end }}
{{- end -}}
{{/*
Sets PodSecurityPolicy annotations
*/}}

3
templates/server-ha-active-service.yaml
View file

@ -22,7 +22,8 @@ metadata:
app.kubernetes.io/managed-by: {{ .Release.Service }}
vault-active: "true"
annotations:
{{ template "vault.service.annotations" .}}
{{- template "vault.service.active.annotations" . }}
{{- template "vault.service.annotations" . }}
spec:
{{- if .Values.server.service.type}}
type: {{ .Values.server.service.type }}

3
templates/server-ha-standby-service.yaml
View file

@ -21,7 +21,8 @@ metadata:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
annotations:
{{ template "vault.service.annotations" .}}
{{- template "vault.service.standby.annotations" . }}
{{- template "vault.service.annotations" . }}
spec:
{{- if .Values.server.service.type}}
type: {{ .Values.server.service.type }}

25
test/unit/server-ha-active-service.bats
View file

@ -13,6 +13,31 @@ load _helpers
[ "${actual}" = "true" ]
}
@test "server/ha-active-Service: with active annotations" {
cd `chart_dir`
local actual=$(helm template \
--show-only templates/server-ha-active-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.active.annotations=vaultIsAwesome: true' \
. | tee /dev/stderr |
yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
}
@test "server/ha-active-Service: with both annotations set" {
cd `chart_dir`
local object=$(helm template \
--show-only templates/server-ha-active-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.active.annotations=vaultIsAwesome: true' \
--set 'server.service.annotations=vaultIsNotAwesome: false' \
. | tee /dev/stderr |
yq -r '.metadata' | tee /dev/stderr)
local actual=$(echo "$object" | yq '.annotations["vaultIsAwesome"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
actual=$(echo "$object" | yq '.annotations["vaultIsNotAwesome"]' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/ha-active-Service: disable with ha.enabled false" {
cd `chart_dir`
local actual=$( (helm template \

36
test/unit/server-ha-standby-service.bats
View file

@ -24,6 +24,42 @@ load _helpers
[ "${actual}" = "true" ]
}
@test "server/ha-standby-Service: with standby annotations string" {
cd `chart_dir`
local actual=$(helm template \
--show-only templates/server-ha-standby-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.standby.annotations=vaultIsAwesome: true' \
. | tee /dev/stderr |
yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
}
@test "server/ha-standby-Service: with standby annotations yaml" {
cd `chart_dir`
local actual=$(helm template \
--show-only templates/server-ha-standby-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.standby.annotations.vaultIsAwesome=true' \
. | tee /dev/stderr |
yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
}
@test "server/ha-standby-Service: with both annotations set" {
cd `chart_dir`
local object=$(helm template \
--show-only templates/server-ha-standby-service.yaml \
--set 'server.ha.enabled=true' \
--set 'server.service.standby.annotations=vaultIsAwesome: true' \
--set 'server.service.annotations=vaultIsNotAwesome: false' \
. | tee /dev/stderr |
yq -r '.metadata' | tee /dev/stderr)
local actual=$(echo "$object" | yq '.annotations["vaultIsAwesome"]' | tee /dev/stderr)
[ "${actual}" = "true" ]
actual=$(echo "$object" | yq '.annotations["vaultIsNotAwesome"]' | tee /dev/stderr)
[ "${actual}" = "false" ]
}
@test "server/ha-standby-Service: disable with ha.enabled false" {
cd `chart_dir`
local actual=$( (helm template \

12
values.schema.json
View file

@ -922,6 +922,12 @@
"properties": {
"enabled": {
"type": "boolean"
},
"annotations": {
"type": [
"object",
"string"
]
}
}
},
@ -956,6 +962,12 @@
"properties": {
"enabled": {
"type": "boolean"
},
"annotations": {
"type": [
"object",
"string"
]
}
}
},

12
values.yaml
View file

@ -658,13 +658,21 @@ server:
service:
enabled: true
# Enable or disable the vault-active service, which selects Vault pods that
# have labelled themselves as the cluster leader with `vault-active: "true"`
# have labeled themselves as the cluster leader with `vault-active: "true"`.
active:
enabled: true
# Extra annotations for the service definition. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the active service.
annotations: {}
# Enable or disable the vault-standby service, which selects Vault pods that
# have labelled themselves as a cluster follower with `vault-active: "false"`
# have labeled themselves as a cluster follower with `vault-active: "false"`.
standby:
enabled: true
# Extra annotations for the service definition. This can either be YAML or a
# YAML-formatted multi-line templated string map of the annotations to apply
# to the standby service.
annotations: {}
# If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}`
# When disabled, services may select Vault pods not deployed from the chart.
# Does not affect the headless vault-internal service with `ClusterIP: None`