Prepare for release 0.20.1
Improvements:
* `vault-k8s` updated to 0.16.1
CHANGES:
* `vault` service account is now created even if the server is set to disabled, as per before 0.20.0 [GH-737](https://github.com/hashicorp/vault-helm/pull/737)
* Mutating webhook will no longer target the agent injector pod [GH-736](https://github.com/hashicorp/vault-helm/pull/736)
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
Set default object selector for webhooks to exclude injector itself
If `injector.failurePolicy` is set to `Fail`, there is a race condition
where if the mutating webhook config is setup before the injector, then
the injector can fail to start because it tries to inject itself.
We can work around this by ignoring the injector pod in in the webhook
by default.
Thanks to @joeyslalom for the object selector to exclude the pod.
Fixes https://github.com/hashicorp/vault-k8s/issues/258
* Issue #629 Updates to allow customization of the CLUSTER_ADDR and unit tests to go with it
* Issue-#629 removing extra whitespace I added accidently.
* Issue-#629 fixing extra whitespace added.
* Update values.yaml
Co-authored-by: Joaco Muleiro Beltran <joaquinmuleirobeltran@gmail.com>
* Issue #629 adding changelog
Co-authored-by: Joaco Muleiro Beltran <joaquinmuleirobeltran@gmail.com>
VAULT-571 Matching documented behavior and consul
Consul's helm template defaults most of the enabled to the special value
`"-"`, which means to inherit from global. This is what is implied
should happen in Vault as well according to the documentation for the
helm chart:
> [global.enabled] The master enabled/disabled configuration. If this is
> true, most components will be installed by default. If this is false,
> no components will be installed by default and manually opting-in is
> required, such as by setting server.enabled to true.
(https://www.vaultproject.io/docs/platform/k8s/helm/configuration#enabled)
We also simplified the chart logic using a few template helpers.
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
* Add some tests on top of #396
* convert server-route.yaml to unix newlines
* changelog
Co-authored-by: André Becker <andre@arestless.com>
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
* Fix test typo
* Add basic server-test Pod tests
- This covers all existing functionality that matches what's
present in server-statefulset.bats
* Fix server-test helm hook Pod rendering
- Properly adhere to the global.enabled flag and the presence of
the injector.externalVaultAddr setting, the same way that
the servers StatefulSet behaves
* Add volumes and env vars to helm hook test pod
- Uses the same extraEnvironmentVars, volumes and volumeMounts set on
the server statefulset to configure the Vault server test pod used by
the helm test hook
- This is necessary in situations where TLS is configured, but the
certificates are not affiliated with the k8s CA / part of k8s PKI
- Fixes GH-665
* make staticSecretRenderInterval default to empty string
* update values schema to add staticSecretRenderInterval
* add test for default value
* adding changelog entry
Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
