Michal.Wrobel/openbao-helm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
222 commits 11 branches 48 tags 1.4 MiB
Commit graph

51 commits

Author SHA1 Message Date
Jason O'Donnell
6d5a2174d8
Add Vault Helm ent support, service discovery (#250) 
* Add Vault Helm ent support, service discovery

* Fix unit test

* Update test/acceptance/server-ha-enterprise-dr.bats

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

* Update test/acceptance/server-ha-enterprise-dr.bats

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

* Update test/acceptance/server-ha-enterprise-perf.bats

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

* Update test/acceptance/server-ha-enterprise-perf.bats

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

* Update values.yaml

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
 2020-04-09 09:26:58 -04:00
Jason O'Donnell
d57bd7cb6e
Fix bug with api server env (#237) 2020-03-23 12:10:47 -04:00
Jason O'Donnell
58b96dbc10
Add Raft HA support (#229) 
* Add raft support

* Add acceptance test

* Update templates/server-headless-service.yaml

Co-Authored-By: Theron Voran <tvoran@users.noreply.github.com>

* Add notes to raft configurables

Co-authored-by: Theron Voran <tvoran@users.noreply.github.com>
 2020-03-18 15:49:14 -04:00
Theron Voran
2b2b0dd2fa
Added support for external vault (#207) 
Uses Values.injector.externalVaultAddr to control the vault address
env variable and server yaml rendering.

If injector.externalVaultAddr is empty, both the injector and vault
are deployed, with the injector using the local vault. If
injector.externalVaultAddr is not empty, only the injector is
deployed, and it uses the vault at the address specified in
injector.externalVaultAddr.
 2020-02-21 08:16:33 -08:00
Theron Voran
77b973c17f
Helm 3 support (#195) 
Update chart and tests to Helm 3

Co-authored-by: Matt Piekunka <mpiekunk@users.noreply.github.com>
Co-authored-by: Mike Brancato <mbrancato@users.noreply.github.com>
 2020-02-06 08:44:38 -08:00
Theron Voran
45c9118782
Adding sleep in the preStop lifecycle step (#188) 
Aims to make vault pod termination more graceful with respect to user
requests.
 2020-01-30 09:39:08 -08:00
Yong Wen Chua
eccd71bfe2 Allow configure StatefulSet updateStrategy (#172) 2020-01-18 07:36:45 -05:00
fischerman
4209cbcc2d make shareProcessNamespace configurable (#174) 
* make shareProcessNamespace configurable

* add unit tests
 2020-01-15 05:06:54 -05:00
fischerman
1f68852dc2 add lifecycle to vault instead of extra container (#179) 2020-01-15 05:03:20 -05:00
Darren Clark
ba6cfe675e Statefulset Liveness Probe failing on standby nodes due to SSL, initial delay and 429 response #137 (#138) 
livenessProbe

 * Set the scheme for vault.scheme to ensure that the check works if tls enabled or not

 * Allow a configurable value initialDelaySeconds rather than the set 5 seconds

 * Set the default initialDelaySeconds to 60 seconds before the probe starts to allow for vault unsealing

 * Set the path to /v1/sys/health?standbyok=true to ensure a 200 response on standbys

readinessProbe

 * Set the path comment to /v1/sys/health?standbyok=true to ensure a 200 response on standbys

 * Set the scheme for vault.scheme to ensure that the check works if tls enabled or not

 * Statefulset liveness probe path check set to /v1/sys/health?standbyok=true

 * Server Statefulset test added for livenessProbe.initialDelaySeconds
 2019-12-16 18:07:23 -05:00
Jason O'Donnell
1c9c64c8f8
Remove chart from labels (#128) 2019-12-02 17:14:59 -05:00
Holden Omans
a0325cfd14 Configure pod probes (#104) 
* Added option for enabling a livenessprobe

* added option for using http for readinessProbe

* added tests
 2019-11-28 18:24:41 -05:00
Janusz Bialy
2ff7d47c07 Use a standard way to define the container image (#103) 
* use a standard way to define image repo and tag

Signed-off-by: Janusz Bialy <jbialy@gmail.com>

* add tests

Signed-off-by: Janusz Bialy <jbialy@gmail.com>

* bump chart version

Signed-off-by: Janusz Bialy <jbialy@gmail.com>

* Revert "bump chart version"

This reverts commit 74cbc984a7d4cf9098acf78977cdc8598c557550.

Signed-off-by: Janusz Bialy <jbialy@gmail.com>

* nest image block inside server

Signed-off-by: Janusz Bialy <jbialy@gmail.com>
 2019-11-28 17:39:28 -05:00
Shahbaz Nazir
faf5a84c5e Add possibility to run sidecars with vault (#87) 
* Add extra containers

* fix template

* add unit tests

* resolve conflicts

* remove duplicate docs

* fix unit tests
 2019-11-21 14:07:41 -05:00
Jason O'Donnell
3fbbf7b8df
Remove readOnlyRootFilesystem configurable (#110) 2019-11-12 19:55:31 -05:00
Jason O'Donnell
a9e6a0a938
Add preStop lifecycle hook (#105) 
* Add preStop lifecycle hook

* Fix typo in comment
 2019-11-06 11:06:57 -05:00
Janusz Bialy
a2b2d32e92 Add support for image pull policy and secrets (#92) 
* add image pull policy and pull secrets

Signed-off-by: Janusz Bialy <jbialy@gmail.com>

* add unit tests

Signed-off-by: Janusz Bialy <jbialy@gmail.com>
 2019-10-24 12:58:32 -04:00
Jason O'Donnell
e1b89d6396
Make readOnlyRootFilesystem configurable (#93) 2019-10-24 12:40:19 -04:00
Jason O'Donnell
b41d36c621
Require vault to run as non root (#80) 
* Require vault to run as non root

* Fix unit tests

* Make uid/gid configurable, remove home emptydir
 2019-10-18 12:42:25 -04:00
Jason O'Donnell
9fd0ad6e20
Fix audit storage mount in HA mode (#79) 
* Fix audit storage mount in HA mode

* Add explicit fsgroup
 2019-10-10 10:03:44 -04:00
StupidScience
c6adb89d4b added possibility to add extraLabels for server pod (#59) 2019-10-06 15:50:48 -04:00
Jason O'Donnell
09f56da548
Remove privileged, add mlock configurable (#50) 2019-09-23 01:11:04 -04:00
Sophian Mehboub
bb7ce9409b add namespace in vault manifest definition (#38) 2019-08-28 09:58:48 -04:00
Jason O'Donnell
0c86c6420a
Add privileged for mlock requirements (#35) 
* Add privilged for mlock requirements

* Update Chart version
 2019-08-22 16:32:30 -04:00
Miroslav E. Hadzhiev
4b12c39099 Address K8s Deprecation of Kubelet security controls. Remove Whitespaces. (#24) 2019-08-22 11:05:31 -04:00
Jason O'Donnell
a6c17ed48a
Remove step-down preStop (#31) 2019-08-21 17:34:31 -04:00
Jason O'Donnell
acd1638b28
Add VAULT_API_ADDR as environment var (#26) 2019-08-20 17:09:06 -04:00
Jason O'Donnell
abb2b6e56e
Remove version label from resources (#27) 2019-08-20 17:08:49 -04:00
Dat Truong
c0f5c7acc0 Add TLS support (#21) 
* Add Secret env vars

* Add custom path for volume mounting

* Add HTTPS support

* Add test for tls

* Simplify network setup

* Make tls_disable true as default

* Update values variable to camelCase
 2019-08-20 11:40:47 -04:00
Dat Truong
2154e341ea Add secret env vars and custom mounting path (#16) 
* Add Secret env vars

* Add custom path for volume mounting
 2019-08-14 16:29:07 -04:00
Khris Richardson
bd02c9ba5f remove field only valid for pod from container securityContext (#9) 2019-08-07 19:23:51 -04:00
Jason O'Donnell
db571d8dda
Update helm labels (#8) 2019-08-07 14:55:32 -04:00
Jason O'Donnell
8e1bd927f2
Add tolerations, nodeselector and annotations (#5) 2019-08-05 12:31:06 -04:00
Jason O'Donnell
b7469914e2
Refactor chart for 1.0, add tests, update TF (#2) 
* Refactor chart for 1.0, add tests, update TF

* Fix typo in helper comment

* Add NOTES for post install instructions

* Fix typo in NOTES

* Fix replication port for enterprise

* Change updateStrategy to OnDelete

* Add icon

* Remove cluster address from config

* Update README, add contributing doc

* Update README

* Change HA replicas to 3
 2019-07-31 14:26:12 -04:00
Clint Shryock
66211943e8
update values, single-server and test 2018-11-27 15:45:32 -06:00
Clint Shryock
bcc8a8db5f
re-add seperate config map file for single server. Update config/values and statefulsets. Add auto-unseal config to single server 2018-11-26 11:44:05 -06:00
Clint Shryock
061852089a
update 2018-10-05 16:12:32 -05:00
Clint Shryock
95024c4d3f
minor tweaks 2018-10-04 15:07:41 -05:00
Clint Shryock
d72a939a51
really ugly hack/slash proof-of-concept, forked from consul-helm 2018-10-02 16:14:57 -05:00
Clint Shryock
a2235339eb
remove unused files, a lot of s/Consul/Vault 2018-09-28 15:56:48 -05:00
Maciek Misztal
febaab96fa #7 added an optional storageClass to the server-statefuset 2018-09-20 21:35:08 +02:00
Mitchell Hashimoto
9ef4efc5c4
client and server must export both TCP and UDP DNS ports 2018-09-11 19:09:45 -07:00
Mitchell Hashimoto
64670ed470
Add consul-dns service 2018-09-11 17:53:02 -07:00
Mitchell Hashimoto
2488f92a23
Support extraVolumes for server, will add for client soon 2018-09-08 08:28:13 -07:00
Mitchell Hashimoto
c9a5588264
Move datacenter to global 2018-09-08 07:52:31 -07:00
Mitchell Hashimoto
9d37c9f2f1
Support global.image value 2018-09-05 07:45:54 -07:00
Mitchell Hashimoto
64f43108f7
test/unit: server StatefulSet 2018-09-03 09:05:59 -07:00
Mitchell Hashimoto
d2558a0be3
use globals.domain instead of common in case we refactor later 2018-09-02 16:19:45 -07:00
Mitchell Hashimoto
3a61646b1d
Add global.enabled to disable all components by default 2018-09-02 16:19:11 -07:00
Mitchell Hashimoto
60e57f700e
setup templates for proper name prefixing 2018-08-18 14:48:22 -07:00