Skip to content
This repository has been archived by the owner on Feb 22, 2022. It is now read-only.

[incubator/vault] Add support for creating a service account #9429

Merged
merged 3 commits into from
Apr 22, 2019
Merged

[incubator/vault] Add support for creating a service account #9429

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9f05788
option for creating a service account
Nov 20, 2018
c8e4712
bump chart version
Nov 20, 2018
f073161
Merge branch 'master' into add-sa
mattfarina Apr 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion incubator/vault/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: v1
description: A Helm chart for Vault, a tool for managing secrets
name: vault
version: 0.16.1
version: 0.16.2
appVersion: 1.0.1
home: https://www.vaultproject.io/
icon: https://www.vaultproject.io/assets/images/mega-nav/logo-vault-0f83e3d2.svg
Expand Down
1 change: 1 addition & 0 deletions incubator/vault/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ The following table lists the configurable parameters of the Vault chart and the
| `labels` | Extra labels for deployment | `{}` |
| `ingress.labels` | Labels for ingress | `{}` |
| `podAnnotations` | Annotations for pods | `{}` |
| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` |
| `consulAgent.join` | If set, start start a consul agent | `nil` |
| `consulAgent.repository` | Container image for consul agent | `consul` |
| `consulAgent.tag` | Container image tag for consul agent | `1.4.0` |
Expand Down
10 changes: 10 additions & 0 deletions incubator/vault/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,13 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
{{- end -}}
{{- end -}}

{{/*
Create the name of the service account to use
*/}}
{{- define "vault.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "vault.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
11 changes: 11 additions & 0 deletions incubator/vault/templates/serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "vault.serviceAccountName" . }}
labels:
app: {{ template "vault.name" . }}
chart: {{ template "vault.chart" . }}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is incorrect as the vault.chart template doesn't exist - did you forget to add it?

Or you can use what the other vault manifests use: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}

Any chance of a quick fix for this @jbialy ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, good catch! I likely grabbed the serviceaccount definition from another chart, and overlooked the way the chart label is set!

I'll adjust it to use {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} as you suggested!

release: "{{ .Release.Name }}"
heritage: "{{ .Release.Service }}"
{{- end -}}
8 changes: 8 additions & 0 deletions incubator/vault/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,14 @@ podAnnotations: {}
# exec:
# command: ["./unseal -s my-unseal-keys"]

serviceAccount:
## Specifies whether a ServiceAccount should be created
##
create: false
## The name of the ServiceAccount to use.
## If not set and create is true, a name is generated using the fullname template
name:

vault:
# Only used to enable dev mode. When in dev mode, the rest of this config
# section below is not used to configure Vault. See
Expand Down