Skip to content

Commit 39b8c77

Browse files
manasagmanasag
authored
Adding Fortanix DSM Secrets Chart (#286)
1 parent 0cd6bdf commit 39b8c77

23 files changed

+589
-0
lines changed

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/report.yaml

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
apiversion: v1
2+
kind: verify-report
3+
metadata:
4+
tool:
5+
verifier-version: 0.0.1
6+
profile:
7+
VendorType: partner
8+
version: v1.0
9+
chart-uri: /charts/src
10+
digest: sha256:492efc99f1c44f9a854b916859732a067bb1500795856b97f890cd1e0b672ffc
11+
digests:
12+
chart: sha256:492efc99f1c44f9a854b916859732a067bb1500795856b97f890cd1e0b672ffc
13+
lastCertifiedTimestamp: "2021-08-11T08:00:19.068501+00:00"
14+
certifiedOpenShiftVersions: 4.7.0
15+
chart:
16+
name: dsm-secrets-injector-chart
17+
home: ""
18+
sources: []
19+
version: "2.0"
20+
description: ""
21+
keywords: []
22+
maintainers:
23+
- name: Aman Ahuja
24+
email: [email protected]
25+
url: ""
26+
icon: ""
27+
apiversion: v2
28+
condition: ""
29+
tags: ""
30+
appversion: "1.0"
31+
deprecated: false
32+
annotations: {}
33+
kubeversion: '>= 1.16.0 < 1.22.0'
34+
dependencies:
35+
- name: fortanix-cert-setup
36+
version: "1.1"
37+
repository: file://cert-setup
38+
condition: ""
39+
tags: []
40+
enabled: false
41+
importvalues: []
42+
alias: ""
43+
type: ""
44+
chart-overrides: ""
45+
results:
46+
- check: v1.0/not-contains-crds
47+
type: Mandatory
48+
outcome: PASS
49+
reason: Chart does not contain CRDs
50+
- check: v1.0/not-contain-csi-objects
51+
type: Mandatory
52+
outcome: PASS
53+
reason: CSI objects do not exist
54+
- check: v1.0/has-readme
55+
type: Mandatory
56+
outcome: PASS
57+
reason: Chart has a README
58+
- check: v1.0/contains-test
59+
type: Mandatory
60+
outcome: PASS
61+
reason: Chart test files exist
62+
- check: v1.0/contains-values
63+
type: Mandatory
64+
outcome: PASS
65+
reason: Values file exist
66+
- check: v1.0/helm-lint
67+
type: Mandatory
68+
outcome: PASS
69+
reason: Helm lint successful
70+
- check: v1.0/images-are-certified
71+
type: Mandatory
72+
outcome: PASS
73+
reason: |-
74+
Image is Red Hat certified : registry.access.redhat.com/ubi7/ubi-minimal:7.9
75+
Image is Red Hat certified : registry.hub.docker.com/fortanix/k8s-sdkms-secrets-injector:ubi7-2.0
76+
Image is Red Hat certified : registry.hub.docker.com/fortanix/k8s-sdkms-cert-setup:ubi7-1.1
77+
- check: v1.0/chart-testing
78+
type: Mandatory
79+
outcome: PASS
80+
reason: Chart tests have passed
81+
- check: v1.0/is-helm-v3
82+
type: Mandatory
83+
outcome: PASS
84+
reason: API version is V2, used in Helm 3
85+
- check: v1.0/contains-values-schema
86+
type: Mandatory
87+
outcome: PASS
88+
reason: Values schema file exist
89+
- check: v1.0/has-kubeversion
90+
type: Mandatory
91+
outcome: PASS
92+
reason: Kubernetes version specified

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/Chart.lock

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: fortanix-cert-setup
3+
repository: file://cert-setup
4+
version: "1.1"
5+
digest: sha256:07a87ec9e979541d13257c8bb24ebdcfaf3c840c5c1f02dc5061c0ccd395461f
6+
generated: "2021-08-11T11:23:04.320866317+05:30"

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/Chart.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: dsm-secrets-injector-chart
2+
version: "2.0"
3+
appVersion: "1.0"
4+
apiVersion: v2
5+
kubeVersion: ">= 1.16.0 < 1.22.0"
6+
dependencies: # A list of the chart requirements
7+
- name: fortanix-cert-setup
8+
version: 1.1
9+
repository: file://cert-setup
10+
maintainers:
11+
- name: Aman Ahuja
12+
email: [email protected]

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/README.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
2+
# DSM Secrets Injector Helm Chart v3
3+
4+
This repository contains Helm chart for deploying and configuring secrets injection with Fortanix DSM in Kubernetes applications.
5+
6+
It deploys Mutating Webhook Controller and sidecar container for injecting secrets.
7+
8+
Note: This chart supports kubernetes version 1.16 and above.
9+
10+
## Dependency Charts
11+
12+
* **fortanix-cert-setup** - `cert-setup` folder in this repository
13+
14+
## Install Chart
15+
16+
* Install Dependency Chart
17+
````console
18+
$ helm dep up dsm-secrets-injector-chart
19+
````
20+
* Install dsm-secrets-injector Chart
21+
** Kubernetes cluster
22+
````console
23+
$ helm install dsm-secrets-injector-chart ./dsm-secrets-injector-chart
24+
````
25+
** OpenShift Cluster
26+
```console
27+
$
28+
$ helm install dsm-secrets-injector-chart ./dsm-secrets-injector --set global.
29+
## Uninstall chart
30+
* Uninstall dsm-secrets-injector-chart
31+
````console
32+
$ helm delete dsm-secrets-injector-chart
33+
````
34+
35+
The command removes all the Kubernetes components associated with the chart and deletes the release.
36+
37+
## Parameters
38+
39+
The following tables lists the configurable parameters of the sdkms-secrets-injection chart and their default values.
40+
41+
| Parameter | Description | Default |
42+
|----------------------------------|-------------------------------------------------------------------------------------------|--------------------------------------------------------------|
43+
| `global.registry` | Global Docker image registry | `fortanix` |
44+
| `global.namespace` | Global Namespace | `fortanix` |
45+
| `global.service` | Global Kubernetes Service | `fortanix-secrets-injector-svc` |
46+
| `global.serviceAccount` | Service Account for cert TLS | `fortanix-webhook-certs-sa` |
47+
| `global.secret` | Secret containing cert TLS | `fortanix-secrets-injector-certs` |
48+
| `global.caBundle` | Kubernetes API Server CA Certificate pem bytes as base64 string | nil
49+
| `configmap.name` | ConfigMap for Controller configuration | `fortanix-webhook-config` |
50+
| `configmap.authTokenType` | Authentication Type for Secrets-Injection | `api-key` (can be set as `jwt` or `api-key`) |
51+
| `configmap.secretAgent.imageName` | Image name for Secret Agent Image | `k8s-sdkms-secret-agent` |
52+
| `configmap.secretAgent.tag` | Image tag for Secret Agent Image | `"1.0"`
53+
| `configmap.tokenVolumeProjection.audience` | The audience of the Service Account JWT token. This should be same as SDKMS endpoint. e.g. https://sdkms.fortanix.com. Applies only if `jwt`type of authentication is set | nil
54+
| `configmap.tokenVolumeProjection.expirationSeconds` | The expiration period of the Service Account JWT token (in seconds). Applies only if `jwt`type of authentication is set | `3600`
55+
| `replicas` | Number of replicas of the Secrets Injector deployment | `1` |
56+
| `image.name` | Secrets Injector Image Name | `k8s-sdkms-secrets-injector` |
57+
| `image.tag` | Secrets Injector Image Tag | `"1.0"` |
58+
| `image.pullPolicy` | Secrets Injector Image Pull Policy | `IfNotPresent` |
59+
60+
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/Chart.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: fortanix-cert-setup
2+
version: 1.1
3+
appVersion: 1.0
4+
maintainers:
5+
- name: Aman Ahuja
6+
email: [email protected]

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/NOTES.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Job to create TLS certificates using Kubernetes apiserver has been deployed successfully.
2+
3+
Generated TLS certificates are stored in secret.

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/_helpers.tpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- define "fortanix-cert-setup.name" -}}
2+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
3+
{{- end -}}
4+
5+
{{- define "fortanix-cert-setup.chart" -}}
6+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{- define "fortanix-cert-setup.image" -}}
10+
{{- $tag := .Values.image.tag | toString -}}
11+
{{- printf "%s/%s:%s" .Values.global.registry .Values.image.name $tag -}}
12+
{{- end -}}

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/cluster-role-bindings.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: {{ .Values.clusterRoleBindings }}
5+
namespace: {{ .Values.global.namespace }}
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: ClusterRole
9+
name: {{ .Values.clusterRole }}
10+
subjects:
11+
- kind: ServiceAccount
12+
name: {{ .Values.serviceAccount }}
13+
namespace: {{ .Values.global.namespace }}

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/cluster-role.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ .Values.clusterRole }}
5+
namespace: {{ .Values.global.namespace }}
6+
rules:
7+
- apiGroups: [ "certificates.k8s.io" ]
8+
resources: [ "certificatesigningrequests" ]
9+
verbs: [ "get", "create", "delete", "list", "watch" ]
10+
- apiGroups: [ "certificates.k8s.io" ]
11+
resources: [ "certificatesigningrequests/approval" ]
12+
verbs: [ "update" ]
13+
- apiGroups: [ "certificates.k8s.io" ]
14+
resources: [ "signers" ]
15+
resourceNames: [ "kubernetes.io/*" ]
16+
verbs: [ "approve" ]
17+
- apiGroups: [ "" ]
18+
resources: [ "secrets" ]
19+
verbs: [ "create", "get", "patch", "update" ]
20+
- apiGroups: [ "" ]
21+
resources: [ "configmaps" ]
22+
verbs: [ "get" ]

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/job.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
name: {{ include "fortanix-cert-setup.name" . }}
5+
namespace: {{ .Values.global.namespace }}
6+
spec:
7+
template:
8+
spec:
9+
serviceAccountName: {{ .Values.serviceAccount }}
10+
containers:
11+
- name: {{ include "fortanix-cert-setup.name" . }}
12+
image: {{ include "fortanix-cert-setup.image" . }}
13+
args:
14+
- "-n"
15+
- {{ .Values.global.namespace }}
16+
- "-s"
17+
- {{ .Values.global.service }}
18+
- "-p"
19+
- {{ .Values.global.secret }}
20+
imagePullPolicy: {{ .Values.image.pullPolicy }}
21+
restartPolicy: Never
22+
backoffLimit: 4
23+

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/namespace.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: {{ .Values.global.namespace }}

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/templates/service-account.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: {{ .Values.serviceAccount }}
5+
namespace: {{ .Values.global.namespace }}

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/cert-setup/values.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Default values for fortanix-cert-setup.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
clusterRole: fortanix-webhook-cert-sa-cluster-role
6+
7+
clusterRoleBindings: fortanix-webhook-cert-sa-role-binding
8+
9+
image:
10+
name: k8s-sdkms-cert-setup
11+
tag: "ubi7-1.1"
12+
pullPolicy: IfNotPresent
13+
14+
serviceAccount: fortanix-sa
15+
16+
17+
18+
19+

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/charts/fortanix-cert-setup-1.1.tgz

1.55 KB
Binary file not shown.

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/templates/NOTES.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
kubernetes Integration with Fortanix SDKMS has been deployed successfully.
2+
3+
Follow the guide to setup your application and inject secrets from SDKMS into your application on Kubernetes.

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/templates/_helpers.tpl

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- define "fortanix-secrets-injector.name" -}}
2+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
3+
{{- end -}}
4+
5+
{{- define "fortanix-secrets-injector.chart" -}}
6+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{- define "fortanix-secrets-injector.image" -}}
10+
{{- $tag := .Values.image.tag | toString -}}
11+
{{- printf "%s/%s:%s" .Values.global.registry .Values.image.name $tag -}}
12+
{{- end -}}

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/templates/mutating-webhook.yaml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: MutatingWebhookConfiguration
3+
metadata:
4+
name: {{ include "fortanix-secrets-injector.name" . }}
5+
namespace: {{ .Values.global.namespace }}
6+
{{ if not .Values.global.caBundle }}
7+
annotations:
8+
cert-manager.io/inject-apiserver-ca: "true"
9+
{{ end }}
10+
labels:
11+
app: {{ include "fortanix-secrets-injector.name" . }}
12+
webhooks:
13+
- name: secrets-injector.fortanix.com
14+
admissionReviewVersions: ["v1"]
15+
rules:
16+
- apiGroups: [""]
17+
apiVersions: ["v1"]
18+
operations: [ "CREATE" ]
19+
resources: ["pods"]
20+
scope: "Namespaced"
21+
namespaceSelector:
22+
matchLabels:
23+
fortanix-secrets-injector: enabled
24+
clientConfig:
25+
{{ if .Values.global.caBundle }}
26+
caBundle: {{ .Values.global.caBundle | quote }}
27+
{{ end }}
28+
service:
29+
name: {{ .Values.global.service }}
30+
namespace: {{ .Values.global.namespace }}
31+
path: "/mutate-pod"
32+
sideEffects: None

‎charts/partners/fortanix/dsm-secrets-injector-chart/2.0/src/templates/sidecar-configmap.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: {{ .Values.configmap.name }}
5+
namespace: {{ .Values.global.namespace }}
6+
data:
7+
controller-config.yaml: |
8+
authTokenType: {{ .Values.configmap.authTokenType }} # acceptable values: `api-key`, `jwt`.
9+
secretAgentImage: {{ .Values.global.registry }}/{{ .Values.configmap.secretAgent.imageName }}:{{ .Values.configmap.secretAgent.tag }}
10+
proxySettings:
11+
#httpProxy: 'http://example.com'
12+
#httpsProxy: 'https://example.com'
13+
#noProxy: '*.example.com,1.2.3.4'
14+
# the following values are set only if authTokenType is set to 'jwt'
15+
{{ if eq .Values.configmap.authTokenType "jwt" }}
16+
tokenVolumeProjection:
17+
addToAllPods: true
18+
audience: {{ .Values.configmap.tokenVolumeProjection.audience }}
19+
expirationSeconds: {{ .Values.configmap.tokenVolumeProjection.expirationSeconds | default "3600" }}
20+
{{ end }}

0 commit comments

Comments
 (0)