-
Notifications
You must be signed in to change notification settings - Fork 30
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: update operator-sdk and golang; add ability to specify kube sec…
…ret type (#10)
- Loading branch information
Showing
35 changed files
with
1,271 additions
and
298 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
4 changes: 2 additions & 2 deletions
4
chart/sops-secrets-operator/Chart.yaml → chart/helm2/sops-secrets-operator/Chart.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # Patterns to ignore when building packages. | ||
| # This supports shell glob matching, relative path matching, and | ||
| # negation (prefixed with !). Only one pattern per line. | ||
| .DS_Store | ||
| # Common VCS dirs | ||
| .git/ | ||
| .gitignore | ||
| .bzr/ | ||
| .bzrignore | ||
| .hg/ | ||
| .hgignore | ||
| .svn/ | ||
| # Common backup files | ||
| *.swp | ||
| *.bak | ||
| *.tmp | ||
| *~ | ||
| # Various IDEs | ||
| .project | ||
| .idea/ | ||
| *.tmproj | ||
| .vscode/ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| apiVersion: v2 | ||
| version: 0.1.0 | ||
| appVersion: 0.0.10 | ||
| type: application | ||
| description: sops secrets operator | ||
| name: sops-secrets-operator | ||
| sources: | ||
| - https://github.com/isindir/sops-secrets-operator.git | ||
| maintainers: | ||
| - name: isindir | ||
| email: [email protected] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,98 @@ | ||
| # sops-secrets-operator | ||
|
|
||
| Installs [sops-secrets-operator](https://github.com/isindir/sops-secrets-operator.git) to provide encrypted secrets in Weaveworks GitOps Flux environment. | ||
|
|
||
| ## TL;DR; | ||
|
|
||
| ```console | ||
| $ kubectl create namespace sops | ||
|
|
||
| $ kubectl apply -f deploy/crds/isindir_v1alpha1_sopssecret_crd.yaml | ||
|
|
||
| $ helm upgrade --install sops chart/sops-secrets-operator/ \ | ||
| --namespace sops -f custom.values.yaml | ||
| ``` | ||
|
|
||
| > where `custom.values.yaml` must customise deployment and configure access to Cloud KMS | ||
| * AWS is supported via `kiam` namespace and pod annotations | ||
| * GCP is supported via service account secret which allows decryption using GCP KMS | ||
| * **TODO:** GPG support | ||
| * **TODO:** Azure support | ||
|
|
||
| ## Introduction | ||
|
|
||
| This chart bootstraps a [sops-secrets-operator](https://github.com/isindir/sops-secrets-operator.git) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. | ||
|
|
||
| ## Prerequisites | ||
| - Kubernetes 1.12+ | ||
| - helm 3.+ | ||
|
|
||
| ## Installing the Chart | ||
|
|
||
| ### AWS | ||
|
|
||
| * Deploy [kiam](https://github.com/uswitch/kiam) using [kiam chart](https://github.com/helm/charts/tree/master/stable/kiam) | ||
| * Create IAM assume role which allows to use KMS key for decryption | ||
| * Create Kubernetes namespace for operator deployment, with kiam annotation | ||
| * Apply `sops-secrets-operator` CRD | ||
| * Deploy helm chart | ||
|
|
||
| ### GCP | ||
|
|
||
| * Create GCP Service Account which allows to use KMS to decrypt | ||
| * Create custom values file in a following format: | ||
|
|
||
| ```yaml | ||
| gcp: | ||
| enabled: true | ||
| svcAccSecret: |- | ||
| { | ||
| "type": "service_account", | ||
| ... | ||
| } | ||
| ``` | ||
| * Create Kubernetes namespace for operator deployment | ||
| * Apply `sops-secrets-operator` CRD | ||
| * Deploy helm chart specifying extra values file | ||
|
|
||
| ## Uninstalling the Chart | ||
|
|
||
| To uninstall/delete the `my-release` deployment: | ||
|
|
||
| ```console | ||
| $ helm delete --purge sops | ||
| ``` | ||
|
|
||
| The command removes all the Kubernetes components associated with the chart and deletes the release. | ||
|
|
||
| ## Configuration | ||
|
|
||
| The following table lists the configurable parameters of the kiam chart and their default values. | ||
|
|
||
| Parameter | Description | Default | ||
| --- | --- | --- | ||
| `replicaCount` | Deployment replica count - should not be modified | `1` | ||
| `image.repository` | Operator image | `isindir/sops-secrets-operator` | ||
| `image.tag` | Operator image tag | `0.0.7` | ||
| `image.pullPolicy` | Operator image pull policy | `AlwaysPull` | ||
| `imagePullSecrets` | Secrets to pull image from private docker repository | `[]` | ||
| `nameOverride` | Overrides auto-generated short resource name | `""` | ||
| `fullnameOverride` | Overrides auto-generated long resource name | `""` | ||
| `podAnnotations` | Annotations to be added to agent pods | `{}` | ||
| `watchNamespace` | Namespace to watch CRs, if not specified all namespaces will be watched | `""` | ||
| `gcp.enabled` | If `true` GCP secret will be created from provided value and mounted as environment variable | `false` | ||
| `gcp.svcAccSecretCustomName` | Name of the secret to create - will override default secret name if specified | `''` | ||
| `gcp.svcAccSecret` | If `gcp.enabled` is `true`, this value must be specified as GCP service account secret json payload | `''` | ||
| `nodeSelector` | Node labels for operator pod assignment | `{}` | ||
| `resources` | Operator container resources | `{}` | ||
| `tolerations` | Tolerations to be applied to operator pod | `[]` | ||
| `affinity` | Node affinity for pod assignment | `{}` | ||
| `rbac.enabled` | If `true`, create & use RBAC resources | `true` | ||
|
|
||
| Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, | ||
|
|
||
| Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, | ||
|
|
||
| > **Tip**: You can use the default [values.yaml](values.yaml) |
Empty file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| {{/* vim: set filetype=mustache: */}} | ||
| {{/* | ||
| Expand the name of the chart. | ||
| */}} | ||
| {{- define "sops-secrets-operator.name" -}} | ||
| {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create a default fully qualified app name. | ||
| We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). | ||
| If release name contains chart name it will be used as a full name. | ||
| */}} | ||
| {{- define "sops-secrets-operator.fullname" -}} | ||
| {{- if .Values.fullnameOverride -}} | ||
| {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} | ||
| {{- else -}} | ||
| {{- $name := default .Chart.Name .Values.nameOverride -}} | ||
| {{- if contains $name .Release.Name -}} | ||
| {{- .Release.Name | trunc 63 | trimSuffix "-" -}} | ||
| {{- else -}} | ||
| {{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Create chart name and version as used by the chart label. | ||
| */}} | ||
| {{- define "sops-secrets-operator.chart" -}} | ||
| {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* | ||
| Common labels | ||
| */}} | ||
| {{- define "sops-secrets-operator.labels" -}} | ||
| app.kubernetes.io/name: {{ include "sops-secrets-operator.name" . }} | ||
| helm.sh/chart: {{ include "sops-secrets-operator.chart" . }} | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| {{- if .Chart.AppVersion }} | ||
| app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} | ||
| {{- end }} | ||
| app.kubernetes.io/managed-by: {{ .Release.Service }} | ||
| {{- end -}} |
66 changes: 66 additions & 0 deletions
66
chart/helm3/sops-secrets-operator/templates/cluster_role.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| {{- if .Values.rbac.enabled }} | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: ClusterRole | ||
| metadata: | ||
| name: {{ include "sops-secrets-operator.fullname" . }} | ||
| labels: | ||
| {{ include "sops-secrets-operator.labels" . | indent 4 }} | ||
| app.kubernetes.io/name: {{ include "sops-secrets-operator.name" . }} | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| rules: | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - pods | ||
| - services | ||
| - services/finalizers | ||
| - endpoints | ||
| - persistentvolumeclaims | ||
| - events | ||
| - configmaps | ||
| - secrets | ||
| verbs: | ||
| - '*' | ||
| - apiGroups: | ||
| - apps | ||
| resources: | ||
| - deployments | ||
| - daemonsets | ||
| - replicasets | ||
| - statefulsets | ||
| verbs: | ||
| - '*' | ||
| - apiGroups: | ||
| - monitoring.coreos.com | ||
| resources: | ||
| - servicemonitors | ||
| verbs: | ||
| - get | ||
| - create | ||
| - apiGroups: | ||
| - apps | ||
| resourceNames: | ||
| - sops-secrets-operator | ||
| resources: | ||
| - deployments/finalizers | ||
| verbs: | ||
| - update | ||
| - apiGroups: | ||
| - "" | ||
| resources: | ||
| - pods | ||
| verbs: | ||
| - get | ||
| - apiGroups: | ||
| - apps | ||
| resources: | ||
| - replicasets | ||
| verbs: | ||
| - get | ||
| - apiGroups: | ||
| - isindir.github.com | ||
| resources: | ||
| - '*' | ||
| verbs: | ||
| - '*' | ||
| {{- end }} |
18 changes: 18 additions & 0 deletions
18
chart/helm3/sops-secrets-operator/templates/cluster_role_binding.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| {{- if .Values.rbac.enabled }} | ||
| kind: ClusterRoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: {{ include "sops-secrets-operator.fullname" . }} | ||
| labels: | ||
| {{ include "sops-secrets-operator.labels" . | indent 4 }} | ||
| app.kubernetes.io/name: {{ include "sops-secrets-operator.name" . }} | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: {{ include "sops-secrets-operator.fullname" . }} | ||
| namespace: {{ .Release.Namespace }} | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: {{ include "sops-secrets-operator.fullname" . }} | ||
| apiGroup: rbac.authorization.k8s.io | ||
| {{- end }} |
Oops, something went wrong.