From ab6a0e1de1017904d0ef965dc364e2f17bcb6b04 Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Tue, 7 Nov 2023 09:20:26 +0100 Subject: [PATCH] Read hcloud secret from vault secrets --- argocd/hcloud-csi/Chart.yaml | 0 argocd/hcloud-csi/templates/_helpers.tpl | 73 +++++++++++++++++++ .../templates/vault-secrets-app.yaml | 19 +++++ argocd/hcloud-csi/test/argocd_values.yaml | 13 ++++ argocd/hcloud-csi/test/templates | 1 + argocd/hcloud-csi/test/values.yaml | 11 +-- argocd/hcloud-csi/values.yaml | 4 + argocd/prometheus/Chart.yaml | 1 + argocd/prometheus/templates/_helpers.tpl | 73 +++++++++++++++++++ .../templates/vault-secrets-app.yaml | 19 +++++ argocd/prometheus/test/templates | 1 + argocd/prometheus/test/values.yaml | 1 + argocd/prometheus/values.yaml | 4 + 13 files changed, 210 insertions(+), 10 deletions(-) create mode 100644 argocd/hcloud-csi/Chart.yaml create mode 100644 argocd/hcloud-csi/templates/_helpers.tpl create mode 100644 argocd/hcloud-csi/templates/vault-secrets-app.yaml create mode 100644 argocd/hcloud-csi/test/argocd_values.yaml create mode 120000 argocd/hcloud-csi/test/templates mode change 100644 => 120000 argocd/hcloud-csi/test/values.yaml create mode 100644 argocd/hcloud-csi/values.yaml create mode 100644 argocd/prometheus/Chart.yaml create mode 100644 argocd/prometheus/templates/_helpers.tpl create mode 100644 argocd/prometheus/templates/vault-secrets-app.yaml create mode 120000 argocd/prometheus/test/templates create mode 120000 argocd/prometheus/test/values.yaml create mode 100644 argocd/prometheus/values.yaml diff --git a/argocd/hcloud-csi/Chart.yaml b/argocd/hcloud-csi/Chart.yaml new file mode 100644 index 0000000..e69de29 diff --git a/argocd/hcloud-csi/templates/_helpers.tpl b/argocd/hcloud-csi/templates/_helpers.tpl new file mode 100644 index 0000000..18979a7 --- /dev/null +++ b/argocd/hcloud-csi/templates/_helpers.tpl @@ -0,0 +1,73 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "template.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "template.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "template.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "template.labels" -}} +helm.sh/chart: {{ include "template.chart" . }} +{{ include "template.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "template.selectorLabels" -}} +app.kubernetes.io/name: {{ include "template.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "template.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "template.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- /* +template.util.merge will merge two YAML templates and output the result. +This takes an array of three values: +- the top context +- the template name of the overrides (destination) +- the template name of the base (source) +*/}} +{{- define "template.util.merge" -}} +{{- $top := first . -}} +{{- $overrides := fromYaml (include (index . 1) $top) | default (dict ) -}} +{{- $tpl := fromYaml (include (index . 2) $top) | default (dict ) -}} +{{- toYaml (merge $overrides $tpl) -}} +{{- end -}} diff --git a/argocd/hcloud-csi/templates/vault-secrets-app.yaml b/argocd/hcloud-csi/templates/vault-secrets-app.yaml new file mode 100644 index 0000000..ff9d21b --- /dev/null +++ b/argocd/hcloud-csi/templates/vault-secrets-app.yaml @@ -0,0 +1,19 @@ +{{- if .Values.vault.enabled }} +apiVersion: secrets.hashicorp.com/v1beta1 +kind: HCPVaultSecretsApp +metadata: + name: {{ include "template.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "template.labels" . | nindent 4 }} +spec: + appName: {{ .Values.vault.applicationName }} + hcpAuthRef: {{ .Values.vault.operatorNamespace | default "vault-secrets-operator-system" }}/hcp-auth + destination: + create: true + labels: + {{- include "template.labels" . | nindent 6 }} + hvs: "true" + name: {{ include "template.fullname" . }} + refreshAfter: 1h +{{- end }} diff --git a/argocd/hcloud-csi/test/argocd_values.yaml b/argocd/hcloud-csi/test/argocd_values.yaml new file mode 100644 index 0000000..cbafeb1 --- /dev/null +++ b/argocd/hcloud-csi/test/argocd_values.yaml @@ -0,0 +1,13 @@ +hcloud-csi: + storageClasses: + - name: hcloud-volumes + defaultStorageClass: true + reclaimPolicy: Retain + metrics: + enabled: true + serviceMonitor: + enabled: true + namespace: observability +vault: + enabled: true + applicationName: hcloud \ No newline at end of file diff --git a/argocd/hcloud-csi/test/templates b/argocd/hcloud-csi/test/templates new file mode 120000 index 0000000..564a409 --- /dev/null +++ b/argocd/hcloud-csi/test/templates @@ -0,0 +1 @@ +../templates \ No newline at end of file diff --git a/argocd/hcloud-csi/test/values.yaml b/argocd/hcloud-csi/test/values.yaml deleted file mode 100644 index 21c4cbc..0000000 --- a/argocd/hcloud-csi/test/values.yaml +++ /dev/null @@ -1,10 +0,0 @@ -hcloud-csi: - storageClasses: - - name: hcloud-volumes - defaultStorageClass: true - reclaimPolicy: Retain - metrics: - enabled: true - serviceMonitor: - enabled: true - namespace: observability \ No newline at end of file diff --git a/argocd/hcloud-csi/test/values.yaml b/argocd/hcloud-csi/test/values.yaml new file mode 120000 index 0000000..5d1191e --- /dev/null +++ b/argocd/hcloud-csi/test/values.yaml @@ -0,0 +1 @@ +../values.yaml \ No newline at end of file diff --git a/argocd/hcloud-csi/values.yaml b/argocd/hcloud-csi/values.yaml new file mode 100644 index 0000000..0ac0162 --- /dev/null +++ b/argocd/hcloud-csi/values.yaml @@ -0,0 +1,4 @@ +vault: + enabled: false + applicationName: "" + operatorNamespace: "" \ No newline at end of file diff --git a/argocd/prometheus/Chart.yaml b/argocd/prometheus/Chart.yaml new file mode 100644 index 0000000..6b7a717 --- /dev/null +++ b/argocd/prometheus/Chart.yaml @@ -0,0 +1 @@ +# only there for correct syntax highlighting in IDE \ No newline at end of file diff --git a/argocd/prometheus/templates/_helpers.tpl b/argocd/prometheus/templates/_helpers.tpl new file mode 100644 index 0000000..18979a7 --- /dev/null +++ b/argocd/prometheus/templates/_helpers.tpl @@ -0,0 +1,73 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "template.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "template.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "template.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "template.labels" -}} +helm.sh/chart: {{ include "template.chart" . }} +{{ include "template.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "template.selectorLabels" -}} +app.kubernetes.io/name: {{ include "template.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "template.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "template.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- /* +template.util.merge will merge two YAML templates and output the result. +This takes an array of three values: +- the top context +- the template name of the overrides (destination) +- the template name of the base (source) +*/}} +{{- define "template.util.merge" -}} +{{- $top := first . -}} +{{- $overrides := fromYaml (include (index . 1) $top) | default (dict ) -}} +{{- $tpl := fromYaml (include (index . 2) $top) | default (dict ) -}} +{{- toYaml (merge $overrides $tpl) -}} +{{- end -}} diff --git a/argocd/prometheus/templates/vault-secrets-app.yaml b/argocd/prometheus/templates/vault-secrets-app.yaml new file mode 100644 index 0000000..ff9d21b --- /dev/null +++ b/argocd/prometheus/templates/vault-secrets-app.yaml @@ -0,0 +1,19 @@ +{{- if .Values.vault.enabled }} +apiVersion: secrets.hashicorp.com/v1beta1 +kind: HCPVaultSecretsApp +metadata: + name: {{ include "template.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "template.labels" . | nindent 4 }} +spec: + appName: {{ .Values.vault.applicationName }} + hcpAuthRef: {{ .Values.vault.operatorNamespace | default "vault-secrets-operator-system" }}/hcp-auth + destination: + create: true + labels: + {{- include "template.labels" . | nindent 6 }} + hvs: "true" + name: {{ include "template.fullname" . }} + refreshAfter: 1h +{{- end }} diff --git a/argocd/prometheus/test/templates b/argocd/prometheus/test/templates new file mode 120000 index 0000000..564a409 --- /dev/null +++ b/argocd/prometheus/test/templates @@ -0,0 +1 @@ +../templates \ No newline at end of file diff --git a/argocd/prometheus/test/values.yaml b/argocd/prometheus/test/values.yaml new file mode 120000 index 0000000..5d1191e --- /dev/null +++ b/argocd/prometheus/test/values.yaml @@ -0,0 +1 @@ +../values.yaml \ No newline at end of file diff --git a/argocd/prometheus/values.yaml b/argocd/prometheus/values.yaml new file mode 100644 index 0000000..0ac0162 --- /dev/null +++ b/argocd/prometheus/values.yaml @@ -0,0 +1,4 @@ +vault: + enabled: false + applicationName: "" + operatorNamespace: "" \ No newline at end of file