From 608f243c43a9a712695c3314a5655459ce1b5666 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Thu, 12 Sep 2019 16:01:48 +0200 Subject: [PATCH 1/6] initial commit Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/.helmignore | 22 +++++++ stable/aws-pod-identity-webhook/Chart.yaml | 13 ++++ stable/aws-pod-identity-webhook/OWNERS | 10 ++++ stable/aws-pod-identity-webhook/README.md | 53 ++++++++++++++++ .../templates/NOTES.txt | 10 ++++ .../templates/_helpers.tpl | 45 ++++++++++++++ .../templates/clusterrole.yaml | 24 ++++++++ .../templates/clusterrolebinding.yaml | 14 +++++ .../templates/deployment.yaml | 60 +++++++++++++++++++ .../templates/mutatingwebhook.yaml | 20 +++++++ .../templates/role.yaml | 23 +++++++ .../templates/rolebinding.yaml | 14 +++++ .../templates/service.yaml | 18 ++++++ .../templates/serviceaccount.yaml | 7 +++ stable/aws-pod-identity-webhook/values.yaml | 18 ++++++ 15 files changed, 351 insertions(+) create mode 100644 stable/aws-pod-identity-webhook/.helmignore create mode 100644 stable/aws-pod-identity-webhook/Chart.yaml create mode 100644 stable/aws-pod-identity-webhook/OWNERS create mode 100644 stable/aws-pod-identity-webhook/README.md create mode 100644 stable/aws-pod-identity-webhook/templates/NOTES.txt create mode 100644 stable/aws-pod-identity-webhook/templates/_helpers.tpl create mode 100644 stable/aws-pod-identity-webhook/templates/clusterrole.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/clusterrolebinding.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/deployment.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/role.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/rolebinding.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/service.yaml create mode 100644 stable/aws-pod-identity-webhook/templates/serviceaccount.yaml create mode 100644 stable/aws-pod-identity-webhook/values.yaml diff --git a/stable/aws-pod-identity-webhook/.helmignore b/stable/aws-pod-identity-webhook/.helmignore new file mode 100644 index 000000000000..50af03172541 --- /dev/null +++ b/stable/aws-pod-identity-webhook/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/stable/aws-pod-identity-webhook/Chart.yaml b/stable/aws-pod-identity-webhook/Chart.yaml new file mode 100644 index 000000000000..60202ae20f1e --- /dev/null +++ b/stable/aws-pod-identity-webhook/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +appVersion: "1.0" +description: A Helm chart for the Amazon EKS Pod Identity Webhook +name: aws-pod-identity-webhook +version: 0.1.0 +icon: https://github.com/kubernetes/kubernetes/blob/master/logo/logo.png +home: https://github.com/aws/amazon-eks-pod-identity-webhook +sources: +- https://github.com/aws/amazon-eks-pod-identity-webhook +maintainers: +- name: Micah Hausler + email: hausler.m@gmail.com +engine: gotpl diff --git a/stable/aws-pod-identity-webhook/OWNERS b/stable/aws-pod-identity-webhook/OWNERS new file mode 100644 index 000000000000..ed1ec183e3b1 --- /dev/null +++ b/stable/aws-pod-identity-webhook/OWNERS @@ -0,0 +1,10 @@ +approvers: +- jqmichael +- nckturner +- micahhausler +- max-rocket-internet +reviewers: +- jqmichael +- nckturner +- micahhausler +- max-rocket-internet diff --git a/stable/aws-pod-identity-webhook/README.md b/stable/aws-pod-identity-webhook/README.md new file mode 100644 index 000000000000..7acc83f5bf76 --- /dev/null +++ b/stable/aws-pod-identity-webhook/README.md @@ -0,0 +1,53 @@ +# AWS Pod Identity Webhook + +This chart will install the [Amazon EKS Pod Identity Webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). This tool allows you to specify IAM Roles for Kubernetes Service Accounts. This allows a pod to assume a IAM role. + +Further details can be found here: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html + +## Prerequisites + +- Kubernetes 1.13+ + +## Installing the Chart + +You first need to retrieve `ca.crt` from your cluster as this is used as a value for the chart: + +```shell +secret_name=$(kubectl get sa default -o jsonpath='{.secrets[0].name}') +export CA_BUNDLE=$(kubectl get secret/$secret_name -o jsonpath='{.data.ca\.crt}' | tr -d '\n') +``` + +Then install the chart: + +```shell +$ helm install --name my-release stable/aws-pod-identity-webhook --set caBundle="${CA_BUNDLE}" +``` + +After installation you need to approve the certificate. Follow the chart notes after installation for this step. + +## Uninstalling the Chart + +To delete the chart: + +```shell +$ helm delete my-release +``` + +## Configuration + +The following table lists the configurable parameters for this chart and their default values. + +| Parameter | Description | Default | +| -----------------------|---------------------------------------|-------------------------------------------------------------------------| +| `image.repository` | Image repository | `602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pod-identity-webhook` | +| `image.tag` | Image tag | `latest` | +| `image.pullPolicy` | Container pull policy | `IfNotPresent` | +| `fullnameOverride` | Override the fullname of the chart | `nil` | +| `nameOverride` | Override the name of the chart | `nil` | +| `priorityClassName` | Set a priority class for pod | `nil` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install` or provide a YAML file containing the values for the above parameters: + +```shell +$ helm install --name my-release stable/aws-pod-identity-webhook --values values.yaml +``` diff --git a/stable/aws-pod-identity-webhook/templates/NOTES.txt b/stable/aws-pod-identity-webhook/templates/NOTES.txt new file mode 100644 index 000000000000..2117c42b5e22 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/NOTES.txt @@ -0,0 +1,10 @@ + +If this is your first installation of {{ .Chart.Name }} then you need to approve the certificate. + +Wait until the pod has started: + + kubectl get pods -n {{ .Release.Namespace }} -l app.kubernetes.io/instance={{ .Release.Name }},app.kubernetes.io/name={{ include "aws-pod-identity-webhook.name" . }} + +Then approve the certificate: + + kubectl certificate approve $(kubectl get csr -o jsonpath='{.items[?(@.spec.username=="system:serviceaccount:{{ .Release.Namespace }}:{{ include "aws-pod-identity-webhook.fullname" . }}")].metadata.name}') diff --git a/stable/aws-pod-identity-webhook/templates/_helpers.tpl b/stable/aws-pod-identity-webhook/templates/_helpers.tpl new file mode 100644 index 000000000000..484f8b1c012c --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/_helpers.tpl @@ -0,0 +1,45 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "aws-pod-identity-webhook.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "aws-pod-identity-webhook.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "aws-pod-identity-webhook.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "aws-pod-identity-webhook.labels" -}} +app.kubernetes.io/name: {{ include "aws-pod-identity-webhook.name" . }} +helm.sh/chart: {{ include "aws-pod-identity-webhook.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} diff --git a/stable/aws-pod-identity-webhook/templates/clusterrole.yaml b/stable/aws-pod-identity-webhook/templates/clusterrole.yaml new file mode 100644 index 000000000000..752d020c5424 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/clusterrole.yaml @@ -0,0 +1,24 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +rules: +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - watch + - list +- apiGroups: + - certificates.k8s.io + resources: + - certificatesigningrequests + verbs: + - create + - get + - list + - watch diff --git a/stable/aws-pod-identity-webhook/templates/clusterrolebinding.yaml b/stable/aws-pod-identity-webhook/templates/clusterrolebinding.yaml new file mode 100644 index 000000000000..da34027d4b4f --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "aws-pod-identity-webhook.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "aws-pod-identity-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} diff --git a/stable/aws-pod-identity-webhook/templates/deployment.yaml b/stable/aws-pod-identity-webhook/templates/deployment.yaml new file mode 100644 index 000000000000..5bcfbfecf6d6 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/deployment.yaml @@ -0,0 +1,60 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: {{ include "aws-pod-identity-webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + template: + metadata: + labels: + app.kubernetes.io/name: {{ include "aws-pod-identity-webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + spec: + {{- if .Values.priorityClassName }} + priorityClassName: "{{ .Values.priorityClassName }}" + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "aws-pod-identity-webhook.fullname" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: + - /webhook + - --in-cluster + - --namespace=default + - --service-name={{ include "aws-pod-identity-webhook.fullname" . }} + - --tls-secret=pod-identity-webhook + - --annotation-prefix=eks.amazonaws.com + - --token-audience=sts.amazonaws.com + - --logtostderr + volumeMounts: + - name: webhook-certs + mountPath: /var/run/app/certs + readOnly: false + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: webhook-certs + emptyDir: {} diff --git a/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml b/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml new file mode 100644 index 000000000000..9f816489075c --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml @@ -0,0 +1,20 @@ +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: MutatingWebhookConfiguration +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +webhooks: +- name: pod-identity-webhook.amazonaws.com + failurePolicy: Ignore + clientConfig: + service: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + path: "/mutate" + caBundle: "{{ .Values.caBundle }}" + rules: + - operations: [ "CREATE" ] + apiGroups: [""] + apiVersions: ["v1"] + resources: ["pods"] diff --git a/stable/aws-pod-identity-webhook/templates/role.yaml b/stable/aws-pod-identity-webhook/templates/role.yaml new file mode 100644 index 000000000000..d16d0ad5da44 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/role.yaml @@ -0,0 +1,23 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - update + - patch + resourceNames: + - "{{ include "aws-pod-identity-webhook.fullname" . }}" diff --git a/stable/aws-pod-identity-webhook/templates/rolebinding.yaml b/stable/aws-pod-identity-webhook/templates/rolebinding.yaml new file mode 100644 index 000000000000..2fa884ab5ff9 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/rolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "aws-pod-identity-webhook.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "aws-pod-identity-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} diff --git a/stable/aws-pod-identity-webhook/templates/service.yaml b/stable/aws-pod-identity-webhook/templates/service.yaml new file mode 100644 index 000000000000..de6917a7c08c --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/service.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} + namespace: {{ .Release.Namespace }} + annotations: + prometheus.io/port: "443" + prometheus.io/scheme: "https" + prometheus.io/scrape: "true" +spec: + ports: + - port: 443 + targetPort: 443 + selector: + app.kubernetes.io/name: {{ include "aws-pod-identity-webhook.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} diff --git a/stable/aws-pod-identity-webhook/templates/serviceaccount.yaml b/stable/aws-pod-identity-webhook/templates/serviceaccount.yaml new file mode 100644 index 000000000000..18ac9f4f4055 --- /dev/null +++ b/stable/aws-pod-identity-webhook/templates/serviceaccount.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "aws-pod-identity-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: +{{ include "aws-pod-identity-webhook.labels" . | indent 4 }} diff --git a/stable/aws-pod-identity-webhook/values.yaml b/stable/aws-pod-identity-webhook/values.yaml new file mode 100644 index 000000000000..780b2e6f11d5 --- /dev/null +++ b/stable/aws-pod-identity-webhook/values.yaml @@ -0,0 +1,18 @@ +image: + repository: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pod-identity-webhook + tag: latest + pullPolicy: IfNotPresent + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +resources: {} + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +priorityClassName: "" From 918eaa8aad57728fc80518342dbf227fa643ef34 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Thu, 12 Sep 2019 17:18:21 +0200 Subject: [PATCH 2/6] remove owners Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/OWNERS | 10 ---------- 1 file changed, 10 deletions(-) delete mode 100644 stable/aws-pod-identity-webhook/OWNERS diff --git a/stable/aws-pod-identity-webhook/OWNERS b/stable/aws-pod-identity-webhook/OWNERS deleted file mode 100644 index ed1ec183e3b1..000000000000 --- a/stable/aws-pod-identity-webhook/OWNERS +++ /dev/null @@ -1,10 +0,0 @@ -approvers: -- jqmichael -- nckturner -- micahhausler -- max-rocket-internet -reviewers: -- jqmichael -- nckturner -- micahhausler -- max-rocket-internet From d1e7a0c8f6f0225e1e46ad2b51a20ac82a830c07 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Thu, 12 Sep 2019 17:22:17 +0200 Subject: [PATCH 3/6] fix maintainer Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stable/aws-pod-identity-webhook/Chart.yaml b/stable/aws-pod-identity-webhook/Chart.yaml index 60202ae20f1e..508fbb8b08b3 100644 --- a/stable/aws-pod-identity-webhook/Chart.yaml +++ b/stable/aws-pod-identity-webhook/Chart.yaml @@ -8,6 +8,6 @@ home: https://github.com/aws/amazon-eks-pod-identity-webhook sources: - https://github.com/aws/amazon-eks-pod-identity-webhook maintainers: -- name: Micah Hausler +- name: micahhausler email: hausler.m@gmail.com engine: gotpl From 0cf9904fdd4a945f7282e8ec930312b4172f1d67 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Fri, 13 Sep 2019 12:39:15 +0200 Subject: [PATCH 4/6] squash all commits and add signoff - fix namespace in command - add options for annotation_prefix / token_audience - updating doc and note about k8s version - fix quote - fix indentation - fix resourcename in role - add note about CSR expiry Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/README.md | 6 +++++- .../templates/deployment.yaml | 14 +++++++------- .../templates/mutatingwebhook.yaml | 2 +- .../aws-pod-identity-webhook/templates/role.yaml | 2 +- stable/aws-pod-identity-webhook/values.yaml | 6 ++++++ 5 files changed, 20 insertions(+), 10 deletions(-) diff --git a/stable/aws-pod-identity-webhook/README.md b/stable/aws-pod-identity-webhook/README.md index 7acc83f5bf76..939d9ea06897 100644 --- a/stable/aws-pod-identity-webhook/README.md +++ b/stable/aws-pod-identity-webhook/README.md @@ -6,7 +6,9 @@ Further details can be found here: https://docs.aws.amazon.com/eks/latest/usergu ## Prerequisites -- Kubernetes 1.13+ +- Kubernetes 1.12+ + +For installation into a non-EKS cluster, see [Self-hosted Kubernetes setup](https://github.com/aws/amazon-eks-pod-identity-webhook/blob/master/SELF_HOSTED_SETUP.md) ## Installing the Chart @@ -25,6 +27,8 @@ $ helm install --name my-release stable/aws-pod-identity-webhook --set caBundle= After installation you need to approve the certificate. Follow the chart notes after installation for this step. +The webhook will request a new CSR prior expiry in 1 year. This new CSR will also need to be manually approved. + ## Uninstalling the Chart To delete the chart: diff --git a/stable/aws-pod-identity-webhook/templates/deployment.yaml b/stable/aws-pod-identity-webhook/templates/deployment.yaml index 5bcfbfecf6d6..0207918e0699 100644 --- a/stable/aws-pod-identity-webhook/templates/deployment.yaml +++ b/stable/aws-pod-identity-webhook/templates/deployment.yaml @@ -5,7 +5,7 @@ metadata: labels: {{ include "aws-pod-identity-webhook.labels" . | indent 4 }} spec: - replicas: 1 + replicas: {{ .Values.replicas }} selector: matchLabels: app.kubernetes.io/name: {{ include "aws-pod-identity-webhook.name" . }} @@ -31,18 +31,18 @@ spec: command: - /webhook - --in-cluster - - --namespace=default + - --namespace={{ .Release.Namespace }} - --service-name={{ include "aws-pod-identity-webhook.fullname" . }} - - --tls-secret=pod-identity-webhook - - --annotation-prefix=eks.amazonaws.com - - --token-audience=sts.amazonaws.com + - --tls-secret={{ .Values.tls_secret_name }} + - --annotation-prefix={{ .Values.annotation_prefix }} + - --token-audience={{ .Values.token_audience }} - --logtostderr volumeMounts: - name: webhook-certs mountPath: /var/run/app/certs readOnly: false - resources: - {{- toYaml .Values.resources | nindent 12 }} + resources: + {{- toYaml .Values.resources | nindent 10 }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml b/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml index 9f816489075c..49bff1632142 100644 --- a/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml +++ b/stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml @@ -12,7 +12,7 @@ webhooks: name: {{ include "aws-pod-identity-webhook.fullname" . }} namespace: {{ .Release.Namespace }} path: "/mutate" - caBundle: "{{ .Values.caBundle }}" + caBundle: {{ .Values.caBundle | quote }} rules: - operations: [ "CREATE" ] apiGroups: [""] diff --git a/stable/aws-pod-identity-webhook/templates/role.yaml b/stable/aws-pod-identity-webhook/templates/role.yaml index d16d0ad5da44..d9513dcbf1af 100644 --- a/stable/aws-pod-identity-webhook/templates/role.yaml +++ b/stable/aws-pod-identity-webhook/templates/role.yaml @@ -20,4 +20,4 @@ rules: - update - patch resourceNames: - - "{{ include "aws-pod-identity-webhook.fullname" . }}" + - "{{ .Values.tls_secret_name }}" diff --git a/stable/aws-pod-identity-webhook/values.yaml b/stable/aws-pod-identity-webhook/values.yaml index 780b2e6f11d5..29a174af1da5 100644 --- a/stable/aws-pod-identity-webhook/values.yaml +++ b/stable/aws-pod-identity-webhook/values.yaml @@ -1,3 +1,9 @@ +tls_secret_name: pod-identity-webhook +annotation_prefix: eks.amazonaws.com +token_audience: sts.amazonaws.com + +replicas: 3 + image: repository: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pod-identity-webhook tag: latest From 7645d6761f9e7a1a9e27d24ab880eeb23ef94e58 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Mon, 16 Sep 2019 10:45:08 +0200 Subject: [PATCH 5/6] Adding Micah as owner Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/OWNERS | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 stable/aws-pod-identity-webhook/OWNERS diff --git a/stable/aws-pod-identity-webhook/OWNERS b/stable/aws-pod-identity-webhook/OWNERS new file mode 100644 index 000000000000..29384ec3fee3 --- /dev/null +++ b/stable/aws-pod-identity-webhook/OWNERS @@ -0,0 +1,4 @@ +approvers: +- micahhausler +reviewers: +- micahhausler From 233a1c09b2852814310011bca0acc7c210c03760 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Wed, 25 Sep 2019 12:28:38 +0200 Subject: [PATCH 6/6] change container name and update values in README Signed-off-by: Max Williams --- stable/aws-pod-identity-webhook/README.md | 11 ++++++++++- .../templates/deployment.yaml | 2 +- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/stable/aws-pod-identity-webhook/README.md b/stable/aws-pod-identity-webhook/README.md index 939d9ea06897..acc58e6536ed 100644 --- a/stable/aws-pod-identity-webhook/README.md +++ b/stable/aws-pod-identity-webhook/README.md @@ -43,12 +43,21 @@ The following table lists the configurable parameters for this chart and their d | Parameter | Description | Default | | -----------------------|---------------------------------------|-------------------------------------------------------------------------| +| `tls_secret_name` | Name of the secret containing the | `pod-identity-webhook` | +| `annotation_prefix` | Prefix for annotation | `eks.amazonaws.com` | +| `token_audience` | Token audience | `sts.amazonaws.com` | +| `caBundle` | CA cert bundle data | None. Must be provided on chart install | | `image.repository` | Image repository | `602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pod-identity-webhook` | | `image.tag` | Image tag | `latest` | | `image.pullPolicy` | Container pull policy | `IfNotPresent` | +| `replicas` | Number of deployment replicas | `3` | | `fullnameOverride` | Override the fullname of the chart | `nil` | | `nameOverride` | Override the name of the chart | `nil` | -| `priorityClassName` | Set a priority class for pod | `nil` | +| `priorityClassName` | Set a priority class for pods | `nil` | +| `resources` | Pod resources | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Optional deployment tolerations | `[]` | +| `affinity` | Map of node/pod affinities | `{}` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install` or provide a YAML file containing the values for the above parameters: diff --git a/stable/aws-pod-identity-webhook/templates/deployment.yaml b/stable/aws-pod-identity-webhook/templates/deployment.yaml index 0207918e0699..ce05108c6be3 100644 --- a/stable/aws-pod-identity-webhook/templates/deployment.yaml +++ b/stable/aws-pod-identity-webhook/templates/deployment.yaml @@ -25,7 +25,7 @@ spec: {{- end }} serviceAccountName: {{ include "aws-pod-identity-webhook.fullname" . }} containers: - - name: {{ .Chart.Name }} + - name: webhook image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} command: