Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/consul] fix: 🔒 Move service-account token auto-mount to pod declaration (#22480)

Browse Source 
Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-22 16:15:23 +01:00
committed by GitHub
parent 580576bb2b
commit 54555487fe
6 changed files with 59 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/consul/Chart.yaml
+1 -1
View File
@@ -32,4 +32,4 @@ maintainers:
name: consul
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/consul
version: 10.15.1
version: 10.16.0
bitnami/consul/README.md
+5
View File
@@ -96,6 +96,7 @@ helm delete --purge my-release
| `raftMultiplier` | Multiplier used to scale key Raft timing parameters | `1` |
| `gossipKey` | Gossip key for all members. The key must be base64-encoded, can be generated with $(consul keygen) | `""` |
| `tlsEncryptionSecretName` | Name of existing secret with TLS encryption data | `""` |
| `automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `hostAliases` | Deployment pod host aliases | `[]` |
| `configuration` | HashiCorp Consul configuration to be injected as ConfigMap | `""` |
| `existingConfigmap` | ConfigMap with HashiCorp Consul configuration | `""` |
@@ -178,6 +179,10 @@ helm delete --purge my-release
| `pdb.create` | Enable/disable a Pod Disruption Budget creation | `false` |
| `pdb.minAvailable` | Minimum number of pods that must still be available after the eviction | `1` |
| `pdb.maxUnavailable` | Max number of pods that can be unavailable after the eviction | `""` |
| `serviceAccount.create` | Enable creation of ServiceAccount for WordPress pod | `true` |
| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` |
| `serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
### Exposure parameters
bitnami/consul/templates/_helpers.tpl
+11
View File
@@ -19,6 +19,17 @@ Return the proper metrics image name
{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "consul.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the proper image name (for the init container volume-permissions image)
*/}}
bitnami/consul/templates/serviceaccount.yaml
+18
View File
@@ -0,0 +1,18 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "consul.serviceAccountName" . }}
namespace: {{ include "common.names.namespace" . | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- end -}}
bitnami/consul/templates/statefulset.yaml
+2
View File
@@ -37,6 +37,8 @@ spec:
{{- end }}
spec:
{{- include "consul.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ include "consul.serviceAccountName" .}}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- if .Values.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/consul/values.yaml
+22
View File
@@ -115,6 +115,9 @@ gossipKey: ""
## tlsEncryptionSecretName: your-already-created-secret
##
tlsEncryptionSecretName: ""
## @param automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param hostAliases Deployment pod host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -413,6 +416,25 @@ pdb:
##
maxUnavailable: ""
## Service Account
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
##
serviceAccount:
## @param serviceAccount.create Enable creation of ServiceAccount for WordPress pod
##
create: true
## @param serviceAccount.name The name of the ServiceAccount to use.
## If not set and create is true, a name is generated using the common.names.fullname template
##
name: ""
## @param serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
## Can be set to false if pods using this serviceAccount do not need to use K8s API
##
automountServiceAccountToken: false
## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount
##
annotations: {}
## @section Exposure parameters
##