mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/etcd] Add support for customizing authentication token type (#7735)
* [bitnami/etcd] Add support for customizing authentication token type Signed-off-by: juan131 <juanariza@vmware.com> * Fix typo in values Signed-off-by: juan131 <juanariza@vmware.com> * Add support for customizin the JWT token and loading the private key from a secret Signed-off-by: juan131 <juanariza@vmware.com>
This commit is contained in:
Juan Ariza Toledano
@@ -24,4 +24,4 @@ name: etcd
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-etcd
|
||||
- https://coreos.com/etcd/
|
||||
version: 6.8.4
|
||||
version: 6.9.0
|
||||
|
||||
+44
-39
@@ -73,45 +73,50 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
|
||||
### etcd parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------- | ----------------------------------------------------------------------------------------------- | --------------------- |
|
||||
| `image.registry` | etcd image registry | `docker.io` |
|
||||
| `image.repository` | etcd image name | `bitnami/etcd` |
|
||||
| `image.tag` | etcd image tag | `3.5.0-debian-10-r94` |
|
||||
| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | etcd image pull secrets | `[]` |
|
||||
| `image.debug` | Enable image debug mode | `false` |
|
||||
| `auth.rbac.enabled` | Switch to enable RBAC authentication | `true` |
|
||||
| `auth.rbac.allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` |
|
||||
| `auth.rbac.rootPassword` | Root user password. The root user is always `root` | `""` |
|
||||
| `auth.rbac.existingSecret` | Name of the existing secret containing credentials for the root user | `""` |
|
||||
| `auth.rbac.existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `""` |
|
||||
| `auth.client.secureTransport` | Switch to encrypt client-to-server communications using TLS certificates | `false` |
|
||||
| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` |
|
||||
| `auth.client.existingSecret` | Name of the existing secret containing the TLS certificates for client-to-server communications | `""` |
|
||||
| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret | `false` |
|
||||
| `auth.client.certFilename` | Name of the file containing the client certificate | `cert.pem` |
|
||||
| `auth.client.certKeyFilename` | Name of the file containing the client certificate private key | `key.pem` |
|
||||
| `auth.client.caFilename` | Name of the file containing the client CA certificate | `""` |
|
||||
| `auth.peer.secureTransport` | Switch to encrypt server-to-server communications using TLS certificates | `false` |
|
||||
| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` |
|
||||
| `auth.peer.existingSecret` | Name of the existing secret containing the TLS certificates for server-to-server communications | `""` |
|
||||
| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret | `false` |
|
||||
| `auth.peer.certFilename` | Name of the file containing the peer certificate | `cert.pem` |
|
||||
| `auth.peer.certKeyFilename` | Name of the file containing the peer certificate private key | `key.pem` |
|
||||
| `auth.peer.caFilename` | Name of the file containing the peer CA certificate | `""` |
|
||||
| `autoCompactionMode` | Auto compaction mode, by default periodic. Valid values: ‘periodic’, ‘revision’. | `""` |
|
||||
| `autoCompactionRetention` | Auto compaction retention for mvcc key value store in hour, by default 0, means disabled | `""` |
|
||||
| `initialClusterState` | Initial cluster state. Allowed values: 'new' or 'existing' | `""` |
|
||||
| `maxProcs` | Limits the number of operating system threads that can execute user-level | `""` |
|
||||
| `removeMemberOnContainerTermination` | Use a PreStop hook to remove the etcd members from the etcd cluster on container termination | `true` |
|
||||
| `configuration` | etcd configuration. Specify content for etcd.conf.yml | `""` |
|
||||
| `existingConfigmap` | Existing ConfigMap with etcd configuration | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be set on etcd container | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` |
|
||||
| `command` | Default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Default container args (useful when using custom images) | `[]` |
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------- | ----------------------------------------------------------------------------------------------- | --------------------- |
|
||||
| `image.registry` | etcd image registry | `docker.io` |
|
||||
| `image.repository` | etcd image name | `bitnami/etcd` |
|
||||
| `image.tag` | etcd image tag | `3.5.0-debian-10-r94` |
|
||||
| `image.pullPolicy` | etcd image pull policy | `IfNotPresent` |
|
||||
| `image.pullSecrets` | etcd image pull secrets | `[]` |
|
||||
| `image.debug` | Enable image debug mode | `false` |
|
||||
| `auth.rbac.enabled` | Switch to enable RBAC authentication | `true` |
|
||||
| `auth.rbac.allowNoneAuthentication` | Allow to use etcd without configuring RBAC authentication | `true` |
|
||||
| `auth.rbac.rootPassword` | Root user password. The root user is always `root` | `""` |
|
||||
| `auth.rbac.existingSecret` | Name of the existing secret containing credentials for the root user | `""` |
|
||||
| `auth.rbac.existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `""` |
|
||||
| `auth.token.type` | Authentication token type. Allowed values: 'simple' or 'jwt' | `jwt` |
|
||||
| `auth.token.privateKey.filename` | Name of the file containing the private key for signing the JWT token | `jwt-token.pem` |
|
||||
| `auth.token.privateKey.existingSecret` | Name of the existing secret containing the private key for signing the JWT token | `""` |
|
||||
| `auth.token.signMethod` | JWT token sign method | `RS256` |
|
||||
| `auth.token.ttl` | JWT token TTL | `10m` |
|
||||
| `auth.client.secureTransport` | Switch to encrypt client-to-server communications using TLS certificates | `false` |
|
||||
| `auth.client.useAutoTLS` | Switch to automatically create the TLS certificates | `false` |
|
||||
| `auth.client.existingSecret` | Name of the existing secret containing the TLS certificates for client-to-server communications | `""` |
|
||||
| `auth.client.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret | `false` |
|
||||
| `auth.client.certFilename` | Name of the file containing the client certificate | `cert.pem` |
|
||||
| `auth.client.certKeyFilename` | Name of the file containing the client certificate private key | `key.pem` |
|
||||
| `auth.client.caFilename` | Name of the file containing the client CA certificate | `""` |
|
||||
| `auth.peer.secureTransport` | Switch to encrypt server-to-server communications using TLS certificates | `false` |
|
||||
| `auth.peer.useAutoTLS` | Switch to automatically create the TLS certificates | `false` |
|
||||
| `auth.peer.existingSecret` | Name of the existing secret containing the TLS certificates for server-to-server communications | `""` |
|
||||
| `auth.peer.enableAuthentication` | Switch to enable host authentication using TLS certificates. Requires existing secret | `false` |
|
||||
| `auth.peer.certFilename` | Name of the file containing the peer certificate | `cert.pem` |
|
||||
| `auth.peer.certKeyFilename` | Name of the file containing the peer certificate private key | `key.pem` |
|
||||
| `auth.peer.caFilename` | Name of the file containing the peer CA certificate | `""` |
|
||||
| `autoCompactionMode` | Auto compaction mode, by default periodic. Valid values: ‘periodic’, ‘revision’. | `""` |
|
||||
| `autoCompactionRetention` | Auto compaction retention for mvcc key value store in hour, by default 0, means disabled | `""` |
|
||||
| `initialClusterState` | Initial cluster state. Allowed values: 'new' or 'existing' | `""` |
|
||||
| `maxProcs` | Limits the number of operating system threads that can execute user-level | `""` |
|
||||
| `removeMemberOnContainerTermination` | Use a PreStop hook to remove the etcd members from the etcd cluster on container termination | `true` |
|
||||
| `configuration` | etcd configuration. Specify content for etcd.conf.yml | `""` |
|
||||
| `existingConfigmap` | Existing ConfigMap with etcd configuration | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be set on etcd container | `[]` |
|
||||
| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` |
|
||||
| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` |
|
||||
| `command` | Default container command (useful when using custom images) | `[]` |
|
||||
| `args` | Default container args (useful when using custom images) | `[]` |
|
||||
|
||||
|
||||
### etcd statefulset parameters
|
||||
|
||||
@@ -117,6 +117,26 @@ Get the secret password key to be retrieved from etcd secret.
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a secret object should be created for the etcd token private key
|
||||
*/}}
|
||||
{{- define "etcd.token.createSecret" -}}
|
||||
{{- if and (eq .Values.auth.token.type "jwt") (empty .Values.auth.token.privateKey.existingSecret) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the secret with etcd token private key
|
||||
*/}}
|
||||
{{- define "etcd.token.secretName" -}}
|
||||
{{- if .Values.auth.token.privateKey.existingSecret -}}
|
||||
{{- printf "%s" .Values.auth.token.privateKey.existingSecret -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-jwt-token" (include "common.names.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Disaster Recovery PVC name
|
||||
*/}}
|
||||
@@ -130,6 +150,17 @@ Return the proper Disaster Recovery PVC name
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "etcd.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
@@ -172,14 +203,3 @@ etcd: disasterRecovery
|
||||
Please enable persistence (--set persistence.enabled=true)
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "etcd.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "common.names.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -30,6 +30,12 @@ spec:
|
||||
{{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if (include "etcd.createConfigmap" .) }}
|
||||
checksum/configuration: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if (include "etcd.token.createSecret" .) }}
|
||||
checksum/token-secret: {{ include (print $.Template.BasePath "/token-secrets.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- include "etcd.imagePullSecrets" . | nindent 6 }}
|
||||
{{- if .Values.hostAliases }}
|
||||
@@ -143,6 +149,12 @@ spec:
|
||||
name: {{ include "etcd.secretName" . }}
|
||||
key: {{ include "etcd.secretPasswordKey" . }}
|
||||
{{- end }}
|
||||
- name: ETCD_AUTH_TOKEN
|
||||
{{- if eq .Values.auth.token.type "jwt" }}
|
||||
value: {{ printf "jwt,priv-key=/opt/bitnami/etcd/certs/token/%s,sign-method=%s,ttl=%s" .Values.auth.token.privateKey.filename .Values.auth.token.signMethod .Values.auth.token.ttl | quote}}
|
||||
{{- else if eq .Values.auth.token.type "simple" }}
|
||||
value: "simple"
|
||||
{{- end }}
|
||||
- name: ETCD_ADVERTISE_CLIENT_URLS
|
||||
value: "{{ $etcdClientProtocol }}://$(MY_POD_NAME).{{ $etcdHeadlessServiceName }}.{{ .Release.Namespace }}.svc.{{ $clusterDomain }}:{{ .Values.service.port }}"
|
||||
- name: ETCD_LISTEN_CLIENT_URLS
|
||||
@@ -294,6 +306,11 @@ spec:
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /bitnami/etcd
|
||||
{{- if eq .Values.auth.token.type "jwt" }}
|
||||
- name: etcd-jwt-token
|
||||
mountPath: /opt/bitnami/etcd/certs/token/
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if or (and .Values.startFromSnapshot.enabled (not .Values.disasterRecovery.enabled)) (and .Values.disasterRecovery.enabled .Values.startFromSnapshot.enabled .Values.disasterRecovery.pvc.existingClaim) }}
|
||||
- name: init-snapshot-volume
|
||||
mountPath: /init-snapshot
|
||||
@@ -323,6 +340,12 @@ spec:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if eq .Values.auth.token.type "jwt" }}
|
||||
- name: etcd-jwt-token
|
||||
secret:
|
||||
secretName: {{ include "etcd.token.secretName" . }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- if or (and .Values.startFromSnapshot.enabled (not .Values.disasterRecovery.enabled)) (and .Values.disasterRecovery.enabled .Values.startFromSnapshot.enabled .Values.disasterRecovery.pvc.existingClaim) }}
|
||||
- name: init-snapshot-volume
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
{{- if (include "etcd.token.createSecret" .) }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-jwt-token" (include "common.names.fullname" .) }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: Opaque
|
||||
data:
|
||||
jwt-token.pem: {{ genPrivateKey "rsa" | b64enc | quote }}
|
||||
{{- end }}
|
||||
@@ -108,6 +108,30 @@ auth:
|
||||
## @param auth.rbac.existingSecretPasswordKey Name of key containing password to be retrieved from the existing secret
|
||||
##
|
||||
existingSecretPasswordKey: ""
|
||||
## Authentication token
|
||||
## ref: https://etcd.io/docs/latest/learning/design-auth-v3/#two-types-of-tokens-simple-and-jwt
|
||||
##
|
||||
token:
|
||||
## @param auth.token.type Authentication token type. Allowed values: 'simple' or 'jwt'
|
||||
## ref: https://etcd.io/docs/latest/op-guide/configuration/#--auth-token
|
||||
##
|
||||
type: jwt
|
||||
## @param auth.token.privateKey.filename Name of the file containing the private key for signing the JWT token
|
||||
## @param auth.token.privateKey.existingSecret Name of the existing secret containing the private key for signing the JWT token
|
||||
## NOTE: Ignored if auth.token.type=simple
|
||||
## NOTE: A secret containing a private key will be auto-generated if an existing one is not provided.
|
||||
##
|
||||
privateKey:
|
||||
filename: jwt-token.pem
|
||||
existingSecret: ""
|
||||
## @param auth.token.signMethod JWT token sign method
|
||||
## NOTE: Ignored if auth.token.type=simple
|
||||
##
|
||||
signMethod: RS256
|
||||
## @param auth.token.ttl JWT token TTL
|
||||
## NOTE: Ignored if auth.token.type=simple
|
||||
##
|
||||
ttl: 10m
|
||||
## TLS authentication for client-to-server communications
|
||||
## ref: https://etcd.io/docs/current/op-guide/security/
|
||||
##
|
||||
|
||||
Reference in New Issue
Block a user