Skip to content

Commit a11719a

Browse files
eyenxeyenx
authored
feat(helm-chart/servicePrincipal): allow an existingSecret for holding armAuth.json (#1551)
* feat(helm-chart/servicePrincipal): allow an existingSecret for holding armAuth.json Signed-off-by: Toni Tauro <toni.tauro@adfinis.com> * feat(existingSecret): add tests Signed-off-by: Toni Tauro <toni.tauro@adfinis.com> --------- Signed-off-by: Toni Tauro <toni.tauro@adfinis.com>
1 parent b9447f0 commit a11719a

File tree

9 files changed

+155
-5
lines changed

9 files changed

+155
-5
lines changed

‎helm/ingress-azure/templates/deployment.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,11 +110,16 @@ spec:
110110
path: /etc/kubernetes/
111111
type: Directory
112112
{{- if .Values.armAuth }}
113-
{{- if eq .Values.armAuth.type "servicePrincipal"}}
113+
{{- if and (eq .Values.armAuth.type "servicePrincipal") (not .Values.armAuth.existingSecret) }}
114114
- name: networking-appgw-k8s-azure-service-principal-mount
115115
secret:
116116
secretName: networking-appgw-k8s-azure-service-principal
117117
{{- end}}
118+
{{- if and (eq .Values.armAuth.type "servicePrincipal") (.Values.armAuth.existingSecret) }}
119+
- name: networking-appgw-k8s-azure-service-principal-mount
120+
secret:
121+
secretName: {{ .Values.armAuth.existingSecret }}
122+
{{- end}}
118123
{{- end}}
119124
{{- if .Values.kubernetes.volumes }}
120125
{{- if .Values.kubernetes.volumes.extraVolumes }}
@@ -144,4 +149,4 @@ spec:
144149
{{- if .Values.image.pullSecrets }}
145150
imagePullSecrets:
146151
- name: {{ .Values.image.pullSecrets }}
147-
{{- end }}
152+
{{- end }}

‎helm/ingress-azure/templates/secrets.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- if .Values.armAuth -}}
2-
{{- if eq .Values.armAuth.type "servicePrincipal" -}}
2+
{{- if and (eq .Values.armAuth.type "servicePrincipal") (not .Values.armAuth.existingSecret) -}}
33
apiVersion: v1
44
kind: Secret
55
metadata:

‎helm/ingress-azure/tests/fixtures/sample-config-existing-secret.json‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
{
2+
"verbosityLevel": 3,
3+
"appgw": {
4+
"subscriptionId": "0000-0000-0000-0000-00000000",
5+
"resourceGroup": "resgp",
6+
"name": "gateway",
7+
"usePrivateIP": false,
8+
"shared": false
9+
},
10+
"armAuth": {
11+
"type": "servicePrincipal",
12+
"existingSecret": "my-existing-secret"
13+
},
14+
"rbac": {
15+
"enabled": false
16+
},
17+
"kubernetes": {
18+
"resources": {}
19+
}
20+
}

‎helm/ingress-azure/tests/snapshots/sample-config-existing-secret/ingress-azure/templates/configmap.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
# Source: ingress-azure/templates/configmap.yaml
3+
apiVersion: v1
4+
kind: ConfigMap
5+
metadata:
6+
name: release-name-cm-ingress-azure
7+
labels:
8+
app: ingress-azure
9+
chart: ingress-azure-1.6.0
10+
heritage: Helm
11+
release: release-name
12+
data:
13+
APPGW_VERBOSITY_LEVEL: "3"
14+
MULTI_CLUSTER_MODE: "false"
15+
HTTP_SERVICE_PORT: "8123"
16+
APPGW_SUBSCRIPTION_ID: "0000-0000-0000-0000-00000000"
17+
APPGW_RESOURCE_GROUP: "resgp"
18+
APPGW_NAME: "gateway"
19+
APPGW_SUBNET_NAME: "gateway-subnet"
20+
INGRESS_CLASS_RESOURCE_ENABLED: "true"
21+
INGRESS_CLASS_RESOURCE_NAME: "azure-application-gateway"
22+
INGRESS_CLASS_RESOURCE_CONTROLLER: "azure/application-gateway"

‎helm/ingress-azure/tests/snapshots/sample-config-existing-secret/ingress-azure/templates/deployment.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
# Source: ingress-azure/templates/deployment.yaml
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: release-name-ingress-azure
7+
labels:
8+
app: ingress-azure
9+
chart: ingress-azure-1.6.0
10+
heritage: Helm
11+
release: release-name
12+
spec:
13+
replicas: 1 # TODO: Make configurable when leader election is supported.
14+
selector:
15+
matchLabels:
16+
app: ingress-azure
17+
release: release-name
18+
template:
19+
metadata:
20+
labels:
21+
app: ingress-azure
22+
release: release-name
23+
annotations:
24+
prometheus.io/scrape: "true"
25+
prometheus.io/port: "8123"
26+
spec:
27+
serviceAccountName: release-name-sa-ingress-azure
28+
securityContext:
29+
runAsUser: 0
30+
containers:
31+
- name: ingress-azure
32+
image: mcr.microsoft.com/azure-application-gateway/kubernetes-ingress:1.6.0
33+
imagePullPolicy: Always
34+
readinessProbe:
35+
httpGet:
36+
path: /health/ready
37+
port: 8123
38+
initialDelaySeconds: 5
39+
periodSeconds: 10
40+
livenessProbe:
41+
httpGet:
42+
path: /health/alive
43+
port: 8123
44+
initialDelaySeconds: 15
45+
periodSeconds: 20
46+
env:
47+
- name: AZURE_CLOUD_PROVIDER_LOCATION
48+
value: /etc/appgw/azure.json
49+
- name: AGIC_POD_NAME
50+
valueFrom:
51+
fieldRef:
52+
fieldPath: metadata.name
53+
- name: AGIC_POD_NAMESPACE
54+
valueFrom:
55+
fieldRef:
56+
fieldPath: metadata.namespace
57+
- name: AZURE_AUTH_LOCATION
58+
value: /etc/Azure/Networking-AppGW/auth/armAuth.json
59+
envFrom:
60+
- configMapRef:
61+
name: release-name-cm-ingress-azure
62+
volumeMounts:
63+
- name: azure
64+
mountPath: /etc/appgw/
65+
readOnly: true
66+
- name: networking-appgw-k8s-azure-service-principal-mount
67+
mountPath: /etc/Azure/Networking-AppGW/auth
68+
readOnly: true
69+
volumes:
70+
- name: azure
71+
hostPath:
72+
path: /etc/kubernetes/
73+
type: Directory
74+
- name: networking-appgw-k8s-azure-service-principal-mount
75+
secret:
76+
secretName: my-existing-secret

‎helm/ingress-azure/tests/snapshots/sample-config-existing-secret/ingress-azure/templates/ingressclass.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
# Source: ingress-azure/templates/ingressclass.yaml
3+
apiVersion: networking.k8s.io/v1
4+
kind: IngressClass
5+
metadata:
6+
labels:
7+
app.kubernetes.io/component: controller
8+
name: azure-application-gateway
9+
spec:
10+
controller: azure/application-gateway

‎helm/ingress-azure/tests/snapshots/sample-config-existing-secret/ingress-azure/templates/serviceaccount.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
# Source: ingress-azure/templates/serviceaccount.yaml
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
labels:
7+
app: ingress-azure
8+
chart: ingress-azure-1.6.0
9+
heritage: Helm
10+
release: release-name
11+
name: release-name-sa-ingress-azure

‎helm/ingress-azure/values-template.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,9 @@ appgw: {}
9999
# # Generate this value with:
100100
# # az ad sp create-for-rbac --subscription <subscription-uuid> --sdk-auth | base64 -w0
101101
# secretJSON: <base64-encoded-JSON-blob>
102+
# # name of existing Secret containing armAuth.json
103+
# # if set, no secret is being created by the chart
104+
# existingSecret: mysecret
102105
#
103106
# - Option 3: Workload Identity (https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
104107
# armAuth:
@@ -112,4 +115,4 @@ nodeSelector: {}
112115
################################################################################
113116
# Specify if the cluster is RBAC enabled or not
114117
rbac:
115-
enabled: false # true/false
118+
enabled: false # true/false

‎helm/ingress-azure/values.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,9 @@ appgw: {}
103103
# # Generate this value with:
104104
# # az ad sp create-for-rbac --subscription <subscription-uuid> --sdk-auth | base64 -w0
105105
# secretJSON: <base64-encoded-JSON-blob>
106+
# # name of existing Secret containing armAuth.json
107+
# # if set, no secret is being created by the chart
108+
# existingSecret: mysecret
106109
#
107110
# - Option 3: Workload Identity (https://learn.microsoft.com/en-us/azure/aks/workload-identity-overview)
108111
# armAuth:
@@ -116,4 +119,4 @@ nodeSelector: {}
116119
################################################################################
117120
# Specify if the cluster is RBAC enabled or not
118121
rbac:
119-
enabled: false # true/false
122+
enabled: false # true/false

0 commit comments

Comments
 (0)