Skip to content

Commit

Permalink
feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12)
Browse files Browse the repository at this point in the history
* Add objectSelector to webhookconfiguration (hashicorp#456)

* changelog++

* Add CSI secrets store provider (hashicorp#461)

* updating acceptance tests to k8s 1.17 on gke (hashicorp#473)

* changelog++

* Target vault-csi-provider release 0.1.0 (hashicorp#475)

* Update to 0.10.0 (hashicorp#477)

* Update to v0.10.0

* Fix typo

* Add csi link in changelog

* Add volumes and mounts support for CSI (hashicorp#479)

* Remove extraVolumes from CSI, add volumes and mounts

* Add better example

* changelog++

* Remove extra word in readme (hashicorp#482)

* fix csi helm deployment (hashicorp#486)

* fix serviceaccount and clusterrole name reference (full name)

* add server.enabled option, align with documentation

* add unit tests

* update server.enabled behaviour to explicit true and update tests

* changelog++

* add hostNetwork value to injector deployment (hashicorp#471)

* add hostNetwork value to injector deployment

* adding unit tests

* changelog++

* feat(ingress): Extra paths to prepend to the ingress host configuration for annotation based services (hashicorp#460)

Refs hashicorp#361

* changelog++

* Add logLevel and logFormat values for Vault (hashicorp#488)

* Add logLevel and logFormat values for Vault

* Add configurable tests

* Update order of log levels

* Update values.yaml

* Update per review

* Update test/unit/server-statefulset.bats

Co-authored-by: Tom Proctor <[email protected]>

* Update test/unit/server-statefulset.bats

Co-authored-by: Tom Proctor <[email protected]>

Co-authored-by: Tom Proctor <[email protected]>

* changelog++

* Custom value of agent port  (hashicorp#489)

* configure the agent port

* add unit test

* remove default

* remove default

* Update values.yaml

Co-authored-by: Jason O'Donnell <[email protected]>

Co-authored-by: Jason O'Donnell <[email protected]>

* changelog++

* Add injector agent default overrides (hashicorp#493)

* Add injector agent default overrides

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* [injector] Add port name in injector service (hashicorp#495)

* [injector] Add port name in injector service

* [injector] Hardcore port to https

* changelog++

* Fix injector unit test failing (hashicorp#496)

* Fix injector unit test failing

* Add null check

* Add default if unset for CI

* Remove redundant logic (hashicorp#434)

* Update to v0.11.0 (hashicorp#497)

* Add container based tests documentation (hashicorp#492)

* update documentation with running unit tests using container

* promote bats version to 1.3.0

* Update CONTRIBUTING.md

Co-authored-by: Jason O'Donnell <[email protected]>

* Update CONTRIBUTING.md

Co-authored-by: Jason O'Donnell <[email protected]>

Co-authored-by: Jason O'Donnell <[email protected]>

* Set kubeVersion and added chart-verifier tests (hashicorp#510)

Set min kubeVersion in Chart.yaml to 1.14. Added a chart-verifier bats
test, and configured to run it in CI. Some verification tests that
haven't been addressed yet are skipped.

* changelog++

* match kubeVersion on semver pre-releases (hashicorp#512)

Since clouds like GKE set their kubeVersion as a
pre-release (e.g. v1.17.17-gke.6700)

* Add ImagePullSecrets to CSI daemonset (hashicorp#519)

* changelog++

* changelog++

* fix CONTRIBUTING.md (hashicorp#501)

* updating to use new dedicated context and token (hashicorp#515)

* added values json schema (hashicorp#513)

Generated the schema using the helm schema-gen plugin, and added extra
data types to fields that allow it, such as annotations, tolerations,
enabled, etc. Enabled the "contains-value-schema" chart-verifier test.

Co-authored-by: Jason O'Donnell <[email protected]>

* changelog++

* [Issue-520] tolerations for csi-daemonset (hashicorp#521)

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* Add extraArgs value for CSI (hashicorp#526)

* changelog++

* add schema unit tests (hashicorp#530)

* Add UI targetPort option (hashicorp#437)

Use custom `targetPort` for UI service. See the usecase in hashicorp#385 (comment)

* changelog++

* Update to v0.12.0 (hashicorp#532)

* Update to v0.12.0

* Update values.schema.json

* Fix schema types

* revert image repo

* Adding helm test for vault server (hashicorp#531)

Also adds acceptance test for 'helm test' and updates the
chart-verifier version.

* changelog++

* fix ui.serviceNodePort schema (hashicorp#537)

UI service nodePort defaults to null, but is set as an integer

* changelog++

* change maxUnavailable to integer (hashicorp#535)

change maxUnavailable from `null` to `integer` to enable upgrade from
0.11.0 to 0.12.0 when using the specific variable.

* Also allow null value

Co-authored-by: Theron Voran <[email protected]>

* add test for server.ha.disruptionBudget.maxUnavailable

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* use vault-helm-test:0.2.0 (hashicorp#543)

* Added webhook-certs volume mount to sidecar injector (hashicorp#545)

* Removed webhook-certs volume mount from leader-elector container

* Added test: injector deployment manual TLS adds volume mount

* changelog++

* Adding server.enterpriseLicense (hashicorp#547)

Sets up a vault-enterprise license for autoloading on vault
startup. Mounts an existing secret to /vault/license and sets
VAULT_LICENSE_PATH appropriately.

* changelog++

* Add openshift overrides (hashicorp#549)

Adds default overrides for OpenShift (values.openshift.yaml) and uses
them in the chart-verifier tests.

* changelog++

* Update to v0.13.0 (hashicorp#554)

* Explain this fork in the README

* Adding support for LoadBalancerIP field in ServiceSpec

* DATAGO-13861: Adding support for logrotate

* DATAGO-13861: Adding audit log rotation and shipment to datdog

* Fixing minor typos and removing extra lines

* DATAGO-13861: Adding support for logrotate

* DATAGO-13861: Adding audit log rotation and shipment to datdog

* Fixing minor typos and removing extra lines

* feat(DATAGO-27002): Upgrade to 1.7.9

* chore(DATAGO-27002): Fix doc issue

Co-authored-by: guru1306 <[email protected]>
Co-authored-by: Jason O'Donnell <[email protected]>
Co-authored-by: Tom Proctor <[email protected]>
Co-authored-by: Theron Voran <[email protected]>
Co-authored-by: Paul <[email protected]>
Co-authored-by: Arie Lev <[email protected]>
Co-authored-by: Paul Witt <[email protected]>
Co-authored-by: Sam Marshall <[email protected]>
Co-authored-by: Hamza ZOUHAIR <[email protected]>
Co-authored-by: Javier Criado Marcos <[email protected]>
Co-authored-by: mehmetsalgar <[email protected]>
Co-authored-by: Sarah Thompson <[email protected]>
Co-authored-by: Iñigo Horcajo <[email protected]>
Co-authored-by: Rule88 <[email protected]>
Co-authored-by: Ricardo Gândara Pinto <[email protected]>
Co-authored-by: Julian Setiawan <[email protected]>
Co-authored-by: marcboudreau <[email protected]>
Co-authored-by: Hadie Laham <[email protected]>
  • Loading branch information
19 people authored and xiaocongji committed Aug 25, 2023
1 parent 93f8ad7 commit 0a92a9c
Show file tree
Hide file tree
Showing 7 changed files with 174 additions and 2 deletions.
106 changes: 106 additions & 0 deletions .circleci/config.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
version: 2.1
orbs:
slack: circleci/[email protected]

jobs:
bats-unit-test:
docker:
# This image is built from test/docker/Test.dockerfile
- image: docker.mirror.hashicorp.services/hashicorpdev/vault-helm-test:0.2.0
steps:
- checkout
- run: bats ./test/unit -t

chart-verifier:
docker:
- image: docker.mirror.hashicorp.services/cimg/go:1.16
environment:
BATS_VERSION: "1.3.0"
CHART_VERIFIER_VERSION: "1.0.0"
steps:
- checkout
- run:
name: install chart-verifier
command: go get github.com/redhat-certification/chart-verifier@${CHART_VERIFIER_VERSION}
- run:
name: install bats
command: |
curl -sSL https://github.com/bats-core/bats-core/archive/v${BATS_VERSION}.tar.gz -o /tmp/bats.tgz
tar -zxf /tmp/bats.tgz -C /tmp
sudo /bin/bash /tmp/bats-core-${BATS_VERSION}/install.sh /usr/local
- run:
name: run chart-verifier tests
command: bats ./test/chart -t

acceptance:
docker:
# This image is build from test/docker/Test.dockerfile
- image: docker.mirror.hashicorp.services/hashicorpdev/vault-helm-test:0.2.0

steps:
- checkout
- run:
name: terraform init & apply
command: |
echo -e "${GOOGLE_APP_CREDS}" | base64 -d > vault-helm-test.json
export GOOGLE_CREDENTIALS=vault-helm-test.json
make provision-cluster
- run:
name: Run acceptance tests
command: bats ./test/acceptance -t

- run:
name: terraform destroy
command: |
export GOOGLE_CREDENTIALS=vault-helm-test.json
make destroy-cluster
when: always
update-helm-charts-index:
docker:
- image: docker.mirror.hashicorp.services/circleci/golang:1.15.3
steps:
- checkout
- run:
name: verify Chart version matches tag version
command: |
GO111MODULE=on go get github.com/mikefarah/yq/v2
git_tag=$(echo "${CIRCLE_TAG#v}")
chart_tag=$(yq r Chart.yaml version)
if [ "${git_tag}" != "${chart_tag}" ]; then
echo "chart version (${chart_tag}) did not match git version (${git_tag})"
exit 1
fi
- run:
name: update helm-charts index
command: |
curl --show-error --silent --fail --user "${CIRCLE_TOKEN}:" \
-X POST \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-d "{\"branch\": \"master\",\"parameters\":{\"SOURCE_REPO\": \"${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}\",\"SOURCE_TAG\": \"${CIRCLE_TAG}\"}}" \
"${CIRCLE_ENDPOINT}/${CIRCLE_PROJECT}/pipeline"
- slack/status:
fail_only: true
failure_message: "Failed to trigger an update to the helm charts index. Check the logs at: ${CIRCLE_BUILD_URL}"

workflows:
version: 2
build_and_test:
jobs:
- bats-unit-test
- chart-verifier
- acceptance:
requires:
- bats-unit-test
filters:
branches:
only: master
update-helm-charts-index:
jobs:
- update-helm-charts-index:
context: helm-charts-trigger-vault
filters:
tags:
only: /^v.*/
branches:
ignore: /.*/
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,7 @@ Please see the many options supported in the `values.yaml`
file. These are also fully documented directly on the
[Vault website](https://www.vaultproject.io/docs/platform/k8s/helm.html).


## Customizations

This Helm chart has been customized in the following ways:
Expand Down
2 changes: 2 additions & 0 deletions templates/_helpers.tpl
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,8 @@ template logic.
{{- $_ := set . "mode" "external" -}}
{{- else if not .serverEnabled -}}
{{- $_ := set . "mode" "external" -}}
{{- else if ne (.Values.server.enabled | toString) "true" -}}
{{- $_ := set . "mode" "external" -}}
{{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
{{- $_ := set . "mode" "dev" -}}
{{- else if eq (.Values.server.ha.enabled | toString) "true" -}}
Expand Down
1 change: 0 additions & 1 deletion test/acceptance/csi.bats
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ load _helpers

@test "csi: testing deployment" {
cd `chart_dir`

kubectl delete namespace acceptance --ignore-not-found=true
kubectl create namespace acceptance

Expand Down
1 change: 0 additions & 1 deletion test/unit/injector-deployment.bats
Original file line number Diff line number Diff line change
Expand Up @@ -963,7 +963,6 @@ EOF
local value=$(echo $object |
yq -r 'map(select(.name=="AGENT_INJECT_MEM_REQUEST")) | .[] .value' | tee /dev/stderr)
[ "${value}" = "64Mi" ]

}

@test "injector/deployment: can set agent default resources" {
Expand Down
56 changes: 56 additions & 0 deletions test/unit/server-statefulset.bats
Original file line number Diff line number Diff line change
Expand Up @@ -1857,3 +1857,59 @@ load _helpers
yq -r '.spec.template.spec.containers[0].livenessProbe.httpGet.port' | tee /dev/stderr)
[ "${actual}" = "8200" ]
}

#--------------------------------------------------------------------
# enterprise license autoload support
@test "server/StatefulSet: adds volume for license secret when enterprise license secret name and key are provided" {
cd `chart_dir`
local actual=$(helm template \
-s templates/server-statefulset.yaml \
--set 'server.enterpriseLicense.secretName=foo' \
--set 'server.enterpriseLicense.secretKey=bar' \
. | tee /dev/stderr |
yq -r -c '.spec.template.spec.volumes[] | select(.name == "vault-license")' | tee /dev/stderr)
[ "${actual}" = '{"name":"vault-license","secret":{"secretName":"foo","defaultMode":288}}' ]
}

@test "server/StatefulSet: adds volume mount for license secret when enterprise license secret name and key are provided" {
cd `chart_dir`
local actual=$(helm template \
-s templates/server-statefulset.yaml \
--set 'server.enterpriseLicense.secretName=foo' \
--set 'server.enterpriseLicense.secretKey=bar' \
. | tee /dev/stderr |
yq -r -c '.spec.template.spec.containers[0].volumeMounts[] | select(.name == "vault-license")' | tee /dev/stderr)
[ "${actual}" = '{"name":"vault-license","mountPath":"/vault/license","readOnly":true}' ]
}

@test "server/StatefulSet: adds env var for license path when enterprise license secret name and key are provided" {
cd `chart_dir`
local actual=$(helm template \
-s templates/server-statefulset.yaml \
--set 'server.enterpriseLicense.secretName=foo' \
--set 'server.enterpriseLicense.secretKey=bar' \
. | tee /dev/stderr |
yq -r -c '.spec.template.spec.containers[0].env[] | select(.name == "VAULT_LICENSE_PATH")' | tee /dev/stderr)
[ "${actual}" = '{"name":"VAULT_LICENSE_PATH","value":"/vault/license/bar"}' ]
}

@test "server/StatefulSet: blank secretName does not set env var" {
cd `chart_dir`

# setting secretName=null
local actual=$(helm template \
-s templates/server-statefulset.yaml \
--set 'server.enterpriseLicense.secretName=null' \
--set 'server.enterpriseLicense.secretKey=bar' \
. | tee /dev/stderr |
yq -r -c '.spec.template.spec.containers[0].env[] | select(.name == "VAULT_LICENSE_PATH")' | tee /dev/stderr)
[ "${actual}" = '' ]

# omitting secretName
local actual=$(helm template \
-s templates/server-statefulset.yaml \
--set 'server.enterpriseLicense.secretKey=bar' \
. | tee /dev/stderr |
yq -r -c '.spec.template.spec.containers[0].env[] | select(.name == "VAULT_LICENSE_PATH")' | tee /dev/stderr)
[ "${actual}" = '' ]
}
9 changes: 9 additions & 0 deletions values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,15 @@ injector:
# matchLabels:
# sidecar-injector: enabled
namespaceSelector: {}
# objectSelector is the selector for restricting the webhook to only
# specific labels.
# See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
# for more details.
# Example:
# objectSelector:
# matchLabels:
# vault-sidecar-injector: enabled
objectSelector: {}

# Deprecated: please use 'webhook.objectSelector' instead
# objectSelector is the selector for restricting the webhook to only
Expand Down

0 comments on commit 0a92a9c

Please sign in to comment.