feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12)

* Add objectSelector to webhookconfiguration (hashicorp#456)

* changelog++

* Add CSI secrets store provider (hashicorp#461)

* updating acceptance tests to k8s 1.17 on gke (hashicorp#473)

* changelog++

* Target vault-csi-provider release 0.1.0 (hashicorp#475)

* Update to 0.10.0 (hashicorp#477)

* Update to v0.10.0

* Fix typo

* Add csi link in changelog

* Add volumes and mounts support for CSI (hashicorp#479)

* Remove extraVolumes from CSI, add volumes and mounts

* Add better example

* changelog++

* Remove extra word in readme (hashicorp#482)

* fix csi helm deployment (hashicorp#486)

* fix serviceaccount and clusterrole name reference (full name)

* add server.enabled option, align with documentation

* add unit tests

* update server.enabled behaviour to explicit true and update tests

* changelog++

* add hostNetwork value to injector deployment (hashicorp#471)

* add hostNetwork value to injector deployment

* adding unit tests

* changelog++

* feat(ingress): Extra paths to prepend to the ingress host configuration for annotation based services (hashicorp#460)

Refs hashicorp#361

* changelog++

* Add logLevel and logFormat values for Vault (hashicorp#488)

* Add logLevel and logFormat values for Vault

* Add configurable tests

* Update order of log levels

* Update values.yaml

* Update per review

* Update test/unit/server-statefulset.bats

Co-authored-by: Tom Proctor <[email protected]>

* Update test/unit/server-statefulset.bats

Co-authored-by: Tom Proctor <[email protected]>

Co-authored-by: Tom Proctor <[email protected]>

* changelog++

* Custom value of agent port  (hashicorp#489)

* configure the agent port

* add unit test

* remove default

* remove default

* Update values.yaml

Co-authored-by: Jason O'Donnell <[email protected]>

Co-authored-by: Jason O'Donnell <[email protected]>

* changelog++

* Add injector agent default overrides (hashicorp#493)

* Add injector agent default overrides

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

* Update test/unit/injector-deployment.bats

Co-authored-by: Theron Voran <[email protected]>

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* [injector] Add port name in injector service (hashicorp#495)

* [injector] Add port name in injector service

* [injector] Hardcore port to https

* changelog++

* Fix injector unit test failing (hashicorp#496)

* Fix injector unit test failing

* Add null check

* Add default if unset for CI

* Remove redundant logic (hashicorp#434)

* Update to v0.11.0 (hashicorp#497)

* Add container based tests documentation (hashicorp#492)

* update documentation with running unit tests using container

* promote bats version to 1.3.0

* Update CONTRIBUTING.md

Co-authored-by: Jason O'Donnell <[email protected]>

* Update CONTRIBUTING.md

Co-authored-by: Jason O'Donnell <[email protected]>

Co-authored-by: Jason O'Donnell <[email protected]>

* Set kubeVersion and added chart-verifier tests (hashicorp#510)

Set min kubeVersion in Chart.yaml to 1.14. Added a chart-verifier bats
test, and configured to run it in CI. Some verification tests that
haven't been addressed yet are skipped.

* changelog++

* match kubeVersion on semver pre-releases (hashicorp#512)

Since clouds like GKE set their kubeVersion as a
pre-release (e.g. v1.17.17-gke.6700)

* Add ImagePullSecrets to CSI daemonset (hashicorp#519)

* changelog++

* changelog++

* fix CONTRIBUTING.md (hashicorp#501)

* updating to use new dedicated context and token (hashicorp#515)

* added values json schema (hashicorp#513)

Generated the schema using the helm schema-gen plugin, and added extra
data types to fields that allow it, such as annotations, tolerations,
enabled, etc. Enabled the "contains-value-schema" chart-verifier test.

Co-authored-by: Jason O'Donnell <[email protected]>

* changelog++

* [Issue-520] tolerations for csi-daemonset (hashicorp#521)

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* Add extraArgs value for CSI (hashicorp#526)

* changelog++

* add schema unit tests (hashicorp#530)

* Add UI targetPort option (hashicorp#437)

Use custom `targetPort` for UI service. See the usecase in hashicorp#385 (comment)

* changelog++

* Update to v0.12.0 (hashicorp#532)

* Update to v0.12.0

* Update values.schema.json

* Fix schema types

* revert image repo

* Adding helm test for vault server (hashicorp#531)

Also adds acceptance test for 'helm test' and updates the
chart-verifier version.

* changelog++

* fix ui.serviceNodePort schema (hashicorp#537)

UI service nodePort defaults to null, but is set as an integer

* changelog++

* change maxUnavailable to integer (hashicorp#535)

change maxUnavailable from `null` to `integer` to enable upgrade from
0.11.0 to 0.12.0 when using the specific variable.

* Also allow null value

Co-authored-by: Theron Voran <[email protected]>

* add test for server.ha.disruptionBudget.maxUnavailable

Co-authored-by: Theron Voran <[email protected]>

* changelog++

* use vault-helm-test:0.2.0 (hashicorp#543)

* Added webhook-certs volume mount to sidecar injector (hashicorp#545)

* Removed webhook-certs volume mount from leader-elector container

* Added test: injector deployment manual TLS adds volume mount

* changelog++

* Adding server.enterpriseLicense (hashicorp#547)

Sets up a vault-enterprise license for autoloading on vault
startup. Mounts an existing secret to /vault/license and sets
VAULT_LICENSE_PATH appropriately.

* changelog++

* Add openshift overrides (hashicorp#549)

Adds default overrides for OpenShift (values.openshift.yaml) and uses
them in the chart-verifier tests.

* changelog++

* Update to v0.13.0 (hashicorp#554)

* Explain this fork in the README

* Adding support for LoadBalancerIP field in ServiceSpec

* DATAGO-13861: Adding support for logrotate

* DATAGO-13861: Adding audit log rotation and shipment to datdog

* Fixing minor typos and removing extra lines

* DATAGO-13861: Adding support for logrotate

* DATAGO-13861: Adding audit log rotation and shipment to datdog

* Fixing minor typos and removing extra lines

* feat(DATAGO-27002): Upgrade to 1.7.9

* chore(DATAGO-27002): Fix doc issue

Co-authored-by: guru1306 <[email protected]>
Co-authored-by: Jason O'Donnell <[email protected]>
Co-authored-by: Tom Proctor <[email protected]>
Co-authored-by: Theron Voran <[email protected]>
Co-authored-by: Paul <[email protected]>
Co-authored-by: Arie Lev <[email protected]>
Co-authored-by: Paul Witt <[email protected]>
Co-authored-by: Sam Marshall <[email protected]>
Co-authored-by: Hamza ZOUHAIR <[email protected]>
Co-authored-by: Javier Criado Marcos <[email protected]>
Co-authored-by: mehmetsalgar <[email protected]>
Co-authored-by: Sarah Thompson <[email protected]>
Co-authored-by: Iñigo Horcajo <[email protected]>
Co-authored-by: Rule88 <[email protected]>
Co-authored-by: Ricardo Gândara Pinto <[email protected]>
Co-authored-by: Julian Setiawan <[email protected]>
Co-authored-by: marcboudreau <[email protected]>
Co-authored-by: Hadie Laham <[email protected]>

README.md

@@ -46,6 +46,7 @@ Please see the many options supported in the `values.yaml`
 file. These are also fully documented directly on the
 [Vault website](https://www.vaultproject.io/docs/platform/k8s/helm.html).
 
+
 ## Customizations
 
 This Helm chart has been customized in the following ways:

templates/_helpers.tpl

@@ -126,6 +126,8 @@ template logic.
     {{- $_ := set . "mode" "external" -}}
   {{- else if not .serverEnabled -}}
     {{- $_ := set . "mode" "external" -}}
+  {{- else if ne (.Values.server.enabled | toString) "true" -}}
+    {{- $_ := set . "mode" "external" -}}
   {{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
     {{- $_ := set . "mode" "dev" -}}
   {{- else if eq (.Values.server.ha.enabled | toString) "true" -}}

templates/tests/server-test.yaml

@@ -1,6 +1,10 @@
+<<<<<<< HEAD
 {{ template "vault.mode" . }}
 {{- if ne .mode "external" }}
 {{- if .serverEnabled -}}
+=======
+{{- if .Values.server.enabled }}
+>>>>>>> c4ab664 (feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12))
 apiVersion: v1
 kind: Pod
 metadata:
@@ -9,15 +13,21 @@ metadata:
   annotations:
     "helm.sh/hook": test
 spec:
+<<<<<<< HEAD
   {{- include "imagePullSecrets" . | nindent 2 }}
+=======
+>>>>>>> c4ab664 (feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12))
   containers:
     - name: {{ .Release.Name }}-server-test
       image: {{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}
       imagePullPolicy: {{ .Values.server.image.pullPolicy }}
       env:
         - name: VAULT_ADDR
           value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.server.service.port }}
+<<<<<<< HEAD
         {{- include "vault.extraEnvironmentVars" .Values.server | nindent 8 }}
+=======
+>>>>>>> c4ab664 (feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12))
       command:
         - /bin/sh
         - -c
@@ -38,6 +48,7 @@ spec:
           fi
 
           exit 0
+<<<<<<< HEAD
       volumeMounts:
         {{- if .Values.server.volumeMounts }}
           {{- toYaml .Values.server.volumeMounts | nindent 8}}
@@ -49,3 +60,8 @@ spec:
   restartPolicy: Never
 {{- end }}
 {{- end }}
+=======
+
+  restartPolicy: Never
+{{- end }}
+>>>>>>> c4ab664 (feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12))

test/acceptance/csi.bats

@@ -4,7 +4,6 @@ load _helpers
 
 @test "csi: testing deployment" {
   cd `chart_dir`
-
   kubectl delete namespace acceptance --ignore-not-found=true
   kubectl create namespace acceptance
 

values.yaml

@@ -172,6 +172,15 @@ injector:
   #    matchLabels:
   #      sidecar-injector: enabled
   namespaceSelector: {}
+  # objectSelector is the selector for restricting the webhook to only
+  # specific labels.
+  # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+  # for more details.
+  # Example:
+  # objectSelector:
+  #    matchLabels:
+  #      vault-sidecar-injector: enabled
+  objectSelector: {}
 
   # Deprecated: please use 'webhook.objectSelector' instead
   # objectSelector is the selector for restricting the webhook to only