Skip to content

Commit 82802d3

Browse files
benashzbenashz
authored
Helm: support setting VaultAuthGlobalRef on VaultAuth (#851)
1 parent 234f8dc commit 82802d3

File tree

4 files changed

+215
-0
lines changed

4 files changed

+215
-0
lines changed

‎chart/templates/_helpers.tpl

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,3 +298,39 @@ logging args
298298
{{- $ret | toYaml | nindent 8 -}}
299299
{{- end -}}
300300
{{- end -}}
301+
302+
{{/*
303+
vaultAuthGlobalRef generates the global-vault-auth-global-ref flag for the manager.
304+
*/}}
305+
{{- define "vso.vaulAuthGlobalRef" -}}
306+
{{- if .Values.controller.manager.globalVaultAuthOptions.allowDefaultGlobals }}
307+
--global-vault-auth-global-ref
308+
{{- end -}}
309+
{{- end -}}
310+
311+
{{/*
312+
vaultAuthGlobalRef generates the default VaultAuth spec.vaultAuthGlobalRef.
313+
*/}}
314+
{{- define "vso.vaultAuthGlobalRef" -}}
315+
{{- $ret := dict -}}
316+
{{- with .Values.defaultAuthMethod.vaultAuthGlobalRef -}}
317+
{{ $_ := set $ret "namespace" .namespace -}}
318+
{{ $_ = set $ret "name" .name -}}
319+
{{ if ne .allowDefault nil -}}
320+
{{- $_ = set $ret "allowDefault" .allowDefault -}}
321+
{{- end -}}
322+
{{- $strat := dict -}}
323+
{{- if .mergeStrategy.headers -}}
324+
{{- $_ = set $strat "headers" .mergeStrategy.headers -}}
325+
{{- end -}}
326+
{{- if .mergeStrategy.params -}}
327+
{{- $_ = set $strat "params" .mergeStrategy.params -}}
328+
{{- end -}}
329+
{{- if $strat -}}
330+
{{- $_ = set $ret "mergeStrategy" $strat -}}
331+
{{- end -}}
332+
{{- end -}}
333+
{{- if $ret -}}
334+
{{- $ret | toYaml | nindent 4 -}}
335+
{{- end -}}
336+
{{- end -}}

‎chart/templates/default-vault-auth-method.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,8 @@ spec:
2424
mount: {{ .Values.defaultAuthMethod.mount }}
2525
{{- $kubeServiceAccount := .Values.defaultAuthMethod.kubernetes.serviceAccount }}
2626
{{- include "vso.vaultAuthMethod" (list .Values.defaultAuthMethod $kubeServiceAccount . ) }}
27+
{{- if .Values.defaultAuthMethod.vaultAuthGlobalRef.enabled }}
28+
vaultAuthGlobalRef:
29+
{{- include "vso.vaultAuthGlobalRef" . }}
30+
{{- end }}
2731
{{- end }}

‎chart/values.yaml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -746,6 +746,40 @@ defaultAuthMethod:
746746
# @type: map
747747
headers: {}
748748

749+
# VaultAuthGlobalRef
750+
vaultAuthGlobalRef:
751+
# toggles the inclusion of the VaultAuthGlobal configuration in the
752+
# default VaultAuth CR.
753+
# @type: boolean
754+
enabled: false
755+
# Name of the VaultAuthGlobal CR to reference.
756+
# @type: string
757+
name: ""
758+
759+
# Namespace of the VaultAuthGlobal CR to reference.
760+
# @type: string
761+
namespace: ""
762+
763+
# allow default globals
764+
# @type: boolean
765+
allowDefault:
766+
767+
mergeStrategy:
768+
# merge strategy for headers
769+
# @type: string
770+
# Valid values are: "replace", "merge", "none"
771+
# Default: "replace"
772+
# @type: string
773+
headers: none
774+
775+
# merge strategy for params
776+
# @type: string
777+
# Valid values are: "replace", "merge", "none"
778+
# Default: "replace"
779+
# @type: string
780+
params: none
781+
782+
749783
# Configures a Prometheus ServiceMonitor
750784
telemetry:
751785
serviceMonitor:

‎test/unit/default-vault-auth-method.bats

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
#!/usr/bin/env bats
22

3+
#
4+
# Copyright (c) HashiCorp, Inc.
5+
# SPDX-License-Identifier: BUSL-1.1
6+
#
7+
38
load _helpers
49

510
#--------------------------------------------------------------------
@@ -398,3 +403,139 @@ load _helpers
398403
actual=$(echo "$object" | yq '.spec.gcp.projectID' | tee /dev/stderr)
399404
[ "${actual}" = "my-project" ]
400405
}
406+
407+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/default" {
408+
cd "$(chart_dir)"
409+
local actual
410+
actual=$(helm template \
411+
--debug \
412+
-s templates/default-vault-auth-method.yaml \
413+
--set 'defaultAuthMethod.enabled=true' \
414+
. | tee /dev/stderr |
415+
yq '.spec' | tee /dev/stderr)
416+
417+
[ "$(echo "$actual" | yq '. | has("vaultAuthGlobalRef")')" = "false" ]
418+
}
419+
420+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/enabled" {
421+
cd "$(chart_dir)"
422+
local actual
423+
actual=$(helm template \
424+
--debug \
425+
-s templates/default-vault-auth-method.yaml \
426+
--set 'defaultAuthMethod.enabled=true' \
427+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
428+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
429+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
430+
. | tee /dev/stderr |
431+
yq '.spec' | tee /dev/stderr)
432+
433+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef | has("allowDefault")')" = "false" ]
434+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
435+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
436+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.params')" = "none" ]
437+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.headers')" = "none" ]
438+
}
439+
440+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/defaults/empty-params" {
441+
cd "$(chart_dir)"
442+
local actual
443+
actual=$(helm template \
444+
--debug \
445+
-s templates/default-vault-auth-method.yaml \
446+
--set 'defaultAuthMethod.enabled=true' \
447+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
448+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
449+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
450+
--set 'defaultAuthMethod.vaultAuthGlobalRef.mergeStrategy.params=' \
451+
. | tee /dev/stderr |
452+
yq '.spec' | tee /dev/stderr)
453+
454+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef | has("allowDefault")')" = "false" ]
455+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
456+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
457+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy | has("params")')" = "false" ]
458+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.headers')" = "none" ]
459+
}
460+
461+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/mergeStrategy/empty-headers" {
462+
cd "$(chart_dir)"
463+
local actual
464+
actual=$(helm template \
465+
--debug \
466+
-s templates/default-vault-auth-method.yaml \
467+
--set 'defaultAuthMethod.enabled=true' \
468+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
469+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
470+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
471+
--set 'defaultAuthMethod.vaultAuthGlobalRef.mergeStrategy.headers=' \
472+
. | tee /dev/stderr |
473+
yq '.spec' | tee /dev/stderr)
474+
475+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef | has("allowDefault")')" = "false" ]
476+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
477+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
478+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.params')" = "none" ]
479+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy | has("headers")')" = "false" ]
480+
}
481+
482+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/allowDefault=true" {
483+
cd "$(chart_dir)"
484+
local actual
485+
actual=$(helm template \
486+
--debug \
487+
-s templates/default-vault-auth-method.yaml \
488+
--set 'defaultAuthMethod.enabled=true' \
489+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
490+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
491+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
492+
--set 'defaultAuthMethod.vaultAuthGlobalRef.allowDefault=true' \
493+
. | tee /dev/stderr |
494+
yq '.spec' | tee /dev/stderr)
495+
496+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.allowDefault')" = "true" ]
497+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
498+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
499+
}
500+
501+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/allowDefault=false" {
502+
cd "$(chart_dir)"
503+
local actual
504+
actual=$(helm template \
505+
--debug \
506+
-s templates/default-vault-auth-method.yaml \
507+
--set 'defaultAuthMethod.enabled=true' \
508+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
509+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
510+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
511+
--set 'defaultAuthMethod.vaultAuthGlobalRef.allowDefault=false' \
512+
. | tee /dev/stderr |
513+
yq '.spec' | tee /dev/stderr)
514+
515+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.allowDefault')" = "false" ]
516+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
517+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
518+
}
519+
520+
@test "defaultAuthMethod/CR: with vaultAuthGlobalRef/mergeStrategy/params=union-headers=replace" {
521+
cd "$(chart_dir)"
522+
local actual
523+
actual=$(helm template \
524+
--debug \
525+
-s templates/default-vault-auth-method.yaml \
526+
--set 'defaultAuthMethod.enabled=true' \
527+
--set 'defaultAuthMethod.vaultAuthGlobalRef.enabled=true' \
528+
--set 'defaultAuthMethod.vaultAuthGlobalRef.name=foo' \
529+
--set 'defaultAuthMethod.vaultAuthGlobalRef.namespace=baz' \
530+
--set 'defaultAuthMethod.vaultAuthGlobalRef.allowDefault=false' \
531+
--set 'defaultAuthMethod.vaultAuthGlobalRef.mergeStrategy.params=union' \
532+
--set 'defaultAuthMethod.vaultAuthGlobalRef.mergeStrategy.headers=replace' \
533+
. | tee /dev/stderr |
534+
yq '.spec' | tee /dev/stderr)
535+
536+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.allowDefault')" = "false" ]
537+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.name')" = "foo" ]
538+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.namespace')" = "baz" ]
539+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.params')" = "union" ]
540+
[ "$(echo "$actual" | yq '.vaultAuthGlobalRef.mergeStrategy.headers')" = "replace" ]
541+
}

0 commit comments

Comments
 (0)