diff --git a/CHANGELOG.md b/CHANGELOG.md index bdc728be4..105f6c57b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,10 +46,15 @@ CHANGES: * CSI provider default image to 1.1.0 * Vault K8s default image to 0.16.0 * Earliest Kubernetes version tested is now 1.16 +<<<<<<< HEAD * Helm 3.6+ now required Features: * Support topologySpreadConstraints in server and injector. [GH-652](https://github.com/hashicorp/vault-helm/pull/652) +======= +* Support topologySpreadConstraints in server and injector. [GH-652](https://github.com/hashicorp/vault-helm/pull/652) +* Maintain default MutatingWebhookConfiguration values from `v1beta1` [GH-692](https://github.com/hashicorp/vault-helm/pull/692) +>>>>>>> c575574 (feat(DATAGO-30305): Upgrade vault server to 1.10.x (#16)) Improvements: * CSI: Set `extraLabels` for daemonset, pods, and service account [GH-690](https://github.com/hashicorp/vault-helm/pull/690) @@ -58,7 +63,10 @@ Improvements: * Make the Cluster Address (CLUSTER_ADDR) configurable [GH-629](https://github.com/hashicorp/vault-helm/pull/709) * server: Make `publishNotReadyAddresses` configurable for services [GH-694](https://github.com/hashicorp/vault-helm/pull/694) * server: Allow config to be defined as a YAML object in the values file [GH-684](https://github.com/hashicorp/vault-helm/pull/684) +<<<<<<< HEAD * Maintain default MutatingWebhookConfiguration values from `v1beta1` [GH-692](https://github.com/hashicorp/vault-helm/pull/692) +======= +>>>>>>> c575574 (feat(DATAGO-30305): Upgrade vault server to 1.10.x (#16)) ## 0.19.0 (January 20th, 2022) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 2ebb2b493..bcc6496c0 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -126,7 +126,7 @@ template logic. {{- $_ := set . "mode" "external" -}} {{- else if not .serverEnabled -}} {{- $_ := set . "mode" "external" -}} - {{- else if ne (.Values.server.enabled | toString) "true" -}} + {{- else if not .serverEnabled -}} {{- $_ := set . "mode" "external" -}} {{- else if eq (.Values.server.dev.enabled | toString) "true" -}} {{- $_ := set . "mode" "dev" -}} diff --git a/templates/injector-deployment.yaml b/templates/injector-deployment.yaml index fc0cf29e1..e69ba72ef 100644 --- a/templates/injector-deployment.yaml +++ b/templates/injector-deployment.yaml @@ -140,41 +140,6 @@ spec: periodSeconds: 2 successThreshold: 1 timeoutSeconds: 5 -{{- if .Values.injector.certs.secretName }} - volumeMounts: - - name: webhook-certs - mountPath: /etc/webhook/certs - readOnly: true -{{- end }} - {{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }} - - name: leader-elector - image: {{ .Values.injector.leaderElector.image.repository }}:{{ .Values.injector.leaderElector.image.tag }} - args: - - --election={{ template "vault.fullname" . }}-agent-injector-leader - - --election-namespace={{ .Release.Namespace }} - - --http=0.0.0.0:4040 - - --ttl={{ .Values.injector.leaderElector.ttl }} - livenessProbe: - httpGet: - path: / - port: 4040 - scheme: HTTP - failureThreshold: 2 - initialDelaySeconds: 5 - periodSeconds: 2 - successThreshold: 1 - timeoutSeconds: 5 - readinessProbe: - httpGet: - path: / - port: 4040 - scheme: HTTP - failureThreshold: 2 - initialDelaySeconds: 5 - periodSeconds: 2 - successThreshold: 1 - timeoutSeconds: 5 - {{- end }} {{- if .Values.injector.certs.secretName }} volumes: - name: webhook-certs diff --git a/templates/server-clusterrolebinding.yaml b/templates/server-clusterrolebinding.yaml index 8cdd61143..0ebacf2d5 100644 --- a/templates/server-clusterrolebinding.yaml +++ b/templates/server-clusterrolebinding.yaml @@ -21,4 +21,4 @@ subjects: - kind: ServiceAccount name: {{ template "vault.serviceAccount.name" . }} namespace: {{ .Release.Namespace }} -{{ end }} \ No newline at end of file +{{ end }} diff --git a/templates/server-ha-standby-service.yaml b/templates/server-ha-standby-service.yaml index b8ee6f38e..e6d66af84 100644 --- a/templates/server-ha-standby-service.yaml +++ b/templates/server-ha-standby-service.yaml @@ -1,12 +1,8 @@ {{ template "vault.mode" . }} {{- if ne .mode "external" }} -<<<<<<< HEAD {{- template "vault.serverServiceEnabled" . -}} {{- if .serverServiceEnabled -}} {{- if eq .mode "ha" }} -======= -{{- if and (eq .mode "ha" ) (eq (.Values.server.service.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }} ->>>>>>> c4ab664 (feat(DATAGO-27002): Upgrade vault to version 1.7.9 (#12)) # Service for standby Vault pod apiVersion: v1 kind: Service diff --git a/test/acceptance/csi.bats b/test/acceptance/csi.bats index 0973043a2..84742d5d0 100644 --- a/test/acceptance/csi.bats +++ b/test/acceptance/csi.bats @@ -17,7 +17,8 @@ check_skip_csi() { # Install Secrets Store CSI driver CSI_DRIVER_VERSION=1.0.0 - helm install secrets-store-csi-driver https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts/secrets-store-csi-driver-${CSI_DRIVER_VERSION}.tgz?raw=true \ + helm install secrets-store-csi-driver secrets-store-csi-driver --repo https://kubernetes-sigs.github.io/secrets-store-csi-driver/charts \ + --version="${CSI_DRIVER_VERSION}" --wait --timeout=5m \ --namespace=acceptance \ --set linux.image.pullPolicy="IfNotPresent" \ diff --git a/test/acceptance/server-ha-enterprise-dr.bats b/test/acceptance/server-ha-enterprise-dr.bats index f09bbb1fc..a5092afc4 100644 --- a/test/acceptance/server-ha-enterprise-dr.bats +++ b/test/acceptance/server-ha-enterprise-dr.bats @@ -75,7 +75,11 @@ load _helpers helm install "$(name_prefix)-west" \ --set='injector.enabled=false' \ --set='server.image.repository=hashicorp/vault-enterprise' \ +<<<<<<< HEAD --set='server.image.tag=1.11.3-ent' \ +======= + --set='server.image.tag=1.10.3-ent' \ +>>>>>>> c575574 (feat(DATAGO-30305): Upgrade vault server to 1.10.x (#16)) --set='server.ha.enabled=true' \ --set='server.ha.raft.enabled=true' \ --set='server.enterpriseLicense.secretName=vault-license' . diff --git a/values.schema.json b/values.schema.json index 3e08c9dd0..c4fb12c45 100644 --- a/values.schema.json +++ b/values.schema.json @@ -866,6 +866,9 @@ "enabled": { "type": "boolean" }, + "publishNotReadyAddresses": { + "type": "boolean" + }, "externalTrafficPolicy": { "type": "string" }, diff --git a/values.yaml b/values.yaml index 854676efc..4adce942a 100644 --- a/values.yaml +++ b/values.yaml @@ -125,7 +125,6 @@ injector: # for more details. # timeoutSeconds: 30 - # namespaceSelector is the selector for restricting the webhook to only # specific namespaces. # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector @@ -172,6 +171,8 @@ injector: # matchLabels: # sidecar-injector: enabled namespaceSelector: {} + + # Deprecated: please use 'webhook.objectSelector' instead # objectSelector is the selector for restricting the webhook to only # specific labels. # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector @@ -977,7 +978,6 @@ csi: extraLabels: {} - # Priority class for csi pods priorityClassName: ""