Refactor snapshot agent to use new acl authmethod workflow (#1084)

* refactor snapshot agent to use new acl authmethod workflow.
hashicorp · Mar 10, 2022 · f874828 · f874828
1 parent 246711a
commit f874828
Show file tree

Hide file tree

Showing 10 changed files with 333 additions and 254 deletions.
diff --git a/charts/consul/templates/client-snapshot-agent-deployment.yaml b/charts/consul/templates/client-snapshot-agent-deployment.yaml
@@ -41,14 +41,14 @@ spec:
         {{- end }}
         {{- if .Values.global.secretsBackend.vault.agentAnnotations }}
         {{ tpl .Values.global.secretsBackend.vault.agentAnnotations . | nindent 8 | trim }}
-        {{- end }}        
+        {{- end }}
         {{- end }}
         {{- if .Values.global.enterpriseLicense.secretName }}
         {{- with .Values.global.enterpriseLicense }}
         "vault.hashicorp.com/agent-inject-secret-enterpriselicense.txt": "{{ .secretName }}"
         "vault.hashicorp.com/agent-inject-template-enterpriselicense.txt": {{ template "consul.vaultSecretTemplate" . }}
         {{- end }}
-        {{- end }}        
+        {{- end }}
         {{- end }}
     spec:
       {{- if .Values.client.tolerations }}
@@ -62,139 +62,175 @@ spec:
       {{- end }}
       {{- if (or .Values.global.acls.manageSystemACLs .Values.global.tls.enabled (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload)) }}
       volumes:
-        {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
-        - name: snapshot-config
-          secret:
-            secretName: {{ .Values.client.snapshotAgent.configSecret.secretName }}
-            items:
-            - key: {{ .Values.client.snapshotAgent.configSecret.secretKey }}
-              path: snapshot-config.json
+      - name: consul-data
+        emptyDir:
+          medium: "Memory"
+      {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
+      - name: snapshot-config
+        secret:
+          secretName: {{ .Values.client.snapshotAgent.configSecret.secretName }}
+          items:
+          - key: {{ .Values.client.snapshotAgent.configSecret.secretKey }}
+            path: snapshot-config.json
+      {{- end }}
+      {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled) (not .Values.global.acls.manageSystemACLs)) }}
+      - name: consul-license
+        secret:
+          secretName: {{ .Values.global.enterpriseLicense.secretName }}
+      {{- end }}
+      {{- if .Values.global.tls.enabled }}
+      {{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
+      - name: consul-ca-cert
+        secret:
+          {{- if .Values.global.tls.caCert.secretName }}
+          secretName: {{ .Values.global.tls.caCert.secretName }}
+          {{- else }}
+          secretName: {{ template "consul.fullname" . }}-ca-cert
+          {{- end }}
+          items:
+          - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
+            path: tls.crt
+      {{- end }}
+      {{- if .Values.global.tls.enableAutoEncrypt }}
+      - name: consul-auto-encrypt-ca-cert
+        emptyDir:
+          medium: "Memory"
+      {{- end }}
+      {{- end }}
+      {{- end }}
+      containers:
+      - name: consul-snapshot-agent
+        image: "{{ default .Values.global.image .Values.client.image }}"
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        {{- if .Values.global.tls.enabled }}
+        - name: CONSUL_HTTP_ADDR
+          value: https://$(HOST_IP):8501
+        - name: CONSUL_CACERT
+          value: /consul/tls/ca/tls.crt
+        {{- else }}
+        - name: CONSUL_HTTP_ADDR
+          value: http://$(HOST_IP):8500
         {{- end }}
         {{- if .Values.global.acls.manageSystemACLs }}
-        - name: aclconfig
-          emptyDir: {}
+        - name: CONSUL_HTTP_TOKEN_FILE
+          value: /consul/login/acl-token
         {{- else }}
-        {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled)) }}
-        - name: consul-license
-          secret:
-            secretName: {{ .Values.global.enterpriseLicense.secretName }}
+        {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload) }}
+        - name: CONSUL_LICENSE_PATH
+          {{- if  .Values.global.secretsBackend.vault.enabled }}
+          value: /vault/secrets/enterpriselicense.txt
+          {{- else }}
+          value: /consul/license/{{ .Values.global.enterpriseLicense.secretKey }}
+          {{- end }}
         {{- end }}
         {{- end }}
-        {{- if .Values.global.tls.enabled }}
-        {{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
-        - name: consul-ca-cert
-          secret:
-            {{- if .Values.global.tls.caCert.secretName }}
-            secretName: {{ .Values.global.tls.caCert.secretName }}
-            {{- else }}
-            secretName: {{ template "consul.fullname" . }}-ca-cert
+        command:
+        - "/bin/sh"
+        - "-ec"
+        - |
+          {{- if .Values.client.snapshotAgent.caCert }}
+          cat <<EOF > /etc/ssl/certs/custom-ca.pem
+          {{- .Values.client.snapshotAgent.caCert | nindent 14 }}
+          EOF
+          {{- end }}
+          exec /bin/consul snapshot agent \
+            {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
+            -config-dir=/consul/config \
+            {{- end }}
+            {{- if .Values.global.acls.manageSystemACLs }}
+            -config-dir=/consul/login \
             {{- end }}
-            items:
-            - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
-              path: tls.crt
+        {{- if (or .Values.global.acls.manageSystemACLs .Values.global.tls.enabled (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload)) }}
+        {{- if .Values.global.acls.manageSystemACLs }}
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - "/bin/sh"
+              - "-ec"
+              - |
+                /bin/consul logout
         {{- end }}
-        {{- if .Values.global.tls.enableAutoEncrypt }}
+        volumeMounts:
+        {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
+        - name: snapshot-config
+          readOnly: true
+          mountPath: /consul/config
+        {{- end }}
+        - mountPath: /consul/login
+          name: consul-data
+          readOnly: true
+        {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled) (not .Values.global.acls.manageSystemACLs))}}
+        - name: consul-license
+          mountPath: /consul/license
+          readOnly: true
+        {{- end }}
+        {{- if .Values.global.tls.enabled }}
+        {{- if .Values.global.tls.enableAutoEncrypt}}
         - name: consul-auto-encrypt-ca-cert
-          emptyDir:
-            medium: "Memory"
+        {{- else }}
+        - name: consul-ca-cert
         {{- end }}
+          mountPath: /consul/tls/ca
+          readOnly: true
+        {{- end }}
+        {{- end }}
+        {{- with .Values.client.snapshotAgent.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
         {{- end }}
-      {{- end }}
-      containers:
-        - name: consul-snapshot-agent
-          image: "{{ default .Values.global.image .Values.client.image }}"
-          env:
-            - name: HOST_IP
-              valueFrom:
-                fieldRef:
-                  fieldPath: status.hostIP
-            {{- if .Values.global.tls.enabled }}
-            - name: CONSUL_HTTP_ADDR
-              value: https://$(HOST_IP):8501
-            - name: CONSUL_CACERT
-              value: /consul/tls/ca/tls.crt
-            {{- else }}
-            - name: CONSUL_HTTP_ADDR
-              value: http://$(HOST_IP):8500
-            {{- end }}
-            {{- if .Values.global.acls.manageSystemACLs }}
-            - name: CONSUL_HTTP_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: "{{ template "consul.fullname" . }}-client-snapshot-agent-acl-token"
-                  key: "token"
-            {{- else }}
-            {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload) }}
-            - name: CONSUL_LICENSE_PATH
-              {{- if  .Values.global.secretsBackend.vault.enabled }}
-              value: /vault/secrets/enterpriselicense.txt
-              {{- else }}
-              value: /consul/license/{{ .Values.global.enterpriseLicense.secretKey }}
-              {{- end }}
-            {{- end }}
-            {{- end}}
-          command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-              {{- if .Values.client.snapshotAgent.caCert }}
-              cat <<EOF > /etc/ssl/certs/custom-ca.pem
-              {{- .Values.client.snapshotAgent.caCert | nindent 14 }}
-              EOF
-              {{- end }}
-              exec /bin/consul snapshot agent \
-                {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
-                -config-dir=/consul/config \
-                {{- end }}
-                {{- if .Values.global.acls.manageSystemACLs }}
-                -config-dir=/consul/aclconfig \
-                {{- end }}
-          {{- if (or .Values.global.acls.manageSystemACLs .Values.global.tls.enabled (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload)) }}
-          volumeMounts:
-            {{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
-            - name: snapshot-config
-              readOnly: true
-              mountPath: /consul/config
-            {{- end }}
-            {{- if .Values.global.acls.manageSystemACLs }}
-            - name: aclconfig
-              mountPath: /consul/aclconfig
-            {{- else }}
-            {{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled)) }}
-            - name: consul-license
-              mountPath: /consul/license
-              readOnly: true
-            {{- end }}
-            {{- end }}
-            {{- if .Values.global.tls.enabled }}
-            {{- if .Values.global.tls.enableAutoEncrypt}}
-            - name: consul-auto-encrypt-ca-cert
-            {{- else }}
-            - name: consul-ca-cert
-            {{- end }}
-              mountPath: /consul/tls/ca
-              readOnly: true
-            {{- end }}
-          {{- end }}
-          {{- with .Values.client.snapshotAgent.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
       {{- if (or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt)) }}
       initContainers:
+      {{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
+      {{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
+      {{- end }}
       {{- if .Values.global.acls.manageSystemACLs }}
-      - name: client-snapshot-agent-acl-init
+      - name: snapshot-agent-acl-init
+        env:
+        - name: HOST_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.hostIP
+        {{- if .Values.global.tls.enabled }}
+        - name: CONSUL_CACERT
+          value: /consul/tls/ca/tls.crt
+        {{- end }}
+        - name: CONSUL_HTTP_ADDR
+          {{- if .Values.global.tls.enabled }}
+          value: https://$(HOST_IP):8501
+          {{- else }}
+          value: http://$(HOST_IP):8500
+          {{- end }}
         image: {{ .Values.global.imageK8S }}
-        command:
-          - "/bin/sh"
-          - "-ec"
-          - |
-            consul-k8s-control-plane acl-init \
-              -secret-name="{{ template "consul.fullname" . }}-client-snapshot-agent-acl-token" \
-              -k8s-namespace={{ .Release.Namespace }}
         volumeMounts:
-          - name: aclconfig
-            mountPath: /consul/aclconfig
+        - mountPath: /consul/login
+          name: consul-data
+          readOnly: false
+        {{- if .Values.global.tls.enabled }}
+        {{- if .Values.global.tls.enableAutoEncrypt }}
+        - name: consul-auto-encrypt-ca-cert
+        {{- else }}
+        - name: consul-ca-cert
+        {{- end }}
+          mountPath: /consul/tls/ca
+          readOnly: true
+        {{- end }}
+        command:
+        - "/bin/sh"
+        - "-ec"
+        - |
+          consul-k8s-control-plane acl-init \
+              -component-name=snapshot-agent \
+              -acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method \
+              {{- if .Values.global.adminPartitions.enabled }}
+              -partition={{ .Values.global.adminPartitions.name }} \
+              {{- end }}
+              -log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
+              -log-json={{ .Values.global.logJSON }}
         resources:
           requests:
             memory: "25Mi"
@@ -203,9 +239,6 @@ spec:
             memory: "25Mi"
             cpu: "50m"
       {{- end }}
-      {{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
-      {{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
-      {{- end }}
       {{- end }}
       {{- if .Values.client.nodeSelector }}
       nodeSelector:

diff --git a/charts/consul/templates/client-snapshot-agent-role.yaml b/charts/consul/templates/client-snapshot-agent-role.yaml
@@ -11,27 +11,16 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
     component: client-snapshot-agent
-{{- if (or .Values.global.acls.manageSystemACLs .Values.global.enablePodSecurityPolicies) }}
-rules:
 {{- if .Values.global.enablePodSecurityPolicies }}
-  - apiGroups: ["policy"]
-    resources: ["podsecuritypolicies"]
-    resourceNames:
-    - {{ template "consul.fullname" . }}-snapshot-agent
-    verbs:
-    - use
-{{- end }}
-{{- if .Values.global.acls.manageSystemACLs }}
-  - apiGroups: [""]
-    resources:
-      - secrets
-    resourceNames:
-      - {{ template "consul.fullname" . }}-client-snapshot-agent-acl-token
-    verbs:
-      - get
-{{- end }}
+rules:
+- apiGroups: [ "policy" ]
+  resources: [ "podsecuritypolicies" ]
+  resourceNames:
+  - {{ template "consul.fullname" . }}-snapshot-agent
+  verbs:
+  - use
 {{- else }}
-rules: []
+rules: [ ]
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/consul/templates/server-acl-init-job.yaml b/charts/consul/templates/server-acl-init-job.yaml
@@ -240,7 +240,7 @@ spec:
                 {{- end }}
 
                 {{- if .Values.client.snapshotAgent.enabled }}
-                -create-snapshot-agent-token=true \
+                -snapshot-agent=true \
                 {{- end }}
 
                 {{- if not (or (and (ne (.Values.client.enabled | toString) "-") .Values.client.enabled) (and (eq (.Values.client.enabled | toString) "-") .Values.global.enabled)) }}

diff --git a/charts/consul/templates/sync-catalog-deployment.yaml b/charts/consul/templates/sync-catalog-deployment.yaml
@@ -123,10 +123,10 @@ spec:
             - name: consul-auto-encrypt-ca-cert
             {{- else }}
             - name: consul-ca-cert
-            {{- end }}
             {{- end }}
               mountPath: /consul/tls/ca
               readOnly: true
+            {{- end }}
           command:
             - "/bin/sh"
             - "-ec"