Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use kube auth method to provision ACL token for the crd controller #995

Merged
merged 8 commits into from
Mar 2, 2022
Merged

Use kube auth method to provision ACL token for the crd controller #995

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
960d34d
Add support for consul-login for ACL tokens and consul-logout to clea…
kschoche Feb 28, 2022
49c6dbc
fix unit test
kschoche Feb 28, 2022
e9ff9d2
fix a typo
kschoche Feb 28, 2022
6d11d92
add partitions back to acl-init and update bats tests
kschoche Mar 1, 2022
73d514a
unnecessary flags
kschoche Mar 1, 2022
986b353
fix bats test
kschoche Mar 1, 2022
65310ee
Apply suggestions from code review
kschoche Mar 2, 2022
01210a9
review comments
kschoche Mar 2, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,8 @@ commands:
type: string
consul-k8s-image:
type: string
default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s-control-plane:latest"
#default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s-control-plane:latest"
default: "kyleschochenmaier/consul-k8s-acls"
go-path:
type: string
default: "/home/circleci/.go_workspace"
Expand Down
2 changes: 0 additions & 2 deletions charts/consul/templates/connect-inject-clusterrole.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
# The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down Expand Up @@ -55,4 +54,3 @@ rules:
verbs:
- get
{{- end }}
{{- end }}
2 changes: 0 additions & 2 deletions charts/consul/templates/connect-inject-clusterrolebinding.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
Expand All @@ -17,4 +16,3 @@ subjects:
- kind: ServiceAccount
name: {{ template "consul.fullname" . }}-connect-injector
namespace: {{ .Release.Namespace }}
{{- end }}
2 changes: 0 additions & 2 deletions charts/consul/templates/connect-inject-serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
apiVersion: v1
kind: ServiceAccount
metadata:
Expand All @@ -20,4 +19,3 @@ imagePullSecrets:
- name: {{ .name }}
{{- end }}
{{- end }}
{{- end }}
70 changes: 58 additions & 12 deletions charts/consul/templates/controller-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,16 +47,52 @@ spec:
spec:
{{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
initContainers:
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
- name: controller-acl-init
env:
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
{{- if .Values.global.tls.enabled }}
- name: CONSUL_CACERT
value: /consul/tls/ca/tls.crt
{{- end }}
- name: CONSUL_HTTP_ADDR
{{- if .Values.global.tls.enabled }}
value: https://$(HOST_IP):8501
{{- else }}
value: http://$(HOST_IP):8500
{{- end }}
image: {{ .Values.global.imageK8S }}
volumeMounts:
- mountPath: /consul/login
name: consul-data
readOnly: false
{{- if .Values.global.tls.enabled }}
{{- if .Values.global.tls.enableAutoEncrypt }}
- name: consul-auto-encrypt-ca-cert
{{- else }}
- name: consul-ca-cert
{{- end }}
mountPath: /consul/tls/ca
readOnly: true
{{- end }}
command:
- "/bin/sh"
- "-ec"
- |
consul-k8s-control-plane acl-init \
-secret-name="{{ template "consul.fullname" . }}-controller-acl-token" \
-k8s-namespace={{ .Release.Namespace }}
-component-name=controller \
-acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method \
{{- if .Values.global.adminPartitions.enabled }}
-partition={{ .Values.global.adminPartitions.name }} \
{{- end }}
kschoche marked this conversation as resolved.
Show resolved Hide resolved
-log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
-log-json={{ .Values.global.logJSON }} \
resources:
requests:
memory: "25Mi"
Expand All @@ -65,9 +101,6 @@ spec:
memory: "25Mi"
cpu: "50m"
{{- end }}
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
{{- end }}
{{- end }}
containers:
- command:
Expand Down Expand Up @@ -98,7 +131,21 @@ spec:
-consul-cross-namespace-acl-policy=cross-namespace-policy \
{{- end }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
lifecycle:
preStop:
exec:
command:
- "/bin/sh"
- "-ec"
- |
consul-k8s-control-plane consul-logout
thisisnotashwin marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might need to pass in the partition here too based on what we learned with login.

{{- end }}
env:
{{- if .Values.global.acls.manageSystemACLs }}
- name: CONSUL_HTTP_TOKEN_FILE
value: "/consul/login/acl-token"
{{- end }}
- name: HOST_IP
valueFrom:
fieldRef:
Expand All @@ -110,13 +157,6 @@ spec:
name: {{ .Values.controller.aclToken.secretName }}
key: {{ .Values.controller.aclToken.secretKey }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
kschoche marked this conversation as resolved.
Show resolved Hide resolved
- name: CONSUL_HTTP_TOKEN
valueFrom:
secretKeyRef:
name: "{{ template "consul.fullname" . }}-controller-acl-token"
key: "token"
{{- end}}
{{- if .Values.global.tls.enabled }}
- name: CONSUL_CACERT
value: /consul/tls/ca/tls.crt
Expand All @@ -138,6 +178,9 @@ spec:
{{- toYaml . | nindent 12 }}
{{- end }}
volumeMounts:
- mountPath: /consul/login
name: consul-data
readOnly: false
kschoche marked this conversation as resolved.
Show resolved Hide resolved
- mountPath: /tmp/controller-webhook/certs
name: cert
readOnly: true
Expand Down Expand Up @@ -175,6 +218,9 @@ spec:
medium: "Memory"
{{- end }}
{{- end }}
- name: consul-data
emptyDir:
medium: "Memory"
serviceAccountName: {{ template "consul.fullname" . }}-controller
{{- if .Values.controller.nodeSelector }}
nodeSelector:
Expand Down
2 changes: 0 additions & 2 deletions charts/consul/templates/server-acl-init-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,13 @@ rules:
verbs:
- create
- get
{{- if .Values.connectInject.enabled }}
- apiGroups: [""]
resources:
- serviceaccounts
resourceNames:
- {{ template "consul.fullname" . }}-connect-injector
verbs:
- get
{{- end }}
{{- if .Values.global.enablePodSecurityPolicies }}
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
Expand Down
27 changes: 0 additions & 27 deletions charts/consul/test/unit/connect-inject-clusterrole.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,33 +2,6 @@

load _helpers

@test "connectInject/ClusterRole: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrole.yaml \
.
}

@test "connectInject/ClusterRole: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-clusterrole.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ClusterRole: disabled with connectInject.enabled" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrole.yaml \
--set 'connectInject.enabled=false' \
.
}

#--------------------------------------------------------------------
# global.enablePodSecurityPolicies

Expand Down
26 changes: 0 additions & 26 deletions charts/consul/test/unit/connect-inject-clusterrolebinding.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,29 +2,3 @@

load _helpers

@test "connectInject/ClusterRoleBinding: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
.
}

@test "connectInject/ClusterRoleBinding: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ClusterRoleBinding: disabled with connectInject.enabled false" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
--set 'connectInject.enabled=false' \
.
}
26 changes: 0 additions & 26 deletions charts/consul/test/unit/connect-inject-serviceaccount.bats
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,32 +2,6 @@

load _helpers

@test "connectInject/ServiceAccount: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-serviceaccount.yaml \
.
}

@test "connectInject/ServiceAccount: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-serviceaccount.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ServiceAccount: disabled with connectInject.enabled false" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-serviceaccount.yaml \
--set 'connectInject.enabled=false' \
.
}
#--------------------------------------------------------------------
# global.imagePullSecrets

Expand Down
Loading