Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use kube auth method to provision ACL token for the crd controller #995

Merged
merged 8 commits into from
Mar 2, 2022
Merged
Show file tree
Hide file tree
Changes from 6 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .circleci/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,8 @@ commands:
type: string
consul-k8s-image:
type: string
default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s-control-plane:latest"
#default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s-control-plane:latest"
default: "kyleschochenmaier/consul-k8s-acls"
go-path:
type: string
default: "/home/circleci/.go_workspace"
Expand Down
2 changes: 0 additions & 2 deletions charts/consul/templates/connect-inject-clusterrole.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
# The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down Expand Up @@ -55,4 +54,3 @@ rules:
verbs:
- get
{{- end }}
{{- end }}
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
Expand All @@ -17,4 +16,3 @@ subjects:
- kind: ServiceAccount
name: {{ template "consul.fullname" . }}-connect-injector
namespace: {{ .Release.Namespace }}
{{- end }}
2 changes: 0 additions & 2 deletions charts/consul/templates/connect-inject-serviceaccount.yaml
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
{{- if or (and (ne (.Values.connectInject.enabled | toString) "-") .Values.connectInject.enabled) (and (eq (.Values.connectInject.enabled | toString) "-") .Values.global.enabled) }}
apiVersion: v1
kind: ServiceAccount
metadata:
Expand All @@ -20,4 +19,3 @@ imagePullSecrets:
- name: {{ .name }}
{{- end }}
{{- end }}
{{- end }}
70 changes: 58 additions & 12 deletions charts/consul/templates/controller-deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -47,16 +47,52 @@ spec:
spec:
{{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
initContainers:
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
- name: controller-acl-init
env:
- name: HOST_IP
valueFrom:
fieldRef:
fieldPath: status.hostIP
{{- if .Values.global.tls.enabled }}
- name: CONSUL_CACERT
value: /consul/tls/ca/tls.crt
{{- end }}
- name: CONSUL_HTTP_ADDR
{{- if .Values.global.tls.enabled }}
value: https://$(HOST_IP):8501
{{- else }}
value: http://$(HOST_IP):8500
{{- end }}
image: {{ .Values.global.imageK8S }}
volumeMounts:
- mountPath: /consul/login
name: consul-data
readOnly: false
{{- if .Values.global.tls.enabled }}
{{- if .Values.global.tls.enableAutoEncrypt }}
- name: consul-auto-encrypt-ca-cert
{{- else }}
- name: consul-ca-cert
{{- end }}
mountPath: /consul/tls/ca
readOnly: true
{{- end }}
command:
- "/bin/sh"
- "-ec"
- |
consul-k8s-control-plane acl-init \
-secret-name="{{ template "consul.fullname" . }}-controller-acl-token" \
-k8s-namespace={{ .Release.Namespace }}
-component-name=controller \
-acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method \
{{- if .Values.global.adminPartitions.enabled }}
-partition={{ .Values.global.adminPartitions.name }} \
{{- end }}
kschoche marked this conversation as resolved.
Show resolved Hide resolved
-log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
-log-json={{ .Values.global.logJSON }} \
resources:
requests:
memory: "25Mi"
Expand All @@ -65,9 +101,6 @@ spec:
memory: "25Mi"
cpu: "50m"
{{- end }}
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
{{- end }}
{{- end }}
containers:
- command:
Expand Down Expand Up @@ -98,7 +131,21 @@ spec:
-consul-cross-namespace-acl-policy=cross-namespace-policy \
{{- end }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
lifecycle:
preStop:
exec:
command:
- "/bin/sh"
- "-ec"
- |
consul-k8s-control-plane consul-logout
thisisnotashwin marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might need to pass in the partition here too based on what we learned with login.

{{- end }}
env:
{{- if .Values.global.acls.manageSystemACLs }}
- name: CONSUL_HTTP_TOKEN_FILE
value: "/consul/login/acl-token"
{{- end }}
- name: HOST_IP
valueFrom:
fieldRef:
Expand All @@ -110,13 +157,6 @@ spec:
name: {{ .Values.controller.aclToken.secretName }}
key: {{ .Values.controller.aclToken.secretKey }}
{{- end }}
{{- if .Values.global.acls.manageSystemACLs }}
kschoche marked this conversation as resolved.
Show resolved Hide resolved
- name: CONSUL_HTTP_TOKEN
valueFrom:
secretKeyRef:
name: "{{ template "consul.fullname" . }}-controller-acl-token"
key: "token"
{{- end}}
{{- if .Values.global.tls.enabled }}
- name: CONSUL_CACERT
value: /consul/tls/ca/tls.crt
Expand All @@ -138,6 +178,9 @@ spec:
{{- toYaml . | nindent 12 }}
{{- end }}
volumeMounts:
- mountPath: /consul/login
name: consul-data
readOnly: false
kschoche marked this conversation as resolved.
Show resolved Hide resolved
- mountPath: /tmp/controller-webhook/certs
name: cert
readOnly: true
Expand Down Expand Up @@ -175,6 +218,9 @@ spec:
medium: "Memory"
{{- end }}
{{- end }}
- name: consul-data
emptyDir:
medium: "Memory"
serviceAccountName: {{ template "consul.fullname" . }}-controller
{{- if .Values.controller.nodeSelector }}
nodeSelector:
Expand Down
2 changes: 0 additions & 2 deletions charts/consul/templates/server-acl-init-role.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,15 +19,13 @@ rules:
verbs:
- create
- get
{{- if .Values.connectInject.enabled }}
- apiGroups: [""]
resources:
- serviceaccounts
resourceNames:
- {{ template "consul.fullname" . }}-connect-injector
verbs:
- get
{{- end }}
{{- if .Values.global.enablePodSecurityPolicies }}
- apiGroups: ["policy"]
resources: ["podsecuritypolicies"]
Expand Down
27 changes: 0 additions & 27 deletions charts/consul/test/unit/connect-inject-clusterrole.bats
Original file line number Diff line number Diff line change
Expand Up @@ -2,33 +2,6 @@

load _helpers

@test "connectInject/ClusterRole: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrole.yaml \
.
}

@test "connectInject/ClusterRole: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-clusterrole.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ClusterRole: disabled with connectInject.enabled" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrole.yaml \
--set 'connectInject.enabled=false' \
.
}

#--------------------------------------------------------------------
# global.enablePodSecurityPolicies

Expand Down
26 changes: 0 additions & 26 deletions charts/consul/test/unit/connect-inject-clusterrolebinding.bats
Original file line number Diff line number Diff line change
Expand Up @@ -2,29 +2,3 @@

load _helpers

@test "connectInject/ClusterRoleBinding: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
.
}

@test "connectInject/ClusterRoleBinding: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ClusterRoleBinding: disabled with connectInject.enabled false" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-clusterrolebinding.yaml \
--set 'connectInject.enabled=false' \
.
}
26 changes: 0 additions & 26 deletions charts/consul/test/unit/connect-inject-serviceaccount.bats
Original file line number Diff line number Diff line change
Expand Up @@ -2,32 +2,6 @@

load _helpers

@test "connectInject/ServiceAccount: disabled by default" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-serviceaccount.yaml \
.
}

@test "connectInject/ServiceAccount: enabled with global.enabled false" {
cd `chart_dir`
local actual=$(helm template \
-s templates/connect-inject-serviceaccount.yaml \
--set 'global.enabled=false' \
--set 'client.enabled=true' \
--set 'connectInject.enabled=true' \
. | tee /dev/stderr |
yq -s 'length > 0' | tee /dev/stderr)
[ "${actual}" = "true" ]
}

@test "connectInject/ServiceAccount: disabled with connectInject.enabled false" {
cd `chart_dir`
assert_empty helm template \
-s templates/connect-inject-serviceaccount.yaml \
--set 'connectInject.enabled=false' \
.
}
#--------------------------------------------------------------------
# global.imagePullSecrets

Expand Down
Loading