-
Notifications
You must be signed in to change notification settings - Fork 57
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixing the integration tests for helm chart.
This PR makes tweaks and fixes some assumptions that prevented the integration test from actually working. This also adds a latest chart.
- Loading branch information
Showing
18 changed files
with
501 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: v2 | ||
| appVersion: 0.4.0 | ||
| description: Windows GMSA Configuration | ||
| keywords: | ||
| - Windows | ||
| - Windows GMSA | ||
| - GMSA | ||
| - Active Directory | ||
| name: gmsa | ||
| sources: | ||
| - https://github.com/kubernetes-sigs/windows-gmsa | ||
| type: application | ||
| version: 0.4.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # Windows GMSA Admission Webhook | ||
|
|
||
| This chart creates the GMSA CRD, Credential, and Admission Webhook. The official documentation and tutorials can be found [here](https://github.com/kubernetes-sigs/windows-gmsa). | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - Active Directory that support Group Managed Service Accounts | ||
| - A Group Managed Service Account | ||
| - Kubernetes v1.21+ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| {{- define "system_default_registry" -}} | ||
| {{- if .Values.global.systemDefaultRegistry -}} | ||
| {{- printf "%s/" .Values.global.systemDefaultRegistry -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* Create chart name and version as used by the chart label. */}} | ||
| {{- define "gmsa.chartref" -}} | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| {{- end }} | ||
|
|
||
| {{/* Determine apiVersion for cert-manager */}} | ||
| {{- define "cert-manager.apiversion" -}} | ||
| {{- $certmanagerVer := split "." .Values.certificates.certManager.version -}} | ||
| {{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }} | ||
| apiVersion: cert-manager.io/v1 | ||
| {{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }} | ||
| apiVersion: cert-manager.io/v1beta1 | ||
| {{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }} | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| {{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }} | ||
| apiVersion: cert-manager.io/v1alpha1 | ||
| {{- else }} | ||
| apiVersion: cert-manager.io/v1 | ||
| {{- end }} | ||
| {{- end }} | ||
|
|
||
| {{- define "certificates.cabundle"}} | ||
| {{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} | ||
| {{- $secret := (lookup "v1" "Secret" .Release.Namespace .Values.certificates.secretName) -}} | ||
| {{- if lt (len $secret) 1 -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' must exist" .Values.certificates.secretName .Release.Namespace) "" -}} | ||
| {{- else -}} | ||
| {{- if not (hasKey $secret "data") -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' is empty" .Values.certificates.secretName .Release.Namespace) "" -}} | ||
| {{- end -}} | ||
| {{- if or (not (hasKey $secret.data "ca.crt")) (not (hasKey $secret.data "tls.crt")) (not (hasKey $secret.data "tls.key")) -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' must contain ca.crt, tls.key, and tls.cert; found the following keys in the secret: %s" .Values.certificates.secretName .Release.Namespace $secret.data) "" -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
| {{- get $secret.data "ca.crt" }} | ||
| {{- else -}} | ||
| INSERT_CERTIFICATE_FROM_SECRET | ||
| {{- end -}} | ||
| {{- end }} | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # the RBAC role that the webhook needs to: | ||
| # * read GMSA custom resources | ||
| # * check authorizations to use GMSA cred specs | ||
| kind: ClusterRole | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: {{ .Release.Name }} | ||
| labels: {{ include "gmsa.chartref" . | nindent 4 }} | ||
| rules: | ||
| - apiGroups: ["windows.k8s.io"] | ||
| resources: ["gmsacredentialspecs"] | ||
| verbs: ["get", "use"] | ||
| - apiGroups: ["authorization.k8s.io"] | ||
| resources: ["localsubjectaccessreviews"] | ||
| verbs: ["create"] | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # bind that role to the webhook's service account | ||
| kind: ClusterRoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: {{ .Release.Name }} | ||
| labels: {{ include "gmsa.chartref" . | nindent 4 }} | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: {{ .Release.Name }} | ||
| namespace: {{.Release.Namespace}} | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: {{ .Release.Name }} | ||
| apiGroup: rbac.authorization.k8s.io | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,119 @@ | ||
| apiVersion: apiextensions.k8s.io/v1 | ||
| kind: CustomResourceDefinition | ||
| metadata: | ||
| name: gmsacredentialspecs.windows.k8s.io | ||
| annotations: | ||
| "api-approved.kubernetes.io": "https://github.com/kubernetes/enhancements/tree/master/keps/sig-windows/689-windows-gmsa" | ||
| spec: | ||
| group: windows.k8s.io | ||
| versions: | ||
| - name: v1alpha1 | ||
| served: true | ||
| storage: false | ||
| deprecated: true | ||
| schema: | ||
| openAPIV3Schema: | ||
| type: object | ||
| properties: | ||
| credspec: | ||
| description: GMSA Credential Spec | ||
| type: object | ||
| properties: | ||
| ActiveDirectoryConfig: | ||
| type: object | ||
| properties: | ||
| GroupManagedServiceAccounts: | ||
| type: array | ||
| items: | ||
| type: object | ||
| properties: | ||
| Name: | ||
| type: string | ||
| Scope: | ||
| type: string | ||
| HostAccountConfig: | ||
| type: object | ||
| properties: | ||
| PluginGUID: | ||
| type: string | ||
| PluginInput: | ||
| type: string | ||
| PortableCcgVersion: | ||
| type: string | ||
| CmsPlugins: | ||
| type: array | ||
| items: | ||
| type: string | ||
| DomainJoinConfig: | ||
| type: object | ||
| properties: | ||
| DnsName: | ||
| type: string | ||
| DnsTreeName: | ||
| type: string | ||
| Guid: | ||
| type: string | ||
| MachineAccountName: | ||
| type: string | ||
| NetBiosName: | ||
| type: string | ||
| Sid: | ||
| type: string | ||
| - name: v1 | ||
| served: true | ||
| storage: true | ||
| schema: | ||
| openAPIV3Schema: | ||
| type: object | ||
| properties: | ||
| credspec: | ||
| description: GMSA Credential Spec | ||
| type: object | ||
| properties: | ||
| ActiveDirectoryConfig: | ||
| type: object | ||
| properties: | ||
| GroupManagedServiceAccounts: | ||
| type: array | ||
| items: | ||
| type: object | ||
| properties: | ||
| Name: | ||
| type: string | ||
| Scope: | ||
| type: string | ||
| HostAccountConfig: | ||
| type: object | ||
| properties: | ||
| PluginGUID: | ||
| type: string | ||
| PluginInput: | ||
| type: string | ||
| PortableCcgVersion: | ||
| type: string | ||
| CmsPlugins: | ||
| type: array | ||
| items: | ||
| type: string | ||
| DomainJoinConfig: | ||
| type: object | ||
| properties: | ||
| DnsName: | ||
| type: string | ||
| DnsTreeName: | ||
| type: string | ||
| Guid: | ||
| type: string | ||
| MachineAccountName: | ||
| type: string | ||
| NetBiosName: | ||
| type: string | ||
| Sid: | ||
| type: string | ||
| conversion: | ||
| strategy: None | ||
| names: | ||
| kind: GMSACredentialSpec | ||
| plural: gmsacredentialspecs | ||
| scope: Cluster | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| {{- if .Values.credential.enabled -}} | ||
| apiVersion: windows.k8s.io/v1 | ||
| kind: GMSACredentialSpec | ||
| metadata: | ||
| name: {{ lower .Values.credential.domainJoinConfig.machineAccountName }} #This is an arbitrary name but it will be used as a reference | ||
| labels: {{ include "gmsa.chartref" . | nindent 4 }} | ||
| credspec: | ||
| ActiveDirectoryConfig: | ||
| GroupManagedServiceAccounts: | ||
| - Name: {{ .Values.credential.domainJoinConfig.machineAccountName }} #Username of the GMSA account | ||
| Scope: {{ .Values.credential.domainJoinConfig.netBiosName }} #NETBIOS Domain Name | ||
| - Name: {{ .Values.credential.domainJoinConfig.machineAccountName }} #Username of the GMSA account | ||
| Scope: {{ .Values.credential.domainJoinConfig.dnsName }} #DNS Domain Name | ||
| CmsPlugins: | ||
| - ActiveDirectory | ||
| DomainJoinConfig: | ||
| DnsName: {{ .Values.credential.domainJoinConfig.dnsName }} #DNS Domain Name | ||
| DnsTreeName: {{ .Values.credential.domainJoinConfig.dnsName }} #DNS Domain Name Root | ||
| Guid: {{ .Values.credential.domainJoinConfig.guid }} #GUID | ||
| MachineAccountName: {{ .Values.credential.domainJoinConfig.machineAccountName }} #Username of the GMSA account | ||
| NetBiosName: {{ .Values.credential.domainJoinConfig.netBiosName }} #NETBIOS Domain Name | ||
| Sid: {{ .Values.credential.domainJoinConfig.sid }} #SID of GMSA | ||
| {{- end -}} | ||
|
|
Oops, something went wrong.