Skip to content

Commit 07331b0

Browse files
inteoninteon
committed
add VenafiConnection CRD to discovery-agent Helm chart
Signed-off-by: Tim Ramlot <42113979+inteon@users.noreply.github.com>
1 parent 98258e0 commit 07331b0

19 files changed

Lines changed: 5849 additions & 23 deletions

‎deploy/charts/discovery-agent/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,21 @@ The Discovery Agent connects your Kubernetes or OpenShift cluster to Palo Alto N
66

77
<!-- AUTO-GENERATED -->
88

9+
### Venafi Connection
10+
11+
#### **venafiConnection.include** ~ `bool`
12+
> Default value:
13+
> ```yaml
14+
> false
15+
> ```
16+
17+
When set to false, the rendered output does not contain the VenafiConnection CRDs and RBAC. This is useful for when the Venafi Connection resoures are already installed separately.
18+
#### **venafiConnection.serviceAccountNamespace** ~ `string`
19+
20+
The namespace in which the 'venafi-connection' service account lives. This is the service account that is used to create JWT tokens for SAs or read credential secrets. (defaults to the namespace in which the controller is running)
21+
22+
### Discovery Agent
23+
924
#### **config.tsgID** ~ `number,string`
1025
> Default value:
1126
> ```yaml

‎deploy/charts/discovery-agent/crd_bases/crd.footer.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
{{ end }}
2+
{{ end }}

‎deploy/charts/discovery-agent/crd_bases/crd.header-without-validations.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{/* DO NOT EDIT. Use 'make generate-crds-venconn' to regenerate. */}}
2+
{{- if .Values.venafiConnection.include }}
3+
{{- if (semverCompare "<1.25" .Capabilities.KubeVersion.GitVersion) }}
4+
apiVersion: apiextensions.k8s.io/v1
5+
kind: CustomResourceDefinition
6+
metadata:
7+
name: "venaficonnections.jetstack.io"
8+
annotations:
9+
# This annotation prevents the CRD from being pruned by Helm when this chart
10+
# is deleted.
11+
helm.sh/resource-policy: keep
12+
labels:
13+
{{- include "venafi-connection.labels" . | nindent 4 }}

‎deploy/charts/discovery-agent/crd_bases/crd.header.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{/* DO NOT EDIT. Use 'make generate-crds-venconn' to regenerate. */}}
2+
{{- if .Values.venafiConnection.include }}
3+
{{- if not (semverCompare "<1.25" .Capabilities.KubeVersion.GitVersion) }}
4+
apiVersion: apiextensions.k8s.io/v1
5+
kind: CustomResourceDefinition
6+
metadata:
7+
name: "venaficonnections.jetstack.io"
8+
annotations:
9+
# This annotation prevents the CRD from being pruned by Helm when this chart
10+
# is deleted.
11+
helm.sh/resource-policy: keep
12+
labels:
13+
{{- include "venafi-connection.labels" . | nindent 4 }}

‎deploy/charts/discovery-agent/crd_bases/jetstack.io_venaficonnections.yaml‎

Lines changed: 1944 additions & 0 deletions
Large diffs are not rendered by default.

‎deploy/charts/discovery-agent/templates/_venafi-connection.tpl‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{/*
2+
Create chart name and version as used by the chart label.
3+
*/}}
4+
{{- define "venafi-connection.chart" -}}
5+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Common labels
10+
*/}}
11+
{{- define "venafi-connection.labels" -}}
12+
helm.sh/chart: {{ include "venafi-connection.chart" . }}
13+
{{ include "venafi-connection.selectorLabels" . }}
14+
{{- if .Chart.AppVersion }}
15+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
16+
{{- end }}
17+
app.kubernetes.io/managed-by: {{ .Release.Service }}
18+
{{- end }}
19+
20+
{{/*
21+
Selector labels
22+
*/}}
23+
{{- define "venafi-connection.selectorLabels" -}}
24+
app.kubernetes.io/name: "venafi-connection"
25+
app.kubernetes.io/instance: {{ .Release.Name }}
26+
{{- end }}

‎deploy/charts/discovery-agent/templates/deployment.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,10 @@ spec:
9191
- {{ .Values.config.venafiConnection.name | quote }}
9292
- --venafi-connection-namespace
9393
- {{ .Values.config.venafiConnection.namespace | quote }}
94+
{{- with .Values.venafiConnection.serviceAccountNamespace }}
95+
- --install-namespace
96+
- {{ . | quote }}
97+
{{- end }}
9498
{{- else }}
9599
- --ngts
96100
{{- if and .Values.config.tsgID .Values.config.serverURL }}

‎deploy/charts/discovery-agent/templates/venafi-connection-crd.without-validations.yaml‎

Lines changed: 1788 additions & 0 deletions
Large diffs are not rendered by default.

‎deploy/charts/discovery-agent/templates/venafi-connection-crd.yaml‎

Lines changed: 1848 additions & 0 deletions
Large diffs are not rendered by default.

‎deploy/charts/discovery-agent/templates/venafi-connection-rbac.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{{- if .Values.venafiConnection.include }}
2+
{{- $saNamespace := .Values.venafiConnection.serviceAccountNamespace | default $.Release.Namespace }}
3+
# The 'venafi-connection' service account is used by multiple
4+
# controllers. When configuring which resources a VenafiConnection
5+
# can access, the RBAC rules you create manually must point to this SA.
6+
apiVersion: v1
7+
kind: ServiceAccount
8+
metadata:
9+
name: venafi-connection
10+
namespace: {{ $saNamespace | quote }}
11+
labels:
12+
{{- include "venafi-connection.labels" $ | nindent 4 }}
13+
---
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
kind: ClusterRole
16+
metadata:
17+
name: venafi-connection-role
18+
labels:
19+
{{- include "venafi-connection.labels" $ | nindent 4 }}
20+
rules:
21+
- apiGroups: [ "" ]
22+
resources: [ "namespaces" ]
23+
verbs: [ "get", "list", "watch" ]
24+
25+
- apiGroups: [ "jetstack.io" ]
26+
resources: [ "venaficonnections" ]
27+
verbs: [ "get", "list", "watch" ]
28+
29+
- apiGroups: [ "jetstack.io" ]
30+
resources: [ "venaficonnections/status" ]
31+
verbs: [ "get", "patch" ]
32+
---
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
kind: ClusterRoleBinding
35+
metadata:
36+
name: venafi-connection-rolebinding
37+
labels:
38+
{{- include "venafi-connection.labels" $ | nindent 4 }}
39+
roleRef:
40+
apiGroup: rbac.authorization.k8s.io
41+
kind: ClusterRole
42+
name: venafi-connection-role
43+
subjects:
44+
- kind: ServiceAccount
45+
name: venafi-connection
46+
namespace: {{ $saNamespace | quote }}
47+
{{- end }}

0 commit comments

Comments
 (0)