basic injector

hashicorp/vault/injector/injector-clusterrole.yaml

@@ -1,12 +1,9 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+  name: vault-example-agent-injector-clusterrole
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
 rules:
 - apiGroups: ["admissionregistration.k8s.io"]
   resources: ["mutatingwebhookconfigurations"]
@@ -15,4 +12,3 @@ rules:
     - "list"
     - "watch"
     - "patch"
-{{ end }}

hashicorp/vault/injector/injector-clusterrolebinding.yaml

@@ -1,19 +1,14 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector-binding
+  name: vault-example-agent-injector-binding
-  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+  name: vault-example-agent-injector-clusterrole
 subjects:
 - kind: ServiceAccount
-  name: {{ template "vault.fullname" . }}-agent-injector
+  name: vault-example-agent-injector
-  namespace: {{ .Release.Namespace }}
+  namespace: vault-example
-{{ end }}

hashicorp/vault/injector/injector-deployment.yaml

@@ -1,59 +1,44 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
-# Deployment for the injector
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector
+  name: vault-example-agent-injector
-  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
     component: webhook
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+      app.kubernetes.io/name: vault-example-agent-injector
-      app.kubernetes.io/instance: {{ .Release.Name }}
       component: webhook
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+        app.kubernetes.io/name: vault-example-agent-injector
-        app.kubernetes.io/instance: {{ .Release.Name }}
         component: webhook
     spec:
-      serviceAccountName: "{{ template "vault.fullname" . }}-agent-injector"
+      serviceAccountName: vault-example-agent-injector
       securityContext:
         runAsNonRoot: true
-        runAsGroup: {{ .Values.injector.gid | default 1000 }}
+        runAsGroup: 1000
-        runAsUser: {{ .Values.injector.uid | default 100 }}
+        runAsUser: 100
       containers:
         - name: sidecar-injector
-          {{ template "injector.resources" . }}
+          image: "hashicorp/vault-k8s:0.1.2"
-          image: "{{ .Values.injector.image.repository }}:{{ .Values.injector.image.tag }}"
+          imagePullPolicy: IfNotPresent
-          imagePullPolicy: "{{ .Values.injector.image.pullPolicy }}"
           env:
             - name: AGENT_INJECT_LISTEN
               value: ":8080"
             - name: AGENT_INJECT_LOG_LEVEL
-              value: {{ .Values.injector.logLevel | default "info" }}
+              value: "info"
             - name: AGENT_INJECT_VAULT_ADDR
-              value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.server.service.port }}
+              value: http://vault-example:8200
             - name: AGENT_INJECT_VAULT_IMAGE
-              value: "{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag }}"
+              value: "vault:1.3.1"
-            {{- if .Values.injector.certs.secretName }}
-            - name: AGENT_INJECT_TLS_CERT_FILE
-              value: "/etc/webhook/certs/{{ .Values.injector.certs.certName }}"
-            - name: AGENT_INJECT_TLS_KEY_FILE
-              value: "/etc/webhook/certs/{{ .Values.injector.certs.keyName }}"
-            {{- else }}
             - name: AGENT_INJECT_TLS_AUTO
-              value: {{ template "vault.fullname" . }}-agent-injector-cfg
+              value: vault-example-agent-injector-cfg
             - name: AGENT_INJECT_TLS_AUTO_HOSTS
-              value: {{ template "vault.fullname" . }}-agent-injector-svc,{{ template "vault.fullname" . }}-agent-injector-svc.{{ .Release.Namespace }},{{ template "vault.fullname" . }}-agent-injector-svc.{{ .Release.Namespace }}.svc
+              value: vault-example-agent-injector-svc,vault-example-agent-injector-svc.vault-example,vault-example-agent-injector-svc.vault-example.svc
-            {{- end }}
           args:
             - agent-inject
             - 2>&1
@@ -77,14 +62,3 @@ spec:
             periodSeconds: 2
             successThreshold: 1
             timeoutSeconds: 5
-{{- if .Values.injector.certs.secretName }}
-          volumeMounts:
-            - name: webhook-certs
-              mountPath: /etc/webhook/certs
-              readOnly: true
-      volumes:
-        - name: webhook-certs
-          secret:
-            secretName: "{{ .Values.injector.certs.secretName }}"
-{{- end }}
-{{ end }}

hashicorp/vault/injector/injector-mutating-webhook.yaml

@@ -1,27 +1,28 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
+apiVersion: admissionregistration.k8s.io/v1
-apiVersion: admissionregistration.k8s.io/v1beta1
 kind: MutatingWebhookConfiguration
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector-cfg
+  name: vault-example-agent-injector-cfg
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
 webhooks:
   - name: vault.hashicorp.com
     clientConfig:
       service:
-        name: {{ template "vault.fullname" . }}-agent-injector-svc
+        name: vault-example-agent-injector-svc
-        namespace: {{ .Release.Namespace }}
+        namespace: vault-example
         path: "/mutate"
-      caBundle: {{ .Values.injector.certs.caBundle }}
+      caBundle: ""
     rules:
       - operations: ["CREATE", "UPDATE"]
         apiGroups: [""]
         apiVersions: ["v1"]
         resources: ["pods"]
-{{- if .Values.injector.namespaceSelector }}
     namespaceSelector:
-{{ toYaml .Values.injector.namespaceSelector | indent 6}}
+      matchExpressions:
-{{ end }}
+        - key: name
-{{ end }}
+          operator: In
+          values: 
+          - example-app
+    sideEffects: None
+    admissionReviewVersions:
+    - "v1"

hashicorp/vault/injector/injector-service.yaml

@@ -1,19 +1,13 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector-svc
+  name: vault-example-agent-injector-svc
-  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
 spec:
   ports:
   - port: 443
     targetPort: 8080
   selector:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
     component: webhook
-{{- end }}

hashicorp/vault/injector/injector-serviceaccount.yaml

@@ -1,11 +1,6 @@
-{{- if and (eq (.Values.injector.enabled | toString) "true" ) (eq (.Values.global.enabled | toString) "true") }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ template "vault.fullname" . }}-agent-injector
+  name: vault-example-agent-injector
-  namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+    app.kubernetes.io/name: vault-example-agent-injector
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{ end }}

hashicorp/vault/server/server-service.yaml

@@ -15,8 +15,8 @@ spec:
   publishNotReadyAddresses: true
   ports:
     - name: http
-      port: 80
+      port: 8200
-      targetPort: 80
+      targetPort: 8200
     - name: internal
       port: 8201
       targetPort: 8201