Skip to content

Commit 7e7a66a

Browse files
mikhail-klimkomikhail-klimko
authored
fix: serviceAccountJsonSecretKeyRef for gcedisk (#470)
1 parent 656f89f commit 7e7a66a

File tree

5 files changed

+226
-8
lines changed

5 files changed

+226
-8
lines changed

‎charts/cf-runtime/Chart.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
description: A Helm chart for Codefresh Runner
33
name: cf-runtime
4-
version: 6.3.30
4+
version: 6.3.31
55
keywords:
66
- codefresh
77
- runner
@@ -17,8 +17,10 @@ annotations:
1717
artifacthub.io/containsSecurityUpdates: "false"
1818
# Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`:
1919
artifacthub.io/changes: |
20-
- kind: added
21-
description: Add pullPolicy for dind and engine
20+
- kind: fixed
21+
description: Fix serviceAccountJsonSecretKeyRef for gcedisk
22+
- kind: fixed
23+
description: Fix google-service-account.json key in volume-provisioner secret template
2224
dependencies:
2325
- name: cf-common
2426
repository: oci://quay.io/codefresh/charts

‎charts/cf-runtime/README.md‎

Lines changed: 109 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
## Codefresh Runner
22

3-
![Version: 6.3.30](https://img.shields.io/badge/Version-6.3.30-informational?style=flat-square)
3+
![Version: 6.3.31](https://img.shields.io/badge/Version-6.3.31-informational?style=flat-square)
44

55
Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes.
66

@@ -20,6 +20,7 @@ Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/insta
2020
- [Configuration](#configuration)
2121
- [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration)
2222
- [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration)
23+
- [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke)
2324
- [Custom volume mounts](#custom-volume-mounts)
2425
- [Custom global environment variables](#custom-global-environment-variables)
2526
- [Volume reuse policy](#volume-reuse-policy)
@@ -440,6 +441,113 @@ runtime:
440441
topology.kubernetes.io/zone: northeurope-1
441442
```
442443
444+
### GCE Disks backend volume configuration in GKE
445+
446+
`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions
447+
448+
There are three options:
449+
450+
1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account
451+
452+
```yaml
453+
storage:
454+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
455+
backend: gcedisk
456+
457+
gcedisk:
458+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
459+
volumeType: "pd-standard"
460+
# -- Set GCP volume availability zone
461+
availabilityZone: "us-central1-c"
462+
463+
volumeProvisioner:
464+
# -- Set node selector
465+
nodeSelector: {}
466+
# -- Set tolerations
467+
tolerations: []
468+
469+
# -- Set runtime parameters
470+
runtime:
471+
# -- Parameters for DinD (docker-in-docker) pod
472+
dind:
473+
# -- Set node selector.
474+
nodeSelector:
475+
topology.kubernetes.io/zone: us-central1-c
476+
```
477+
478+
2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret)
479+
480+
```yaml
481+
storage:
482+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
483+
backend: gcedisk
484+
485+
gcedisk:
486+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
487+
volumeType: "`pd-standard"
488+
# -- Set GCP volume availability zone
489+
availabilityZone: "us-central1-c"
490+
# -- Set Google SA JSON key for volume-provisioner (optional)
491+
serviceAccountJson: |
492+
{
493+
"type": "service_account",
494+
"project_id": "...",
495+
"private_key_id": "...",
496+
"private_key": "...",
497+
"client_email": "...",
498+
"client_id": "...",
499+
"auth_uri": "...",
500+
"token_uri": "...",
501+
"auth_provider_x509_cert_url": "...",
502+
"client_x509_cert_url": "..."
503+
}
504+
# -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional)
505+
serviceAccountJsonSecretKeyRef: {}
506+
# E.g.:
507+
# serviceAccountJsonSecretKeyRef:
508+
# name: gce-service-account
509+
# key: service-account.json
510+
511+
# -- Set runtime parameters
512+
runtime:
513+
# -- Parameters for DinD (docker-in-docker) pod
514+
dind:
515+
# -- Set node selector.
516+
nodeSelector:
517+
topology.kubernetes.io/zone: us-central1-c
518+
```
519+
520+
3. Assign IAM role to `dind-volume-provisioner` service account
521+
522+
```yaml
523+
storage:
524+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
525+
backend: gcedisk
526+
527+
gcedisk:
528+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
529+
volumeType: "`pd-standard"
530+
# -- Set GCP volume availability zone
531+
availabilityZone: "us-central1-c"
532+
533+
volumeProvisioner:
534+
# -- Service Account parameters
535+
serviceAccount:
536+
# -- Create service account
537+
create: true
538+
# -- Additional service account annotations
539+
annotations:
540+
iam.gke.io/gcp-service-account: <GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
541+
542+
# -- Set runtime parameters
543+
runtime:
544+
# -- Parameters for DinD (docker-in-docker) pod
545+
dind:
546+
# -- Set node selector.
547+
nodeSelector:
548+
topology.kubernetes.io/zone: us-central1-c
549+
```
550+
443551
### Custom global environment variables
444552
445553
You can add your own environment variables to the runtime environment. All pipeline steps have access to the global variables.

‎charts/cf-runtime/README.md.gotmpl‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/insta
2020
- [Configuration](#configuration)
2121
- [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration)
2222
- [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration)
23+
- [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke)
2324
- [Custom volume mounts](#custom-volume-mounts)
2425
- [Custom global environment variables](#custom-global-environment-variables)
2526
- [Volume reuse policy](#volume-reuse-policy)
@@ -440,6 +441,112 @@ runtime:
440441
topology.kubernetes.io/zone: northeurope-1
441442
```
442443

444+
### GCE Disks backend volume configuration in GKE
445+
446+
`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions
447+
448+
There are three options:
449+
450+
1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account
451+
452+
```yaml
453+
storage:
454+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
455+
backend: gcedisk
456+
457+
gcedisk:
458+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
459+
volumeType: "pd-standard"
460+
# -- Set GCP volume availability zone
461+
availabilityZone: "us-central1-c"
462+
463+
volumeProvisioner:
464+
# -- Set node selector
465+
nodeSelector: {}
466+
# -- Set tolerations
467+
tolerations: []
468+
469+
# -- Set runtime parameters
470+
runtime:
471+
# -- Parameters for DinD (docker-in-docker) pod
472+
dind:
473+
# -- Set node selector.
474+
nodeSelector:
475+
topology.kubernetes.io/zone: us-central1-c
476+
```
477+
478+
2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret)
479+
480+
```yaml
481+
storage:
482+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
483+
backend: gcedisk
484+
485+
gcedisk:
486+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
487+
volumeType: "`pd-standard"
488+
# -- Set GCP volume availability zone
489+
availabilityZone: "us-central1-c"
490+
# -- Set Google SA JSON key for volume-provisioner (optional)
491+
serviceAccountJson: |
492+
{
493+
"type": "service_account",
494+
"project_id": "...",
495+
"private_key_id": "...",
496+
"private_key": "...",
497+
"client_email": "...",
498+
"client_id": "...",
499+
"auth_uri": "...",
500+
"token_uri": "...",
501+
"auth_provider_x509_cert_url": "...",
502+
"client_x509_cert_url": "..."
503+
}
504+
# -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional)
505+
serviceAccountJsonSecretKeyRef: {}
506+
# E.g.:
507+
# serviceAccountJsonSecretKeyRef:
508+
# name: gce-service-account
509+
# key: service-account.json
510+
511+
# -- Set runtime parameters
512+
runtime:
513+
# -- Parameters for DinD (docker-in-docker) pod
514+
dind:
515+
# -- Set node selector.
516+
nodeSelector:
517+
topology.kubernetes.io/zone: us-central1-c
518+
```
519+
520+
3. Assign IAM role to `dind-volume-provisioner` service account
521+
522+
```yaml
523+
storage:
524+
# -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`)
525+
backend: gcedisk
526+
527+
gcedisk:
528+
# -- Set GCP volume backend type (`pd-ssd`/`pd-standard`)
529+
volumeType: "`pd-standard"
530+
# -- Set GCP volume availability zone
531+
availabilityZone: "us-central1-c"
532+
533+
volumeProvisioner:
534+
# -- Service Account parameters
535+
serviceAccount:
536+
# -- Create service account
537+
create: true
538+
# -- Additional service account annotations
539+
annotations:
540+
iam.gke.io/gcp-service-account: <GSA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
541+
542+
# -- Set runtime parameters
543+
runtime:
544+
# -- Parameters for DinD (docker-in-docker) pod
545+
dind:
546+
# -- Set node selector.
547+
nodeSelector:
548+
topology.kubernetes.io/zone: us-central1-c
549+
```
443550

444551
### Custom global environment variables
445552

‎charts/cf-runtime/templates/_components/volume-provisioner/_env-vars.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ AWS_SECRET_ACCESS_KEY:
3434
{{- end }}
3535

3636
{{- if or .Values.storage.gcedisk.serviceAccountJson .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }}
37-
GOOGLE_APPLICATION_CREDENTIALS: /etc/dind-volume-provisioner/credentials/google-service-account.json
37+
GOOGLE_APPLICATION_CREDENTIALS: {{ printf "/etc/dind-volume-provisioner/credentials/%s" (.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.key | default "google-service-account.json") }}
3838
{{- end }}
3939

4040
{{- if and .Values.storage.mountAzureJson }}
@@ -62,7 +62,7 @@ CLOUDCONFIG_AZURE: /etc/kubernetes/azure.json
6262
optional: true
6363
{{- else if .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }}
6464
- name: credentials
65-
secrete:
65+
secret:
6666
secretName: {{ .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.name }}
6767
optional: true
6868
{{- end }}
@@ -85,4 +85,4 @@ CLOUDCONFIG_AZURE: /etc/kubernetes/azure.json
8585
readOnly: true
8686
mountPath: "/etc/kubernetes/azure.json"
8787
{{- end }}
88-
{{- end }}
88+
{{- end }}

‎charts/cf-runtime/templates/_components/volume-provisioner/_secret.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ metadata:
99
{{- include "dind-volume-provisioner.labels" . | nindent 4 }}
1010
stringData:
1111
{{- with .Values.storage.gcedisk.serviceAccountJson }}
12-
google-service-account.json: {{ . }}
12+
google-service-account.json: |
13+
{{- . | nindent 4 }}
1314
{{- end }}
1415
{{- with .Values.storage.ebs.accessKeyId }}
1516
aws_access_key_id: {{ . }}

0 commit comments

Comments
 (0)