Skip to content

Commit 18dbbdb

Browse files
trublasttrublast
committed
Ability to skip container mutation (for example for istio)
Signed-off-by: Maksim Kiselev <maksim.kiselev@flant.com>
1 parent ffb1fd8 commit 18dbbdb

File tree

11 files changed

+41
-14
lines changed

11 files changed

+41
-14
lines changed

‎docs/USAGE_RU.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ export VAULT_ADDR=https://secretstoreexample.com
114114

115115
```bash
116116
stronghold kv get demo-kv/myapp-secret
117-
```
117+
```
118118

119119
Команда с использованием curl:
120120
```bash
@@ -174,8 +174,8 @@ export VAULT_ADDR=https://secretstoreexample.com
174174
* Создаём роль, состоящую из названия пространства имён и политики. Связываем её с ServiceAccount `myapp-sa` из пространства имён `myapp-namespace` и политикой `myapp-ro-policy`:
175175

176176
{{< alert level="danger">}}
177-
**Важно!**
178-
Помимо настроек со стороны Stronghold, вы должны настроить разрешения авторизации используемых `serviceAccount` в кластере kubernetes.
177+
**Важно!**
178+
Помимо настроек со стороны Stronghold, вы должны настроить разрешения авторизации используемых `serviceAccount` в кластере kubernetes.
179179
Подробности в пункте [ниже](#как-разрешить-serviceaccount-авторизоваться-в-stronghold)
180180
{{< /alert >}}
181181

@@ -216,7 +216,7 @@ export VAULT_ADDR=https://secretstoreexample.com
216216

217217

218218
{{< alert level="info">}}
219-
**Важно!**
219+
**Важно!**
220220
Рекомендованное значение TTL для токена Kubernetes составляет 10m.
221221
{{< /alert >}}
222222

@@ -255,6 +255,7 @@ Stronghold может использовать различные авториз
255255
|secrets-store.deckhouse.io/mutate-probes | false | Инжектирует переменные окружения в пробы |
256256
|secrets-store.deckhouse.io/log-level | info | Уровень логирования |
257257
|secrets-store.deckhouse.io/enable-json-log | false | Формат логов, строка или json |
258+
|secrets-store.deckhouse.io/skip-mutate-containers | | Список имен контейнеров через пробел, к которым не будет применятся инжектирование |
258259

259260
Используя инжектор вы сможете задавать в манифестах пода вместо значений env-шаблоны, которые будут заменяться на этапе запуска контейнера на значения из хранилища.
260261

‎images/env-injector/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ require (
6262
go.uber.org/multierr v1.11.0 // indirect
6363
golang.org/x/crypto v0.31.0 // indirect
6464
golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 // indirect
65-
golang.org/x/net v0.26.0 // indirect
65+
golang.org/x/net v0.33.0 // indirect
6666
golang.org/x/oauth2 v0.20.0 // indirect
6767
golang.org/x/sync v0.10.0 // indirect
6868
golang.org/x/sys v0.28.0 // indirect

‎images/env-injector/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -203,8 +203,8 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
203203
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
204204
golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
205205
golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
206-
golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
207-
golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
206+
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
207+
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
208208
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
209209
golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
210210
golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=

‎images/vault-secrets-webhook/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ require (
142142
go.uber.org/zap v1.27.0 // indirect
143143
golang.org/x/crypto v0.31.0 // indirect
144144
golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
145-
golang.org/x/net v0.30.0 // indirect
145+
golang.org/x/net v0.33.0 // indirect
146146
golang.org/x/oauth2 v0.22.0 // indirect
147147
golang.org/x/sync v0.10.0 // indirect
148148
golang.org/x/sys v0.28.0 // indirect

‎images/vault-secrets-webhook/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -424,8 +424,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
424424
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
425425
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
426426
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
427-
golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
428-
golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
427+
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
428+
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
429429
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
430430
golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
431431
golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=

‎images/vault-secrets-webhook/pkg/common/common.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ const (
3737
VaultNamespaceAnnotation = "secrets-store.deckhouse.io/namespace"
3838
ServiceAccountTokenVolumeNameAnnotation = "secrets-store.deckhouse.io/service-account-token-volume-name"
3939
LogLevelAnnotation = "secrets-store.deckhouse.io/log-level"
40-
VaultEnvFromPathAnnotation = "secrets-store.deckhouse.io/env-from-path"
41-
40+
VaultEnvFromPathAnnotation = "secrets-store.deckhouse.io/env-from-path"
41+
SkipMutateContainersAnnotation = "secrets-store.deckhouse.io/skip-mutate-containers"
4242
)
4343

4444
func HasVaultPrefix(value string) bool {

‎images/vault-secrets-webhook/pkg/webhook/config.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package webhook
1818

1919
import (
2020
"strconv"
21+
"strings"
2122
"time"
2223

2324
"github.com/slok/kubewebhook/v2/pkg/model"
@@ -66,6 +67,7 @@ type VaultConfig struct {
6667
ObjectNamespace string
6768
MutateProbes bool
6869
Token string
70+
SkipMutateContainers []string
6971
}
7072

7173
func parseVaultConfig(obj metav1.Object, ar *model.AdmissionReview) VaultConfig {
@@ -142,6 +144,12 @@ func parseVaultConfig(obj metav1.Object, ar *model.AdmissionReview) VaultConfig
142144

143145
vaultConfig.EnvLogServer = viper.GetString("VAULT_ENV_LOG_SERVER")
144146

147+
if val, ok := annotations[common.SkipMutateContainersAnnotation]; ok {
148+
vaultConfig.SkipMutateContainers = strings.Fields(val)
149+
} else {
150+
vaultConfig.SkipMutateContainers = viper.GetStringSlice("skip_mutate_containers")
151+
}
152+
145153
if val, ok := annotations[common.VaultNamespaceAnnotation]; ok {
146154
vaultConfig.VaultNamespace = val
147155
} else {
@@ -180,6 +188,7 @@ func SetConfigDefaults() {
180188
viper.SetDefault("env_injector_pull_policy", string(corev1.PullIfNotPresent))
181189
viper.SetDefault("addr", "https://stronghold.d8-stronghold:8200")
182190
viper.SetDefault("tls_skip_verify", "false")
191+
viper.SetDefault("skip_mutate_containers", "")
183192
viper.SetDefault("auth_path", "kubernetes_local")
184193
viper.SetDefault("auth_method", "jwt")
185194
viper.SetDefault("role", "")

‎images/vault-secrets-webhook/pkg/webhook/pod.go‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,17 @@ func (mw *MutatingWebhook) mutateContainers(ctx context.Context, containers []co
156156
continue
157157
}
158158

159+
if func() bool {
160+
for _, skipContainerName := range vaultConfig.SkipMutateContainers {
161+
if container.Name == skipContainerName {
162+
return true
163+
}
164+
}
165+
return false
166+
}() {
167+
continue
168+
}
169+
159170
mutated = true
160171

161172
args := container.Command

‎lib/python/requirements.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
deckhouse==0.4.9
22
dotmap==1.3.30
33
PyYAML==6.0.1
4-
cryptography==43.0.1
4+
cryptography==44.0.1

‎templates/registry-secret.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ data:
1212
.dockerconfigjson: {{ . }}
1313
{{- end }}
1414
{{- else }}
15+
{{- if .Values.global.registry }}
16+
{{- with .Values.global.registry.dockercfg }}
1517
---
1618
apiVersion: v1
1719
kind: Secret
@@ -21,5 +23,7 @@ metadata:
2123
{{- include "helm_lib_module_labels" (list $ (dict "app" $.Chart.Name )) | nindent 2 }}
2224
type: kubernetes.io/dockerconfigjson
2325
data:
24-
.dockerconfigjson: {{ .Values.global.registry.dockercfg }}
26+
.dockerconfigjson: {{ . }}
27+
{{- end }}
28+
{{- end }}
2529
{{- end }}

0 commit comments

Comments
 (0)