Skip to content

Commit 9b0e619

Browse files
wallrjwallrj
committed
Add missing VenafiConnection templates and values to the Helm chart
Signed-off-by: Richard Wall <[email protected]>
1 parent 804d81d commit 9b0e619

16 files changed

+1583
-297
lines changed

‎deploy/charts/venafi-kubernetes-agent/README.md

Lines changed: 11 additions & 130 deletions
Original file line numberDiff line numberDiff line change
@@ -4,147 +4,26 @@ The Venafi Kubernetes Agent connects your Kubernetes or Openshift cluster to the
44

55
![Version: 0.1.49](https://img.shields.io/badge/Version-0.1.49-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.1.49](https://img.shields.io/badge/AppVersion-v0.1.49-informational?style=flat-square)
66

7-
## Additional Information
8-
97
The Venafi Kubernetes Agent connects your Kubernetes or OpenShift cluster to the Venafi Control Plane.
108
You will require a Venafi Control Plane account to connect your cluster.
119
If you do not have one, you can sign up for a free trial now at:
1210
- https://venafi.com/try-venafi/tls-protect/
1311

14-
Note that there are EU and US Venafi Control Plane options.
15-
Upon signing up you will be redirected to one of either of the following login URLs:
16-
- https://ui.venafi.cloud/ (US)
17-
- https://ui.venafi.eu/ (EU)
18-
19-
> 📖 Learn more about [Venafi Kubernetes Agent network requirements](https://docs.venafi.cloud/vaas/k8s-components/c-vcp-network-requirements/),
20-
> in the two regions.
21-
22-
## Installation
23-
24-
The Helm chart is available from the following Venafi OCI registries:
25-
26-
- `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` (public)
27-
- `oci://private-registry.venafi.cloud/charts/venafi-kubernetes-agent` (private, US)
28-
- `oci://private-registry.venafi.eu/charts/venafi-kubernetes-agent` (private, EU)
29-
30-
> ℹ️ In the following steps it is assumed that you are using the **public** registry.
31-
>
32-
> 📖 Learn [how to access the private Venafi OCI registries](https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/).
33-
34-
Familiarise yourself with the Helm chart:
35-
36-
```sh
37-
helm show readme oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
38-
helm show values oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
39-
helm template oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
40-
```
41-
42-
### 1) Create a Venafi service account
43-
44-
Create a new service account in the Venafi TLS Protect Cloud web UI.
45-
The service account is used by the Venafi Kubernetes Agent to authenticate to the Venafi Control Plane.
46-
Every Venafi Kubernetes Agent should use a unique service account.
47-
You must create the service account **before** installing the Helm chart.
48-
49-
First create an RSA key pair:
50-
51-
```shell
52-
export VENAFI_SERVICE_ACCOUNT="example-cluster"
53-
openssl genrsa -out ${VENAFI_SERVICE_ACCOUNT}.pem
54-
openssl rsa -in ${VENAFI_SERVICE_ACCOUNT}.pem -pubout --out ${VENAFI_SERVICE_ACCOUNT}.pub
55-
```
56-
57-
Next create a service account in the Venafi Control Plane:
58-
59-
- Click **Settings > Service Accounts**.
60-
- Click **New**.
61-
- Type a name for your new service account.
62-
Must match the ${VENAFI_SERVICE_ACCOUNT} variable that you used above.
63-
- Select an **Owning Team**, which is the team who owns the machine you want to create the service account for.
64-
- The scope should be "Kubernetes Discovery" only.
65-
- Set the validity period of your pubic key up to a maximum of 365 days.
66-
- Paste in the **public key** from the pair you generated.
67-
- Click **Save** to finish and return to the Service Account list view.
68-
- Find the row matching the name you entered and copy the "Client ID" value,
69-
by clicking "Copy Client ID" in the row actions menu.
70-
You will need this when you install the Helm chart.
71-
72-
### 2) Deploy the chart
73-
74-
Create a Namespace and then create a Secret containing the private key of the service account:
75-
76-
```shell
77-
export VENAFI_NAMESPACE="venafi"
78-
kubectl create namespace ${VENAFI_NAMESPACE}
79-
kubectl create secret generic agent-credentials \
80-
--namespace ${VENAFI_NAMESPACE} \
81-
--from-file=privatekey.pem=${VENAFI_SERVICE_ACCOUNT}.pem
82-
```
83-
84-
Install the chart:
85-
86-
```shell
87-
export VENAFI_CLIENT_ID="<your-client-id>"
88-
helm upgrade venafi-kubernetes-agent oci://registry.venafi.cloud/charts/venafi-kubernetes-agent \
89-
--install \
90-
--namespace ${VENAFI_NAMESPACE} \
91-
--set config.clientId="${VENAFI_CLIENT_ID}"
92-
```
93-
94-
> ℹ️ To use the [EU Venafi Control Plane](https://docs.venafi.cloud/vaas/k8s-components/c-vcp-network-requirements/),
95-
> add: `--set config.server=https://api.venafi.eu/`.
96-
97-
### 3) Connect the cluster in Venafi Control Plane
98-
99-
- Click **Installations > Kubernetes Clusters**.
100-
- Click **Connect**.
101-
- On step 1, click **Continue**.
102-
- On step 2, select **Advanced Connection**.
103-
- On step 3, click **Continue** to skip.
104-
- On step 4, fill in the details as follows:
105-
- Name: use the name of the service account that you created earlier. E.g. "example-cluster".
106-
- Service Account: select the service account that you created earlier.
107-
- Check "The connection command has completed." box and click **continue**.
108-
- On step 5, either wait for validation or click **Finish** to go back to the cluster list.
109-
110-
### 4) Verify the deployment
111-
112-
Check the agent logs:
113-
114-
```shell
115-
kubectl logs -n ${VENAFI_NAMESPACE} -l app.kubernetes.io/instance=venafi-kubernetes-agent --tail -1 | grep -A 5 "Running Agent"
116-
```
117-
118-
You should see:
119-
120-
```console
121-
2023/10/24 12:10:03 Running Agent...
122-
2023/10/24 12:10:03 Posting data to: https://api.venafi.cloud/
123-
2023/10/24 12:10:04 Data sent successfully.
124-
```
125-
126-
Check the cluster status by visiting the Clusters page in the Venafi Control Plane:
127-
- Click **Installations > Kubernetes Clusters**
128-
129-
You should see:
130-
- Status: Active
131-
- Last Check In: ...seconds ago
132-
133-
Check the Event Log page:
134-
- Click **Settings > Event Log**
135-
136-
You should see the following events for your service account:
137-
- Service Account Access Token Granted
138-
- Login Succeeded
12+
> 📖 Read the [Venafi Kubernetes Agent documentation](https://docs.venafi.cloud/vaas/k8s-components/c-tlspk-agent-overview/),
13+
> to learn how install and configure this Helm chart.
13914
14015
## Values
14116

14217
| Key | Type | Default | Description |
14318
|-----|------|---------|-------------|
14419
| affinity | object | `{}` | Embed YAML for Node affinity settings, see https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/. |
145-
| authentication | object | `{"secretKey":"privatekey.pem","secretName":"agent-credentials"}` | Authentication details for the Venafi Kubernetes Agent |
20+
| authentication | object | `{"secretKey":"privatekey.pem","secretName":"agent-credentials","venafiConnection":{"enabled":false,"name":"venafi-components","namespace":"venafi"}}` | Authentication details for the Venafi Kubernetes Agent |
14621
| authentication.secretKey | string | `"privatekey.pem"` | Key name in the referenced secret |
14722
| authentication.secretName | string | `"agent-credentials"` | Name of the secret containing the private key |
23+
| authentication.venafiConnection | object | `{"enabled":false,"name":"venafi-components","namespace":"venafi"}` | Configure VenafiConnection authentication |
24+
| authentication.venafiConnection.enabled | bool | `false` | When set to true, the Venafi Kubernetes Agent will authenticate to Venafi using the configuration in a VenafiConnection resource. Use `venafiConnection.enabled=true` for [secretless authentication](https://docs.venafi.cloud/vaas/k8s-components/t-install-tlspk-agent/). When set to true, the `authentication.secret` values will be ignored and the Secret with `authentication.secretName` will _not_ be mounted into the Venafi Kubernetes Agent Pod. |
25+
| authentication.venafiConnection.name | string | `"venafi-components"` | The name of a VenafiConnection resource which contains the configuration for authenticating to Venafi. |
26+
| authentication.venafiConnection.namespace | string | `"venafi"` | The namespace of a VenafiConnection resource which contains the configuration for authenticating to Venafi. |
14827
| command | list | `[]` | Specify the command to run overriding default binary. |
14928
| config | object | `{"clientId":"","clusterDescription":"","clusterName":"","configmap":{"key":null,"name":null},"period":"0h1m0s","server":"https://api.venafi.cloud/"}` | Configuration section for the Venafi Kubernetes Agent itself |
15029
| config.clientId | string | `""` | The client-id returned from the Venafi Control Plane |
@@ -153,11 +32,13 @@ You should see the following events for your service account:
15332
| config.configmap | object | `{"key":null,"name":null}` | Specify ConfigMap details to load config from an existing resource. This should be blank by default unless you have you own config. |
15433
| config.period | string | `"0h1m0s"` | Send data back to the platform every minute unless changed |
15534
| config.server | string | `"https://api.venafi.cloud/"` | Overrides the server if using a proxy in your environment For the EU variant use: https://api.venafi.eu/ |
35+
| crds.forceRemoveValidationAnnotations | bool | `false` | The 'x-kubernetes-validations' annotation is not supported in Kubernetes 1.22 and below. This annotation is used by CEL, which is a feature introduced in Kubernetes 1.25 that improves how validation is performed. This option allows to force the 'x-kubernetes-validations' annotation to be excluded, even on Kubernetes 1.25+ clusters. |
36+
| crds.venafiConnection | object | `{"include":false}` | Optionally include the VenafiConnection CRDs |
37+
| crds.venafiConnection.include | bool | `false` | When set to false, the rendered output does not contain the VenafiConnection CRDs and RBAC. This is useful for when the Venafi Connection resources are already installed separately. |
15638
| extraArgs | list | `[]` | Specify additional arguments to pass to the agent binary. For example `["--strict", "--oneshot"]` |
15739
| fullnameOverride | string | `""` | Helm default setting, use this to shorten the full install name. |
15840
| image.pullPolicy | string | `"IfNotPresent"` | Defaults to only pull if not already present |
15941
| image.repository | string | `"registry.venafi.cloud/venafi-agent/venafi-agent"` | Default to Open Source image repository |
160-
| image.tag | string | `"v0.1.49"` | Overrides the image tag whose default is the chart appVersion |
16142
| imagePullSecrets | list | `[]` | Specify image pull credentials if using a private registry example: - name: my-pull-secret |
16243
| metrics.enabled | bool | `true` | Enable the metrics server. If false, the metrics server will be disabled and the other metrics fields below will be ignored. |
16344
| metrics.podmonitor.annotations | object | `{}` | Additional annotations to add to the PodMonitor. |
@@ -176,7 +57,7 @@ You should see the following events for your service account:
17657
| podSecurityContext | object | `{}` | Optional Pod (all containers) `SecurityContext` options, see https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod. |
17758
| replicaCount | int | `1` | default replicas, do not scale up |
17859
| resources | object | `{"limits":{"memory":"500Mi"},"requests":{"cpu":"200m","memory":"200Mi"}}` | Set resource requests and limits for the pod. Read [Venafi Kubernetes components deployment best practices](https://docs.venafi.cloud/vaas/k8s-components/c-k8s-components-best-practice/#scaling) to learn how to choose suitable CPU and memory resource requests and limits. |
179-
| securityContext | object | `{"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":1000}` | Add Container specific SecurityContext settings to the container. Takes precedence over `podSecurityContext` when set. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container |
60+
| securityContext | object | `{"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Add Container specific SecurityContext settings to the container. Takes precedence over `podSecurityContext` when set. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-capabilities-for-a-container |
18061
| serviceAccount.annotations | object | `{}` | Annotations YAML to add to the service account |
18162
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created |
18263
| serviceAccount.name | string | `""` | The name of the service account to use. If blank and `serviceAccount.create` is true, a name is generated using the fullname template of the release. |

‎deploy/charts/venafi-kubernetes-agent/README.md.gotmpl

Lines changed: 2 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -3,138 +3,13 @@
33

44
{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }}
55

6-
## Additional Information
7-
86
The Venafi Kubernetes Agent connects your Kubernetes or OpenShift cluster to the Venafi Control Plane.
97
You will require a Venafi Control Plane account to connect your cluster.
108
If you do not have one, you can sign up for a free trial now at:
119
- https://venafi.com/try-venafi/tls-protect/
1210

13-
Note that there are EU and US Venafi Control Plane options.
14-
Upon signing up you will be redirected to one of either of the following login URLs:
15-
- https://ui.venafi.cloud/ (US)
16-
- https://ui.venafi.eu/ (EU)
17-
18-
> 📖 Learn more about [Venafi Kubernetes Agent network requirements](https://docs.venafi.cloud/vaas/k8s-components/c-vcp-network-requirements/),
19-
> in the two regions.
20-
21-
## Installation
22-
23-
The Helm chart is available from the following Venafi OCI registries:
24-
25-
- `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` (public)
26-
- `oci://private-registry.venafi.cloud/charts/venafi-kubernetes-agent` (private, US)
27-
- `oci://private-registry.venafi.eu/charts/venafi-kubernetes-agent` (private, EU)
28-
29-
> ℹ️ In the following steps it is assumed that you are using the **public** registry.
30-
>
31-
> 📖 Learn [how to access the private Venafi OCI registries](https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/).
32-
33-
Familiarise yourself with the Helm chart:
34-
35-
```sh
36-
helm show readme oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
37-
helm show values oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
38-
helm template oci://registry.venafi.cloud/charts/venafi-kubernetes-agent
39-
```
40-
41-
### 1) Create a Venafi service account
42-
43-
Create a new service account in the Venafi TLS Protect Cloud web UI.
44-
The service account is used by the Venafi Kubernetes Agent to authenticate to the Venafi Control Plane.
45-
Every Venafi Kubernetes Agent should use a unique service account.
46-
You must create the service account **before** installing the Helm chart.
47-
48-
First create an RSA key pair:
49-
50-
```shell
51-
export VENAFI_SERVICE_ACCOUNT="example-cluster"
52-
openssl genrsa -out ${VENAFI_SERVICE_ACCOUNT}.pem
53-
openssl rsa -in ${VENAFI_SERVICE_ACCOUNT}.pem -pubout --out ${VENAFI_SERVICE_ACCOUNT}.pub
54-
```
55-
56-
Next create a service account in the Venafi Control Plane:
57-
58-
- Click **Settings > Service Accounts**.
59-
- Click **New**.
60-
- Type a name for your new service account.
61-
Must match the ${VENAFI_SERVICE_ACCOUNT} variable that you used above.
62-
- Select an **Owning Team**, which is the team who owns the machine you want to create the service account for.
63-
- The scope should be "Kubernetes Discovery" only.
64-
- Set the validity period of your pubic key up to a maximum of 365 days.
65-
- Paste in the **public key** from the pair you generated.
66-
- Click **Save** to finish and return to the Service Account list view.
67-
- Find the row matching the name you entered and copy the "Client ID" value,
68-
by clicking "Copy Client ID" in the row actions menu.
69-
You will need this when you install the Helm chart.
70-
71-
### 2) Deploy the chart
72-
73-
Create a Namespace and then create a Secret containing the private key of the service account:
74-
75-
```shell
76-
export VENAFI_NAMESPACE="venafi"
77-
kubectl create namespace ${VENAFI_NAMESPACE}
78-
kubectl create secret generic agent-credentials \
79-
--namespace ${VENAFI_NAMESPACE} \
80-
--from-file=privatekey.pem=${VENAFI_SERVICE_ACCOUNT}.pem
81-
```
82-
83-
Install the chart:
84-
85-
```shell
86-
export VENAFI_CLIENT_ID="<your-client-id>"
87-
helm upgrade venafi-kubernetes-agent oci://registry.venafi.cloud/charts/venafi-kubernetes-agent \
88-
--install \
89-
--namespace ${VENAFI_NAMESPACE} \
90-
--set config.clientId="${VENAFI_CLIENT_ID}"
91-
```
92-
93-
> ℹ️ To use the [EU Venafi Control Plane](https://docs.venafi.cloud/vaas/k8s-components/c-vcp-network-requirements/),
94-
> add: `--set config.server=https://api.venafi.eu/`.
95-
96-
### 3) Connect the cluster in Venafi Control Plane
97-
98-
- Click **Installations > Kubernetes Clusters**.
99-
- Click **Connect**.
100-
- On step 1, click **Continue**.
101-
- On step 2, select **Advanced Connection**.
102-
- On step 3, click **Continue** to skip.
103-
- On step 4, fill in the details as follows:
104-
- Name: use the name of the service account that you created earlier. E.g. "example-cluster".
105-
- Service Account: select the service account that you created earlier.
106-
- Check "The connection command has completed." box and click **continue**.
107-
- On step 5, either wait for validation or click **Finish** to go back to the cluster list.
108-
109-
### 4) Verify the deployment
110-
111-
Check the agent logs:
112-
113-
```shell
114-
kubectl logs -n ${VENAFI_NAMESPACE} -l app.kubernetes.io/instance=venafi-kubernetes-agent --tail -1 | grep -A 5 "Running Agent"
115-
```
116-
117-
You should see:
118-
119-
```console
120-
2023/10/24 12:10:03 Running Agent...
121-
2023/10/24 12:10:03 Posting data to: https://api.venafi.cloud/
122-
2023/10/24 12:10:04 Data sent successfully.
123-
```
124-
125-
Check the cluster status by visiting the Clusters page in the Venafi Control Plane:
126-
- Click **Installations > Kubernetes Clusters**
127-
128-
You should see:
129-
- Status: Active
130-
- Last Check In: ...seconds ago
131-
132-
Check the Event Log page:
133-
- Click **Settings > Event Log**
134-
135-
You should see the following events for your service account:
136-
- Service Account Access Token Granted
137-
- Login Succeeded
11+
> 📖 Read the [Venafi Kubernetes Agent documentation](https://docs.venafi.cloud/vaas/k8s-components/c-tlspk-agent-overview/),
12+
> to learn how install and configure this Helm chart.
13813

13914
{{ template "chart.requirementsSection" . }}
14015

0 commit comments

Comments
 (0)