Skip to content

Commit ae4da81

Browse files
hawksighthawksight
authored
Merge pull request #430 from jetstack/pf/chart-vei-rbac
feat: Venafi Enhanced Issuer config + chart docs update
2 parents 1926f2d + eb56c74 commit ae4da81

File tree

9 files changed

+284
-138
lines changed

9 files changed

+284
-138
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ attest-docker-image:
124124
# This target can be used instead if the pre-commit hook is not desired
125125
.PHONY: update-helm-docs
126126
update-helm-docs:
127-
go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.10.0
127+
go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
128128
helm-docs --chart-search-root=deploy/charts/
129129

130130
# CI

‎deploy/charts/jetstack-agent/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@ apiVersion: v2
22
name: jetstack-agent
33
description: Jetstack Secure Agent
44
type: application
5-
version: 0.1.0
6-
appVersion: "v1.38.0"
5+
version: 0.2.0
6+
appVersion: "v0.1.39"
77
home: https://github.com/jetstack/jetstack-secure
88
maintainers:
99
- name: JSCP and CRE Team

‎deploy/charts/jetstack-agent/README.md

Lines changed: 112 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -2,136 +2,155 @@
22

33
Jetstack Secure Agent
44

5-
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.38.0](https://img.shields.io/badge/AppVersion-v1.38.0-informational?style=flat-square)
5+
![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.1.39](https://img.shields.io/badge/AppVersion-v0.1.39-informational?style=flat-square)
66

77
## Additional Information
88

9-
The Jetstack secure agent helm chart installs the Kubernetes agent that connects to The TLS Protect For Kubernetes platform.
9+
The Jetstack Secure agent helm chart installs the Kubernetes agent that connects to the TLS Protect For Kubernetes (TLSPK) platform.
1010
It will require a valid TLS Protect for Kubernetes organisation with a license to add the new cluster.
11-
You should also choose a unique name for your cluster that it will appear under in the TLPK platform.
11+
You can sign up for a free account with up to two clusters [here](https://platform.jetstack.io/).
12+
You should also choose a unique name for your cluster that it will appear under in the TLSPK platform.
1213

13-
## Installing the Chart
14+
## Installation:
1415

15-
### Obtaining credentials
16+
Using chart installation, there are two credentials required.
1617

17-
First obtain your service account credential, this can be done through the UI or [jsctl](https://github.com/jetstack/jsctl/releases)
18+
- A credential to allow helm to pull the chart from our private OCI registry.
19+
- An agent credential used by the agent to authenticate to TLSPK.
1820

19-
For example with `jsctl`:
21+
### 1) Obtain OCI registry credentials
22+
23+
The helm chart is an OCI chart artifact hosted on both EU and US registries:
24+
25+
- `oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent`
26+
- `oci://us.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent`
27+
28+
More detailed instructions on how to access our registry are available in [this guide](https://platform.jetstack.io/documentation/installation/enterprise-registry).
29+
30+
For chart installation, run the following to set a registry configuration
31+
file, so `helm` can authenticate to our private OCI registry:
32+
33+
```shell
34+
export TLSPK_DOCKER_CONFIG_PATH="$(pwd)"
35+
export TLSPK_DOCKER_CONFIG_FILE="${TLSPK_DOCKER_CONFIG_PATH}/config.json"
36+
jsctl registry auth output --format=dockerconfig > "${TLSPK_DOCKER_CONFIG_FILE}"
2037
```
21-
jsctl set organization <MY_ORG>
22-
jsctl auth login
23-
jsctl auth clusters create-service-account <CLUSTER_NAME> | tee credentials.json
24-
{
25-
"user_id": "SOME_AUTOGENERATED_USERID",
26-
"user_secret": "REDACTED"
27-
}
38+
39+
To validate you registry credentials are working with `helm`, we can use it to
40+
show us the full list of values available to configure the chart:
41+
42+
```shell
43+
export TLSPK_REGISTRY="eu.gcr.io/jetstack-secure-enterprise"
44+
helm show values oci://${TLSPK_REGISTRY}/charts/jetstack-agent --registry-config "${TLSPK_DOCKER_CONFIG_FILE}"
2845
```
2946

30-
### Deploying the chart
47+
**Note**: Feel free to alter the registry to the US equivalent if that is closer
48+
to you, for example: `export TLSPK_REGISTRY="us.gcr.io/jetstack-secure-enterprise"`
3149

32-
Once credentials are obtained, there are two ways to install the chart:
50+
### 2) Obtaining TLSPK agent credentials:
3351

34-
#### Method 1: create secret manually
52+
Set the following environments variables for ease of installation:
3553

54+
```shell
55+
export TLSPK_ORG="<ORG_NAME>"
56+
export TLSPK_CLUSTER_NAME="<CLUSTER_NAME>"
3657
```
37-
# pre-create secret
38-
kubectl create secret -n jetstack-secure "<SOME_SECRET_NAME>" --from-file=credentials.json
39-
# Install refering to secret
40-
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
41-
oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \
42-
--set config.organisation="strange-jones" --set config.cluster="<CLUSTER_NAME>" \
43-
--set authentication.secretName="<SOME_SECRET_NAME>"
58+
59+
Obtain your service account credential, this can be done through the UI or [jsctl](https://github.com/jetstack/jsctl/releases)
60+
61+
For example with `jsctl`:
62+
63+
```shell
64+
jsctl auth login
65+
jsctl set organization ${TLSPK_ORG}
66+
jsctl auth clusters create-service-account ${TLSPK_CLUSTER_NAME} | tee credentials.json
4467
```
4568

46-
#### Method 2: Pass secret to chart as a value, it creates the secret
69+
Store this carefully as we will need it to create a Kubernetes secret in the
70+
installation cluster.
4771

48-
*This is loading the secret obtained from create-service-account step [above](#obtaining-credentials)
49-
`export HELM_SECRET="$(cat credentials.json)"`*
72+
### 3) Deploying the chart:
5073

51-
```console
52-
# Installing by passing in secret directly
74+
Once credentials are obtained, there are two ways to install the chart:
75+
76+
#### Option 1 (Recommended): Create secret manually
77+
78+
Use the credential obtained in the previous step to create the secret in cluster:
79+
80+
```shell
81+
kubectl create secret generic agent-credentials --namespace jetstack-secure --from-file=credentials.json
82+
```
83+
84+
Install the chart with the basic configuration:
85+
86+
```shell
5387
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
54-
oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \
55-
--set config.organisation="strange-jones" --set config.cluster="<CLUSTER_NAME>" \
56-
--set authentication.createSecret=true --set authentication.secretValue="$HELM_SECRET"
88+
oci://${TLSPK_REGISTRY}/charts/jetstack-agent \
89+
--registry-config "${TLSPK_DOCKER_CONFIG_FILE}" \
90+
--set config.organisation="${TLSPK_ORG}" \
91+
--set config.cluster="${TLSPK_CLUSTER_NAME}"
5792
```
5893

59-
## Values
94+
#### Option 2 (Not Recommended): Create secret with helm chart install
6095

61-
| Key | Type | Default | Description |
62-
|-----|------|---------|-------------|
63-
| affinity | object | `{}` | |
64-
| authentication.createSecret | bool | `false` | |
65-
| authentication.secretKey | string | `"credentials.json"` | |
66-
| authentication.secretName | string | `"agent-credentials"` | |
67-
| authentication.secretValue | string | `""` | |
68-
| authentication.type | string | `"file"` | |
69-
| config.cluster | string | `""` | |
70-
| config.dataGatherers.custom | list | `[]` | |
71-
| config.dataGatherers.default | bool | `true` | |
72-
| config.organisation | string | `""` | |
73-
| config.period | string | `"0h1m0s"` | |
74-
| config.server | string | `"https://platform.jetstack.io"` | |
75-
| fullnameOverride | string | `""` | Helm default setting, use this to shorten install name |
76-
| image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/jetstack/preflight","tag":"v0.1.38"}` | image settings |
77-
| imagePullSecrets | list | `[]` | specify credentials if pulling from a customer registry |
78-
| nameOverride | string | `""` | Helm default setting to override release name, leave blank |
79-
| nodeSelector | object | `{}` | |
80-
| podAnnotations | object | `{}` | |
81-
| podSecurityContext | object | `{}` | |
82-
| replicaCount | int | `1` | default replicas, do not scale up |
83-
| resources.limits.cpu | string | `"500m"` | |
84-
| resources.limits.memory | string | `"500Mi"` | |
85-
| resources.requests.cpu | string | `"200m"` | |
86-
| resources.requests.memory | string | `"200Mi"` | |
87-
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
88-
| securityContext.readOnlyRootFilesystem | bool | `true` | |
89-
| securityContext.runAsNonRoot | bool | `true` | |
90-
| securityContext.runAsUser | int | `1000` | |
91-
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
92-
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created @default true |
93-
| serviceAccount.name | string | `""` | |
94-
| tolerations | list | `[]` | |
96+
Set this environment variable to contain the encoded agent credential:
9597

96-
----------------------------------------------
97-
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
98-
# jetstack-agent
98+
```shell
99+
export HELM_SECRET="$(cat credentials.json | base64 -w0)"
100+
```
99101

100-
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.38.0](https://img.shields.io/badge/AppVersion-v1.38.0-informational?style=flat-square)
102+
Installing the chart with additional configuration options for the agents
103+
credential, read from the environment variable just set:
101104

102-
Jetstack Secure Agent
105+
```shell
106+
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
107+
oci://${TLSPK_REGISTRY}/charts/jetstack-agent \
108+
--registry-config "${TLSPK_DOCKER_CONFIG_FILE}" \
109+
--set config.organisation="${TLSPK_ORG}" \
110+
--set config.cluster="${TLSPK_CLUSTER_NAME}" \
111+
--set authentication.createSecret=true \
112+
--set authentication.secretValue="${HELM_SECRET}"
113+
```
103114

104-
**Homepage:** <https://github.com/jetstack/jetstack-secure>
115+
### 4) Deployment Verification
105116

106-
## Maintainers
117+
Check the agent logs to ensure you see a similar entry to the following:
107118

108-
| Name | Email | Url |
109-
| ---- | ------ | --- |
110-
| JSCP and CRE Team | <[email protected]> | <https://platform.jetstack.io/documentation> |
119+
```console
120+
2023/04/19 14:11:41 Running Agent...
121+
2023/04/19 14:11:41 Posting data to: https://platform.jetstack.io
122+
2023/04/19 14:11:42 Data sent successfully.
123+
```
111124

112-
## Source Code
125+
You can do this with the following command:
113126

114-
* <https://github.com/jetstack/jetstack-secure>
127+
```shell
128+
kubectl logs -n jetstack-secure $(kubectl get pod -n jetstack-secure -l app.kubernetes.io/instance=agent -o jsonpath='{.items[0].metadata.name}')
129+
```
115130

116131
## Values
117132

118133
| Key | Type | Default | Description |
119134
|-----|------|---------|-------------|
120135
| affinity | object | `{}` | |
121-
| authentication.createSecret | bool | `false` | |
122-
| authentication.secretKey | string | `"credentials.json"` | |
123-
| authentication.secretName | string | `"agent-credentials"` | |
124-
| authentication.secretValue | string | `""` | |
125-
| authentication.type | string | `"file"` | |
126-
| config.cluster | string | `""` | |
127-
| config.dataGatherers.custom | list | `[]` | |
128-
| config.dataGatherers.default | bool | `true` | |
129-
| config.organisation | string | `""` | |
130-
| config.period | string | `"0h1m0s"` | |
131-
| config.server | string | `"https://platform.jetstack.io"` | |
136+
| authentication.createSecret | bool | `false` | Reccomend that you do not use this and instead creat the credential secret outside of helm |
137+
| authentication.secretKey | string | `"credentials.json"` | Key name in secret |
138+
| authentication.secretName | string | `"agent-credentials"` | Name of the secret containing agent credentials.json |
139+
| authentication.secretValue | string | `""` | Base64 encoded value from Jetstack Secure Dashboard - only required when createSecret is true |
140+
| authentication.type | string | `"file"` | Type can be "file"/"token" which dictates whether a credential file or token is used |
141+
| config | object | `{"cluster":"","dataGatherers":{"custom":[],"default":true},"organisation":"","period":"0h1m0s","server":"https://platform.jetstack.io"}` | Configuration section for the Jetstack Agent itself |
142+
| config.cluster | string | `""` | REQUIRED - Your Jetstack Secure Cluster Name |
143+
| config.dataGatherers | object | `{"custom":[],"default":true}` | Configure data that is gathered from your cluster, for full details see https://platform.jetstack.io/documentation/configuration/jetstack-agent/configuration |
144+
| config.dataGatherers.custom | list | `[]` | A list of data gatherers to limit agent scope |
145+
| config.dataGatherers.default | bool | `true` | Use the standard full set of data gatherers |
146+
| config.organisation | string | `""` | REQUIRED - Your Jetstack Secure Organisation Name |
147+
| config.period | string | `"0h1m0s"` | Send data back to the platform every minute unless changed |
148+
| config.server | string | `"https://platform.jetstack.io"` | Overrides the server if using a proxy between agent and Jetstack Secure |
132149
| fullnameOverride | string | `""` | Helm default setting, use this to shorten install name |
133-
| image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/jetstack/preflight","tag":"v0.1.38"}` | image settings |
134-
| imagePullSecrets | list | `[]` | specify credentials if pulling from a customer registry |
150+
| image.pullPolicy | string | `"IfNotPresent"` | Defaults to only pull if not already present |
151+
| image.repository | string | `"quay.io/jetstack/preflight"` | Default to Open Source image repository |
152+
| image.tag | string | `"v0.1.39"` | Overrides the image tag whose default is the chart appVersion |
153+
| imagePullSecrets | list | `[]` | Specify image pull credentials if using a prviate registry |
135154
| nameOverride | string | `""` | Helm default setting to override release name, leave blank |
136155
| nodeSelector | object | `{}` | |
137156
| podAnnotations | object | `{}` | |
@@ -151,4 +170,4 @@ Jetstack Secure Agent
151170
| tolerations | list | `[]` | |
152171

153172
----------------------------------------------
154-
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
173+
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

0 commit comments

Comments
 (0)