Skip to content

Commit e3b13de

Browse files
hawksighthawksight
committed
docs: Update helm-docs & readme to match official documentation
Signed-off-by: Peter Fiddes <[email protected]>
1 parent e2c6016 commit e3b13de

File tree

4 files changed

+220
-130
lines changed

4 files changed

+220
-130
lines changed

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ attest-docker-image:
124124
# This target can be used instead if the pre-commit hook is not desired
125125
.PHONY: update-helm-docs
126126
update-helm-docs:
127-
go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.10.0
127+
go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
128128
helm-docs --chart-search-root=deploy/charts/
129129

130130
# CI

‎deploy/charts/jetstack-agent/README.md

Lines changed: 107 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -2,136 +2,151 @@
22

33
Jetstack Secure Agent
44

5-
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.38.0](https://img.shields.io/badge/AppVersion-v1.38.0-informational?style=flat-square)
5+
![Version: 0.2.0](https://img.shields.io/badge/Version-0.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.1.39](https://img.shields.io/badge/AppVersion-v0.1.39-informational?style=flat-square)
66

77
## Additional Information
88

9-
The Jetstack secure agent helm chart installs the Kubernetes agent that connects to The TLS Protect For Kubernetes platform.
9+
The Jetstack Secure agent helm chart installs the Kubernetes agent that connects to the TLS Protect For Kubernetes (TLSPK) platform.
1010
It will require a valid TLS Protect for Kubernetes organisation with a license to add the new cluster.
11-
You should also choose a unique name for your cluster that it will appear under in the TLPK platform.
11+
You can sign up for a free account with up to two clusters [here](https://platform.jetstack.io/).
12+
You should also choose a unique name for your cluster that it will appear under in the TLSPK platform.
1213

13-
## Installing the Chart
14+
## Installation:
1415

15-
### Obtaining credentials
16+
Using chart installation, there are two credentials required.
1617

17-
First obtain your service account credential, this can be done through the UI or [jsctl](https://github.com/jetstack/jsctl/releases)
18+
- A credential to allow helm to pull the chart from our private OCI registry.
19+
- An agent credential used by the agent to authenticate to TLSPK.
1820

19-
For example with `jsctl`:
21+
### 1) Obtain OCI registry credentials
22+
23+
The helm chart is an OCI chart artifact hosted on both EU and US registries:
24+
25+
- `oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent`
26+
- `oci://us.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent`
27+
28+
More detailed instructions on how to access our registry are available in [this guide](https://platform.jetstack.io/documentation/installation/enterprise-registry).
29+
30+
For chart installation, run the following to set a registry configuration
31+
file, so `helm` can authenticate to our private OCI registry:
32+
33+
```shell
34+
export TLSPK_DOCKER_CONFIG_PATH="$(pwd)"
35+
export TLSPK_DOCKER_CONFIG_FILE="${TLSPK_DOCKER_CONFIG_PATH}/config.json"
36+
jsctl registry auth output --format=dockerconfig > "${TLSPK_DOCKER_CONFIG_FILE}"
37+
```
38+
39+
To validate you registry credentials are working with `helm`, we can use it to
40+
show us the full list of values available to configure the chart:
41+
42+
```shell
43+
helm show values oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent --registry-config "${TLSPK_DOCKER_CONFIG_FILE}"
2044
```
21-
jsctl set organization <MY_ORG>
45+
46+
### 2) Obtaining TLSPK agent credentials:
47+
48+
Set the following environments variables for ease of installation:
49+
50+
```shell
51+
export TLSPK_ORG="<ORG_NAME>"
52+
export TLSPK_CLUSTER_NAME="<CLUSTER_NAME>"
53+
```
54+
55+
Obtain your service account credential, this can be done through the UI or [jsctl](https://github.com/jetstack/jsctl/releases)
56+
57+
For example with `jsctl`:
58+
59+
```shell
2260
jsctl auth login
23-
jsctl auth clusters create-service-account <CLUSTER_NAME> | tee credentials.json
24-
{
25-
"user_id": "SOME_AUTOGENERATED_USERID",
26-
"user_secret": "REDACTED"
27-
}
61+
jsctl set organization ${TLSPK_ORG}
62+
jsctl auth clusters create-service-account ${TLSPK_CLUSTER_NAME} | tee credentials.json
2863
```
2964

30-
### Deploying the chart
65+
Store this carefully as we will need it to create a Kubernetes secret in the
66+
installation cluster.
67+
68+
### 3) Deploying the chart:
3169

3270
Once credentials are obtained, there are two ways to install the chart:
3371

34-
#### Method 1: create secret manually
72+
#### Option 1 (Recommended): Create secret manually
3573

36-
```
37-
# pre-create secret
38-
kubectl create secret -n jetstack-secure "<SOME_SECRET_NAME>" --from-file=credentials.json
39-
# Install refering to secret
40-
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
41-
oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \
42-
--set config.organisation="strange-jones" --set config.cluster="<CLUSTER_NAME>" \
43-
--set authentication.secretName="<SOME_SECRET_NAME>"
44-
```
74+
Use the credential obtained in the previous step to create the secret in cluster:
4575

46-
#### Method 2: Pass secret to chart as a value, it creates the secret
76+
```shell
77+
kubectl create secret generic agent-credentials --namespace jetstack-secure --from-file=credentials.json
78+
```
4779

48-
*This is loading the secret obtained from create-service-account step [above](#obtaining-credentials)
49-
`export HELM_SECRET="$(cat credentials.json)"`*
80+
Install the chart with the basic configuration:
5081

51-
```console
52-
# Installing by passing in secret directly
82+
```shell
5383
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
5484
oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \
55-
--set config.organisation="strange-jones" --set config.cluster="<CLUSTER_NAME>" \
56-
--set authentication.createSecret=true --set authentication.secretValue="$HELM_SECRET"
85+
--registry-config "${TLSPK_DOCKER_CONFIG_FILE}" \
86+
--set config.organisation="${TLSPK_ORG}" \
87+
--set config.cluster="${TLSPK_CLUSTER_NAME}"
5788
```
5889

59-
## Values
90+
#### Option 2 (Not Recommended): Create secret with helm chart install
6091

61-
| Key | Type | Default | Description |
62-
|-----|------|---------|-------------|
63-
| affinity | object | `{}` | |
64-
| authentication.createSecret | bool | `false` | |
65-
| authentication.secretKey | string | `"credentials.json"` | |
66-
| authentication.secretName | string | `"agent-credentials"` | |
67-
| authentication.secretValue | string | `""` | |
68-
| authentication.type | string | `"file"` | |
69-
| config.cluster | string | `""` | |
70-
| config.dataGatherers.custom | list | `[]` | |
71-
| config.dataGatherers.default | bool | `true` | |
72-
| config.organisation | string | `""` | |
73-
| config.period | string | `"0h1m0s"` | |
74-
| config.server | string | `"https://platform.jetstack.io"` | |
75-
| fullnameOverride | string | `""` | Helm default setting, use this to shorten install name |
76-
| image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/jetstack/preflight","tag":"v0.1.38"}` | image settings |
77-
| imagePullSecrets | list | `[]` | specify credentials if pulling from a customer registry |
78-
| nameOverride | string | `""` | Helm default setting to override release name, leave blank |
79-
| nodeSelector | object | `{}` | |
80-
| podAnnotations | object | `{}` | |
81-
| podSecurityContext | object | `{}` | |
82-
| replicaCount | int | `1` | default replicas, do not scale up |
83-
| resources.limits.cpu | string | `"500m"` | |
84-
| resources.limits.memory | string | `"500Mi"` | |
85-
| resources.requests.cpu | string | `"200m"` | |
86-
| resources.requests.memory | string | `"200Mi"` | |
87-
| securityContext.capabilities.drop[0] | string | `"ALL"` | |
88-
| securityContext.readOnlyRootFilesystem | bool | `true` | |
89-
| securityContext.runAsNonRoot | bool | `true` | |
90-
| securityContext.runAsUser | int | `1000` | |
91-
| serviceAccount.annotations | object | `{}` | Annotations to add to the service account |
92-
| serviceAccount.create | bool | `true` | Specifies whether a service account should be created @default true |
93-
| serviceAccount.name | string | `""` | |
94-
| tolerations | list | `[]` | |
92+
Set this environment variable to contain the encoded agent credential:
9593

96-
----------------------------------------------
97-
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
98-
# jetstack-agent
94+
```shell
95+
export HELM_SECRET="$(cat credentials.json | base64 -w0)"
96+
```
9997

100-
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.38.0](https://img.shields.io/badge/AppVersion-v1.38.0-informational?style=flat-square)
98+
Installing the chart with additional configuration options for the agents
99+
credential, read from the environment variable just set:
101100

102-
Jetstack Secure Agent
101+
```shell
102+
helm upgrade --install --create-namespace -n jetstack-secure jetstack-agent \
103+
oci://eu.gcr.io/jetstack-secure-enterprise/charts/jetstack-agent \
104+
--registry-config "${TLSPK_DOCKER_CONFIG_FILE}" \
105+
--set config.organisation="${TLSPK_ORG}" \
106+
--set config.cluster="${TLSPK_CLUSTER_NAME}" \
107+
--set authentication.createSecret=true \
108+
--set authentication.secretValue="${HELM_SECRET}"
109+
```
103110

104-
**Homepage:** <https://github.com/jetstack/jetstack-secure>
111+
### 4) Deployment Verification
105112

106-
## Maintainers
113+
Check the agent logs to ensure you see a similar entry to the following:
107114

108-
| Name | Email | Url |
109-
| ---- | ------ | --- |
110-
| JSCP and CRE Team | <[email protected]> | <https://platform.jetstack.io/documentation> |
115+
```console
116+
2023/04/19 14:11:41 Running Agent...
117+
2023/04/19 14:11:41 Posting data to: https://platform.jetstack.io
118+
2023/04/19 14:11:42 Data sent successfully.
119+
```
111120

112-
## Source Code
121+
You can do this with the following command:
113122

114-
* <https://github.com/jetstack/jetstack-secure>
123+
```shell
124+
kubectl logs -n jetstack-secure $(kubectl get pod -n jetstack-secure -l app.kubernetes.io/instance=agent -o jsonpath='{.items[0].metadata.name}')
125+
```
115126

116127
## Values
117128

118129
| Key | Type | Default | Description |
119130
|-----|------|---------|-------------|
120131
| affinity | object | `{}` | |
121-
| authentication.createSecret | bool | `false` | |
122-
| authentication.secretKey | string | `"credentials.json"` | |
123-
| authentication.secretName | string | `"agent-credentials"` | |
124-
| authentication.secretValue | string | `""` | |
125-
| authentication.type | string | `"file"` | |
126-
| config.cluster | string | `""` | |
127-
| config.dataGatherers.custom | list | `[]` | |
128-
| config.dataGatherers.default | bool | `true` | |
129-
| config.organisation | string | `""` | |
130-
| config.period | string | `"0h1m0s"` | |
131-
| config.server | string | `"https://platform.jetstack.io"` | |
132+
| authentication.createSecret | bool | `false` | Reccomend that you do not use this and instead creat the credential secret outside of helm |
133+
| authentication.secretKey | string | `"credentials.json"` | Key name in secret |
134+
| authentication.secretName | string | `"agent-credentials"` | Name of the secret containing agent credentials.json |
135+
| authentication.secretValue | string | `""` | Base64 encoded value from Jetstack Secure Dashboard - only required when createSecret is true |
136+
| authentication.type | string | `"file"` | Type can be "file"/"token" which dictates whether a credential file or token is used |
137+
| config | object | `{"cluster":"","dataGatherers":{"custom":[],"default":true},"organisation":"","period":"0h1m0s","server":"https://platform.jetstack.io"}` | Configuration section for the Jetstack Agent itself |
138+
| config.cluster | string | `""` | REQUIRED - Your Jetstack Secure Cluster Name |
139+
| config.dataGatherers | object | `{"custom":[],"default":true}` | Configure data that is gathered from your cluster, for full details see https://platform.jetstack.io/documentation/configuration/jetstack-agent/configuration |
140+
| config.dataGatherers.custom | list | `[]` | A list of data gatherers to limit agent scope |
141+
| config.dataGatherers.default | bool | `true` | Use the standard full set of data gatherers |
142+
| config.organisation | string | `""` | REQUIRED - Your Jetstack Secure Organisation Name |
143+
| config.period | string | `"0h1m0s"` | Send data back to the platform every minute unless changed |
144+
| config.server | string | `"https://platform.jetstack.io"` | Overrides the server if using a proxy between agent and Jetstack Secure |
132145
| fullnameOverride | string | `""` | Helm default setting, use this to shorten install name |
133-
| image | object | `{"pullPolicy":"IfNotPresent","repository":"quay.io/jetstack/preflight","tag":"v0.1.38"}` | image settings |
134-
| imagePullSecrets | list | `[]` | specify credentials if pulling from a customer registry |
146+
| image.pullPolicy | string | `"IfNotPresent"` | Defaults to only pull if not already present |
147+
| image.repository | string | `"quay.io/jetstack/preflight"` | Default to Open Source image repository |
148+
| image.tag | string | `"v0.1.39"` | Overrides the image tag whose default is the chart appVersion |
149+
| imagePullSecrets | list | `[]` | Specify image pull credentials if using a prviate registry |
135150
| nameOverride | string | `""` | Helm default setting to override release name, leave blank |
136151
| nodeSelector | object | `{}` | |
137152
| podAnnotations | object | `{}` | |
@@ -151,4 +166,4 @@ Jetstack Secure Agent
151166
| tolerations | list | `[]` | |
152167

153168
----------------------------------------------
154-
Autogenerated from chart metadata using [helm-docs v1.10.0](https://github.com/norwoodj/helm-docs/releases/v1.10.0)
169+
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

0 commit comments

Comments
 (0)