|
| 1 | +From f62623030374c55410624a00755e9a3c07a411da Mon Sep 17 00:00:00 2001 |
| 2 | +From: Michele Baldessari < [email protected]> |
| 3 | +Date: Tue, 29 Nov 2022 20:06:09 +0100 |
| 4 | +Subject: [PATCH] Allow per-service annotations |
| 5 | + |
| 6 | +We add the 'annotations' field to the existing |
| 7 | +vault.service.{active,standby} dictionaries which are relevant for the |
| 8 | +active/standby vault ha services. We also add |
| 9 | +vault.service.{nonha,internal}.annotations in order to allow per-service |
| 10 | +annotations when using the non-ha variant. |
| 11 | + |
| 12 | +We had to choose 'nonha' as we cannot reuse the existing |
| 13 | +vault.service.annotations key, because that gets still applied to all |
| 14 | +services and we do not want to break existing installations. |
| 15 | + |
| 16 | +WIP as we need to add some more docs and maybe some more tests. |
| 17 | +--- |
| 18 | + templates/_helpers.tpl | 57 ++++++++++++++++++++++++ |
| 19 | + templates/server-ha-active-service.yaml | 3 +- |
| 20 | + templates/server-ha-standby-service.yaml | 1 + |
| 21 | + templates/server-headless-service.yaml | 1 + |
| 22 | + templates/server-service.yaml | 1 + |
| 23 | + test/unit/server-ha-active-service.bats | 11 +++++ |
| 24 | + test/unit/server-ha-standby-service.bats | 11 +++++ |
| 25 | + test/unit/server-service.bats | 10 +++++ |
| 26 | + values.schema.json | 34 ++++++++++++++ |
| 27 | + values.yaml | 22 +++++++++ |
| 28 | + 10 files changed, 150 insertions(+), 1 deletion(-) |
| 29 | + |
| 30 | +diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl |
| 31 | +index 3897391..9e98c0b 100644 |
| 32 | +--- a/templates/_helpers.tpl |
| 33 | ++++ b/templates/_helpers.tpl |
| 34 | +@@ -683,6 +683,63 @@ Sets extra vault server Service annotations |
| 35 | + {{- end }} |
| 36 | + {{- end -}} |
| 37 | + |
| 38 | ++{{/* |
| 39 | ++Sets extra vault server Service active annotations |
| 40 | ++*/}} |
| 41 | ++{{- define "vault.service.active.annotations" -}} |
| 42 | ++ {{- if .Values.server.service.active.annotations }} |
| 43 | ++ {{- $tp := typeOf .Values.server.service.active.annotations }} |
| 44 | ++ {{- if eq $tp "string" }} |
| 45 | ++ {{- tpl .Values.server.service.active.annotations . | nindent 4 }} |
| 46 | ++ {{- else }} |
| 47 | ++ {{- toYaml .Values.server.service.active.annotations | nindent 4 }} |
| 48 | ++ {{- end }} |
| 49 | ++ {{- end }} |
| 50 | ++{{- end -}} |
| 51 | ++ |
| 52 | ++{{/* |
| 53 | ++Sets extra vault server Service standby annotations |
| 54 | ++*/}} |
| 55 | ++{{- define "vault.service.standby.annotations" -}} |
| 56 | ++ {{- if .Values.server.service.standby.annotations }} |
| 57 | ++ {{- $tp := typeOf .Values.server.service.standby.annotations }} |
| 58 | ++ {{- if eq $tp "string" }} |
| 59 | ++ {{- tpl .Values.server.service.standby.annotations . | nindent 4 }} |
| 60 | ++ {{- else }} |
| 61 | ++ {{- toYaml .Values.server.service.standby.annotations | nindent 4 }} |
| 62 | ++ {{- end }} |
| 63 | ++ {{- end }} |
| 64 | ++{{- end -}} |
| 65 | ++ |
| 66 | ++{{/* |
| 67 | ++Sets extra vault server Service internal annotations |
| 68 | ++*/}} |
| 69 | ++{{- define "vault.service.internal.annotations" -}} |
| 70 | ++ {{- if .Values.server.service.internal.annotations }} |
| 71 | ++ {{- $tp := typeOf .Values.server.service.internal.annotations }} |
| 72 | ++ {{- if eq $tp "string" }} |
| 73 | ++ {{- tpl .Values.server.service.internal.annotations . | nindent 4 }} |
| 74 | ++ {{- else }} |
| 75 | ++ {{- toYaml .Values.server.service.internal.annotations | nindent 4 }} |
| 76 | ++ {{- end }} |
| 77 | ++ {{- end }} |
| 78 | ++{{- end -}} |
| 79 | ++{{/* |
| 80 | ++Sets extra vault server Service nonha annotations |
| 81 | ++Note: We call it 'nonha' as we need to differentiate the "vault.service.annotations" which are |
| 82 | ++ applied to all services |
| 83 | ++*/}} |
| 84 | ++{{- define "vault.service.nonha.annotations" -}} |
| 85 | ++ {{- if .Values.server.service.nonha.annotations }} |
| 86 | ++ {{- $tp := typeOf .Values.server.service.nonha.annotations }} |
| 87 | ++ {{- if eq $tp "string" }} |
| 88 | ++ {{- tpl .Values.server.service.nonha.annotations . | nindent 4 }} |
| 89 | ++ {{- else }} |
| 90 | ++ {{- toYaml .Values.server.service.nonha.annotations | nindent 4 }} |
| 91 | ++ {{- end }} |
| 92 | ++ {{- end }} |
| 93 | ++{{- end -}} |
| 94 | ++ |
| 95 | + {{/* |
| 96 | + Sets PodSecurityPolicy annotations |
| 97 | + */}} |
| 98 | +diff --git a/templates/server-ha-active-service.yaml b/templates/server-ha-active-service.yaml |
| 99 | +index 7def2a0..649ffb8 100644 |
| 100 | +--- a/templates/server-ha-active-service.yaml |
| 101 | ++++ b/templates/server-ha-active-service.yaml |
| 102 | +@@ -18,8 +18,9 @@ metadata: |
| 103 | + vault-active: "true" |
| 104 | + annotations: |
| 105 | + {{ template "vault.service.annotations" .}} |
| 106 | ++{{ template "vault.service.active.annotations" .}} |
| 107 | + spec: |
| 108 | +- {{- if .Values.server.service.type}} |
| 109 | ++ {{- if .Values.server.service.type }} |
| 110 | + type: {{ .Values.server.service.type }} |
| 111 | + {{- end}} |
| 112 | + {{- if .Values.server.service.clusterIP }} |
| 113 | +diff --git a/templates/server-ha-standby-service.yaml b/templates/server-ha-standby-service.yaml |
| 114 | +index 50fca4b..cdbfcad 100644 |
| 115 | +--- a/templates/server-ha-standby-service.yaml |
| 116 | ++++ b/templates/server-ha-standby-service.yaml |
| 117 | +@@ -17,6 +17,7 @@ metadata: |
| 118 | + app.kubernetes.io/managed-by: {{ .Release.Service }} |
| 119 | + annotations: |
| 120 | + {{ template "vault.service.annotations" .}} |
| 121 | ++{{ template "vault.service.standby.annotations" .}} |
| 122 | + spec: |
| 123 | + {{- if .Values.server.service.type}} |
| 124 | + type: {{ .Values.server.service.type }} |
| 125 | +diff --git a/templates/server-headless-service.yaml b/templates/server-headless-service.yaml |
| 126 | +index b03f491..25aaa8d 100644 |
| 127 | +--- a/templates/server-headless-service.yaml |
| 128 | ++++ b/templates/server-headless-service.yaml |
| 129 | +@@ -16,6 +16,7 @@ metadata: |
| 130 | + vault-internal: "true" |
| 131 | + annotations: |
| 132 | + {{ template "vault.service.annotations" .}} |
| 133 | ++{{ template "vault.service.internal.annotations" .}} |
| 134 | + spec: |
| 135 | + clusterIP: None |
| 136 | + publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }} |
| 137 | +diff --git a/templates/server-service.yaml b/templates/server-service.yaml |
| 138 | +index 913b569..02a1ccd 100644 |
| 139 | +--- a/templates/server-service.yaml |
| 140 | ++++ b/templates/server-service.yaml |
| 141 | +@@ -15,6 +15,7 @@ metadata: |
| 142 | + app.kubernetes.io/managed-by: {{ .Release.Service }} |
| 143 | + annotations: |
| 144 | + {{ template "vault.service.annotations" .}} |
| 145 | ++{{ template "vault.service.nonha.annotations" .}} |
| 146 | + spec: |
| 147 | + {{- if .Values.server.service.type}} |
| 148 | + type: {{ .Values.server.service.type }} |
| 149 | +diff --git a/test/unit/server-ha-active-service.bats b/test/unit/server-ha-active-service.bats |
| 150 | +index d78f5d4..13b5271 100755 |
| 151 | +--- a/test/unit/server-ha-active-service.bats |
| 152 | ++++ b/test/unit/server-ha-active-service.bats |
| 153 | +@@ -13,6 +13,17 @@ load _helpers |
| 154 | + [ "${actual}" = "true" ] |
| 155 | + } |
| 156 | + |
| 157 | ++@test "server/ha-active-Service: specific annotations" { |
| 158 | ++ cd `chart_dir` |
| 159 | ++ local actual=$(helm template \ |
| 160 | ++ --show-only templates/server-ha-active-service.yaml \ |
| 161 | ++ --set 'server.ha.enabled=true' \ |
| 162 | ++ --set 'server.service.active.annotations=vaultIsAwesome: true' \ |
| 163 | ++ . | tee /dev/stderr | |
| 164 | ++ yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) |
| 165 | ++ [ "${actual}" = "true" ] |
| 166 | ++} |
| 167 | ++ |
| 168 | + @test "server/ha-active-Service: disable with ha.enabled false" { |
| 169 | + cd `chart_dir` |
| 170 | + local actual=$( (helm template \ |
| 171 | +diff --git a/test/unit/server-ha-standby-service.bats b/test/unit/server-ha-standby-service.bats |
| 172 | +index 6698314..6244565 100755 |
| 173 | +--- a/test/unit/server-ha-standby-service.bats |
| 174 | ++++ b/test/unit/server-ha-standby-service.bats |
| 175 | +@@ -13,6 +13,17 @@ load _helpers |
| 176 | + [ "${actual}" = "true" ] |
| 177 | + } |
| 178 | + |
| 179 | ++@test "server/ha-standby-Service: specific annotations string" { |
| 180 | ++ cd `chart_dir` |
| 181 | ++ local actual=$(helm template \ |
| 182 | ++ --show-only templates/server-ha-standby-service.yaml \ |
| 183 | ++ --set 'server.ha.enabled=true' \ |
| 184 | ++ --set 'server.service.standby.annotations=vaultIsAwesome: true' \ |
| 185 | ++ . | tee /dev/stderr | |
| 186 | ++ yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) |
| 187 | ++ [ "${actual}" = "true" ] |
| 188 | ++} |
| 189 | ++ |
| 190 | + @test "server/ha-standby-Service: generic annotations yaml" { |
| 191 | + cd `chart_dir` |
| 192 | + local actual=$(helm template \ |
| 193 | +diff --git a/test/unit/server-service.bats b/test/unit/server-service.bats |
| 194 | +index 70a5445..cc66987 100755 |
| 195 | +--- a/test/unit/server-service.bats |
| 196 | ++++ b/test/unit/server-service.bats |
| 197 | +@@ -153,6 +153,16 @@ load _helpers |
| 198 | + [ "${actual}" = "true" ] |
| 199 | + } |
| 200 | + |
| 201 | ++@test "server/Service: specific annotations" { |
| 202 | ++ cd `chart_dir` |
| 203 | ++ local actual=$(helm template \ |
| 204 | ++ --show-only templates/server-service.yaml \ |
| 205 | ++ --set 'server.service.nonha.annotations=vaultIsAwesome: true' \ |
| 206 | ++ . | tee /dev/stderr | |
| 207 | ++ yq -r '.metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) |
| 208 | ++ [ "${actual}" = "true" ] |
| 209 | ++} |
| 210 | ++ |
| 211 | + @test "server/Service: publish not ready" { |
| 212 | + cd `chart_dir` |
| 213 | + local actual=$(helm template \ |
| 214 | +diff --git a/values.schema.json b/values.schema.json |
| 215 | +index c183957..d0dca34 100644 |
| 216 | +--- a/values.schema.json |
| 217 | ++++ b/values.schema.json |
| 218 | +@@ -854,11 +854,39 @@ |
| 219 | + "active": { |
| 220 | + "type": "object", |
| 221 | + "properties": { |
| 222 | ++ "annotations" : { |
| 223 | ++ "type": [ |
| 224 | ++ "object", |
| 225 | ++ "string" |
| 226 | ++ ] |
| 227 | ++ }, |
| 228 | + "enabled": { |
| 229 | + "type": "boolean" |
| 230 | + } |
| 231 | + } |
| 232 | + }, |
| 233 | ++ "internal": { |
| 234 | ++ "type": "object", |
| 235 | ++ "properties": { |
| 236 | ++ "annotations": { |
| 237 | ++ "type": [ |
| 238 | ++ "object", |
| 239 | ++ "string" |
| 240 | ++ ] |
| 241 | ++ } |
| 242 | ++ } |
| 243 | ++ }, |
| 244 | ++ "nonha": { |
| 245 | ++ "type": "object", |
| 246 | ++ "properties": { |
| 247 | ++ "annotations": { |
| 248 | ++ "type": [ |
| 249 | ++ "object", |
| 250 | ++ "string" |
| 251 | ++ ] |
| 252 | ++ } |
| 253 | ++ } |
| 254 | ++ }, |
| 255 | + "annotations": { |
| 256 | + "type": [ |
| 257 | + "object", |
| 258 | +@@ -890,6 +918,12 @@ |
| 259 | + "properties": { |
| 260 | + "enabled": { |
| 261 | + "type": "boolean" |
| 262 | ++ }, |
| 263 | ++ "annotations": { |
| 264 | ++ "type": [ |
| 265 | ++ "object", |
| 266 | ++ "string" |
| 267 | ++ ] |
| 268 | + } |
| 269 | + } |
| 270 | + }, |
| 271 | +diff --git a/values.yaml b/values.yaml |
| 272 | +index 2c3d9e2..32d8ea1 100644 |
| 273 | +--- a/values.yaml |
| 274 | ++++ b/values.yaml |
| 275 | +@@ -600,10 +600,32 @@ server: |
| 276 | + # have labelled themselves as the cluster leader with `vault-active: "true"` |
| 277 | + active: |
| 278 | + enabled: true |
| 279 | ++ # Extra annotations for the service definition. This can either be YAML or a |
| 280 | ++ # YAML-formatted multi-line templated string map of the annotations to apply |
| 281 | ++ # to the service. |
| 282 | ++ annotations: {} |
| 283 | ++ |
| 284 | + # Enable or disable the vault-standby service, which selects Vault pods that |
| 285 | + # have labelled themselves as a cluster follower with `vault-active: "false"` |
| 286 | + standby: |
| 287 | + enabled: true |
| 288 | ++ # Extra annotations for the service definition. This can either be YAML or a |
| 289 | ++ # YAML-formatted multi-line templated string map of the annotations to apply |
| 290 | ++ # to the service. |
| 291 | ++ annotations: {} |
| 292 | ++ |
| 293 | ++ nonha: |
| 294 | ++ # Extra annotations for the service definition. This can either be YAML or a |
| 295 | ++ # YAML-formatted multi-line templated string map of the annotations to apply |
| 296 | ++ # to the service. |
| 297 | ++ annotations: {} |
| 298 | ++ |
| 299 | ++ internal: |
| 300 | ++ # Extra annotations for the service definition. This can either be YAML or a |
| 301 | ++ # YAML-formatted multi-line templated string map of the annotations to apply |
| 302 | ++ # to the service. |
| 303 | ++ annotations: {} |
| 304 | ++ |
| 305 | + # If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}` |
| 306 | + # When disabled, services may select Vault pods not deployed from the chart. |
| 307 | + # Does not affect the headless vault-internal service with `ClusterIP: None` |
| 308 | +-- |
| 309 | +2.38.1 |
| 310 | + |
0 commit comments