ITQ/submariner-charts
1
0
Fork 0
mirror of https://github.com/submariner-io/submariner-charts.git synced 2026-09-20 19:10:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Create secrets along with SAs

Browse Source 
Starting with Kubernetes 1.24, secrets are no longer automatically
created for SAs. This adds secrets to the relevant templates; creating
secrets in this way is supported in all Kubernetes versions.

This also enables testing with 1.24 in CI, to make sure that the fix
actually works.

Signed-off-by: Stephen Kitt <skitt@redhat.com>
This commit is contained in:
Stephen Kitt
2022-07-07 11:54:23 -04:00
committed by Thomas Pantelis
parent d3a4507650
commit c605528741
5 changed files with 61 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/e2e-full.yml
+1
View File
@@ -21,6 +21,7 @@ jobs:
include:
- k8s_version: '1.21'
- k8s_version: '1.22'
- k8s_version: '1.24'
steps:
- name: Check out the repository
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
deploy_helm
+2 -2
View File
@@ -27,8 +27,8 @@ function setup_broker() {
fi
submariner_broker_url=$(kubectl -n default get endpoints kubernetes -o jsonpath="{.subsets[0].addresses[0].ip}:{.subsets[0].ports[?(@.name=='https')].port}")
submariner_broker_ca=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data['ca\.crt']}")
submariner_broker_token=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='${SUBMARINER_BROKER_NS}-client')].data.token}"|base64 --decode)
submariner_broker_ca=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets "${SUBMARINER_BROKER_NS}-client-token" -o jsonpath="{.data['ca\.crt']}")
submariner_broker_token=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets "${SUBMARINER_BROKER_NS}-client-token" -o jsonpath="{.data.token}"|base64 --decode)
}
function helm_install_subm() {
submariner-k8s-broker/templates/NOTES.txt
+2 -2
View File
@@ -6,5 +6,5 @@ You can retrieve the server URL by running
The broker client token and CA can be retrieved by running
$ SUBMARINER_BROKER_CA=$(kubectl -n {{ .Release.Namespace }} get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='{{ template "submariner-k8s-broker.clientServiceAccountName" . }}')].data['ca\.crt']}")
$ SUBMARINER_BROKER_TOKEN=$(kubectl -n {{ .Release.Namespace }} get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='{{ template "submariner-k8s-broker.clientServiceAccountName" . }}')].data.token}"|base64 --decode)
$ SUBMARINER_BROKER_CA=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets "${SUBMARINER_BROKER_NS}-client-token" -o jsonpath="{.data['ca\.crt']}")
$ SUBMARINER_BROKER_TOKEN=$(kubectl -n "${SUBMARINER_BROKER_NS}" get secrets "${SUBMARINER_BROKER_NS}-client-token" -o jsonpath="{.data.token}"|base64 --decode)
submariner-k8s-broker/templates/svc-acct.yaml
+8
View File
@@ -8,4 +8,12 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner-k8s-broker.chart" . }}
app: {{ template "submariner-k8s-broker.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner-k8s-broker.clientServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
submariner-operator/templates/svc-acct.yaml
+48
View File
@@ -8,6 +8,14 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.operatorServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.operatorServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
---
{{- if .Values.serviceAccounts.gateway.create }}
@@ -20,6 +28,14 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.gatewayServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.gatewayServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
---
{{- if .Values.serviceAccounts.routeAgent.create }}
@@ -32,6 +48,14 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.routeAgentServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.routeAgentServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
---
{{- if .Values.serviceAccounts.globalnet.create }}
@@ -44,6 +68,14 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.globalnetServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.globalnetServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
---
{{- if .Values.serviceAccounts.lighthouseAgent.create }}
@@ -56,6 +88,14 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.lighthouseAgentServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}
---
{{- if .Values.serviceAccounts.lighthouseCoreDns.create }}
@@ -68,4 +108,12 @@ metadata:
release: {{ .Release.Name | quote }}
chart: {{ template "submariner.chart" . }}
app: {{ template "submariner.name" . }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}-token
annotations:
kubernetes.io/service-account.name: {{ template "submariner.lighthouseCoreDnsServiceAccountName" . }}
type: kubernetes.io/service-account-token
{{- end }}