Add CRD templates for vaultstaticsecret and vault auth

charts/statefull/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: A Helm chart for statefull vality services
 name: statefull
-version: 1.0.26
+version: 1.0.27

charts/statefull/templates/vaultauth.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.vaultSecret.enabled }}
+{{- $fullName := include "statefull.fullname" . -}}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  {{- with .Values.vaultSecret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+{{ include "statefull.labels" . | indent 4 }}
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  vaultConnectionRef: {{ .Values.vaultSecret.vaultConnectionRef | default "default" }}
+  method: {{ .Values.vaultSecret.vaultAuthMethodType | default "kubernetes" }}
+  mount: {{  .Values.vaultSecret.vaultAuthMethodMount | default "kubernetes" }}
+  {{- if eq (.Values.vaultSecret.vaultAuthMethodType | default "kubernetes") "kubernetes" }}
+  kubernetes:
+    role: {{ .Values.vaultSecret.vaultAuthRole | default (include "statefull.serviceAccountName" .) }}
+    serviceAccount: {{ .Values.vaultSecret.serviceAccount | default (include "statefull.serviceAccountName" .) }}
+    tokenExpirationSeconds: {{ .Values.vaultSecret.tokenExpirationSeconds | default 600 }}
+  {{- end }}
+{{- end }}

charts/statefull/templates/vaultstaticsecret.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.vaultSecret.enabled }}
+{{- $fullName := include "statefull.fullname" . -}}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  {{- with .Values.vaultSecret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+{{ include "statefull.labels" . | indent 4 }}
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  vaultAuthRef: {{ .Values.vaultSecret.vaultAuthRef | default $fullName }}
+  type: {{ .Values.vaultSecret.vaultSecretType | default "kv-v2" }}
+  mount: {{ required "Required value .Values.vaultSecret.vaultSecretMount" .Values.vaultSecret.vaultSecretMount }}
+  path: {{ required "Required value .Values.vaultSecret.vaultSecretPath" .Values.vaultSecret.vaultSecretPath }}
+  refreshAfter: {{ .Values.vaultSecret.refreshAfter | default "60s" }}
+  destination:
+    create: true
+    name: {{ $fullName }}-vault-static-secret
+    {{- if .Values.vaultSecret.transformation }}
+    transformation:
+      templates:
+        {{ .Values.vaultSecret.transformationTemplateName | default "secret.yaml" | quote }}:
+          text: |
+            {{- .Values.vaultSecret.transformation | nindent 12 }}
+    {{- end }}
+{{- end }}

charts/statefull/values.yaml

@@ -212,3 +212,35 @@ storage: {}
 #  resources:
 #     requests:
 #       storage: 1Gi
+
+vaultSecret:
+  # Enables vault static secret for the service
+  enabled: false
+  # Annotations for VaultAuth and VaultStaticSecret resources
+  annotations: {}
+  # Reference to the vault connection CR
+  vaultConnectionRef: ""
+  # Type of the auth method (kubernetes, token, etc.)
+  vaultAuthMethodType: ""
+  # Mount point for the auth method
+  vaultAuthMethodMount: ""
+  # Role for the auth method (usually the service account name)
+  vaultAuthRole: ""
+  # Service account for kubernetes auth method
+  serviceAccount: ""
+  # Token expiration time in seconds for kubernetes auth method
+  tokenExpirationSeconds: ""
+  # Reference to the vault auth CR
+  vaultAuthRef: ""
+  # Mount point for secret in vault
+  vaultSecretMount: ""
+  # Type of the secret in vault (kv-v2, kv-v1, etc.)
+  vaultSecretType: ""
+  # Path to the vault secret
+  vaultSecretPath: ""
+  # Refresh interval for the secret (default is 60s)
+  refreshAfter: ""
+  # Name of the transformation template file
+  transformationTemplateName: ""
+  # Transformation for the secret (e.g. template https://developer.hashicorp.com/vault/docs/deploy/kubernetes/vso/secret-transformation#related-api-references)
+  transformation: ""

charts/stateless/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v1
 appVersion: "1.0"
 description: A Helm chart for stateless vality services
 name: stateless
-version: 1.0.39
+version: 1.0.40

charts/stateless/templates/vaultauth.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.vaultSecret.enabled }}
+{{- $fullName := include "stateless.fullname" . -}}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  {{- with .Values.vaultSecret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+{{ include "stateless.labels" . | indent 4 }}
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  vaultConnectionRef: {{ .Values.vaultSecret.vaultConnectionRef | default "default" }}
+  method: {{ .Values.vaultSecret.vaultAuthMethodType | default "kubernetes" }}
+  mount: {{  .Values.vaultSecret.vaultAuthMethodMount | default "kubernetes" }}
+  {{- if eq (.Values.vaultSecret.vaultAuthMethodType | default "kubernetes") "kubernetes" }}
+  kubernetes:
+    role: {{ .Values.vaultSecret.vaultAuthRole | default (include "stateless.serviceAccountName" .) }}
+    serviceAccount: {{ .Values.vaultSecret.serviceAccount | default (include "stateless.serviceAccountName" .) }}
+    tokenExpirationSeconds: {{ .Values.vaultSecret.tokenExpirationSeconds | default 600 }}
+  {{- end }}
+{{- end }}

charts/stateless/templates/vaultstaticsecret.yaml

@@ -0,0 +1,30 @@
+{{- if .Values.vaultSecret.enabled }}
+{{- $fullName := include "stateless.fullname" . -}}
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  {{- with .Values.vaultSecret.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+{{ include "stateless.labels" . | indent 4 }}
+  name: {{ $fullName }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  vaultAuthRef: {{ .Values.vaultSecret.vaultAuthRef | default $fullName }}
+  type: {{ .Values.vaultSecret.vaultSecretType | default "kv-v2" }}
+  mount: {{ required "Required value .Values.vaultSecret.vaultSecretMount" .Values.vaultSecret.vaultSecretMount }}
+  path: {{ required "Required value .Values.vaultSecret.vaultSecretPath" .Values.vaultSecret.vaultSecretPath }}
+  refreshAfter: {{ .Values.vaultSecret.refreshAfter | default "60s" }}
+  destination:
+    create: true
+    name: {{ $fullName }}-vault-static-secret
+    {{- if .Values.vaultSecret.transformation }}
+    transformation:
+      templates:
+        {{ .Values.vaultSecret.transformationTemplateName | default "secret.yaml" | quote }}:
+          text: |
+            {{- .Values.vaultSecret.transformation | nindent 12 }}
+    {{- end }}
+{{- end }}

charts/stateless/values.yaml

@@ -227,3 +227,35 @@ cronjob:
     tag: latest
     pullPolicy: IfNotPresent
   args: []
+
+vaultSecret:
+  # Enables vault static secret for the service
+  enabled: false
+  # Annotations for VaultAuth and VaultStaticSecret resources
+  annotations: {}
+  # Reference to the vault connection CR
+  vaultConnectionRef: ""
+  # Type of the auth method (kubernetes, token, etc.)
+  vaultAuthMethodType: ""
+  # Mount point for the auth method
+  vaultAuthMethodMount: ""
+  # Role for the auth method (usually the service account name)
+  vaultAuthRole: ""
+  # Service account for kubernetes auth method
+  serviceAccount: ""
+  # Token expiration time in seconds for kubernetes auth method
+  tokenExpirationSeconds: ""
+  # Reference to the vault auth CR
+  vaultAuthRef: ""
+  # Mount point for secret in vault
+  vaultSecretMount: ""
+  # Type of the secret in vault (kv-v2, kv-v1, etc.)
+  vaultSecretType: ""
+  # Path to the vault secret
+  vaultSecretPath: ""
+  # Refresh interval for the secret (default is 60s)
+  refreshAfter: ""
+  # Name of the transformation template file
+  transformationTemplateName: ""
+  # Transformation for the secret (e.g. template https://developer.hashicorp.com/vault/docs/deploy/kubernetes/vso/secret-transformation#related-api-references)
+  transformation: ""