From fae80f905db61266c8877e93348a824c91744ebc Mon Sep 17 00:00:00 2001 From: Scott Hawkins Date: Tue, 28 Jul 2020 11:12:49 -0400 Subject: [PATCH 1/3] Add templates for annotations to apply to PV. --- templates/_helpers.tpl | 32 ++++++++++++++++++++++++++++++++ values.yaml | 4 ++++ 2 files changed, 36 insertions(+) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 15b144b31..fba6d022d 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -179,6 +179,7 @@ storage might be desired by the user. {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }} - metadata: name: data + {{- template "vault.dataVolumeClaim.annotations" . }} spec: accessModes: - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} @@ -192,6 +193,7 @@ storage might be desired by the user. {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }} - metadata: name: audit + {{- template "vault.auditVolumeClaim.annotations" . }} spec: accessModes: - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }} @@ -395,6 +397,36 @@ Sets extra statefulset annotations {{- end }} {{- end -}} +{{/* +Sets VolumeClaim annotations for data volume +*/}} +{{- define "vault.dataVolumeClaim.annotations" -}} + {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.annotations) }} + annotations: + {{- $tp := typeOf .Values.server.dataStorage.annotations }} + {{- if eq $tp "string" }} + {{- tpl .Values.server.dataStorage.annotations . | nindent 4 }} + {{- else }} + {{- toYaml .Values.server.dataStorage.annotations | nindent 4 }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Sets VolumeClaim annotations for audit volume +*/}} +{{- define "vault.auditVolumeClaim.annotations" -}} + {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.annotations) }} + annotations: + {{- $tp := typeOf .Values.server.auditStorage.annotations }} + {{- if eq $tp "string" }} + {{- tpl .Values.server.auditStorage.annotations . | nindent 4 }} + {{- else }} + {{- toYaml .Values.server.auditStorage.annotations | nindent 4 }} + {{- end }} + {{- end }} +{{- end -}} + {{/* Set's the container resources if the user has set any. */}} diff --git a/values.yaml b/values.yaml index b23e3a8fe..58ba57413 100644 --- a/values.yaml +++ b/values.yaml @@ -346,6 +346,8 @@ server: storageClass: null # Access Mode of the storage device being used for the PVC accessMode: ReadWriteOnce + # Annotations to apply to the PVC + annotations: {} # This configures the Vault Statefulset to create a PVC for audit # logs. Once Vault is deployed, initialized and unseal, Vault must @@ -361,6 +363,8 @@ server: storageClass: null # Access Mode of the storage device being used for the PVC accessMode: ReadWriteOnce + # Annotations to apply to the PVC + annotations: {} # Run Vault in "dev" mode. This requires no further setup, no state management, # and no initialization. This is useful for experimenting with Vault without From 998bef20399f2030cb6e19c4ac0368cea7c5aed2 Mon Sep 17 00:00:00 2001 From: Scott Hawkins Date: Tue, 28 Jul 2020 11:34:58 -0400 Subject: [PATCH 2/3] Fix spacing for template injection. --- templates/_helpers.tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index fba6d022d..3db3e3a03 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -179,7 +179,7 @@ storage might be desired by the user. {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }} - metadata: name: data - {{- template "vault.dataVolumeClaim.annotations" . }} + {{- template "vault.dataVolumeClaim.annotations" . }} spec: accessModes: - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} @@ -193,7 +193,7 @@ storage might be desired by the user. {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }} - metadata: name: audit - {{- template "vault.auditVolumeClaim.annotations" . }} + {{- template "vault.auditVolumeClaim.annotations" . }} spec: accessModes: - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }} From 65e9dd82616d5d387d53adad535af05f88636bbc Mon Sep 17 00:00:00 2001 From: Scott Hawkins Date: Mon, 3 Aug 2020 12:18:51 -0400 Subject: [PATCH 3/3] Fix template logic, add unit tests. --- templates/_helpers.tpl | 4 +-- test/unit/server-statefulset.bats | 44 +++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+), 2 deletions(-) diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 3db3e3a03..2f7cc3929 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -179,7 +179,7 @@ storage might be desired by the user. {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }} - metadata: name: data - {{- template "vault.dataVolumeClaim.annotations" . }} + {{- include "vault.dataVolumeClaim.annotations" . | nindent 6 }} spec: accessModes: - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} @@ -193,7 +193,7 @@ storage might be desired by the user. {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }} - metadata: name: audit - {{- template "vault.auditVolumeClaim.annotations" . }} + {{- include "vault.auditVolumeClaim.annotations" . | nindent 6 }} spec: accessModes: - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }} diff --git a/test/unit/server-statefulset.bats b/test/unit/server-statefulset.bats index 1ffb72db3..23e75c706 100755 --- a/test/unit/server-statefulset.bats +++ b/test/unit/server-statefulset.bats @@ -1090,6 +1090,50 @@ load _helpers [ "${actual}" = "true" ] } +@test "server/standalone-StatefulSet: auditStorage volumeClaim annotations string" { + cd `chart_dir` + local actual=$(helm template \ + --show-only templates/server-statefulset.yaml \ + --set 'server.auditStorage.enabled=true' \ + --set 'server.auditStorage.annotations=vaultIsAwesome: true' \ + . | tee /dev/stderr | + yq -r '.spec.volumeClaimTemplates[1].metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) + [ "${actual}" = "true" ] +} + +@test "server/standalone-StatefulSet: dataStorage volumeClaim annotations string" { + cd `chart_dir` + local actual=$(helm template \ + --show-only templates/server-statefulset.yaml \ + --set 'server.dataStorage.enabled=true' \ + --set 'server.dataStorage.annotations=vaultIsAwesome: true' \ + . | tee /dev/stderr | + yq -r '.spec.volumeClaimTemplates[0].metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) + [ "${actual}" = "true" ] +} + +@test "server/standalone-StatefulSet: auditStorage volumeClaim annotations yaml" { + cd `chart_dir` + local actual=$(helm template \ + --show-only templates/server-statefulset.yaml \ + --set 'server.auditStorage.enabled=true' \ + --set 'server.auditStorage.annotations.vaultIsAwesome=true' \ + . | tee /dev/stderr | + yq -r '.spec.volumeClaimTemplates[1].metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) + [ "${actual}" = "true" ] +} + +@test "server/standalone-StatefulSet: dataStorage volumeClaim annotations yaml" { + cd `chart_dir` + local actual=$(helm template \ + --show-only templates/server-statefulset.yaml \ + --set 'server.dataStorage.enabled=true' \ + --set 'server.dataStorage.annotations.vaultIsAwesome=true' \ + . | tee /dev/stderr | + yq -r '.spec.volumeClaimTemplates[0].metadata.annotations["vaultIsAwesome"]' | tee /dev/stderr) + [ "${actual}" = "true" ] +} + @test "server/ha-standby-Service: generic annotations yaml" { cd `chart_dir` local actual=$(helm template \