-
Notifications
You must be signed in to change notification settings - Fork 58
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Creating a Helm chart and repository for GMSA. (#55)
* Creating a Helm chart and repository for GMSA. Created a Helm chart for GMSA that supports installing the CRD, CertManager, and the Admission web hook. This also makes this repository a Helm chart repo. Signed-off-by: Jamie Phillips <[email protected]> * Starting the integration tests for the chart. Just stubbing out all of the items needed. Signed-off-by: Jamie Phillips <[email protected]> * Just plumbing. Signed-off-by: Jamie Phillips <[email protected]> * Implementing feedback. Signed-off-by: Jamie Phillips <[email protected]> * Progress on the integration tests. Signed-off-by: Jamie Phillips <[email protected]> * ci deploys, but cert manager deployment doesn't work * Updating to 0.4.0 * Updating a kind version. Signed-off-by: Jamie Phillips <[email protected]> * Hmm Signed-off-by: Jamie Phillips <[email protected]> * Fixing version of chart. Signed-off-by: Jamie Phillips <[email protected]> * specify go 1.17 in GH action jobs Co-authored-by: James Sturtevant <[email protected]> Co-authored-by: Mark Rossetti <[email protected]>
- Loading branch information
3 people
authored
Apr 20, 2022
1 parent
0c81292
commit 28498a9
Showing
23 changed files
with
647 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| HELM = $(shell which helm 2> /dev/null) | ||
| HELM_URL = https://get.helm.sh/helm-v$(HELM_VERSION)-$(UNAME)-amd64.tar.gz | ||
|
|
||
| ifeq ($(HELM),) | ||
| HELM = $(DEV_DIR)/HELM-$(HELM_VERSION) | ||
| endif | ||
|
|
||
| .PHONY: install-helm | ||
| install-helm: | ||
| curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash | ||
|
|
||
| .PHONY: helm-chart | ||
| helm-chart: | ||
| $(HELM) package ../charts/$(VERSION)/gmsa -d ../charts/$(VERSION) | ||
|
|
||
| .PHONY: helm-index | ||
| helm-index: | ||
| $(HELM) repo index ../charts | ||
|
|
||
| .PHONY: helm-lint | ||
| helm-lint: | ||
| $(HELM) lint ../charts/$(VERSION)/gmsa | ||
|
|
||
| # deploys the chart to the kind cluster with the release image | ||
| .PHONY: deploy_chart | ||
| deploy_chart: install-helm | ||
| K8S_GMSA_IMAGE=$(IMAGE_NAME) $(MAKE) _deploy_chart | ||
|
|
||
| # removes the chart from the kind cluster | ||
| .PHONY: remove_chart | ||
| remove_chart: | ||
| KUBECONFIG=$(KUBECONFIG) $(HELM) uninstall $(DEPLOYMENT_NAME) | ||
|
|
||
| # deploys the webhook to the kind cluster using helm | ||
| # if $K8S_GMSA_DEPLOY_METHOD is set to "download", then it will deploy by downloading | ||
| # the deploy script as documented in the README, using $K8S_GMSA_DEPLOY_CHART_REPO and | ||
| # $K8S_GMSA_DEPLOY_CHART_VERSION env variables to build the download URL. If VERSION is | ||
| # not set then latest is used. | ||
| .PHONY: _deploy_chart | ||
| _deploy_chart: _deploy_certmanager | ||
| ifeq ($(K8S_GMSA_CHART),) | ||
| @ echo "Cannot call target $@ without setting K8S_GMSA_CHART" | ||
| exit 1 | ||
| endif | ||
| mkdir -p $(dir $(MANIFESTS_FILE)) | ||
| @ echo "installing helm deployment $(DEPLOYMENT_NAME) with chart $(K8S_GMSA_CHART) and image $(IMAGE_REPO):$(VERSION)" | ||
| KUBECONFIG=$(KUBECONFIG) $(HELM) version | ||
| KUBECONFIG=$(KUBECONFIG) $(HELM) install $(DEPLOYMENT_NAME) --set image.repository=$(IMAGE_REPO) --set image.tag=$(VERSION) $(K8S_GMSA_CHART) | ||
|
|
||
| .PHONY: _deploy_certmanager | ||
| _deploy_certmanager: remove_certmanager | ||
| KUBECONFIG=$(KUBECONFIG) $(KUBECTL) create namespace cert-manager | ||
| KUBECONFIG=$(KUBECONFIG) $(KUBECTL) apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.7.1/cert-manager.yaml | ||
|
|
||
| .PHONY: remove_certmanager | ||
| remove_certmanager: | ||
| KUBECONFIG=$(KUBECONFIG) $(KUBECTL) delete namespace cert-manager || true |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| # Install Windows GMSA with Helm 3 | ||
|
|
||
| ## Prerequisites | ||
| - [install Helm](https://helm.sh/docs/intro/quickstart/#install-helm) | ||
|
|
||
| ### Tips | ||
|
|
||
|
|
||
| ### install a specific version | ||
| ```console | ||
| helm repo add windows-gmsa https://raw.githubusercontent.com/windows-gmsa/gmsa/master/charts | ||
| helm install windows-gmsa/gmsa --namespace kube-system --version v0.3.0 | ||
| ``` | ||
|
|
||
| ### search for all available chart versions | ||
| ```console | ||
| helm search repo -l gmsa | ||
| ``` | ||
|
|
||
| ## uninstall Windows GMSA | ||
| ```console | ||
| helm uninstall gmsa -n kube-system | ||
| ``` | ||
|
|
||
| ## latest chart configuration | ||
|
|
||
| The following table lists the configurable parameters of the latest GMSA chart and default values. | ||
|
|
||
| | Parameter | Description | Default | | ||
| |-------------------------------------------------------|-------------------------------------------------------------------|-------------------------------------------------------| | ||
| | `certificates.certManager.enabled` | enable cert manager integration | `true` | | ||
| | `certificates.certManager.version` | version of cert manager | | | ||
| | `certificates.caBundle` | cert-manager disabled, add self-signed ca.crt in base64 format | | | ||
| | `certificates.secretName` | cert-manager disabled, upload certs data as k8s secretName | `gmsa-server-cert` | | ||
| | `credential.enabled ` | enable creation of GMSA Credential | `true` | | ||
| | `credential.domainJoinConfig.dnsName` | DNS Domain Name | | | ||
| | `credential.domainJoinConfig.dnsTreeName` | DNS Domain Name Root | | | ||
| | `credential.domainJoinConfig.guid` | GUID | | | ||
| | `credential.domainJoinConfig.machineAccountName` | username of the GMSA account | | | ||
| | `credential.domainJoinConfig.netBiosName` | NETBIOS Domain Name | | | ||
| | `credential.domainJoinConfig.sid` | SID | | | ||
| | `image.repository` | image repository | `sigwindowstools/k8s-gmsa-webhook` | | ||
| | `image.tag` | image tag | `v0.3.0` | | ||
| | `image.imagePullPolicy` | image pull policy | `IfNotPresent` | | ||
| | `global.systemDefaultRegistry ` | container registry | | | ||
| | `tolerations` | tolerations | [] | | ||
|
|
||
| ## troubleshooting | ||
| - Add `--wait -v=5 --debug` in `helm install` command to get detailed error | ||
| - Use `kubectl describe` to acquire more info |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| apiVersion: v1 | ||
| entries: | ||
| gmsa: | ||
| - apiVersion: v2 | ||
| appVersion: 0.4.0 | ||
| created: "2022-04-10T13:16:01.700697-04:00" | ||
| description: Windows GMSA Configuration | ||
| digest: 7f29d22ba85d90a18e5b9c4e1a7d9ba1149d5827a2ca37b9a6fe1966e3598767 | ||
| keywords: | ||
| - Windows | ||
| - Windows GMSA | ||
| - GMSA | ||
| - Active Directory | ||
| name: gmsa | ||
| sources: | ||
| - https://github.com/kubernetes-sigs/windows-gmsa | ||
| type: application | ||
| urls: | ||
| - v0.4.0/gmsa-0.4.0.tgz | ||
| version: 0.4.0 | ||
| generated: "2022-04-10T13:16:01.700137-04:00" |
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| apiVersion: v2 | ||
| appVersion: 0.4.0 | ||
| description: Windows GMSA Configuration | ||
| keywords: | ||
| - Windows | ||
| - Windows GMSA | ||
| - GMSA | ||
| - Active Directory | ||
| name: gmsa | ||
| sources: | ||
| - https://github.com/kubernetes-sigs/windows-gmsa | ||
| type: application | ||
| version: 0.4.0 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| # Windows GMSA Admission Webhook | ||
|
|
||
| This chart creates the GMSA CRD, Credential, and Admission Webhook. The official documentation and tutorials can be found [here](https://github.com/kubernetes-sigs/windows-gmsa). | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - Active Directory that support Group Managed Service Accounts | ||
| - A Group Managed Service Account | ||
| - Kubernetes v1.21+ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| {{- define "system_default_registry" -}} | ||
| {{- if .Values.global.systemDefaultRegistry -}} | ||
| {{- printf "%s/" .Values.global.systemDefaultRegistry -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
|
|
||
| {{/* Create chart name and version as used by the chart label. */}} | ||
| {{- define "gmsa.chartref" -}} | ||
| chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| {{- end }} | ||
|
|
||
| {{/* Determine apiVersion for cert-manager */}} | ||
| {{- define "cert-manager.apiversion" -}} | ||
| {{- $certmanagerVer := split "." .Values.certificates.certManager.version -}} | ||
| {{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }} | ||
| apiVersion: cert-manager.io/v1 | ||
| {{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }} | ||
| apiVersion: cert-manager.io/v1beta1 | ||
| {{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }} | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| {{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }} | ||
| apiVersion: cert-manager.io/v1alpha1 | ||
| {{- else }} | ||
| apiVersion: cert-manager.io/v1 | ||
| {{- end }} | ||
| {{- end }} | ||
|
|
||
| {{- define "certificates.cabundle"}} | ||
| {{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} | ||
| {{- $secret := (lookup "v1" "Secret" .Release.Namespace .Values.certificates.secretName) -}} | ||
| {{- if lt (len $secret) 1 -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' must exist" .Values.certificates.secretName .Release.Namespace) "" -}} | ||
| {{- else -}} | ||
| {{- if not (hasKey $secret "data") -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' is empty" .Values.certificates.secretName .Release.Namespace) "" -}} | ||
| {{- end -}} | ||
| {{- if or (not (hasKey $secret.data "ca.crt")) (not (hasKey $secret.data "tls.crt")) (not (hasKey $secret.data "tls.key")) -}} | ||
| {{- required (printf "CA Bundle secret '%s' in namespace '%s' must contain ca.crt, tls.key, and tls.cert; found the following keys in the secret: %s" .Values.certificates.secretName .Release.Namespace $secret.data) "" -}} | ||
| {{- end -}} | ||
| {{- end -}} | ||
| {{- get $secret.data "ca.crt" }} | ||
| {{- else -}} | ||
| INSERT_CERTIFICATE_FROM_SECRET | ||
| {{- end -}} | ||
| {{- end }} | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # the RBAC role that the webhook needs to: | ||
| # * read GMSA custom resources | ||
| # * check authorizations to use GMSA cred specs | ||
| kind: ClusterRole | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: {{ .Release.Name }} | ||
| labels: {{ include "gmsa.chartref" . | nindent 4 }} | ||
| rules: | ||
| - apiGroups: ["windows.k8s.io"] | ||
| resources: ["gmsacredentialspecs"] | ||
| verbs: ["get", "use"] | ||
| - apiGroups: ["authorization.k8s.io"] | ||
| resources: ["localsubjectaccessreviews"] | ||
| verbs: ["create"] | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # bind that role to the webhook's service account | ||
| kind: ClusterRoleBinding | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| metadata: | ||
| name: {{ .Release.Name }} | ||
| labels: {{ include "gmsa.chartref" . | nindent 4 }} | ||
| subjects: | ||
| - kind: ServiceAccount | ||
| name: {{ .Release.Name }} | ||
| namespace: {{.Release.Namespace}} | ||
| roleRef: | ||
| kind: ClusterRole | ||
| name: {{ .Release.Name }} | ||
| apiGroup: rbac.authorization.k8s.io | ||
|
|
Oops, something went wrong.