From 35f7420447cd1c7cded91bff6bf377408a8370ba Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Mon, 16 Dec 2024 23:54:43 +0800 Subject: [PATCH] misc: added missing helm configs --- docs/integrations/platforms/kubernetes.mdx | 33 +++++++++++++++---- helm-charts/secrets-operator/Chart.yaml | 4 +-- .../templates/infisicalsecret-crd.yaml | 4 ++- helm-charts/secrets-operator/values.yaml | 3 +- 4 files changed, 34 insertions(+), 10 deletions(-) diff --git a/docs/integrations/platforms/kubernetes.mdx b/docs/integrations/platforms/kubernetes.mdx index 6defea119..77bf94e6d 100644 --- a/docs/integrations/platforms/kubernetes.mdx +++ b/docs/integrations/platforms/kubernetes.mdx @@ -45,11 +45,21 @@ The operator can be install via [Helm](https://helm.sh) or [kubectl](https://git The operator can be configured to watch and manage secrets in a specific namespace instead of having cluster-wide access. + **Note**: For multiple namespace-scoped installations, only the first installation should install CRDs. Subsequent installations should set `installCRDs: false` to avoid conflicts. + ```bash - helm install operator infisical-helm-charts/secrets-operator \ - --namespace your-namespace \ - --set scopedNamespace=your-namespace \ + # First namespace installation (with CRDs) + helm install operator-namespace1 infisical-helm-charts/secrets-operator \ + --namespace first-namespace \ + --set scopedNamespace=first-namespace \ --set scopedRBAC=true + + # Subsequent namespace installations + helm install operator-namespace2 infisical-helm-charts/secrets-operator \ + --namespace another-namespace \ + --set scopedNamespace=another-namespace \ + --set scopedRBAC=true \ + --set installCRDs=false ``` When scoped to a namespace, the operator will: @@ -61,14 +71,19 @@ The operator can be install via [Helm](https://helm.sh) or [kubectl](https://git The default configuration gives cluster-wide access: ```yaml + installCRDs: true # Install CRDs (set to false for additional namespace installations) scopedNamespace: "" # Empty for cluster-wide access scopedRBAC: false # Cluster-wide permissions ``` + If you want to install operators in multiple namespaces simultaneously: + - Make sure to set `installCRDs: false` for all but one of the installations to avoid conflicts, as CRDs are cluster-wide resources. + - Use unique release names for each installation (e.g., operator-namespace1, operator-namespace2). + - - For production deployments, it is highly recommended to set the version of the Kubernetes operator manually instead of pointing to the latest version. - Doing so will help you avoid accidental updates to the newest release which may introduce unintended breaking changes. View all application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags). + + For production deployments, it is highly recommended to set the version of the Kubernetes operator manually instead of pointing to the latest version. + Doing so will help you avoid accidental updates to the newest release which may introduce unintended breaking changes. View all application versions [here](https://hub.docker.com/r/infisical/kubernetes-operator/tags). The command below will install the most recent version of the Kubernetes operator. However, to set the version manually, download the manifest and set the image tag version of `infisical/kubernetes-operator` according to your desired version. @@ -714,6 +729,7 @@ Define secret keys and their corresponding templates. Each data value uses a Golang template with access to all secrets retrieved from the specified scope. Secrets are structured as follows: + ```golang type TemplateSecret struct { Value string `json:"value"` @@ -722,6 +738,7 @@ type TemplateSecret struct { ``` #### Example template configuration: + ```golang managedSecretReference: secretName: managed-secret @@ -733,19 +750,23 @@ type TemplateSecret struct { ``` When you run the following command: + ```bash kubectl get secret managed-secret -o jsonpath='{.data}' ``` You'll receive Kubernetes secrets output that includes the NEW_KEY: + ```bash {... "KEY":"d29ybGQ=","NEW_KEY":"LyBoZWxsbw=="} ``` When you set `includeAllSecrets` as `false` the Kubernetes secrets outputs will be: + ```bash {"NEW_KEY":"LyBoZWxsbw=="} ``` + Creation polices allow you to control whether or not owner references should be added to the managed Kubernetes secret that is generated by the Infisical operator. diff --git a/helm-charts/secrets-operator/Chart.yaml b/helm-charts/secrets-operator/Chart.yaml index ca6747984..fc76e455f 100644 --- a/helm-charts/secrets-operator/Chart.yaml +++ b/helm-charts/secrets-operator/Chart.yaml @@ -13,9 +13,9 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: v0.7.6 +version: v0.7.7 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "v0.7.6" +appVersion: "v0.7.7" diff --git a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml index 9d300eaf4..18198d365 100644 --- a/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml +++ b/helm-charts/secrets-operator/templates/infisicalsecret-crd.yaml @@ -1,3 +1,4 @@ +{{- if .Values.installCRDs }} apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: @@ -424,4 +425,5 @@ status: kind: "" plural: "" conditions: [] - storedVersions: [] \ No newline at end of file + storedVersions: [] +{{- end }} \ No newline at end of file diff --git a/helm-charts/secrets-operator/values.yaml b/helm-charts/secrets-operator/values.yaml index 82668c5a4..4b25f9d14 100644 --- a/helm-charts/secrets-operator/values.yaml +++ b/helm-charts/secrets-operator/values.yaml @@ -32,7 +32,7 @@ controllerManager: - ALL image: repository: infisical/kubernetes-operator - tag: v0.7.6 + tag: v0.7.7 resources: limits: cpu: 500m @@ -48,6 +48,7 @@ controllerManager: kubernetesClusterDomain: cluster.local scopedNamespace: "" scopedRBAC: false +installCRDs: true metricsService: ports: - name: https