439 lines
25 KiB
Plaintext
439 lines
25 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Vault Secrets Operator Helm Chart Configuration
|
|
description: >-
|
|
Configuration for the Vault Secrets Operator Helm chart.
|
|
---
|
|
|
|
# Vault Secrets Operator Helm Chart
|
|
|
|
The chart is customizable using
|
|
[Helm configuration values](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing).
|
|
|
|
<!-- DO NOT EDIT. The docs below are generated automatically. To change, edit
|
|
the vault-secrets-operator repo's values.yaml: file commit=e9c2b499105d977fa23a9f746186253991ebcee1 -->
|
|
<!-- codegen: start -->
|
|
|
|
## Top-Level Stanzas
|
|
|
|
Use these links to navigate to a particular top-level stanza.
|
|
|
|
- [`controller`](#h-controller)
|
|
- [`metricsService`](#h-metricsservice)
|
|
- [`defaultVaultConnection`](#h-defaultvaultconnection)
|
|
- [`defaultAuthMethod`](#h-defaultauthmethod)
|
|
- [`telemetry`](#h-telemetry)
|
|
- [`tests`](#h-tests)
|
|
|
|
## All Values
|
|
|
|
### controller ((#h-controller))
|
|
|
|
- `controller` ((#v-controller)) - Top level configuration for the vault secrets operator deployment.
|
|
This consists of a controller and a kube rbac proxy container.
|
|
|
|
- `replicas` ((#v-controller-replicas)) (`integer: 1`) - Set the number of replicas for the operator.
|
|
|
|
- `kubeRbacProxy` ((#v-controller-kuberbacproxy)) - Settings related to the kubeRbacProxy container. This container is an HTTP proxy for the
|
|
controller manager which performs RBAC authorization against the Kubernetes API using SubjectAccessReviews.
|
|
|
|
- `image` ((#v-controller-kuberbacproxy-image)) - Image sets the repo and tag of the kube-rbac-proxy image to use for the controller.
|
|
|
|
- `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: gcr.io/kubebuilder/kube-rbac-proxy`)
|
|
|
|
- `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.11.0`)
|
|
|
|
- `resources` ((#v-controller-kuberbacproxy-resources)) (`map`) - Configures the default resources for the kube rbac proxy container.
|
|
For more information on configuring resources, see the K8s documentation:
|
|
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
|
|
- `limits` ((#v-controller-kuberbacproxy-resources-limits))
|
|
|
|
- `cpu` ((#v-controller-kuberbacproxy-resources-limits-cpu)) (`string: 500m`)
|
|
|
|
- `memory` ((#v-controller-kuberbacproxy-resources-limits-memory)) (`string: 128Mi`)
|
|
|
|
- `requests` ((#v-controller-kuberbacproxy-resources-requests))
|
|
|
|
- `cpu` ((#v-controller-kuberbacproxy-resources-requests-cpu)) (`string: 5m`)
|
|
|
|
- `memory` ((#v-controller-kuberbacproxy-resources-requests-memory)) (`string: 64Mi`)
|
|
|
|
- `annotations` ((#v-controller-annotations)) - This value defines additional annotations for the deployment. This should be formatted as a YAML object (map)
|
|
|
|
- `manager` ((#v-controller-manager)) - Settings related to the vault-secrets-operator container.
|
|
|
|
- `image` ((#v-controller-manager-image)) - Image sets the repo and tag of the vault-secrets-operator image to use for the controller.
|
|
|
|
- `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`)
|
|
|
|
- `tag` ((#v-controller-manager-image-tag)) (`string: 0.1.0`)
|
|
|
|
- `clientCache` ((#v-controller-manager-clientcache)) - Configures the client cache which is used by the controller to cache (and potentially persist) vault tokens that
|
|
are the result of using the VaultAuthMethod. This enables re-use of Vault Tokens
|
|
throughout their TTLs as well as the ability to renew.
|
|
Persistence is only useful in the context of Dynamic Secrets, so "none" is an okay default.
|
|
|
|
- `persistenceModel` ((#v-controller-manager-clientcache-persistencemodel)) (`string: ""`) - Defines the `-client-cache-persistence-model` which caches+persists vault tokens.
|
|
Valid values are:
|
|
"none" - in-memory client cache is used, no tokens are persisted.
|
|
"direct-unencrypted" - in-memory client cache is persisted, unencrypted. This is NOT recommended for any production workload.
|
|
"direct-encrypted" - in-memory client cache is persisted encrypted using the Vault Transit engine.
|
|
Note: It is strongly encouraged to not use the setting of "direct-unencrypted" in
|
|
production due to the potential of vault tokens being leaked as they would then be stored
|
|
in clear text.
|
|
|
|
default: "none"
|
|
|
|
- `cacheSize` ((#v-controller-manager-clientcache-cachesize)) (`integer: ""`) - Defines the size of the in-memory LRU cache *in entries*, that is used by the client cache controller.
|
|
Larger numbers will increase memory usage by the controller, lower numbers will cause more frequent evictions
|
|
of the client cache which can result in additional Vault client counts.
|
|
|
|
default: 10000
|
|
|
|
- `storageEncryption` ((#v-controller-manager-clientcache-storageencryption)) - StorageEncryption provides the necessary configuration to encrypt the client storage
|
|
cache within Kubernetes objects using (required) Vault Transit Engine.
|
|
This should only be configured when client cache persistence with encryption is enabled and
|
|
will deploy an additional VaultAuthMethod to be used by the Vault Transit Engine.
|
|
E.g. when `controller.manager.clientCache.persistenceModel=direct-encrypted`
|
|
Supported Vault authentication methods for the Transit Auth method are: jwt, appRole,
|
|
aws, and kubernetes.
|
|
Typically, there should only ever be one VaultAuth configured with
|
|
StorageEncryption in the Cluster.
|
|
|
|
- `enabled` ((#v-controller-manager-clientcache-storageencryption-enabled)) (`boolean: false`) - toggles the deployment of the Transit VaultAuthMethod CR.
|
|
|
|
- `vaultConnectionRef` ((#v-controller-manager-clientcache-storageencryption-vaultconnectionref)) (`string: default`) - Vault Connection Ref to be used by the Transit VaultAuthMethod.
|
|
Default setting will use the default VaultConnectionRef, which must also be configured.
|
|
|
|
- `keyName` ((#v-controller-manager-clientcache-storageencryption-keyname)) (`string: ""`) - KeyName to use for encrypt/decrypt operations via Vault Transit.
|
|
|
|
- `transitMount` ((#v-controller-manager-clientcache-storageencryption-transitmount)) (`string: ""`) - Mount path for the Transit VaultAuthMethod.
|
|
|
|
- `namespace` ((#v-controller-manager-clientcache-storageencryption-namespace)) (`string: ""`) - Vault namespace for the Transit VaultAuthMethod CR.
|
|
|
|
- `method` ((#v-controller-manager-clientcache-storageencryption-method)) (`string: kubernetes`) - Vault Auth method to be used with the Transit VaultAuthMethod CR.
|
|
|
|
- `mount` ((#v-controller-manager-clientcache-storageencryption-mount)) (`string: kubernetes`) - Mount path for the Transit VaultAuthMethod.
|
|
|
|
- `kubernetes` ((#v-controller-manager-clientcache-storageencryption-kubernetes)) - Vault Kubernetes auth method specific configuration
|
|
|
|
- `role` ((#v-controller-manager-clientcache-storageencryption-kubernetes-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if `defaultAuthMethod.enabled=true`
|
|
|
|
- `serviceAccount` ((#v-controller-manager-clientcache-storageencryption-kubernetes-serviceaccount)) (`string: ""`) - Kubernetes ServiceAccount associated with the Transit Vault Auth Role
|
|
Defaults to using the Operator's service-account.
|
|
|
|
- `tokenAudiences` ((#v-controller-manager-clientcache-storageencryption-kubernetes-tokenaudiences)) (`array<string>: []`) - Token Audience should match the audience of the vault kubernetes auth role.
|
|
|
|
- `jwt` ((#v-controller-manager-clientcache-storageencryption-jwt)) - Vault JWT auth method specific configuration
|
|
|
|
- `role` ((#v-controller-manager-clientcache-storageencryption-jwt-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if using JWT for the Transit VaultAuthMethod.
|
|
|
|
- `secretRef` ((#v-controller-manager-clientcache-storageencryption-jwt-secretref)) (`string: ""`) - One of the following is required prior to deploying the helm chart
|
|
- K8s secret that contains the JWT
|
|
- K8s service account if a service account JWT is used as a Vault JWT auth token and
|
|
needs generating by VSO.
|
|
|
|
Name of Kubernetes Secret that has the Vault JWT auth token.
|
|
The Kubernetes Secret must contain a key named `jwt` which references the JWT token, and
|
|
must exist in the namespace of any consuming VaultSecret CR. This is a required field if
|
|
a JWT token is provided.
|
|
|
|
- `serviceAccount` ((#v-controller-manager-clientcache-storageencryption-jwt-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount to generate a service account JWT
|
|
|
|
- `tokenAudiences` ((#v-controller-manager-clientcache-storageencryption-jwt-tokenaudiences)) (`array<string>: []`) - Token Audience should match the bound_audiences or the `aud` list in bound_claims if
|
|
applicable of the Vault JWT auth role.
|
|
|
|
- `appRole` ((#v-controller-manager-clientcache-storageencryption-approle)) - AppRole auth method specific configuration
|
|
|
|
- `roleId` ((#v-controller-manager-clientcache-storageencryption-approle-roleid)) (`string: ""`) - AppRole Role's RoleID to use for authenticating to Vault.
|
|
This is a required field when using appRole and must be setup in Vault prior to deploying
|
|
the helm chart.
|
|
|
|
- `secretRef` ((#v-controller-manager-clientcache-storageencryption-approle-secretref)) (`string: ""`) - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with
|
|
Vault. The Kubernetes Secret must contain a key named `id` which references the AppRole
|
|
Role's SecretID, and must exist in the namespace of any consuming VaultSecret CR.
|
|
This is a required field when using appRole and must be setup in Vault prior to
|
|
deploying the helm chart.
|
|
|
|
- `aws` ((#v-controller-manager-clientcache-storageencryption-aws)) - AWS auth method specific configuration
|
|
|
|
- `role` ((#v-controller-manager-clientcache-storageencryption-aws-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if using the AWS for the Transit auth method.
|
|
|
|
- `region` ((#v-controller-manager-clientcache-storageencryption-aws-region)) (`string: ""`) - AWS region to use for signing the authentication request
|
|
Optional, but most commonly will be the EKS cluster region.
|
|
|
|
- `headerValue` ((#v-controller-manager-clientcache-storageencryption-aws-headervalue)) (`string: ""`) - Vault header value to include in the STS signing request
|
|
|
|
- `sessionName` ((#v-controller-manager-clientcache-storageencryption-aws-sessionname)) (`string: ""`) - The role session name to use when creating a WebIdentity provider
|
|
|
|
- `stsEndpoint` ((#v-controller-manager-clientcache-storageencryption-aws-stsendpoint)) (`string: ""`) - The STS endpoint to use; if not set will use the default
|
|
|
|
- `iamEndpoint` ((#v-controller-manager-clientcache-storageencryption-aws-iamendpoint)) (`string: ""`) - The IAM endpoint to use; if not set will use the default
|
|
|
|
- `secretRef` ((#v-controller-manager-clientcache-storageencryption-aws-secretref)) (`string: ""`) - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys
|
|
include `access_key_id`, `secret_access_key`, `session_token`
|
|
|
|
- `irsaServiceAccount` ((#v-controller-manager-clientcache-storageencryption-aws-irsaserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured with IAM Roles
|
|
for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
|
|
|
|
- `params` ((#v-controller-manager-clientcache-storageencryption-params)) (`map`) - Params to use when authenticating to Vault using this auth method.
|
|
params:
|
|
param-something1: "foo"
|
|
|
|
- `headers` ((#v-controller-manager-clientcache-storageencryption-headers)) (` map: ""`) - Headers to be included in all Vault requests.
|
|
headers:
|
|
X-vault-something1: "foo"
|
|
|
|
- `maxConcurrentReconciles` ((#v-controller-manager-maxconcurrentreconciles)) (`integer: ""`) - Defines the maximum number of concurrent reconciles by the controller.
|
|
NOTE: Currently this is only used by the reconciliation logic of dynamic secrets.
|
|
|
|
default: 100
|
|
|
|
- `resources` ((#v-controller-manager-resources)) (`map`) - Configures the default resources for the vault-secrets-operator container.
|
|
For more information on configuring resources, see the K8s documentation:
|
|
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
|
|
|
- `limits` ((#v-controller-manager-resources-limits))
|
|
|
|
- `cpu` ((#v-controller-manager-resources-limits-cpu)) (`string: 500m`)
|
|
|
|
- `memory` ((#v-controller-manager-resources-limits-memory)) (`string: 128Mi`)
|
|
|
|
- `requests` ((#v-controller-manager-resources-requests))
|
|
|
|
- `cpu` ((#v-controller-manager-resources-requests-cpu)) (`string: 10m`)
|
|
|
|
- `memory` ((#v-controller-manager-resources-requests-memory)) (`string: 64Mi`)
|
|
|
|
- `controllerConfigMapYaml` ((#v-controller-controllerconfigmapyaml)) (`map`) - Sets the configuration settings used by the controller. Any custom changes will be reflected in the
|
|
data field of the configmap.
|
|
For more information on configuring resources, see the K8s documentation:
|
|
https://kubernetes.io/docs/concepts/configuration/configmap/
|
|
|
|
- `health` ((#v-controller-controllerconfigmapyaml-health))
|
|
|
|
- `healthProbeBindAddress` ((#v-controller-controllerconfigmapyaml-health-healthprobebindaddress)) (`string: :8081`)
|
|
|
|
- `leaderElection` ((#v-controller-controllerconfigmapyaml-leaderelection))
|
|
|
|
- `leaderElect` ((#v-controller-controllerconfigmapyaml-leaderelection-leaderelect)) (`boolean: true`)
|
|
|
|
- `resourceName` ((#v-controller-controllerconfigmapyaml-leaderelection-resourcename)) (`string: b0d477c0.hashicorp.com`)
|
|
|
|
- `metrics` ((#v-controller-controllerconfigmapyaml-metrics))
|
|
|
|
- `bindAddress` ((#v-controller-controllerconfigmapyaml-metrics-bindaddress)) (`string: 127.0.0.1:8080`)
|
|
|
|
- `webhook` ((#v-controller-controllerconfigmapyaml-webhook))
|
|
|
|
- `port` ((#v-controller-controllerconfigmapyaml-webhook-port)) (`integer: 9443`)
|
|
|
|
- `kubernetesClusterDomain` ((#v-controller-kubernetesclusterdomain)) (`string: cluster.local`) - Configures the environment variable KUBERNETES_CLUSTER_DOMAIN used by KubeDNS.
|
|
|
|
### metricsService ((#h-metricsservice))
|
|
|
|
- `metricsService` ((#v-metricsservice)) (`map`) - Configure the metrics service ports used by the metrics service.
|
|
Set the configuration fo the metricsService port.
|
|
|
|
- `ports` ((#v-metricsservice-ports)) (`map`) - Set the port settings for the metrics service.
|
|
For more information on configuring resources, see the K8s documentation:
|
|
https://kubernetes.io/docs/concepts/services-networking/service/
|
|
|
|
- `name` ((#v-metricsservice-ports-name)) (`string: https`)
|
|
|
|
- `port` ((#v-metricsservice-ports-port)) (`integer: 8443`)
|
|
|
|
- `protocol` ((#v-metricsservice-ports-protocol)) (`string: TCP`)
|
|
|
|
- `targetPort` ((#v-metricsservice-ports-targetport)) (`string: https`)
|
|
|
|
- `type` ((#v-metricsservice-type)) (`string: ClusterIP`)
|
|
|
|
### defaultVaultConnection ((#h-defaultvaultconnection))
|
|
|
|
- `defaultVaultConnection` ((#v-defaultvaultconnection)) - Configures the default VaultConnection CR which will be used by resources
|
|
if they do not specify a VaultConnection reference. The name is 'default' and will
|
|
always be installed in the same namespace as the operator.
|
|
NOTE:
|
|
* It is strongly recommended to deploy the vault secrets operator in a secure Vault environment
|
|
which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
|
|
|
|
- `enabled` ((#v-defaultvaultconnection-enabled)) (`boolean: false`) - toggles the deployment of the VaultAuthMethod CR
|
|
|
|
- `address` ((#v-defaultvaultconnection-address)) (`string: ""`) - Address of the Vault Server
|
|
Example: http://vault.default.svc.cluster.local:8200
|
|
|
|
- `caCertSecret` ((#v-defaultvaultconnection-cacertsecret)) (`string: ""`) - CACertSecret is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`.
|
|
Note: This secret must exist prior to deploying the CR.
|
|
|
|
- `tlsServerName` ((#v-defaultvaultconnection-tlsservername)) (`string: ""`) - TLSServerName to use as the SNI host for TLS connections.
|
|
|
|
- `skipTLSVerify` ((#v-defaultvaultconnection-skiptlsverify)) (`boolean: false`) - SkipTLSVerify for TLS connections.
|
|
|
|
- `headers` ((#v-defaultvaultconnection-headers)) (`map`) - Headers to be included in all Vault requests.
|
|
headers:
|
|
X-vault-something: "foo"
|
|
|
|
### defaultAuthMethod ((#h-defaultauthmethod))
|
|
|
|
- `defaultAuthMethod` ((#v-defaultauthmethod)) - Configures and deploys the default VaultAuthMethod CR which will be used by resources
|
|
if they do not specify a VaultAuthMethod reference. The name is 'default' and will
|
|
always be installed in the same namespace as the operator.
|
|
NOTE:
|
|
* It is strongly recommended to deploy the vault secrets operator in a secure Vault environment
|
|
which includes a configuration utilizing TLS and installing Vault into its own restricted namespace.
|
|
|
|
- `enabled` ((#v-defaultauthmethod-enabled)) (`boolean: false`) - toggles the deployment of the VaultAuthMethod CR
|
|
|
|
- `namespace` ((#v-defaultauthmethod-namespace)) (`string: ""`) - Vault namespace for the VaultAuthMethod CR
|
|
|
|
- `method` ((#v-defaultauthmethod-method)) (`string: kubernetes`) - Vault Auth method to be used with the VaultAuthMethod CR
|
|
|
|
- `mount` ((#v-defaultauthmethod-mount)) (`string: kubernetes`) - Mount path for the Vault Auth Method.
|
|
|
|
- `kubernetes` ((#v-defaultauthmethod-kubernetes)) - Vault Kubernetes auth method specific configuration
|
|
|
|
- `role` ((#v-defaultauthmethod-kubernetes-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if `defaultAuthMethod.enabled=true`
|
|
|
|
- `serviceAccount` ((#v-defaultauthmethod-kubernetes-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount associated with the default Vault Auth Role
|
|
|
|
- `tokenAudiences` ((#v-defaultauthmethod-kubernetes-tokenaudiences)) (`array<string>: []`) - Token Audience should match the audience of the vault kubernetes auth role.
|
|
|
|
- `jwt` ((#v-defaultauthmethod-jwt)) - Vault JWT auth method specific configuration
|
|
|
|
- `role` ((#v-defaultauthmethod-jwt-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if using the JWT for the default auth method.
|
|
|
|
- `secretRef` ((#v-defaultauthmethod-jwt-secretref)) (`string: ""`) - One of the following is required prior to deploying the helm chart
|
|
- K8s secret that contains the JWT
|
|
- K8s service account if a service account JWT is used as a Vault JWT auth token and needs generating by VSO
|
|
|
|
Name of Kubernetes Secret that has the Vault JWT auth token.
|
|
The Kubernetes Secret must contain a key named `jwt` which references the JWT token, and must exist in the namespace
|
|
of any consuming VaultSecret CR. This is a required field if a JWT token is provided.
|
|
|
|
- `serviceAccount` ((#v-defaultauthmethod-jwt-serviceaccount)) (`string: default`) - Kubernetes ServiceAccount to generate a service account JWT
|
|
|
|
- `tokenAudiences` ((#v-defaultauthmethod-jwt-tokenaudiences)) (`array<string>: []`) - Token Audience should match the bound_audiences or the `aud` list in bound_claims if applicable
|
|
of the Vault JWT auth role.
|
|
|
|
- `appRole` ((#v-defaultauthmethod-approle)) - AppRole auth method specific configuration
|
|
|
|
- `roleId` ((#v-defaultauthmethod-approle-roleid)) (`string: ""`) - AppRole Role's RoleID to use for authenticating to Vault.
|
|
This is a required field when using appRole and must be setup in Vault prior to deploying the
|
|
helm chart.
|
|
|
|
- `secretRef` ((#v-defaultauthmethod-approle-secretref)) (`string: ""`) - Name of Kubernetes Secret that has the AppRole Role's SecretID used to authenticate with Vault.
|
|
The Kubernetes Secret must contain a key named `id` which references the AppRole Role's
|
|
SecretID, and must exist in the namespace of any consuming VaultSecret CR.
|
|
This is a required field when using appRole and must be setup in Vault prior to deploying the
|
|
helm chart.
|
|
|
|
- `aws` ((#v-defaultauthmethod-aws)) - AWS auth method specific configuration
|
|
|
|
- `role` ((#v-defaultauthmethod-aws-role)) (`string: ""`) - Vault Auth Role to use
|
|
This is a required field and must be setup in Vault prior to deploying the helm chart
|
|
if using the AWS for the default auth method.
|
|
|
|
- `region` ((#v-defaultauthmethod-aws-region)) (`string: ""`) - AWS region to use for signing the authentication request
|
|
Optional, but most commonly will be the region where the EKS cluster is running
|
|
|
|
- `headerValue` ((#v-defaultauthmethod-aws-headervalue)) (`string: ""`) - Vault header value to include in the STS signing request
|
|
|
|
- `sessionName` ((#v-defaultauthmethod-aws-sessionname)) (`string: ""`) - The role session name to use when creating a WebIdentity provider
|
|
|
|
- `stsEndpoint` ((#v-defaultauthmethod-aws-stsendpoint)) (`string: ""`) - The STS endpoint to use; if not set will use the default
|
|
|
|
- `iamEndpoint` ((#v-defaultauthmethod-aws-iamendpoint)) (`string: ""`) - The IAM endpoint to use; if not set will use the default
|
|
|
|
- `secretRef` ((#v-defaultauthmethod-aws-secretref)) (`string: ""`) - The name of a Kubernetes Secret which holds credentials for AWS. Supported keys include
|
|
`access_key_id`, `secret_access_key`, `session_token`
|
|
|
|
- `irsaServiceAccount` ((#v-defaultauthmethod-aws-irsaserviceaccount)) (`string: ""`) - Name of a Kubernetes service account that is configured with IAM Roles
|
|
for Service Accounts (IRSA). Should be annotated with "eks.amazonaws.com/role-arn".
|
|
|
|
- `params` ((#v-defaultauthmethod-params)) (`map`) - Params to use when authenticating to Vault
|
|
params:
|
|
param-something1: "foo"
|
|
|
|
- `headers` ((#v-defaultauthmethod-headers)) (`map`) - Headers to be included in all Vault requests.
|
|
headers:
|
|
X-vault-something1: "foo"
|
|
|
|
### telemetry ((#h-telemetry))
|
|
|
|
- `telemetry` ((#v-telemetry)) - Configures a Prometheus ServiceMonitor
|
|
|
|
- `serviceMonitor` ((#v-telemetry-servicemonitor))
|
|
|
|
- `enabled` ((#v-telemetry-servicemonitor-enabled)) (`boolean: false`) - The Prometheus operator *must* be installed before enabling this feature,
|
|
if not the chart will fail to install due to missing CustomResourceDefinitions
|
|
provided by the operator.
|
|
|
|
Instructions on how to install the Helm chart can be found here:
|
|
https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
|
|
More information can be found here:
|
|
https://github.com/prometheus-operator/prometheus-operator
|
|
https://github.com/prometheus-operator/kube-prometheus
|
|
|
|
Enable deployment of the Vault Secrets Operator ServiceMonitor CustomResource.
|
|
|
|
- `selectors` ((#v-telemetry-servicemonitor-selectors)) (`string: ""`) - Selector labels to add to the ServiceMonitor.
|
|
When empty, defaults to:
|
|
release: prometheus
|
|
|
|
- `scheme` ((#v-telemetry-servicemonitor-scheme)) (`string: https`) - Scheme of the service Prometheus scrapes metrics from. This must match the scheme of the metrics service of VSO
|
|
|
|
- `port` ((#v-telemetry-servicemonitor-port)) (`string: https`) - Port at which Prometheus scrapes metrics. This must match the port of the metrics service of VSO
|
|
|
|
- `path` ((#v-telemetry-servicemonitor-path)) (`string: /metrics`) - Path at which Prometheus scrapes metrics
|
|
|
|
- `bearerTokenFile` ((#v-telemetry-servicemonitor-bearertokenfile)) (`string: /var/run/secrets/kubernetes.io/serviceaccount/token`) - File Prometheus reads bearer token from for scraping metrics
|
|
|
|
- `interval` ((#v-telemetry-servicemonitor-interval)) (`string: 30s`) - Interval at which Prometheus scrapes metrics
|
|
|
|
- `scrapeTimeout` ((#v-telemetry-servicemonitor-scrapetimeout)) (`string: 10s`) - Timeout for Prometheus scrapes
|
|
|
|
### tests ((#h-tests))
|
|
|
|
- `tests` ((#v-tests)) - # Used by unit tests, and will not be rendered except when using `helm template`, this can be safely ignored.
|
|
|
|
- `enabled` ((#v-tests-enabled)) (`boolean: true`)
|
|
|
|
<!-- codegen: end -->
|
|
|
|
## Helm Chart Examples
|
|
|
|
The below `config.yaml` results in a single replica installation of the Vault Secrets Operator
|
|
with a default vault connection and auth method custom resource deployed.
|
|
It expects a local Vault installation within the kubernetes cluster
|
|
accessible via `http://vault.default.svc.cluster.local:8200` with TLS disabled,
|
|
and a [Vault Auth Method](/vault/docs/auth/kubernetes) to be setup against the `default` ServiceAccount.
|
|
|
|
|
|
```yaml
|
|
# config.yaml
|
|
|
|
defaultVaultConnection:
|
|
enabled: true
|
|
defaultAuthMethod:
|
|
enabled: true
|
|
|
|
```
|
|
|
|
## Customizing the Helm Chart
|
|
|
|
If you need to extend the Helm chart with additional options, we recommend using a third-party tool,
|
|
such as [kustomize](https://github.com/kubernetes-sigs/kustomize) using the project repo `config/` path
|
|
in the [vault-secrets-operator](https://github.com/hashicorp/vault-secrets-operator) project.
|