Skip to content

Commit 400576f

Browse files
pilatpilat
authored
chore: add eks pod identity webhook chart (#1)
1 parent 8609951 commit 400576f

File tree

13 files changed

+341
-0
lines changed

13 files changed

+341
-0
lines changed

‎.github/workflows/publish.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Publish Helm Chart
2+
3+
on:
4+
repository_dispatch:
5+
6+
jobs:
7+
release:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- uses: actions/checkout@v4
11+
with:
12+
fetch-depth: 0
13+
- name: Set up Helm
14+
uses: azure/setup-helm@v3
15+
with:
16+
version: v3.13.0
17+
- name: Prepare chart
18+
run: |
19+
mkdir -p public
20+
if git ls-remote --exit-code origin gh-pages; then
21+
git fetch origin gh-pages
22+
git show origin/gh-pages:index.yaml > public/index.yaml || true
23+
fi
24+
helm package charts/eks-pod-identity-webhook -d public
25+
if [ -f public/index.yaml ]; then
26+
helm repo index public --url "https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}" --merge public/index.yaml
27+
else
28+
helm repo index public --url "https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}"
29+
fi
30+
- name: Publish
31+
uses: peaceiris/actions-gh-pages@v3
32+
with:
33+
github_token: ${{ secrets.GITHUB_TOKEN }}
34+
publish_dir: ./public
35+
publish_branch: gh-pages
36+
keep_files: true

‎charts/eks-pod-identity-webhook/Chart.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: v2
2+
name: eks-pod-identity-webhook
3+
description: Helm chart for deploying the EKS Pod Identity Webhook
4+
type: application
5+
version: 0.1.1
6+
appVersion: "0.1.1"

‎charts/eks-pod-identity-webhook/README.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# EKS Pod Identity Webhook
2+
3+
A Helm chart for deploying the EKS Pod Identity Webhook.
4+
5+
## Installing the Chart
6+
7+
Add the Mondu AI Helm repository:
8+
9+
```bash
10+
helm repo add mondu-ai https://mondu-ai.github.io/eks-pod-identity-webhook
11+
helm repo update
12+
```
13+
14+
Install or upgrade the chart:
15+
16+
```bash
17+
helm upgrade --install eks-pod-identity-webhook \
18+
mondu-ai/eks-pod-identity-webhook \
19+
--namespace aws-pod-identity-webhook
20+
```
21+
22+
## Uninstalling the Chart
23+
24+
To uninstall/delete the release:
25+
26+
```bash
27+
helm uninstall eks-pod-identity-webhook --namespace aws-pod-identity-webhook
28+
```
29+
30+
## Configuration
31+
32+
The following table lists the most commonly used parameters of the chart. See
33+
`values.yaml` for the full list.
34+
35+
| Parameter | Description | Default |
36+
|-----------|-------------|---------|
37+
| `replicaCount` | Number of webhook replicas | `3` |
38+
| `image.repository` | Container image repository | `ghcr.io/mondu-ai/eks-pod-identity-webhook` |
39+
| `image.tag` | Image tag | `latest` |
40+
| `serviceAccount.create` | Create a service account | `true` |
41+
| `serviceAccount.name` | Service account name | `aws-pod-identity-webhook-sa` |
42+
| `certManager.enabled` | Manage certificates with cert-manager | `true` |
43+
| `existingTLSSecret` | Use an existing TLS secret | `""` |
44+
| `service.port` | Webhook service port | `443` |
45+
| `env.AWS_REGION` | Default AWS region | `us-east-1` |
46+
47+

‎charts/eks-pod-identity-webhook/templates/_helpers.tpl‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- define "eks-pod-identity-webhook.name" -}}
2+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
3+
{{- end -}}
4+
5+
{{- define "eks-pod-identity-webhook.fullname" -}}
6+
{{- if .Values.fullnameOverride -}}
7+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
8+
{{- else -}}
9+
{{- printf "%s" (include "eks-pod-identity-webhook.name" .) | trunc 63 | trimSuffix "-" -}}
10+
{{- end -}}
11+
{{- end -}}
12+
13+
{{- define "eks-pod-identity-webhook.namespace" -}}
14+
{{- .Release.Namespace -}}
15+
{{- end -}}

‎charts/eks-pod-identity-webhook/templates/certificate.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{{- if and .Values.certManager.enabled (not .Values.existingTLSSecret) }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Certificate
4+
metadata:
5+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-tls
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
9+
spec:
10+
secretName: {{ .Values.certManager.secretName }}
11+
duration: {{ .Values.certManager.certificate.duration }}
12+
renewBefore: {{ .Values.certManager.certificate.renewBefore }}
13+
commonName: {{ include "eks-pod-identity-webhook.fullname" . }}-svc.{{ .Release.Namespace }}.svc
14+
dnsNames:
15+
- {{ include "eks-pod-identity-webhook.fullname" . }}-svc.{{ .Release.Namespace }}.svc.cluster.local
16+
- {{ include "eks-pod-identity-webhook.fullname" . }}-svc.{{ .Release.Namespace }}.svc
17+
issuerRef:
18+
name: {{ .Values.certManager.issuerName }}
19+
kind: Issuer
20+
usages:
21+
- server auth
22+
- client auth
23+
{{- end }}

‎charts/eks-pod-identity-webhook/templates/clusterrole.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-cr
5+
labels:
6+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
7+
rules:
8+
- apiGroups: [""]
9+
resources: ["serviceaccounts"]
10+
verbs: ["get", "list", "watch"]
11+
- apiGroups: [""]
12+
resources: ["pods"]
13+
verbs: ["list", "watch"]

‎charts/eks-pod-identity-webhook/templates/clusterrolebinding.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-crb
5+
labels:
6+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: ClusterRole
10+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-cr
11+
subjects:
12+
- kind: ServiceAccount
13+
name: {{ .Values.serviceAccount.name }}
14+
namespace: {{ .Release.Namespace }}

‎charts/eks-pod-identity-webhook/templates/deployment.yaml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-deployment
5+
namespace: {{ .Release.Namespace }}
6+
labels:
7+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
8+
app.kubernetes.io/instance: {{ include "eks-pod-identity-webhook.fullname" . }}
9+
spec:
10+
replicas: {{ .Values.replicaCount }}
11+
selector:
12+
matchLabels:
13+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
14+
app.kubernetes.io/instance: {{ include "eks-pod-identity-webhook.fullname" . }}
15+
template:
16+
metadata:
17+
labels:
18+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
19+
app.kubernetes.io/instance: {{ include "eks-pod-identity-webhook.fullname" . }}
20+
spec:
21+
serviceAccountName: {{ .Values.serviceAccount.name }}
22+
automountServiceAccountToken: true
23+
nodeSelector:
24+
{{ toYaml .Values.nodeSelector | indent 8 }}
25+
containers:
26+
- name: webhook
27+
image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
28+
imagePullPolicy: {{ .Values.image.pullPolicy }}
29+
args:
30+
- "--tls-cert-path=/etc/webhook/certs/tls.crt"
31+
- "--tls-key-path=/etc/webhook/certs/tls.key"
32+
- "--listen-addr=:8443"
33+
- "--aws-region={{ .Values.env.AWS_REGION }}"
34+
ports:
35+
- name: webhook-https
36+
containerPort: 8443
37+
protocol: TCP
38+
env:
39+
- name: GIN_MODE
40+
value: {{ .Values.env.GIN_MODE }}
41+
securityContext:
42+
allowPrivilegeEscalation: false
43+
capabilities:
44+
drop:
45+
- "ALL"
46+
readOnlyRootFilesystem: true
47+
volumeMounts:
48+
- name: webhook-tls-certs
49+
mountPath: /etc/webhook/certs
50+
readOnly: true
51+
livenessProbe:
52+
httpGet:
53+
path: /healthz
54+
port: webhook-https
55+
scheme: HTTPS
56+
initialDelaySeconds: 5
57+
periodSeconds: 10
58+
readinessProbe:
59+
httpGet:
60+
path: /healthz
61+
port: webhook-https
62+
scheme: HTTPS
63+
initialDelaySeconds: 5
64+
periodSeconds: 10
65+
resources:
66+
{{ toYaml .Values.resources | indent 12 }}
67+
volumes:
68+
- name: webhook-tls-certs
69+
secret:
70+
secretName: {{ default .Values.certManager.secretName .Values.existingTLSSecret }}
71+
securityContext:
72+
runAsNonRoot: true
73+
runAsUser: 1000
74+
fsGroup: 1000
75+
affinity:
76+
{{ toYaml .Values.affinity | indent 8 }}

‎charts/eks-pod-identity-webhook/templates/issuer.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
{{- if and .Values.certManager.enabled (not .Values.existingTLSSecret) }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: {{ .Values.certManager.issuerName }}
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
9+
spec:
10+
selfSigned: {}
11+
{{- end }}

‎charts/eks-pod-identity-webhook/templates/mutatingwebhookconfiguration.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: MutatingWebhookConfiguration
3+
metadata:
4+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-cfg
5+
labels:
6+
app.kubernetes.io/name: {{ include "eks-pod-identity-webhook.name" . }}
7+
annotations:
8+
{{- if not .Values.existingTLSSecret }}
9+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "eks-pod-identity-webhook.fullname" . }}-tls
10+
{{- end }}
11+
webhooks:
12+
- name: aws-pod-identity-webhook.mondu.internal
13+
admissionReviewVersions: ["v1"]
14+
sideEffects: None
15+
failurePolicy: Fail
16+
clientConfig:
17+
service:
18+
namespace: {{ .Release.Namespace }}
19+
name: {{ include "eks-pod-identity-webhook.fullname" . }}-svc
20+
path: "/mutate"
21+
port: 443
22+
objectSelector:
23+
matchExpressions:
24+
- key: app.kubernetes.io/name
25+
operator: NotIn
26+
values: ["{{ include "eks-pod-identity-webhook.name" . }}"]
27+
rules:
28+
- operations: ["CREATE", "UPDATE"]
29+
apiGroups: [""]
30+
apiVersions: ["v1"]
31+
resources: ["pods"]
32+
scope: "*"
33+

0 commit comments

Comments
 (0)