diff --git a/Makefile b/Makefile index a0f51c6cef7..144730e569f 100644 --- a/Makefile +++ b/Makefile @@ -904,6 +904,7 @@ helmunit/installed: test-helm: helmunit/installed helm unittest -3 --with-subchart=false examples/chart/teleport-cluster helm unittest -3 --with-subchart=false examples/chart/teleport-kube-agent + helm unittest -3 --with-subchart=false examples/chart/teleport-relay helm unittest -3 --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator helm unittest -3 --with-subchart=false examples/chart/access/* helm unittest -3 --with-subchart=false examples/chart/event-handler @@ -913,6 +914,7 @@ test-helm: helmunit/installed test-helm-update-snapshots: helmunit/installed helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster helm unittest -3 -u --with-subchart=false examples/chart/teleport-kube-agent + helm unittest -3 -u --with-subchart=false examples/chart/teleport-relay helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster/charts/teleport-operator helm unittest -3 -u --with-subchart=false examples/chart/access/* helm unittest -3 -u --with-subchart=false examples/chart/event-handler @@ -1326,7 +1328,7 @@ lint-helm: if [ "$${CI}" = "true" ]; then echo "This is a failure when running in CI." && exit 1; fi; \ exit 0; \ fi; \ - for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \ + for CHART in ./examples/chart/teleport-cluster ./examples/chart/teleport-kube-agent ./examples/chart/teleport-relay ./examples/chart/teleport-cluster/charts/teleport-operator ./examples/chart/tbot; do \ if [ -d $${CHART}/.lint ]; then \ for VALUES in $${CHART}/.lint/*.yaml; do \ export HELM_TEMP=$$(mktemp); \ @@ -1335,6 +1337,7 @@ lint-helm: helm lint --quiet --strict $${CHART} -f $${VALUES} || exit 1; \ helm template test $${CHART} -f $${VALUES} 1>$${HELM_TEMP} || exit 1; \ yamllint -c examples/chart/.lint-config.yaml $${HELM_TEMP} || { cat -en $${HELM_TEMP}; exit 1; }; \ + echo; \ done \ else \ export HELM_TEMP=$$(mktemp); \ diff --git a/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx b/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx new file mode 100644 index 00000000000..fb7b1178950 --- /dev/null +++ b/docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx @@ -0,0 +1,897 @@ + +{/* Generated file. Do not edit.*/} +{/* Generate this file by navigating to examples/chart and running make render-chart-ref*/} +## `relayGroup` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`relayGroup` sets the internal identifier for the group of Relay +instances reachable through the same load balancer. Should be unique in the +whole Teleport cluster. + +## `publicHostnames` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`publicHostnames` a list of hostnames that this Relay group is publicly +reachable at by clients. + +``` +publicHostnames: + - relay.example.com +``` + +## `targetConnectionCount` + +| Type | Default | +|------|---------| +| `int` | `2` | + +`targetConnectionCount` the amount of tunnel connections that agents +will open to distinct Relay instances. It should not be bigger than the +replica count. + +## `proxyAddr` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`proxyAddr` provides the public-facing Teleport Proxy Service +endpoint which should be used to join the cluster. This is the same URL used +to access the web UI of your Teleport cluster. The port used is usually either +3080 or 443. + +Here are a few examples: + +| Deployment method | Example `proxy_service.public_addr` | +|-------------------------------|-------------------------------------| +| On-prem Teleport cluster | `teleport.example.com:3080` | +| Teleport Cloud cluster | `example.teleport.sh:443` | +| `teleport-cluster` Helm chart | `teleport.example.com:443` | + +## `enterprise` + +| Type | Default | +|------|---------| +| `bool` | `false` | + +`enterprise` controls if the `teleport-relay` chart should deploy the +OSS version or the enterprise version of the container image. This must be set +to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise +clusters to allow the agent to leverage enterprise features. + +## `joinParams` + +`joinParams` controls how the Teleport Agent joins the Teleport cluster. +These sub-values must be configured for the agent to connect to a cluster. + +The token used must grant the `Relay` role, and should be valid for the +lifetime of the Helm release. + +### `joinParams.method` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`joinParams.method` controls which join method will be used by the +instance to join the Teleport cluster. + +See [the join method reference](../../reference/deployment/join-methods.mdx) +for the list of possible values, the implications of each join method, and +guides to set up each method. + +Common join-methods for the `teleport-relay` are: +- `token`: the most basic one, with regular ephemeral secret tokens +- `kubernetes`: either the `in-cluster` variant (if the agent runs in the + same Kubernetes cluster as the `teleport-cluster` chart) or the + `JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the + Teleport Auth Service location). + +### `joinParams.tokenName` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`joinParams.tokenName` controls which token is used by the agent to +join the Teleport cluster. + +When `joinParams.method` is [a delegated join +method](../../reference/deployment/join-methods.mdx#delegated-join-methods), +the value is not sensitive. + +When `joinParams.method` is `token` (by default), `joinParams.tokenName` +contains the secret token itself. In this case, the value is sensitive and +is automatically stored in a Kubernetes Secret instead of being directly +included in the agent's configuration. + +If method is `token`, `joinParams.tokenName` can be empty if the token is +provided through an existing Kubernetes Secret, see +[`joinTokenSecret`](#joinTokenSecret) for more details and instructions. + +If method is `kubernetes`, you must set +[`teleportClusterName`](#teleportClusterName). + +## `teleportClusterName` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`teleportClusterName` is the name of the joined Teleport cluster. +Setting this value is required when joining via the +[Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method. + +When this value is set, the chart mounts a kubernetes service account token +via a projected volume and configures Teleport to use it for joining. + +## `joinTokenSecret` + +`joinTokenSecret` manages the join token secret creation and its name. See +the [`joinParams`](#joinParams) section for more details. + +### `joinTokenSecret.create` + +| Type | Default | +|------|---------| +| `bool` | `true` | + +`joinTokenSecret.create` controls whether the chart creates the +Kubernetes `Secret` containing the Teleport join token. If false, you must +create a Kubernetes Secret with the configured name in the Helm release +namespace. + +### `joinTokenSecret.name` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`joinTokenSecret.name` is the name of the Kubernetes Secret +containing the Teleport join token used by the chart. + +If `joinTokenSecret.create` is `false`, the chart will not attempt to create +the secret itself. Instead, it will read the value from an existing secret. +`joinTokenSecret.name` configures the name of this secret. This allows you +to configure this secret externally and avoid having a plaintext join token +stored in your Teleport chart values. + +To create your own join token secret, you can use a command like this: + +```code +$ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token= +``` + + + + The key used for the auth token inside the secret must be `auth-token`, as + in the command above. + + + +```yaml +joinTokenSecret: + create: false + name: my-token-secret + +joinParams: + method: "token" + tokenName: "" +``` + +## `proxyProtocol` + +| Type | Default | +|------|---------| +| `bool` | `false` | + +`proxyProtocol` controls whether or not the connections coming from the +load balancer will include a PROXY protocol v2 header. + +## `log` + +`log` controls the agent logging. + +### `log.level` + +| Type | Default | +|------|---------| +| `string` | `"INFO"` | + +`log.level` is the log level for the Teleport process. +Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`. + +The default is `INFO`, which is recommended in production. +`DEBUG` is useful during first-time setup or to see more detailed logs for debugging. + +### `log.format` + +| Type | Default | +|------|---------| +| `string` | `"json"` | + +`log.format` sets the log output format for the Teleport process. +Possible values are `text` or `json`. + +## `preStopDelay` + +| Type | Default | +|------|---------| +| `string` | `"30s"` | + +`preStopDelay` the optional time that will pass between the pod +entering the Terminating state and the Teleport instance getting signaled to +begin its shutdown advertisement. Useful to allow load balancers to stop +routing connections to the terminating pod. + +## `shutdownDelay` + +| Type | Default | +|------|---------| +| `string` | `"30s"` | + +`shutdownDelay` the optional time that the Teleport instance will +wait after advertising its shutdown and before it will stop serving new +inbound connections. + +## `terminationGracePeriodSeconds` + +| Type | Default | +|------|---------| +| `int` | `90` | + +`terminationGracePeriodSeconds` the time allotted to a Teleport instance +pod for termination. It should be longer than the sum of +[`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay). + +## `highAvailability` + +`highAvailability` contains settings controlling the availability of the +Teleport Agent deployed by the chart. + +The availability can be increased by: +- running more replicas with `replicaCount` +- requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity` +- by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`. + +Even with highAvailability settings Restarting/rolling-out pods can still cause +disruption for established long-lived sessions. + +### `highAvailability.replicaCount` + +| Type | Default | +|------|---------| +| `int` | `2` | + +`highAvailability.replicaCount` is the number of agent replicas +deployed by the Chart. + +Set to a number higher than `1` for a high availability mode where multiple +Teleport pods will be deployed. + + + + As a rough guide, we recommend configuring one replica per distinct + availability zone where your cluster has worker nodes. + + 2 replicas/availability zones will be fine for smaller workloads. 3-5 + replicas/availability zones will be more appropriate for bigger clusters + with more traffic. + + + +### `highAvailability.podDisruptionBudget` + +`highAvailability.podDisruptionBudget` controls how the chart creates and +configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not +delete all agent replicas at the same time. + +#### `highAvailability.podDisruptionBudget.enabled` + +| Type | Default | +|------|---------| +| `bool` | `false` | + +`highAvailability.podDisruptionBudget.enabled` makes the chart create +a Kubernetes PodDisruptionBudget for the agent pods. + +#### `highAvailability.podDisruptionBudget.minAvailable` + +| Type | Default | +|------|---------| +| `intOrString` | `1` | + +`highAvailability.podDisruptionBudget.minAvailable` is the +minimum available pod count specified on the PodDisruptionBudget. + +## `resources` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`resources` sets the resource requests/limits for any pods created by +the chart. See [the Kubernetes +documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) +for more details. + +## `service` + +`service` options for the Service that points to the Teleport Relay +instances. + +### `service.type` + +| Type | Default | +|------|---------| +| `string` | `"LoadBalancer"` | + +`service.type` the type of the Service. Unless you have specific +needs, it should probably be set to LoadBalancer. + +### `service.spec` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`service.spec` any additional entries here will be added to the +Service spec. + +``` +spec: + loadBalancerIP: "1.2.3.4" + loadBalancerClass: service.k8s.aws/nlb +``` + +## `serviceAccount` + +`serviceAccount` contains settings related to the Kubernetes service account +used by pods. + +### `serviceAccount.create` + +| Type | Default | +|------|---------| +| `bool` | `true` | + +`serviceAccount.create` specifies whether a `ServiceAccount` should +be created or if an existing one should be used. + +### `serviceAccount.name` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`serviceAccount.name` the name of the `ServiceAccount` to use. If +not set and serviceAccount.create is true, the name is generated using the +release name. If create is false, the name will be used to reference an +existing service account. + +## `extraLabels` + +`extraLabels` contains additional Kubernetes labels to apply on the resources +created by the chart. See [the Kubernetes label documentation +](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) +for more information. + +### `extraLabels.config` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.config` are labels to set on the ConfigMap. + +### `extraLabels.deployment` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.deployment` are labels to set on the Deployment. + +### `extraLabels.pod` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.pod` are labels to set on the Pods. + +### `extraLabels.podDisruptionBudget` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.podDisruptionBudget` are labels to set on the +PodDisruptionBudget. + +### `extraLabels.secret` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.secret` are labels to set on the Secret. + +### `extraLabels.service` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.service` are labels to set on the Service. + +### `extraLabels.serviceAccount` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`extraLabels.serviceAccount` are labels to set on the +ServiceAccount. + +## `annotations` + +`annotations` contains annotations to apply to the different Kubernetes +objects created by the chart. See [the Kubernetes annotation +documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) +for more details. + +### `annotations.config` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.config` are annotations to set on the ConfigMap. + +### `annotations.deployment` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.deployment` are annotations to set on the Deployment. + +### `annotations.pod` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.pod` are annotations to set on the Pods. + +### `annotations.podDisruptionBudget` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.podDisruptionBudget` are annotations to set on the +podDisruptionBudget. + +### `annotations.secret` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.secret` are annotations to set on the Secret. + +### `annotations.service` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.service` are annotations to set on the Service. + +### `annotations.serviceAccount` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`annotations.serviceAccount` are annotations to set on the +ServiceAccount. + +## `image` + +| Type | Default | +|------|---------| +| `string` | `"public.ecr.aws/gravitational/teleport-distroless"` | + +`image` sets the container image used for Teleport Community Edition +Agent pods created by the chart. + +You can override this to use your own Teleport image rather than a +Teleport-published image. + +By default, the image contains only the Teleport application and its runtime +dependencies, and does not contain a shell. + +This setting only takes effect when [`enterprise`](#enterprise) is `false`. +When running an enterprise version, you must use +[`enterpriseImage`](#enterpriseImage) instead. + +## `enterpriseImage` + +| Type | Default | +|------|---------| +| `string` | `"public.ecr.aws/gravitational/teleport-ent-distroless"` | + +`enterpriseImage` sets the container image used for Teleport Enterprise +agent pods created by the chart. + +You can override this to use your own Teleport image rather than a +Teleport-published image. + +By default, the image contains only the Teleport application and its runtime +dependencies, and does not contain a shell. + +This setting only takes effect when [`enterprise`](#enterprise) is `true`. +When running an enterprise version, you must use [`image`](#image) instead. + +## `imagePullSecrets` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`imagePullSecrets` is a list of secrets containing authorization tokens +which can be optionally used to access a private Docker registry. + +See the [Kubernetes +reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) +for more details. + +## `imagePullPolicy` + +| Type | Default | +|------|---------| +| `string` | `"IfNotPresent"` | + +`imagePullPolicy` sets the pull policy for any pods created by the +chart. See [the Kubernetes +documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images) +for more details. + +## `topologySpreadConstraints` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`topologySpreadConstraints` sets the topology spread constraints for +any pods created by the chart. See [the Kubernetes +documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) +for more details. + +When unset, the chart defaults to a soft topology spread constraint that tries +to spread pods across hosts and zones. + +``` +topologySpreadConstraints: + - maxSkew: 1 + topologyKey: kubernetes.io/hostname + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: # dynamically computed + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: # dynamically computed +``` + +## `disableTopologySpreadConstraints` + +| Type | Default | +|------|---------| +| `bool` | `false` | + +`disableTopologySpreadConstraints` turns off the default topology +spread constraints. + +## `affinity` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`affinity` sets the affinities for any pods created by the chart. See +[the Kubernetes +documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) +for more details. + +## `tolerations` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`tolerations` sets the tolerations for any pods created by the chart. +See [the Kubernetes +documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) +for more details. + +## `teleportConfig` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`teleportConfig` contains YAML teleport configuration to pass to the +Teleport pods. The configuration will be merged with the chart-generated +configuration and will take precedence in case of conflict. + +See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields. + +## `extraArgs` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`extraArgs` contains extra arguments to pass to `teleport start` for +the main Teleport container. + +## `extraEnv` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`extraEnv` contains extra environment variables to set in the main +Teleport container. + +For example: +```yaml +extraEnv: + - name: HTTPS_PROXY + value: "http://username:password@my.proxy.host:3128" +``` + +## `extraVolumes` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`extraVolumes` contains extra volumes to mount into the Teleport pods. +See [the Kubernetes volume +documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more +details. + +For example: +```yaml +extraVolumes: +- name: myvolume + secret: + secretName: testSecret +``` + +## `extraVolumeMounts` + +| Type | Default | +|------|---------| +| `list` | `[]` | + +`extraVolumeMounts` contains extra volumes mounts for the main Teleport +container. See [the Kubernetes volume +documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more +details. + +For example: +```yaml +extraVolumesMounts: +- name: myvolume + mountPath: /path/on/host +``` + +## `dnsConfig` + +| Type | Default | +|------|---------| +| `object` | `{}` | + +`dnsConfig` contains custom Pod DNS Configuration for the agent pods. +This value is useful if you need to reduce the DNS load: set "ndots" to 0 and +only use FQDNs to refer to remote hosts. + +See [the Kubernetes pod DNS documentation +](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) +for more information. + +For example: +```yaml + nameservers: + - 1.2.3.4 + searches: + - ns1.svc.cluster-domain.example + - my.dns.search.suffix + options: + - name: ndots + value: "2" +``` + +## `dnsPolicy` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`dnsPolicy` sets the Pod's DNS Policy + +See [the Kubernetes pod DNS documentation +](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) +for more information. + +## `hostAliases` + +`hostAliases` sets Host aliases in the Teleport Pod. See [the Kubernetes +hosts file +documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/) +for more details. + +For example: +```yaml +hostAliases: + - ip: "127.0.0.1" + hostnames: + - "foo.local" + - "bar.local" + - ip: "10.1.2.3" + hostnames: + - "foo.remote" + - "bar.remote" +``` + +## `tls` + +`tls` contains settings for mounting your own TLS material in the agent pod. + +### `tls.existingCASecretName` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`tls.existingCASecretName` sets the `SSL_CERT_FILE` environment +variable to load a trusted CA or bundle in PEM format into Teleport pods. +The injected CA will be used to validate TLS communications with the Proxy +Service. + +You must create a secret containing the CA certs in the same namespace as +Teleport using a command like: + +```code +$ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem +``` + +### `tls.existingCASecretKeyName` + +| Type | Default | +|------|---------| +| `string` | `"ca.pem"` | + +`tls.existingCASecretKeyName` determines which key in the CA secret +will be used as a trusted CA bundle file. + +## `insecureSkipProxyTLSVerify` + +| Type | Default | +|------|---------| +| `bool` | `false` | + +`insecureSkipProxyTLSVerify` disables TLS verification of the TLS +certificate presented by the Proxy Service. + +This can be used for joining a Teleport instance to a Teleport cluster which +does not have valid TLS certificates for testing. + + + + Using a self-signed TLS certificate and disabling TLS verification is OK for + testing, but is not viable when running a production Teleport cluster as it + will drastically reduce security. You must configure valid TLS certificates + on your Teleport cluster for production workloads. + + One option might be to use Teleport's built-in [ACME + support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable + [cert-manager + support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager). + + + +## `securityContext` + +| Type | Default | +|------|---------| +| `object` | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | + +`securityContext` sets the container security context for any pods +created by the chart. See [the Kubernetes +documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) +for more details. + +The default value is compatible with [the restricted +PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/). + +To unset the security context, set it to `null` or `~`. + +## `podSecurityContext` + +| Type | Default | +|------|---------| +| `object` | `{"fsGroup":65532}` | + +`podSecurityContext` sets the pod security context for any pods +created by the chart. See [the Kubernetes +documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) +for more details. + +To unset the security context, set it to `null` or `~`. + +## `priorityClassName` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`priorityClassName` sets the priority class used by any pods created by the chart. +The user is responsible for creating the `PriorityClass` resource before deploying the chart. +See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) +for more details. + +## `nameOverride` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`nameOverride` optionally overrides the name of the chart, used +together with the release name when giving a name to resources. + +## `fullnameOverride` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`fullnameOverride` optionally overrides the full name of resources. + +## `teleportVersionOverride` + +| Type | Default | +|------|---------| +| `string` | `""` | + +`teleportVersionOverride` controls the Teleport Kubernetes Operator +image version deployed by the chart. + +Normally, the version of the Teleport Kubernetes Operator matches the version +of the chart. If you install chart version 15.0.0, you'll use Teleport version +15.0.0. Upgrading the agent is done by upgrading the chart. + + + + `teleportVersionOverride` is intended for development and MUST NOT be used + to control the Teleport version in a typical deployment. This chart is + designed to run a specific Teleport version. You will face compatibility + issues trying to run a different Teleport version with it. + + If you want to run Teleport version `X.Y.Z`, you should use `helm install + --version X.Y.Z` instead. + + diff --git a/examples/chart/.lint-config.yaml b/examples/chart/.lint-config.yaml index df72f345818..d8049b35bb9 100644 --- a/examples/chart/.lint-config.yaml +++ b/examples/chart/.lint-config.yaml @@ -5,3 +5,8 @@ rules: min-spaces-after: 0 line-length: max: 120 + indentation: + # helm's toYaml template function adds zero indentation to arrays but we + # generally add it in our manual templates; "whatever" means that any + # indentation level is fine (as long as it's the same within the same array) + indent-sequences: whatever diff --git a/examples/chart/Makefile b/examples/chart/Makefile index 017864ae573..efa442bb5e0 100644 --- a/examples/chart/Makefile +++ b/examples/chart/Makefile @@ -7,7 +7,7 @@ check_access = $(addprefix check-chart-ref-access-,$(access)) render_access = $(addprefix render-chart-ref-access-,$(access)) .PHONY: render-chart-ref -render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-tbot $(render_access) # render-chart-ref-teleport-cluster +render-chart-ref: render-chart-ref-example render-chart-ref-teleport-operator render-chart-ref-teleport-kube-agent render-chart-ref-teleport-relay render-chart-ref-tbot $(render_access) # render-chart-ref-teleport-cluster .PHONY: render-chart-ref-example render-chart-ref-example: @@ -25,6 +25,11 @@ render-chart-ref-teleport-kube-agent: cd ../../build.assets/tooling && \ go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx +.PHONY: render-chart-ref-teleport-relay +render-chart-ref-teleport-relay: + cd ../../build.assets/tooling && \ + go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay/ -output ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx + .PHONY: render-chart-ref-teleport-operator render-chart-ref-teleport-operator: cd ../../build.assets/tooling && \ @@ -41,7 +46,7 @@ render-chart-ref-access-%: go run ./cmd/render-helm-ref -chart ../../examples/chart/access/$* -output ../../docs/pages/includes/helm-reference/zz_generated.access-$*.mdx .PHONY: check-chart-ref -check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-tbot $(check_access) #check-chart-ref-teleport-cluster +check-chart-ref: check-chart-ref-example check-chart-ref-teleport-operator check-chart-ref-teleport-kube-agent check-chart-ref-teleport-relay check-chart-ref-tbot $(check_access) #check-chart-ref-teleport-cluster .PHONY: check-chart-ref-example check-chart-ref-example: @@ -64,6 +69,13 @@ check-chart-ref-teleport-kube-agent: go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-kube-agent -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx - || \ ( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 ) +.PHONY: check-chart-ref-teleport-relay +check-chart-ref-teleport-relay: + @ echo "Checking teleport-relay reference" + @ cd ../../build.assets/tooling && \ + GOWORK=off go run ./cmd/render-helm-ref -chart ../../examples/chart/teleport-relay -output - | diff ../../docs/pages/includes/helm-reference/zz_generated.teleport-relay.mdx - || \ + ( echo "Chart values.yaml and reference differ, please run 'make -C examples/chart render-chart-ref'" && exit 1 ) + .PHONY: check-chart-ref-teleport-operator check-chart-ref-teleport-operator: @echo "Checking teleport-operator reference" diff --git a/examples/chart/teleport-relay/.helmignore b/examples/chart/teleport-relay/.helmignore new file mode 100644 index 00000000000..0e8a0eb36f4 --- /dev/null +++ b/examples/chart/teleport-relay/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/examples/chart/teleport-relay/.lint/exercise-configmap.yaml b/examples/chart/teleport-relay/.lint/exercise-configmap.yaml new file mode 100644 index 00000000000..23a1d09d242 --- /dev/null +++ b/examples/chart/teleport-relay/.lint/exercise-configmap.yaml @@ -0,0 +1,24 @@ +joinParams: + tokenName: token-name-2 + method: join-method-2 + +proxyAddr: proxy-2.example.com:443 + +log: + level: randomLogLevel + format: randomLogFormat + +shutdownDelay: "90s" + +relayGroup: relay-group-2 + +publicHostnames: + - public-hostname-3.example.com + - public-hostname-4.example.com + +targetConnectionCount: 42 + +highAvailability: + replicaCount: 0 + +proxyProtocol: true diff --git a/examples/chart/teleport-relay/.lint/simple.yaml b/examples/chart/teleport-relay/.lint/simple.yaml new file mode 100644 index 00000000000..09bc0e0e8c4 --- /dev/null +++ b/examples/chart/teleport-relay/.lint/simple.yaml @@ -0,0 +1,11 @@ +joinParams: + tokenName: token-name + method: join-method + +proxyAddr: proxy.example.com:443 + +relayGroup: relay-group + +publicHostnames: + - public-hostname-1.example.com + - public-hostname-2.example.com diff --git a/examples/chart/teleport-relay/Chart.yaml b/examples/chart/teleport-relay/Chart.yaml new file mode 100644 index 00000000000..d3d2a5f7c8e --- /dev/null +++ b/examples/chart/teleport-relay/Chart.yaml @@ -0,0 +1,10 @@ +.version: &version "19.0.0-dev" + +name: teleport-relay +apiVersion: v2 +version: *version +appVersion: *version +description: This chart deploys the Teleport Relay service. +icon: https://goteleport.com/static/teleport-symbol-bimi.svg +keywords: + - Teleport diff --git a/examples/chart/teleport-relay/templates/NOTES.txt b/examples/chart/teleport-relay/templates/NOTES.txt new file mode 100644 index 00000000000..8883ab66dde --- /dev/null +++ b/examples/chart/teleport-relay/templates/NOTES.txt @@ -0,0 +1,9 @@ +{{- if .Values.teleportVersionOverride }} + +DANGER: `teleportVersionOverride` MUST NOT be used to control the Teleport version. +This chart is designed to run Teleport version {{ .Chart.AppVersion }}. +You will face compatibility issues trying to run a different Teleport version with it. + +If you want to run Teleport version {{.Values.teleportVersionOverride}}, +you should use `helm --version {{.Values.teleportVersionOverride}}` instead. +{{- end }} diff --git a/examples/chart/teleport-relay/templates/_config.tpl b/examples/chart/teleport-relay/templates/_config.tpl new file mode 100644 index 00000000000..a6f98746857 --- /dev/null +++ b/examples/chart/teleport-relay/templates/_config.tpl @@ -0,0 +1,41 @@ +{{- define "teleport-relay.config" -}} +version: v3 +teleport: + join_params: + method: {{ required "joinParams.method is required in chart values" .Values.joinParams.method | quote }} + token_name: "/etc/teleport-secrets/auth-token" + proxy_server: {{ required "proxyAddr is required in chart values" .Values.proxyAddr | quote }} + log: + severity: {{ required "log.level is required in chart values" .Values.log.level | quote }} + format: + output: {{ required "log.format is required in chart values" .Values.log.format | quote }} + diag_addr: "0.0.0.0:3000" + {{- with .Values.shutdownDelay }} + shutdown_delay: {{ quote . }} + {{- end }} +auth_service: + enabled: false +proxy_service: + enabled: false +ssh_service: + enabled: false +relay_service: + enabled: true + relay_group: {{ required "relayGroup is required in chart values" .Values.relayGroup | quote }} + {{- if le (int .Values.targetConnectionCount) 0 }} + {{ fail "targetConnectionCount must be greater than 0" }} + {{- end }} + target_connection_count: {{ int .Values.targetConnectionCount }} + {{- if empty .Values.publicHostnames }} + {{- fail "publicHostnames cannot be empty in chart values" }} + {{- end }} + public_hostnames: + {{- toYaml .Values.publicHostnames | nindent 4 }} + transport_listen_addr: "0.0.0.0:3040" + peer_listen_addr: "0.0.0.0:3041" + tunnel_listen_addr: "0.0.0.0:3042" + {{- if .Values.proxyProtocol }} + transport_proxy_protocol: true + tunnel_proxy_protocol: true + {{- end }} +{{- end -}} diff --git a/examples/chart/teleport-relay/templates/_helpers.tpl b/examples/chart/teleport-relay/templates/_helpers.tpl new file mode 100644 index 00000000000..66aee87f3e6 --- /dev/null +++ b/examples/chart/teleport-relay/templates/_helpers.tpl @@ -0,0 +1,87 @@ +{{- define "teleport-relay.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +This is a modified version of the default fully qualified app name helper. +We diverge by always honouring "nameOverride" when it's set, as opposed to the +default behaviour of shortening if `nameOverride` is included in chart name. +This is done to avoid naming conflicts when including the chart in other charts. +*/}} +{{- define "teleport-relay.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- if .Values.nameOverride }} +{{- printf "%s-%s" .Release.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- if contains .Chart.Name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "teleport-relay.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "teleport-relay.selectorLabels" -}} +app.kubernetes.io/name: {{ include "teleport-relay.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "teleport-relay.labels" -}} +helm.sh/chart: {{ include "teleport-relay.chart" . }} +{{ include "teleport-relay.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "teleport-relay.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "teleport-relay.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- required "serviceAccount.name is required in chart values if serviceAccount.create is false" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "teleport-relay.version" -}} +{{ default .Chart.AppVersion .Values.teleportVersionOverride }} +{{- end }} + +{{- define "teleport-relay.baseImage" -}} +{{- if .Values.enterprise }} + {{- .Values.enterpriseImage }} +{{- else }} + {{- .Values.image }} +{{- end }} +{{- end }} + +{{- define "teleport-relay.image" -}} +{{ include "teleport-relay.baseImage" . }}:{{ include "teleport-relay.version" . }} +{{- end }} + +{{- define "teleport-relay.joinTokenSecretName" -}} +{{- if .Values.joinTokenSecret.create }} +{{- default (include "teleport-relay.fullname" .) .Values.joinTokenSecret.name }} +{{- else }} +{{- required "joinTokenSecret.name is required in chart values if joinTokenSecret.create is false" .Values.joinTokenSecret.name }} +{{- end }} +{{- end }} diff --git a/examples/chart/teleport-relay/templates/configmap.yaml b/examples/chart/teleport-relay/templates/configmap.yaml new file mode 100644 index 00000000000..fda395d5ebf --- /dev/null +++ b/examples/chart/teleport-relay/templates/configmap.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "teleport-relay.fullname" . }} + labels: + {{- include "teleport-relay.labels" . | nindent 4 }} + {{- with .Values.extraLabels.config }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.config }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +data: + teleport.yaml: | + {{- mustMergeOverwrite (include "teleport-relay.config" . | fromYaml) .Values.teleportConfig | toYaml | nindent 4 -}} diff --git a/examples/chart/teleport-relay/templates/deployment.yaml b/examples/chart/teleport-relay/templates/deployment.yaml new file mode 100644 index 00000000000..e21d108ade0 --- /dev/null +++ b/examples/chart/teleport-relay/templates/deployment.yaml @@ -0,0 +1,224 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "teleport-relay.fullname" . }} + labels: + {{- include "teleport-relay.labels" . | nindent 4 }} + {{- with .Values.extraLabels.deployment }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.deployment }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "teleport-relay.selectorLabels" . | nindent 6 }} + {{- $replicaCount := int .Values.highAvailability.replicaCount }} + {{- if and (gt $replicaCount 0) (lt $replicaCount (int .Values.targetConnectionCount)) }} + {{- fail "highAvailability.replicaCount must not be smaller than targetConnectionCount" }} + {{- end }} + replicas: {{ $replicaCount }} + template: + metadata: + labels: + {{- include "teleport-relay.labels" . | nindent 8 }} + {{- with .Values.extraLabels.pod }} + {{- toYaml . | nindent 8 }} + {{- end }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- with .Values.annotations.pod }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "teleport-relay.serviceAccountName" . | quote }} + automountServiceAccountToken: false + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ quote . }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.dnsPolicy }} + dnsPolicy: {{ quote . }} + {{- end }} + {{- with .Values.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if and .Values.topologySpreadConstraints .Values.disableTopologySpreadConstraints }} + {{- fail "disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values"}} + {{- end }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml .Values.topologySpreadConstraints | nindent 8 }} + {{- else if not .Values.disableTopologySpreadConstraints }} + topologySpreadConstraints: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + {{- include "teleport-relay.selectorLabels" . | nindent 14 }} + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + {{- include "teleport-relay.selectorLabels" . | nindent 14 }} + {{- end }} + volumes: + - name: config + configMap: + name: {{ include "teleport-relay.fullname" . }} + - name: auth-token + secret: + secretName: {{ include "teleport-relay.joinTokenSecretName" . }} + - name: data + emptyDir: {} + {{- with .Values.tls.existingCASecretName }} + - name: teleport-tls-ca + secret: + secretName: {{ quote . }} + {{- end }} + {{- with .Values.teleportClusterName }} + {{- /* This volume is used to obtain a service account token that can be + used to join the Teleport cluster using the kubernetes join method. To + ensure Kubernetes compatibility, we use .Values.teleportClusterName as + a feature flag. The token must have the cluster name as audience, and + its TTL must not exceed 30 minutes. We pick 10 minutes because that's + the shortest lifetime for the token. */}} + - name: join-sa-token + projected: + sources: + - serviceAccountToken: + path: join-sa-token + expirationSeconds: 600 + audience: {{ quote . }} + {{- end }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: teleport + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + image: {{ include "teleport-relay.image" . | quote }} + {{- with .Values.imagePullPolicy }} + imagePullPolicy: {{ quote . }} + {{- end }} + command: + - /usr/bin/dumb-init + - "--" + - /usr/local/bin/teleport + args: + - start + {{- if .Values.insecureSkipProxyTLSVerify }} + - "--insecure" + {{- end }} + {{- with .Values.extraArgs }} + {{- toYaml . | nindent 12 }} + {{- end }} + env: + {{- /* This variable is set for telemetry purposes. + Telemetry is opt-in and controlled at the auth level. */}} + - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT + value: "true" + {{- if .Values.teleportClusterName }} + - name: KUBERNETES_TOKEN_PATH + value: /var/run/secrets/teleport-join-sa-token/join-sa-token + {{- end }} + {{- if .Values.tls.existingCASecretName }} + - name: SSL_CERT_FILE + value: /etc/teleport-tls-ca.pem + {{- end }} + {{- with .Values.extraEnv }} + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - containerPort: 3000 + name: diagnostics + protocol: TCP + - containerPort: 3040 + name: transport + protocol: TCP + - containerPort: 3041 + name: peer + protocol: TCP + - containerPort: 3042 + name: tunnel + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: diagnostics + failureThreshold: 6 + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + readinessProbe: + httpGet: + path: /readyz + port: diagnostics + failureThreshold: 12 + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 1 + {{- with .Values.preStopDelay }} + lifecycle: + {{- /* waiting during preStop ensures that load balancers have time + to stop sending new connections to the Terminating pod */}} + preStop: + exec: + command: + - /usr/local/bin/teleport + - wait + - duration + - {{ quote . }} + {{- end }} + volumeMounts: + - mountPath: /var/lib/teleport + name: data + - mountPath: /etc/teleport.yaml + name: config + subPath: teleport.yaml + - mountPath: /etc/teleport-secrets + name: auth-token + {{- if .Values.teleportClusterName }} + - mountPath: /var/run/secrets/teleport-join-sa-token + name: join-sa-token + {{- end }} + {{- if .Values.tls.existingCASecretName }} + - mountPath: /etc/teleport-tls-ca.pem + name: teleport-tls-ca + subPath: {{ required "tls.existingCASecretKeyName must be set if tls.existingCASecretName is set in chart values" .Values.tls.existingCASecretKeyName | quote }} + {{- end }} + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} diff --git a/examples/chart/teleport-relay/templates/pdb.yaml b/examples/chart/teleport-relay/templates/pdb.yaml new file mode 100644 index 00000000000..2146124b649 --- /dev/null +++ b/examples/chart/teleport-relay/templates/pdb.yaml @@ -0,0 +1,20 @@ +{{- if .Values.highAvailability.podDisruptionBudget.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "teleport-relay.fullname" . }} + labels: + {{- include "teleport-relay.labels" . | nindent 4 }} + {{- with .Values.extraLabels.podDisruptionBudget }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.podDisruptionBudget }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + minAvailable: {{ .Values.highAvailability.podDisruptionBudget.minAvailable }} + selector: + matchLabels: + {{- include "teleport-relay.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/examples/chart/teleport-relay/templates/secret.yaml b/examples/chart/teleport-relay/templates/secret.yaml new file mode 100644 index 00000000000..07859f15b71 --- /dev/null +++ b/examples/chart/teleport-relay/templates/secret.yaml @@ -0,0 +1,17 @@ +{{- if .Values.joinTokenSecret.create }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "teleport-relay.joinTokenSecretName" . | quote }} + {{- with .Values.extraLabels.secret }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.secret }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +type: Opaque +stringData: + auth-token: {{ required "joinParams.tokenName must be specified if joinTokenSecret.create is enabled" .Values.joinParams.tokenName | quote }} +{{- end }} diff --git a/examples/chart/teleport-relay/templates/service.yaml b/examples/chart/teleport-relay/templates/service.yaml new file mode 100644 index 00000000000..bbabf706919 --- /dev/null +++ b/examples/chart/teleport-relay/templates/service.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "teleport-relay.fullname" . }} + labels: + {{- include "teleport-relay.labels" . | nindent 4 }} + {{- with .Values.extraLabels.service }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.service }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ required "service.type must be set in chart values" .Values.service.type | quote }} + ports: + - name: transport + port: 443 + targetPort: transport + protocol: TCP + - name: tunnel + port: 3042 + targetPort: tunnel + protocol: TCP + selector: + {{- include "teleport-relay.selectorLabels" . | nindent 4 }} + {{- with .Values.service.spec }} + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/examples/chart/teleport-relay/templates/serviceaccount.yaml b/examples/chart/teleport-relay/templates/serviceaccount.yaml new file mode 100644 index 00000000000..c2217dde773 --- /dev/null +++ b/examples/chart/teleport-relay/templates/serviceaccount.yaml @@ -0,0 +1,16 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "teleport-relay.serviceAccountName" . }} + labels: + {{- include "teleport-relay.labels" . | nindent 4 }} + {{- with .Values.extraLabels.serviceAccount }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.annotations.serviceAccount }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: false +{{- end }} diff --git a/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap b/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap new file mode 100644 index 00000000000..3834076c7da --- /dev/null +++ b/examples/chart/teleport-relay/tests/__snapshot__/configmap_test.yaml.snap @@ -0,0 +1,64 @@ +teleport.yaml matches the snapshot (exercise-configmap): + 1: | + |- + auth_service: + enabled: false + proxy_service: + enabled: false + relay_service: + enabled: true + peer_listen_addr: 0.0.0.0:3041 + public_hostnames: + - public-hostname-3.example.com + - public-hostname-4.example.com + relay_group: relay-group-2 + target_connection_count: 42 + transport_listen_addr: 0.0.0.0:3040 + transport_proxy_protocol: true + tunnel_listen_addr: 0.0.0.0:3042 + tunnel_proxy_protocol: true + ssh_service: + enabled: false + teleport: + diag_addr: 0.0.0.0:3000 + join_params: + method: join-method-2 + token_name: /etc/teleport-secrets/auth-token + log: + format: + output: randomLogFormat + severity: randomLogLevel + proxy_server: proxy-2.example.com:443 + shutdown_delay: 90s + version: v3 +teleport.yaml matches the snapshot (simple): + 1: | + |- + auth_service: + enabled: false + proxy_service: + enabled: false + relay_service: + enabled: true + peer_listen_addr: 0.0.0.0:3041 + public_hostnames: + - public-hostname-1.example.com + - public-hostname-2.example.com + relay_group: relay-group + target_connection_count: 2 + transport_listen_addr: 0.0.0.0:3040 + tunnel_listen_addr: 0.0.0.0:3042 + ssh_service: + enabled: false + teleport: + diag_addr: 0.0.0.0:3000 + join_params: + method: join-method + token_name: /etc/teleport-secrets/auth-token + log: + format: + output: json + severity: INFO + proxy_server: proxy.example.com:443 + shutdown_delay: 30s + version: v3 diff --git a/examples/chart/teleport-relay/tests/configmap_test.yaml b/examples/chart/teleport-relay/tests/configmap_test.yaml new file mode 100644 index 00000000000..50675dc26b6 --- /dev/null +++ b/examples/chart/teleport-relay/tests/configmap_test.yaml @@ -0,0 +1,95 @@ +suite: Test ConfigMap +templates: + - configmap.yaml + +tests: + - it: creates a config map + values: + - ../.lint/simple.yaml + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: ConfigMap + apiVersion: v1 + name: RELEASE-NAME-teleport-relay + - isNotNull: + path: data.teleport\.yaml + - it: includes extraLabels and annotations + values: + - ../.lint/simple.yaml + set: + extraLabels: + config: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + config: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + + - it: fails if joinParams.method is missing + values: + - ../.lint/simple.yaml + set: + joinParams: + method: "" + asserts: + - failedTemplate: + errorMessage: joinParams.method is required in chart values + - it: fails if proxyAddr is missing + values: + - ../.lint/simple.yaml + set: + proxyAddr: "" + asserts: + - failedTemplate: + errorMessage: proxyAddr is required in chart values + - it: fails if relayGroup is missing + values: + - ../.lint/simple.yaml + set: + relayGroup: "" + asserts: + - failedTemplate: + errorMessage: relayGroup is required in chart values + - it: fails if targetConnectionCount is not positive + values: + - ../.lint/simple.yaml + set: + targetConnectionCount: -3 + asserts: + - failedTemplate: + errorMessage: targetConnectionCount must be greater than 0 + - it: fails if publicHostnames is empty + values: + - ../.lint/simple.yaml + set: + publicHostnames: [] + asserts: + - failedTemplate: + errorMessage: publicHostnames cannot be empty in chart values + + - it: teleport.yaml matches the snapshot (simple) + values: + - ../.lint/simple.yaml + asserts: + - matchSnapshot: + path: data.teleport\.yaml + - it: teleport.yaml matches the snapshot (exercise-configmap) + values: + - ../.lint/exercise-configmap.yaml + asserts: + - matchSnapshot: + path: data.teleport\.yaml diff --git a/examples/chart/teleport-relay/tests/deployment_test.yaml b/examples/chart/teleport-relay/tests/deployment_test.yaml new file mode 100644 index 00000000000..22c77d16802 --- /dev/null +++ b/examples/chart/teleport-relay/tests/deployment_test.yaml @@ -0,0 +1,318 @@ +suite: Test Deployment +templates: + - configmap.yaml + - deployment.yaml + +tests: + - it: creates a deployment + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: Deployment + apiVersion: apps/v1 + name: RELEASE-NAME-teleport-relay + + - it: includes extraLabels and annotations + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + extraLabels: + deployment: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + deployment: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + - it: includes extraLabels and annotations in the pod template + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + extraLabels: + pod: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + pod: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: spec.template.metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - isSubset: + path: spec.template.metadata.annotations + content: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + + - it: pods are selected by deployment, service and pdb + template: deployment.yaml + values: + - ../.lint/simple.yaml + # these selector labels are also checked to be matched in service_test.yaml + # and pdb_test.yaml + asserts: + - equal: + path: spec.selector.matchLabels + value: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + - isSubset: + path: spec.template.metadata.labels + content: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + + - it: pods are selected by the default topologySpreadConstraints + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - equal: + path: spec.template.spec.topologySpreadConstraints + value: + - topologyKey: kubernetes.io/hostname + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + - topologyKey: topology.kubernetes.io/zone + maxSkew: 1 + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + + - it: refuses to set and disable topologySpreadConstraints at the same time + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + disableTopologySpreadConstraints: true + topologySpreadConstraints: nonempty + asserts: + - failedTemplate: + errorMessage: disableTopologySpreadConstraints cannot be enabled if topologySpreadConstraints is set in chart values + + - it: requires the target connection count to be not greater than the replica count + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + highAvailability: + replicaCount: 2 + targetConnectionCount: 3 + asserts: + - failedTemplate: + errorMessage: highAvailability.replicaCount must not be smaller than targetConnectionCount + + - it: allows the replica count to be zero no matter the target connection count + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + highAvailability: + replicaCount: 0 + targetConnectionCount: 3 + asserts: + - equal: + path: spec.replicas + value: 0 + + - it: chooses the default service account and join token + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: RELEASE-NAME-teleport-relay + - contains: + path: spec.template.spec.volumes + content: + name: auth-token + secret: + secretName: RELEASE-NAME-teleport-relay + + - it: chooses the customized service account and join token + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + serviceAccount: + name: randomServiceAccountName + joinTokenSecret: + name: randomSecretName + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: randomServiceAccountName + - contains: + path: spec.template.spec.volumes + content: + name: auth-token + secret: + secretName: randomSecretName + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + mountPath: /etc/teleport-secrets + name: auth-token + + - it: chooses the correct configmap + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: config + configMap: + name: RELEASE-NAME-teleport-relay + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + mountPath: /etc/teleport.yaml + name: config + subPath: teleport.yaml + + - it: defines the projected service account token with the appropriate audience + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + teleportClusterName: randomTeleportClusterName + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: join-sa-token + projected: + sources: + - serviceAccountToken: + path: join-sa-token + expirationSeconds: 600 + audience: randomTeleportClusterName + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + mountPath: /var/run/secrets/teleport-join-sa-token + name: join-sa-token + - contains: + path: spec.template.spec.containers[0].env + content: + name: KUBERNETES_TOKEN_PATH + value: /var/run/secrets/teleport-join-sa-token/join-sa-token + - it: does not include a projected service account if teleportClusterName is not set + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - notContains: + path: spec.template.spec.volumes + content: + name: join-sa-token + any: true + - notContains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: join-sa-token + any: true + - notContains: + path: spec.template.spec.containers[0].env + content: + name: KUBERNETES_TOKEN_PATH + any: true + + - it: defines the ports referenced by the service + template: deployment.yaml + values: + - ../.lint/simple.yaml + # these are values checked for in service_test.yaml + asserts: + - contains: + path: spec.template.spec.containers[0].ports + content: + name: transport + protocol: TCP + any: true + - contains: + path: spec.template.spec.containers[0].ports + content: + name: tunnel + protocol: TCP + any: true + + - it: uses the non-enterprise image by default + chart: + appVersion: 12.34.56-sigma + template: deployment.yaml + values: + - ../.lint/simple.yaml + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: public.ecr.aws/gravitational/teleport-distroless:12.34.56-sigma + - it: uses the enterprise image if the option is set + chart: + appVersion: 12.34.56-sigma + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + enterprise: true + asserts: + - equal: + path: spec.template.spec.containers[0].image + value: public.ecr.aws/gravitational/teleport-ent-distroless:12.34.56-sigma + + - it: mounts a secret for SSL_CERT_FILE if the option is set + template: deployment.yaml + values: + - ../.lint/simple.yaml + set: + tls: + existingCASecretName: randomCASecretName + existingCASecretKeyName: randomCASecretKeyName + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: teleport-tls-ca + secret: + secretName: randomCASecretName + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + mountPath: /etc/teleport-tls-ca.pem + name: teleport-tls-ca + subPath: randomCASecretKeyName + - contains: + path: spec.template.spec.containers[0].env + content: + name: SSL_CERT_FILE + value: /etc/teleport-tls-ca.pem diff --git a/examples/chart/teleport-relay/tests/pdb_test.yaml b/examples/chart/teleport-relay/tests/pdb_test.yaml new file mode 100644 index 00000000000..01ee55ec6eb --- /dev/null +++ b/examples/chart/teleport-relay/tests/pdb_test.yaml @@ -0,0 +1,73 @@ +suite: Test PodDisruptionBudget +templates: + - pdb.yaml + +tests: + - it: does not create a PDB by default + asserts: + - hasDocuments: + count: 0 + - it: creates a PDB if highAvailability.podDisruptionBudget.enabled is set + set: + highAvailability: + podDisruptionBudget: + enabled: true + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: PodDisruptionBudget + apiVersion: policy/v1 + name: RELEASE-NAME-teleport-relay + - equal: + path: spec.minAvailable + value: 1 + - it: sets the custom minAvailable from the values + set: + highAvailability: + podDisruptionBudget: + enabled: true + minAvailable: 42 + asserts: + - equal: + path: spec.minAvailable + value: 42 + + - it: selects the deployment pods + set: + highAvailability: + podDisruptionBudget: + enabled: true + # the selector labels are checked to be in the deployment template in + # deployment_test.yaml + asserts: + - equal: + path: spec.selector.matchLabels + value: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + + - it: includes extraLabels and annotations + set: + highAvailability: + podDisruptionBudget: + enabled: true + extraLabels: + podDisruptionBudget: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + podDisruptionBudget: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 diff --git a/examples/chart/teleport-relay/tests/secret_test.yaml b/examples/chart/teleport-relay/tests/secret_test.yaml new file mode 100644 index 00000000000..d63c952ce64 --- /dev/null +++ b/examples/chart/teleport-relay/tests/secret_test.yaml @@ -0,0 +1,70 @@ +suite: Test Secret +templates: + - secret.yaml + +tests: + - it: creates a secret by default + set: + joinParams: + tokenName: randomTokenName + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: Secret + apiVersion: v1 + name: RELEASE-NAME-teleport-relay + - it: fails if joinParams.tokenName is missing + asserts: + - failedTemplate: + errorMessage: joinParams.tokenName must be specified if joinTokenSecret.create is enabled + - it: the secret contains the token in auth-token + set: + joinParams: + tokenName: randomTokenName + asserts: + - equal: + path: stringData.auth-token + value: randomTokenName + + - it: does not create a secret account if joinTokenSecret.create is false + set: + joinTokenSecret: + create: false + asserts: + - hasDocuments: + count: 0 + - it: creates a secret with the configured name + set: + joinParams: + tokenName: randomTokenName + joinTokenSecret: + name: randomSecretName + asserts: + - equal: + path: metadata.name + value: randomSecretName + + - it: includes extraLabels and annotations + set: + joinParams: + tokenName: randomTokenName + extraLabels: + secret: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + secret: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 diff --git a/examples/chart/teleport-relay/tests/service_test.yaml b/examples/chart/teleport-relay/tests/service_test.yaml new file mode 100644 index 00000000000..518213c66ba --- /dev/null +++ b/examples/chart/teleport-relay/tests/service_test.yaml @@ -0,0 +1,100 @@ +suite: Test Service +templates: + - service.yaml + +tests: + - it: creates a service + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: Service + apiVersion: v1 + name: RELEASE-NAME-teleport-relay + + - it: defines the expected ports + # the port names are checked in deployment_test.yaml + asserts: + - lengthEqual: + path: spec.ports + count: 2 + - contains: + path: spec.ports + content: + name: transport + port: 443 + targetPort: transport + protocol: TCP + - contains: + path: spec.ports + content: + name: tunnel + port: 3042 + targetPort: tunnel + protocol: TCP + + - it: selects the deployment pods + # the selector labels are checked to be in the deployment template in + # deployment_test.yaml + asserts: + - equal: + path: spec.selector + value: + app.kubernetes.io/instance: RELEASE-NAME + app.kubernetes.io/name: teleport-relay + + - it: requires service.type + set: + service: + type: "" + asserts: + - failedTemplate: + errorMessage: service.type must be set in chart values + - it: the default service type is LoadBalancer + asserts: + - equal: + path: spec.type + value: LoadBalancer + - it: service.type sets the service type + set: + service: + type: serviceType + asserts: + - equal: + path: spec.type + value: serviceType + + - it: includes service.spec, extraLabels and annotations + set: + service: + spec: + specKey1: + - specValue1 + - 42 + specKey2: specValue2 + extraLabels: + service: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + service: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + - isSubset: + path: spec + content: + specKey2: specValue2 + specKey1: + - specValue1 + - 42 diff --git a/examples/chart/teleport-relay/tests/serviceaccount_test.yaml b/examples/chart/teleport-relay/tests/serviceaccount_test.yaml new file mode 100644 index 00000000000..66983b80ade --- /dev/null +++ b/examples/chart/teleport-relay/tests/serviceaccount_test.yaml @@ -0,0 +1,49 @@ +suite: Test ServiceAccount +templates: + - serviceaccount.yaml + +tests: + - it: creates a service account by default + asserts: + - hasDocuments: + count: 1 + - containsDocument: + kind: ServiceAccount + apiVersion: v1 + name: RELEASE-NAME-teleport-relay + - it: does not create a service account if serviceAccount.create is false + set: + serviceAccount: + create: false + asserts: + - hasDocuments: + count: 0 + - it: creates a service account with the configured name + set: + serviceAccount: + name: randomServiceAccountName + asserts: + - equal: + path: metadata.name + value: randomServiceAccountName + - it: includes extraLabels and annotations + set: + extraLabels: + serviceAccount: + labelName1: labelValue1 + labelName2: labelValue2 + annotations: + serviceAccount: + annotationName1: annotationValue1 + annotationName2: annotationValue2 + asserts: + - isSubset: + path: metadata.labels + content: + labelName1: labelValue1 + labelName2: labelValue2 + - equal: + path: metadata.annotations + value: + annotationName1: annotationValue1 + annotationName2: annotationValue2 diff --git a/examples/chart/teleport-relay/values.yaml b/examples/chart/teleport-relay/values.yaml new file mode 100644 index 00000000000..29077b26786 --- /dev/null +++ b/examples/chart/teleport-relay/values.yaml @@ -0,0 +1,559 @@ +# relayGroup(string) -- sets the internal identifier for the group of Relay +# instances reachable through the same load balancer. Should be unique in the +# whole Teleport cluster. +relayGroup: "" + +# publicHostnames(list) -- a list of hostnames that this Relay group is publicly +# reachable at by clients. +# +# ``` +# publicHostnames: +# - relay.example.com +# ``` +publicHostnames: [] + +# targetConnectionCount(int) -- the amount of tunnel connections that agents +# will open to distinct Relay instances. It should not be bigger than the +# replica count. +targetConnectionCount: 2 + +# proxyAddr(string) -- provides the public-facing Teleport Proxy Service +# endpoint which should be used to join the cluster. This is the same URL used +# to access the web UI of your Teleport cluster. The port used is usually either +# 3080 or 443. +# +# Here are a few examples: +# +# | Deployment method | Example `proxy_service.public_addr` | +# |-------------------------------|-------------------------------------| +# | On-prem Teleport cluster | `teleport.example.com:3080` | +# | Teleport Cloud cluster | `example.teleport.sh:443` | +# | `teleport-cluster` Helm chart | `teleport.example.com:443` | +proxyAddr: "" + +# enterprise(bool) -- controls if the `teleport-relay` chart should deploy the +# OSS version or the enterprise version of the container image. This must be set +# to `true` when connecting to Teleport Cloud or self-hosted Teleport Enterprise +# clusters to allow the agent to leverage enterprise features. +enterprise: false + +# joinParams -- controls how the Teleport Agent joins the Teleport cluster. +# These sub-values must be configured for the agent to connect to a cluster. +# +# The token used must grant the `Relay` role, and should be valid for the +# lifetime of the Helm release. +joinParams: + # joinParams.method(string) -- controls which join method will be used by the + # instance to join the Teleport cluster. + # + # See [the join method reference](../../reference/deployment/join-methods.mdx) + # for the list of possible values, the implications of each join method, and + # guides to set up each method. + # + # Common join-methods for the `teleport-relay` are: + # - `token`: the most basic one, with regular ephemeral secret tokens + # - `kubernetes`: either the `in-cluster` variant (if the agent runs in the + # same Kubernetes cluster as the `teleport-cluster` chart) or the + # `JWKS/OIDC` variants (work in every Kubernetes cluster, regardless of the + # Teleport Auth Service location). + method: "" + + # joinParams.tokenName(string) -- controls which token is used by the agent to + # join the Teleport cluster. + # + # When `joinParams.method` is [a delegated join + # method](../../reference/deployment/join-methods.mdx#delegated-join-methods), + # the value is not sensitive. + # + # When `joinParams.method` is `token` (by default), `joinParams.tokenName` + # contains the secret token itself. In this case, the value is sensitive and + # is automatically stored in a Kubernetes Secret instead of being directly + # included in the agent's configuration. + # + # If method is `token`, `joinParams.tokenName` can be empty if the token is + # provided through an existing Kubernetes Secret, see + # [`joinTokenSecret`](#joinTokenSecret) for more details and instructions. + # + # If method is `kubernetes`, you must set + # [`teleportClusterName`](#teleportClusterName). + tokenName: "" + +# teleportClusterName(string) -- is the name of the joined Teleport cluster. +# Setting this value is required when joining via the +# [Kubernetes JWKS or OIDC](../../reference/deployment/join-methods.mdx#kubernetes-jwks) join method. +# +# When this value is set, the chart mounts a kubernetes service account token +# via a projected volume and configures Teleport to use it for joining. +teleportClusterName: "" + +# joinTokenSecret -- manages the join token secret creation and its name. See +# the [`joinParams`](#joinParams) section for more details. +joinTokenSecret: + # joinTokenSecret.create(bool) -- controls whether the chart creates the + # Kubernetes `Secret` containing the Teleport join token. If false, you must + # create a Kubernetes Secret with the configured name in the Helm release + # namespace. + create: true + # joinTokenSecret.name(string) -- is the name of the Kubernetes Secret + # containing the Teleport join token used by the chart. + # + # If `joinTokenSecret.create` is `false`, the chart will not attempt to create + # the secret itself. Instead, it will read the value from an existing secret. + # `joinTokenSecret.name` configures the name of this secret. This allows you + # to configure this secret externally and avoid having a plaintext join token + # stored in your Teleport chart values. + # + # To create your own join token secret, you can use a command like this: + # + # ```code + # $ kubectl --namespace teleport create secret generic my-token-secret --from-literal=auth-token= + # ``` + # + # + # + # The key used for the auth token inside the secret must be `auth-token`, as + # in the command above. + # + # + # + # ```yaml + # joinTokenSecret: + # create: false + # name: my-token-secret + # + # joinParams: + # method: "token" + # tokenName: "" + # ``` + name: "" + +# proxyProtocol(bool) -- controls whether or not the connections coming from the +# load balancer will include a PROXY protocol v2 header. +proxyProtocol: false + +# log -- controls the agent logging. +log: + # log.level(string) -- is the log level for the Teleport process. + # Available log levels are: `DEBUG`, `INFO`, `WARNING`, `ERROR`. + # + # The default is `INFO`, which is recommended in production. + # `DEBUG` is useful during first-time setup or to see more detailed logs for debugging. + level: INFO + # log.format(string) -- sets the log output format for the Teleport process. + # Possible values are `text` or `json`. + format: json + +# preStopDelay(string) -- the optional time that will pass between the pod +# entering the Terminating state and the Teleport instance getting signaled to +# begin its shutdown advertisement. Useful to allow load balancers to stop +# routing connections to the terminating pod. +preStopDelay: "30s" + +# shutdownDelay(string) -- the optional time that the Teleport instance will +# wait after advertising its shutdown and before it will stop serving new +# inbound connections. +shutdownDelay: "30s" + +# terminationGracePeriodSeconds(int) -- the time allotted to a Teleport instance +# pod for termination. It should be longer than the sum of +# [`preStopDelay`](#preStopDelay) and [`shutdownDelay`](#shutdownDelay). +terminationGracePeriodSeconds: 90 + +# highAvailability -- contains settings controlling the availability of the +# Teleport Agent deployed by the chart. +# +# The availability can be increased by: +# - running more replicas with `replicaCount` +# - requiring that the Pods are not scheduled on the same Kubernetes Node with `requireAntiAffinity` +# - by asking Kubernetes not to delete all pods at the same time with `podDisruptionBudget`. +# +# Even with highAvailability settings Restarting/rolling-out pods can still cause +# disruption for established long-lived sessions. +highAvailability: + # highAvailability.replicaCount(int) -- is the number of agent replicas + # deployed by the Chart. + # + # Set to a number higher than `1` for a high availability mode where multiple + # Teleport pods will be deployed. + # + # + # + # As a rough guide, we recommend configuring one replica per distinct + # availability zone where your cluster has worker nodes. + # + # 2 replicas/availability zones will be fine for smaller workloads. 3-5 + # replicas/availability zones will be more appropriate for bigger clusters + # with more traffic. + # + # + replicaCount: 2 + + # highAvailability.podDisruptionBudget -- controls how the chart creates and + # configures a Kubernetes PodDisruptionBudget to ensure Kubernetes does not + # delete all agent replicas at the same time. + podDisruptionBudget: + # highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create + # a Kubernetes PodDisruptionBudget for the agent pods. + enabled: false + + # highAvailability.podDisruptionBudget.minAvailable(intOrString) -- is the + # minimum available pod count specified on the PodDisruptionBudget. + minAvailable: 1 + +# resources(object) -- sets the resource requests/limits for any pods created by +# the chart. See [the Kubernetes +# documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) +# for more details. +resources: {} + +# service -- options for the Service that points to the Teleport Relay +# instances. +service: + # service.type(string) -- the type of the Service. Unless you have specific + # needs, it should probably be set to LoadBalancer. + type: LoadBalancer + # service.spec(object) -- any additional entries here will be added to the + # Service spec. + # + # ``` + # spec: + # loadBalancerIP: "1.2.3.4" + # loadBalancerClass: service.k8s.aws/nlb + # ``` + spec: {} + # To set annotations on the Service, use the annotations.service value. + +# serviceAccount -- contains settings related to the Kubernetes service account +# used by pods. +serviceAccount: + # serviceAccount.create(bool) -- specifies whether a `ServiceAccount` should + # be created or if an existing one should be used. + create: true + # serviceAccount.name(string) -- the name of the `ServiceAccount` to use. If + # not set and serviceAccount.create is true, the name is generated using the + # release name. If create is false, the name will be used to reference an + # existing service account. + name: "" + # To set annotations on the `ServiceAccount`, use the + # `annotations.serviceAccount` value. + +# extraLabels -- contains additional Kubernetes labels to apply on the resources +# created by the chart. See [the Kubernetes label documentation +# ](https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/) +# for more information. +extraLabels: + # extraLabels.config(object) -- are labels to set on the ConfigMap. + config: {} + # extraLabels.deployment(object) -- are labels to set on the Deployment. + deployment: {} + # extraLabels.pod(object) -- are labels to set on the Pods. + pod: {} + # extraLabels.podDisruptionBudget(object) -- are labels to set on the + # PodDisruptionBudget. + podDisruptionBudget: {} + # extraLabels.secret(object) -- are labels to set on the Secret. + secret: {} + # extraLabels.service(object) -- are labels to set on the Service. + service: {} + # extraLabels.serviceAccount(object) -- are labels to set on the + # ServiceAccount. + serviceAccount: {} + +# annotations -- contains annotations to apply to the different Kubernetes +# objects created by the chart. See [the Kubernetes annotation +# documentation](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) +# for more details. +annotations: + # annotations.config(object) -- are annotations to set on the ConfigMap. + config: {} + # annotations.deployment(object) -- are annotations to set on the Deployment. + deployment: {} + # annotations.pod(object) -- are annotations to set on the Pods. + pod: {} + # annotations.podDisruptionBudget(object) -- are annotations to set on the + # podDisruptionBudget. + podDisruptionBudget: {} + # annotations.secret(object) -- are annotations to set on the Secret. + secret: {} + # annotations.service(object) -- are annotations to set on the Service. + service: {} + # annotations.serviceAccount(object) -- are annotations to set on the + # ServiceAccount. + serviceAccount: {} + +# image(string) -- sets the container image used for Teleport Community Edition +# Agent pods created by the chart. +# +# You can override this to use your own Teleport image rather than a +# Teleport-published image. +# +# By default, the image contains only the Teleport application and its runtime +# dependencies, and does not contain a shell. +# +# This setting only takes effect when [`enterprise`](#enterprise) is `false`. +# When running an enterprise version, you must use +# [`enterpriseImage`](#enterpriseImage) instead. +image: public.ecr.aws/gravitational/teleport-distroless + +# enterpriseImage(string) -- sets the container image used for Teleport Enterprise +# agent pods created by the chart. +# +# You can override this to use your own Teleport image rather than a +# Teleport-published image. +# +# By default, the image contains only the Teleport application and its runtime +# dependencies, and does not contain a shell. +# +# This setting only takes effect when [`enterprise`](#enterprise) is `true`. +# When running an enterprise version, you must use [`image`](#image) instead. +enterpriseImage: public.ecr.aws/gravitational/teleport-ent-distroless + +# imagePullSecrets(list) -- is a list of secrets containing authorization tokens +# which can be optionally used to access a private Docker registry. +# +# See the [Kubernetes +# reference](https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod) +# for more details. +imagePullSecrets: [] + +# imagePullPolicy(string) -- sets the pull policy for any pods created by the +# chart. See [the Kubernetes +# documentation](https://kubernetes.io/docs/concepts/containers/images/#updating-images) +# for more details. +imagePullPolicy: IfNotPresent + +# topologySpreadConstraints(list) -- sets the topology spread constraints for +# any pods created by the chart. See [the Kubernetes +# documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/) +# for more details. +# +# When unset, the chart defaults to a soft topology spread constraint that tries +# to spread pods across hosts and zones. +# +# ``` +# topologySpreadConstraints: +# - maxSkew: 1 +# topologyKey: kubernetes.io/hostname +# whenUnsatisfiable: ScheduleAnyway +# labelSelector: +# matchLabels: # dynamically computed +# - maxSkew: 1 +# topologyKey: topology.kubernetes.io/zone +# whenUnsatisfiable: ScheduleAnyway +# labelSelector: +# matchLabels: # dynamically computed +# ``` +topologySpreadConstraints: [] + +# disableTopologySpreadConstraints(bool) -- turns off the default topology +# spread constraints. +disableTopologySpreadConstraints: false + +# affinity(object) -- sets the affinities for any pods created by the chart. See +# [the Kubernetes +# documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) +# for more details. +affinity: {} + +# tolerations(list) -- sets the tolerations for any pods created by the chart. +# See [the Kubernetes +# documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) +# for more details. +tolerations: [] + +# teleportConfig(object) -- contains YAML teleport configuration to pass to the +# Teleport pods. The configuration will be merged with the chart-generated +# configuration and will take precedence in case of conflict. +# +# See the [Teleport Configuration Reference](../../reference/deployment/config.mdx) for the list of supported fields. +teleportConfig: {} + +# extraArgs(list) -- contains extra arguments to pass to `teleport start` for +# the main Teleport container. +extraArgs: [] + +# extraEnv(list) -- contains extra environment variables to set in the main +# Teleport container. +# +# For example: +# ```yaml +# extraEnv: +# - name: HTTPS_PROXY +# value: "http://username:password@my.proxy.host:3128" +# ``` +extraEnv: [] + +# extraVolumes(list) -- contains extra volumes to mount into the Teleport pods. +# See [the Kubernetes volume +# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more +# details. +# +# For example: +# ```yaml +# extraVolumes: +# - name: myvolume +# secret: +# secretName: testSecret +# ``` +extraVolumes: [] + +# extraVolumeMounts(list) -- contains extra volumes mounts for the main Teleport +# container. See [the Kubernetes volume +# documentation](https://kubernetes.io/docs/concepts/storage/volumes/) for more +# details. +# +# For example: +# ```yaml +# extraVolumesMounts: +# - name: myvolume +# mountPath: /path/on/host +# ``` +extraVolumeMounts: [] + +# dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods. +# This value is useful if you need to reduce the DNS load: set "ndots" to 0 and +# only use FQDNs to refer to remote hosts. +# +# See [the Kubernetes pod DNS documentation +# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config) +# for more information. +# +# For example: +# ```yaml +# nameservers: +# - 1.2.3.4 +# searches: +# - ns1.svc.cluster-domain.example +# - my.dns.search.suffix +# options: +# - name: ndots +# value: "2" +# ``` +dnsConfig: {} + +# dnsPolicy(string) -- sets the Pod's DNS Policy +# +# See [the Kubernetes pod DNS documentation +# ](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) +# for more information. +dnsPolicy: "" + +# hostAliases -- sets Host aliases in the Teleport Pod. See [the Kubernetes +# hosts file +# documentation](https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/) +# for more details. +# +# For example: +# ```yaml +# hostAliases: +# - ip: "127.0.0.1" +# hostnames: +# - "foo.local" +# - "bar.local" +# - ip: "10.1.2.3" +# hostnames: +# - "foo.remote" +# - "bar.remote" +# ``` +hostAliases: [] + +# tls -- contains settings for mounting your own TLS material in the agent pod. +tls: + # tls.existingCASecretName(string) -- sets the `SSL_CERT_FILE` environment + # variable to load a trusted CA or bundle in PEM format into Teleport pods. + # The injected CA will be used to validate TLS communications with the Proxy + # Service. + # + # You must create a secret containing the CA certs in the same namespace as + # Teleport using a command like: + # + # ```code + # $ kubectl create secret generic my-root-ca --from-file=ca.pem=/path/to/root-ca.pem + # ``` + existingCASecretName: "" + # tls.existingCASecretKeyName(string) -- determines which key in the CA secret + # will be used as a trusted CA bundle file. + existingCASecretKeyName: ca.pem + +# insecureSkipProxyTLSVerify(bool) -- disables TLS verification of the TLS +# certificate presented by the Proxy Service. +# +# This can be used for joining a Teleport instance to a Teleport cluster which +# does not have valid TLS certificates for testing. +# +# +# +# Using a self-signed TLS certificate and disabling TLS verification is OK for +# testing, but is not viable when running a production Teleport cluster as it +# will drastically reduce security. You must configure valid TLS certificates +# on your Teleport cluster for production workloads. +# +# One option might be to use Teleport's built-in [ACME +# support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable +# [cert-manager +# support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager). +# +# +insecureSkipProxyTLSVerify: false + +# securityContext(object) -- sets the container security context for any pods +# created by the chart. See [the Kubernetes +# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) +# for more details. +# +# The default value is compatible with [the restricted +# PSS](https://kubernetes.io/docs/concepts/security/pod-security-standards/). +# +# To unset the security context, set it to `null` or `~`. +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + seccompProfile: + type: RuntimeDefault + +# podSecurityContext(object) -- sets the pod security context for any pods +# created by the chart. See [the Kubernetes +# documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) +# for more details. +# +# To unset the security context, set it to `null` or `~`. +podSecurityContext: + fsGroup: 65532 + +# priorityClassName(string) -- sets the priority class used by any pods created by the chart. +# The user is responsible for creating the `PriorityClass` resource before deploying the chart. +# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/) +# for more details. +priorityClassName: "" + +# nameOverride(string) -- optionally overrides the name of the chart, used +# together with the release name when giving a name to resources. +nameOverride: "" +# fullnameOverride(string) -- optionally overrides the full name of resources. +fullnameOverride: "" + +# teleportVersionOverride(string) -- controls the Teleport Kubernetes Operator +# image version deployed by the chart. +# +# Normally, the version of the Teleport Kubernetes Operator matches the version +# of the chart. If you install chart version 15.0.0, you'll use Teleport version +# 15.0.0. Upgrading the agent is done by upgrading the chart. +# +# +# +# `teleportVersionOverride` is intended for development and MUST NOT be used +# to control the Teleport version in a typical deployment. This chart is +# designed to run a specific Teleport version. You will face compatibility +# issues trying to run a different Teleport version with it. +# +# If you want to run Teleport version `X.Y.Z`, you should use `helm install +# --version X.Y.Z` instead. +# +# +teleportVersionOverride: "" diff --git a/version.mk b/version.mk index c37997842db..c90518d03b7 100644 --- a/version.mk +++ b/version.mk @@ -21,7 +21,7 @@ setver: validate-semver helm-version tsh-version # The weird -i usage is to make the sed commands work the same on both Linux and Mac. Test on both platforms if you change it. .PHONY:helm-version helm-version: - for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \ + for CHART in teleport-cluster tbot teleport-kube-agent teleport-cluster/charts/teleport-operator teleport-relay event-handler access/discord access/email access/jira access/mattermost access/msteams access/pagerduty access/slack access/datadog; do \ sed -i'.bak' -e "s_^\\.version:\ .*_.version: \\&version \"$${VERSION}\"_g" examples/chart/$${CHART}/Chart.yaml || exit 1; \ rm -f examples/chart/$${CHART}/Chart.yaml.bak; \ done