From e26d80ba369b4d4a03f34dd41df890e81e99e236 Mon Sep 17 00:00:00 2001 From: Carlos David Ramirez Date: Wed, 2 Sep 2026 22:59:06 -0500 Subject: [PATCH] Build sealed secrets pack --- packs/sealed-secrets-2.19.3/README.md | 100 +++ .../charts/sealed-secrets-2.19.3.tgz | Bin 0 -> 22816 bytes .../charts/sealed-secrets/.helmignore | 21 + .../charts/sealed-secrets/Chart.yaml | 19 + .../charts/sealed-secrets/README.md | 318 +++++++++ .../sealed-secrets/artifacthub-repo.yml | 1 + .../crds/bitnami.com_sealedsecrets.yaml | 168 +++++ .../dashboards/sealed-secrets-controller.json | 302 +++++++++ .../charts/sealed-secrets/templates/NOTES.txt | 46 ++ .../sealed-secrets/templates/_helpers.tpl | 203 ++++++ .../templates/cluster-role-binding.yaml | 26 + .../templates/cluster-role.yaml | 60 ++ .../templates/configmap-dashboards.yaml | 29 + .../sealed-secrets/templates/deployment.yaml | 242 +++++++ .../sealed-secrets/templates/extra-list.yaml | 4 + .../sealed-secrets/templates/ingress.yaml | 57 ++ .../templates/networkpolicy.yaml | 46 ++ .../charts/sealed-secrets/templates/pdb.yaml | 24 + .../templates/prometheusrule.yaml | 54 ++ .../templates/psp-clusterrole.yaml | 23 + .../templates/psp-clusterrolebinding.yaml | 25 + .../charts/sealed-secrets/templates/psp.yaml | 38 ++ .../templates/role-binding.yaml | 80 +++ .../charts/sealed-secrets/templates/role.yaml | 125 ++++ .../templates/service-account.yaml | 23 + .../sealed-secrets/templates/service.yaml | 78 +++ .../templates/servicemonitor.yaml | 50 ++ .../sealed-secrets/templates/tls-secret.yaml | 46 ++ .../charts/sealed-secrets/values.yaml | 594 +++++++++++++++++ packs/sealed-secrets-2.19.3/logo.png | Bin 0 -> 12653 bytes packs/sealed-secrets-2.19.3/pack.json | 28 + packs/sealed-secrets-2.19.3/values.yaml | 609 ++++++++++++++++++ 32 files changed, 3439 insertions(+) create mode 100644 packs/sealed-secrets-2.19.3/README.md create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets-2.19.3.tgz create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/.helmignore create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/Chart.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/README.md create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/artifacthub-repo.yml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/dashboards/sealed-secrets-controller.json create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/NOTES.txt create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/_helpers.tpl create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role-binding.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/configmap-dashboards.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/deployment.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/extra-list.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/ingress.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/networkpolicy.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/pdb.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/prometheusrule.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrole.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrolebinding.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role-binding.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service-account.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/servicemonitor.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/tls-secret.yaml create mode 100644 packs/sealed-secrets-2.19.3/charts/sealed-secrets/values.yaml create mode 100644 packs/sealed-secrets-2.19.3/logo.png create mode 100644 packs/sealed-secrets-2.19.3/pack.json create mode 100644 packs/sealed-secrets-2.19.3/values.yaml diff --git a/packs/sealed-secrets-2.19.3/README.md b/packs/sealed-secrets-2.19.3/README.md new file mode 100644 index 00000000..32100e51 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/README.md @@ -0,0 +1,100 @@ +# Sealed Secrets + +## Overview + +Sealed Secrets is an open source Kubernetes controller used to manage encrypted Kubernetes Secrets. It allows sensitive configuration data to be stored safely in Git repositories by encrypting Kubernetes Secrets into `SealedSecret` resources. + +The Sealed Secrets controller decrypts `SealedSecret` resources inside the Kubernetes cluster and creates the corresponding Kubernetes Secrets. + +This pack installs the official Sealed Secrets Helm chart and deploys the Sealed Secrets controller. + +## Prerequisites + +Before installing this pack, ensure the following requirements are met: + +* Kubernetes 1.29 or later. +* A running Kubernetes cluster. +* Sufficient cluster resources to deploy the Sealed Secrets controller. +* Appropriate permissions to create cluster-scoped resources, including CRDs and RBAC resources. + +## Pack Contents + +This pack deploys the following components: + +* Sealed Secrets Controller +* SealedSecret Custom Resource Definition (CRD) +* Kubernetes Service +* Service Account +* ClusterRole and ClusterRoleBinding +* Role and RoleBinding when configured +* ConfigMaps when configured +* ServiceMonitor and PrometheusRule when enabled +* PodDisruptionBudget when enabled + +## Configuration + +The pack installs Sealed Secrets into the `sealed-secrets` namespace by default. + +The following table describes the primary configuration parameters. + +| Parameter | Description | Default | +| -------------------------------- | ----------------------------------------------- | ----------------------------------- | +| `pack.namespace` | Namespace where Sealed Secrets is installed. | `sealed-secrets` | +| `image.registry` | Container image registry. | `docker.io` | +| `image.repository` | Sealed Secrets controller image repository. | `bitnami/sealed-secrets-controller` | +| `image.tag` | Sealed Secrets controller image tag. | `0.39.1` | +| `service.type` | Kubernetes Service type used by the controller. | `ClusterIP` | +| `service.port` | HTTP port exposed by the controller Service. | `8080` | +| `ingress.enabled` | Enables Ingress for the Sealed Secrets service. | `false` | +| `networkPolicy.enabled` | Enables NetworkPolicy for the controller. | `false` | +| `metrics.serviceMonitor.enabled` | Enables a Prometheus ServiceMonitor. | `false` | + +Additional configuration options can be customized through the Helm chart values. + +## Installation + +Deploy the Sealed Secrets pack from Palette. + +Wait until the pack reaches the **Healthy** state before proceeding with validation. + +## Validation + +Verify that the Sealed Secrets controller is running successfully. + +```bash +kubectl get all -n sealed-secrets +``` + +Verify that the SealedSecret CRD has been installed. + +```bash +kubectl get crd sealedsecrets.bitnami.com +``` + +Verify the Sealed Secrets controller logs if necessary. + +```bash +kubectl logs deployment/sealed-secrets -n sealed-secrets +``` + +Verify that the controller is ready. + +```bash +kubectl get pods -n sealed-secrets +``` + +The controller pod should reach the **Running** state and report ready containers. + +## Using Sealed Secrets + +The Sealed Secrets controller works together with the `kubeseal` command-line client. + +A Kubernetes Secret can be encrypted with `kubeseal` to create a `SealedSecret` resource. The resulting `SealedSecret` can then be stored in a Git repository and deployed through a GitOps workflow. + +The Sealed Secrets controller running in the cluster decrypts the `SealedSecret` and creates the corresponding Kubernetes Secret. + +## References + +* https://github.com/bitnami/sealed-secrets +* https://github.com/bitnami/sealed-secrets/releases +* https://bitnami.github.io/sealed-secrets diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets-2.19.3.tgz b/packs/sealed-secrets-2.19.3/charts/sealed-secrets-2.19.3.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5d8d82a0d9029deca4d9286a8397072e395d4eea GIT binary patch literal 22816 zcmV)>K!d*@iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POv1d)qjYFbvOU{R*s-eQjq=S+bpUkKf5$kK0M6eRU3A+ueKb z-P2DDk&uKj1+W3owkFB`_UA$YAi<+3TXr(N=7+>0fjR(%ssd0bNP=S$1(Jk9KP7!hyRDeVfp{jaJ2iU(evH?(ewS`^S#lZhNJ!Aix+=F!!^>- z_@q){@u%UPag~|-7kMyaTwz5ylLtM7LafM?i^TzYMXpH96C%zzk7W-h^cNx|-5e|1o+nSx|07ALH3B-~^EqcI!2-{TB0~0h`ZN4S zp2|ZXu80scBIu`dOavo}NMzMX@5z&*cI@{(AX=YgmCux*Y>E`u7!}2Fyg=N2EXw6z zlE$&Ftik(0O7LB=8XWplH~3{BH9W`!hXlRP{<@wKK{S?#Br#ury*mR8=&WMz91l}c966ds^YUwRc5-r_NdJ?ic62P8ZOj2_K~gq&PAv`WHo zQXFEXuXK*5q(Y@O@DUF$i2yq<8Z3Q~3)+stQ|YxDz#RxOrBaDSEmq{d)>KQlq>49J zbl)pg6`t1D(H}PHe4Z*ij^U?7SZG+fH3^GIv{iwYq;Y)0V;VLPqQ9dA3e?thrQPUi zf#RH}Cr^6tR(r^6VT1o9W72$nMJ70n z&7j{njIZ%RZXi1G+L21M5o1N9+So=UmRiLrD1JP7&((<_k}$Plz-59}Fa4<`BABK$ zB0GRU?mS5Z33Qw2Az@-@&tZn^)Z4KKO^HeG{ zCTNaX3NS)Jup$wn4D?;5Mh7Ln8iuvP@)8F3gice<5s#o>z+vCfoEYYUM9?d&NZ@*V z$G|6p>4EvnlO+2Fp#aSnr?$dRWMMvQBjGodt5np4R?)q&M8JQ^AF!cL*#}^ zr49V~+cR4X+5QBxKO^XpEKn*5*aN~su}G9Zu5;K2s9zefmt^5{pC%Dj2ziiGqx18jPHQ z_Tl+}7DP)5L0a^#v52%;POze58dJ5m{0tK3nvMJ1cpt{2GG}D^BtfGj-}tYmt-Lb zBi9KLlt*6kY6*fbI7a53{sQ=yWaJDy`gCw1E6j2GrE|moJ zhy88iy#1bXMdZJM_gn_hFA}L#>=6g8MTDXgJ+CKvgwsg3ev}Hsc}DAKh!zA3Ik411 zQ*lP%ttDNl_yG04|L(|7H1QaRq%Loi5x}Dr^jr<&s4-ywXzMkrg5x6Aj&3O(<1?n##;bf z)s8Wrz9m=0S3Md|4Da~FN3wbR{>_K&*Qci+PPZ&%s9F+-m`~rph%JFM!x(KUa-+8Y zAvtqEOz9GoIleh1O6bbDNYC*Nou}HXf-ky$UakZH?8zH0Tx;E`NsUp`gF-7a&%G!? zudzDmm>k8FF!i4&XW*)Z@C)gmn~Y4cqF2N^Zq{~47?dz3DVuJ&C6^3LSy5--%+U9c zz>8x2x{>SjVz#W}T+7UNc17Gw7_+D}8nKwlHURoN3~VvY2J(?})ZNNQVg{^k=t7U= zaO4Jx=@nr_%55YFj;Q_1!$ixaZ4P;=9Gr9W^A><6n8v9f=QBa%Ogofs%nPKlH{F5BGz^K9Ij}SHVhONb z;f0qaH$KHV@EV51}%>x~xC5v?5t6Ud68+ z<*Nj8H32JDZic#4#JU3NAY@%ZbriF%;5rIg1zfNA=9>{UtMh6F&HvU>%nIOE6EeSQ z6U3zg)&)oh;pzgWqhNIb)lsNQpnCrAf-oyvol0pT!Ygv4cAiM00yQH+`Aab2BEY)3 zKLdr42<0qEB}E*S8Y1D5+^FTF8RA6#P4F~9XGB$@ZB$zY*$VAYB?+}yod`amF&U^u zLb_wHm9=lLYa?A7X44fsb=K0-cYt0zf4;Y`wNil=T?HW%L35fit=#OIT2Um9vdPRh zCl?u@)uh9pR<+1TBXq4cKd^Xl%DH+&V`7%m(0?_}tiAc*3`>MT?*^R33nVyKXp+I` zggs@4@;zr7J33|&EH6r^5NObby?D+qnLYaxs zW;1255tCDZHYFkG!izJyFk8H^FVPMEAQC(=D-HFf>&AG!DCVC%St-8M9irWup>|@L zT0QrZd_s-l(A1j05DL)Y+qYi#&bU+>LEX9&7qIc6i@@J*oihSSl-_1qDq$zBdsM?U z7nd=|k=)Vx-&pp11s38NGRh9n|MZHQyBv4%8brq~a#q)7G>ZF)xyWcKufy_aX?V-M z(^(E`DH2s(Ip!e1F_sc`I_u1IrIcMTF1{=;{2Pna4!K+iyrR;(@^b!UqUQt)uX){@ z`nE+_N;-wDzm=NVnM7!~9RmccBjXX-dE)2@FpC1r6b;-PSWdKmm)cubJtHv*6&E=J z?|DSp<#W@WkOC93wlWJ+ae=2~=gJ`3Dee(j^h>CI$5W;%q+j{pmeZfv zq_vZ8NGS23)%1I!v<4~@Wk$AFpy&PV?L;*1Z6sVMyXjBBOE{hs5Nb1d0PUgQo^YXD zYzd7BQ#8aeL=e~=U}zRys?NXB@8v+ZmEW2_o}Zr}0BpC+e$>`byB@Een0FXWTC?EQOEWh6GUzjE=i<)O4nF5ElQ>7mu&=2uO`v} zk=8wk5QLh-u9F9K(>e=u;zD~cLu8()1(FZ~yH%2z6`H%YW~a7wenhDu`+dI|i}9}! zll8%UMw+wFz3i{dEV)?AbD@=fh+gZqfvI{+v?Y?-hKIzDdWNtdcxywuvN$Ao>87T2 zP+;C^qrJ?8@hDEEBI5X@7L<0ve!wwiArW9`8{k&TIV6=2wt1_lv>Y`+htAXAvp_X2 zR3`9MP}*=oUxUE}z*;eCFvVy_h|zO}%^s%Hpl?0GVGO=^<@~mk-QxOkJ!-hViMeSpFl=h8AVChD3HhW@fQ91e%U-tKoVzWb|d7spFuBjZ}P zGgIVt&94xBP&MTim_v%IUSqL5Wm7?i8(~e0p$yxq8Yv-XwG3r0W*mDDiAZr;?fu= ze|=eZoCI|^Oo0PS3jc0wZ5 zAR+U5xm=<#%BsQ>ifom8fX=xcT7_UhEzS9;+(t=^Lt-2V)2&3Pz=T-|ACc|npQRQT z>M0fo86wJ_HL)UArqGAFjU*v8QsbBLRFZaqoi=)sNqOL5D92%!&aXloc2Oisu8|rz_9jo}t1tE9*><)`(0X&JQbeQI_kA zy#1{j(6I7umYEhY@lIDHGOKUc4~vFyMi@e8R4n^w@QYcJtBk5I zUoH&V|K=$QG4sORjewAxWIKv3iV|Z3mO+$qigGZguz$;0Q6BS(RH5-g%bjvT-60o( z$b>V9@~ntQ0Vo_r&Vfl1PXawlCQ-2wJro{4@#GB3zSMJ_i_Eo)Wt$1htDz%2uD8O%+%wi+_KY`kY5qu zN6pqKJ#Sd%$UJdbrf~IRwPxlotHK|r1ts(;z0bYZzo+*D7S5&=YA#2`QLB6zvwaJ!$(xa|i;83~- z)u@`9Q(X2vp$2KD9}8<%9U0e;$sS9$}^zLA^6`kV}%ynbiHVGFf&uWY#G z|Clm@(!`27+Q`}508>3l1?(oIiGguE(fX81=gWnqxTy??0T^P=N^5JZv}XMrQ%t`7nc9le72YxjCX?a06l- zOO6sQC52;$nQhR7cv0sC3_MkmM#P*@p%Trq3>OCS37ovu?hZPAefa9#>%rU*0A4p` zrXSs)^~73MPLVb1$xKE;-Y?1G0DTVf7YGIV`Qi27j^CrxvqN-pdi=}b`D^sk>;Hx? ze$l~TP^tO){i`MQyf$gUef0YD{P@lB(c$^)&UkC<^ibA5cHPshl)(v46WonX@1k<- zpMe8tmgdb%yTVjZ0fkT5l(@QmhaIVQJ*#^5tz}MJtoqt$*@C*xYG?EH79xw&_ad!8 zswt7J-kK%60udGg{8yoPDQev*IH5;05~agS-j{8AVu+eAumWlcvu9HV$Uord19b{u z!c*ovDe(Ma&M!gtWz>7s?3}VI`LH}yOTPYcOY#Be>f~q3P=&S64Wi<;_wLhCY$I#{QGe!PB(s{%DNCS% z6qzS6R@pq6c{|6aKO7!a#ZQcJSQI+_rnz$fN*>_1de<26W@>-R1|jWTNt4o{AKTUHvP%jg_aR_AGX4m>o=57ev+IT0z+?c>(~J7brrO}tZ- zM(B;~o8o9HuwA?_B1VdDJJ-sMC68Q3ftjL=i3DvO&M=$WwKK($J3G6nA*<-hxSeG`9hKWO)}ur~Q;<}irY=O+I~HmR z4vM8p9`FLu3Bu^4P$qN5vcy4JjPf$*L!xaV7cCBPH)5I-N!4J}edMAkDf4lcQb~0} zU8mdJXel;_kI7SP-O%{nqQOX~t^_zoW>_X4k zf`ugNmjD!!hV~B?iV2o*u%&1>V6D*xV@rSp`BMnm93n1IFxncRqZtV=eatbR+LOQT z{EMDe(3qO_PLqITU`>DBn6u9FJI<*7*=B8RnI=6{ELE?EO4!z*hdR-6FKVb0<~A)< zY>Wmi)Co&BCDe?sI-l%-lrlxc6^_x5{2EQ*6cJM~ByWxcRGCf${nXj?Eb$DrQfY$u{ZKxwpL#KZ(Z0b=4#qx2fqD@OAuJKONn(>B(JriNbAiSr z=GO;ixv29M8BeG|3)(iA2tE(&PC{>YkjL>A2!;dc*@W0cCYn@fJ_(xQP{ldRP!)W7 z8rq)_TZ)1p5{p2j?4?c678pWesDt`F%~G`=+}Qp&OR^jJpK)RMt{!`Y5MF> zgaU8X3NXCX{msHSjYv7&ZMKEiM+5ZbOEV1c<=Oycg({G2Za+;m`YW0*Ohr>~;BnOJ zX>AUT+gu1Dd7#0m$sZ1RBYM4K6Y_oyQYSDNH^!BT@pBs!_EehPWm7y)NSbeMx}I8? zz*pVRUXOm;4NX)y3qm3kv~w1L-ZR;wAxhYsE=$KT4I!+@oIsesj2rSKYahcT&Vvvp zg&+ngUJP6)u!aE5f;O@i2@KX8=LXUPi{Qv^J_A~SWU!LKbnrM%YR8FBd!=2M44}OM zI!qFKhOi*dwT&H2TA`g<6}RE4fp6&MA6~~48hpd7*vJ{bwp&ynSNX^?XJD`&VE~cq z6`BXV-VfYH9v2pdwS4B4?Mq1D0Y_c{kR}YM(}lg1@t-~gCR6^GFTLjVYdBVEOaqCw zLG)d;uzl^99+L?dq*pX+FjjIG+G1vrM*NlSf205RaYo{V2su#6U9SRa_y0!wd*7As z|9P?h-TtHh_YlvgPdm?guWu4PG*l^e2pqdX@7d0mFCekzkV>r@>w~9g3&A$@z+5E= z;Tz7qEL_d=87Yyn5WU!gKk57|olNKr>IXS6Jx0I<1u`=qEIXeDcl!LE;@HNYBndDu z==~Ql&}}C27kj{r_6$R;ZII;i!tF&Sq=b?gb|1SF_Xa?^p;@0$cuP|D8G5)B0!J#z{ z`VYmsjUwv|RECnzj=|+Ox_Q$&WIS2aq`Tv;*d|-I!fi^yQuT6rp>V&k2YdlBf4kGS zpOGNuAY%VN`l$c0e|t?(R#>G_Q|oXpWu+KL`MznO)d!F2g4&<@^eOAF%?_U9Rufoz z=B_B?B?Nu@N52!0MnU%UpH!GdSVV4LZCR6P2(Q1=^fp z`4d^70qVCONbYa7mCedz3L`LWy4<9l5*87my%MvH1M{-XaJxytp!c(cThLkrLja^c z+C&iz73u@LTu&uf%?64O)Qp%{sBhC&_R&+Id|9hH1cApToxpa|u|$27?WT_gh7nsR zYmOv#Uj`Ph-&$@mSgx{Z>wHFv|2Lk;TlKZggsxe>X9OuM^vt>D-ppludzWg~TBm8u z$2dmCRw;h;VfY1GN(BwAQ}p!x+>AfvwKJ3N5Hv#e1=C_#4~Au8pLGmQ62TKeVZxB7 z3elP-$}*BI_lmr-Ig~u#N2SFI=sk8Rbxt?n{vEOc{EX@}Wi;Z$O0)$-j#YL;6x*m8furcCIgP2*2^ z2^0FLZ@=1KUZ#ZnoBdVtGI|gv0U>XJpM(Jg_R8o1L_U?TnRF9O3)`;^!7Z-#&M{L1 zlMWB2VvwE>Vh*-SbJYPl&KHN2z)Z&2E<8naG9iL6yI&TOgqV{Z)E%J5Ho2d6A~A#T z(5cDN6d>oI1n8A+xB#76PkI2667I7L*l|7{BHGolcP1{A%B*v;g(6SN4_-D)UY#j$ zF4dMV(%L&FzZc-v$>mnHRP(4e2nv}u^gP9vg8aLQ1MZWo4DN{vgTlu$1%&~g0U;ggUfs|Gee%8{p#M`av!V{wz^em(g49^JU zTg!61!IEnsrCA4^V9UxA3&l=EmoD>Es(FI8Sz~p+UqyRX)F%W+wQEe%E?rHE%x1`5 zW*Uea%vY~(+my#8Xe%~pwR*e9yHd;EOT&KceV1?LY25#FD-VLlB(P@+Az%OMIF`hJ z?G8t!_^;j3@cG{3{@+79W)TXrD4Rj~hwnETSH%yd;YTven{kH8qITiB6LN>*eft4D*HR8GXDWr!mkVSj!9xrM?jiH zCJk3DBI}IQ!e5;yqbaJW&CiI$#QWLW0L^rfE5ho@Dq&A7{E`sXC8siyu_7V)MQMc+ z0M(Vc{V1#@vtcy8aFSiyPlZ*wCO5Cy{=>1}IZguaT=4zO|M#Bnm*@YZ(eTm!Kg3fS zB+Y03{ZLR7ad_~uty*60bGDEFv?h|#!WEF_>S==2Y#TlOsDYya+|xMtTg=A@^>f%e z&j$aHob@xBCNw54MAeHQ+$1;3fZRfxV=RgLQF2Oh*CRVTU+Z|3VjMe!`90n8h=Z|O zoThoLxw7N(w8e3G+R`z1_G3B#znxq2biIB}J-D?vHf>FS*W%`M#juu^UXN$i0(2GE z%niFwpHMz#(U&ifZd#8Srxu7E+^{#5gA0P763y_q#L@IL+J7&S>29=dG)ULyxWTZ?bbTizb^1N|Guq~mkEKK z&w?Z|4Y4%&J<7{2L;F zLguun1?$OrP3M#@tIooYi>Y5e1vd7$sa{UR_c@G`_3t(U8oB$v92;HaqBss*nJU$` zTnk)}WG5&!DCrze$skGN*qz$Vz`&=I{EH94%rrUx$uog!!D?yL+86%HgS!_y@7w%V z>S_~Z#k+NB30dK0>#R`es_81yLbY2V_OGnY$`r1Qu0iWpx)s*y#pzkenv2mr4N!xzGl@TX->hL3@bF+-1Sru6&g0zh%(zrPL!R-heDHLQOXa{+pGYj&1cayhX4 zD&wq#cWJRlXidQi?Cer%F9)wvPkH)*>=SZ{X#9-5HC_Ssad@R}?Z9Y&4Zh20w}|Rf z&50YsRxLx7CeaTTQ`y3z{=7c^0NNdyD-mc`%FkdCzuFE#V7>?5Dt~KpRN%`?nw*k+ z39k%ae-8vHte|&+&j{Mg&fJiNAdFlmL{J`q<}gvvTd3c!LwZRT0n`Xgl~Mt3WK=+x z6y+*SaY+_R#ZB}m6}OV1tKJoTm?}P*Xx-mLg((r}BCXVTknTj3z>0XjagiYXF@Qt} z&9vkI)9I4lf2SXTk^74^57-v_iKvVrT)up^z=#>S`A^Yg19m< z3s0}mrgIfsB>mH?t*vTJSX7)~8l!%W!5n#&HeV3r*fmgOnfS(*Yi)*?-oC-hf0x_; zF8k=|rKY;RLU%#UtCwy_E(wdDQenH_MCZDMr8*5PH&9;a4kA*IW=+xoz}GGqIn~Q$ zA}f0Ef0T}iP0RXw(!zHU(A}Kp3{<0o=ux%AK`aAX zg|gb0u!dNQ5ZL*5336IoXB1>gr4ozE>x4_Hc;$n_(;8GKX&l!qBjih&<<$fPSHoN# z)HU&DzGQAAod)1$%dJ6}q}7%-OAdeg@b2*coSc3*IxE>bu$gZJpO>!+$^)g|P!dNr z9KWf|fyuxoH4QbzB6>w77YC?6>aQS9ExgXjTsMC+yRYB9J$`q5e$VV0GVaVV9LhVW zWku`u68wS+Er?XTUC7c-;S!}CGag8Nsod{qt_!`nEvidYhvS z(;9nL5FF7ZU0W=3_r5K{`&K*mv`FQeTcj1&TKm`C%w1x@1=82;1Lu|QhCDM>OZP`n zr#;dpcVKrk2TEx+3!jWc(%Z3MZ)u?I>v_A=6gd~V7N^m^%xcYpi$vjr>r$DybkI* zPPu=J(d#vX$Fc9HXM-@2P4c_TOV)UBuq7Lt+psRfE$#p`Aunuk6k0nw2;V3kGcFbL zqFV!4u&c#eE^21Y`Q%1VmfOPhG6kbu5Ixn9)p=BDW>8bbo81gM%)|MN}CFoo0@~2(8d})t= z$`iWQ=}Q$$$dbD>Wo+GT3N5y0tMXBjcyb08M{HF;g6y3;yRG7)YW!vhFAj`CNO+rC zt_+(zjIn&cUB$9WURl4l+wJ-`y^AkYfw+=m@#*nUaP?`N{}mII-)R=OWd66eH+o)P z|M_nJ@&3ODc}iopm}h?ViC%M_dT+Y--Y@hx>3cj143jB1j&?7{ajn@nuqLw*923}0 zx{A#Y( zEJ`?K3LU&eG3S?Qg8EmZKI*#VTXJ`sL zLv1)t3XDGba`*8x`hQ6@UdP)1pO*W7qZcpA>;KPR40j*>zlV5AmP+?}ep=MHYbQK< zMWsj+ZQFlHqbX4ZchF1`cCJQ`uH2(5=dX(kG9@?fv~z~~FZQ4I%^fr!iqbZx?C=WH zSUW>@UBiD>%-K*XU$dUQ5^8+&Gs9)%g_l+Ih0iqv+)GNC`?GP)`d{!lQ8SWCk=`)_ z_|p0RuoVBXI~Q<}W@Pj&A%ECkFsql&|IX(1PcgZ{`fd7l)3+{rpr z=Tr@pmJ(_fZOUqOi*EC6t&=x&b6d4kO|N3F8o0Sdp3hp7&<_5Okifiyt!-$8+isn& z($L?^M*8ah!qRqk{=(GDyw=A__H`A zCpU>WK%YxHb7-L7FA4wE-7xVpa_MKn?S#AXr6`?cKyl64cVDyk<=uXHT+X`I5~N&% zvPRO)QyDpR$Z>6=x(;E|H3D6k_J3^?`Y-)7`+qVC?ByDFy#i+G{C~Jx@&CSi^#2~@ zDIeY#<8YA37Mgh%cu5G-a<;){s@G z_aEnf5Av*L|Ff;$F;RGw?+?4v@oNd`d)&|cR?KJ?nkVQLjmeZm2WWz0sjVZ9V}5<& zKD?G8jsZid1c{Dtg2yzbio#?|PoN6P0RprUx_j3)+#7d5KYNh~u1zV4vNxs$vY!#Z zX4hCmhbPB*B`vp75vEMqfTI}G`9`lctgez4sgU;F@l@zgUE=uUDE|sci;iFAFGR`? z<v)r zSzrDv(f=>@hL!uD_J@!6KRw7}?td<*|2+O@#i`#ab3RB~9L*_PY3BE>ga|#(82@Od z?v^vgmZ{=xB)m9b%n7lV5r0!NNShcWzhQW#d*t1LLcwn+5w^%yYZ+~f?pZ5Yj6q^h zKI*1N-SmglO}CeGUqju#_v(hXgWS}cyLVSQ+2D(G+sG}nsb>IBi}ms~z^y!j%bo|R zxn-kpJwekgAL~|G9S&{RDWzKaS5`uuE}mYG7ODle-W#01!5fg*G~S=K$-cXVvp1Q#g0ay9(e_X=8@;jI#3nr7R}0DEl-esv`~E;1zCk3{Xs^vd(iMg0_^@ zX0_@1eW{4YS@<7aQQUFRb>2#B7&RbXcN~T#sx}}4S!db~Hf~*07vETaYwYOJw&&8_~|PruuT`Ist(=Ts|^X5rLiE;XB;jdMTXCbV^7-tq2VE)ifZ zXkM%7Zse&n5Hr-~XGCJ+{cLT3X1d4~VVyjRYueu} zH3Wb3wT8y|zjMN{S-`p1^FQVJ|L$F~eZA+yk_zTmBbxVlgUR793iM=4!uU(U2(p%Anl+#v&vWrxk5Sd=7!7RWn?*ah#u9iplF)#kfyBD&NCVN8d_@rNlhoy1sL#yN@YZb)C z6lD8u^ZmXIL6F~*ygq|a&d$3=!_Wr$&Lh4J_@kk?Rc5TU8;l0Pe+0v!f8rz=yjB~T)Zu%#`Iox(E+tEKGj{Yv78>t6cJb0yVk?K=|V}h_ASYfp}+|_r*pzn z&z&p0?m|!loLf?5UY`=sC6rCQ=B|7K>Pj11ox$c}`2C%U7Iox`TM;T&A~CZoH8&)6 z509%_r{-k!9YQgdUAxqICi&>Hf4!&C|5vfJZ|}SXxWxb8+kIZi|1jEpy#Mb(o|+)= zRqlT;>CODAQV=IsqW+#=uTaCnvi@E_ZSZn@-{LG;;U3g=#a{laIkw-PPiR&Wi{?Vb zvgdkV#acM6vl0@a=!Aw?5%d|2U+fbW8koA+C0Uqamt;}+TyqAZ`8b4s$8S}7-EF+C z^3xEbgO_MZ*wJCR;ertN(cX*ad0AralbaG|pd9HJWhB{!yNt$YGp4e+$QFRtG~8x9 zt#S*${hhaWmBVG5WQwSiC@-K}}5(N{B!)Wn|DBygK`Mrnn%zC+G+?ANu9!3`JDP-e5}A4*YA# z?+wQP6g%**doi2t=zrW#dBt{eKw}(UrU{zRn8@Cde#>5^I ziqLq0Fk5g&w$V5>U%4LNV}c^$fQ%PN%?Jwfxu!@N(@KXj_+s|okv$BE1PS>S5xRi> z$_1TLhGWDbiOHbX`^&!t0XjQBJUvGd4;2r!gG~fbbpGK8B{9L0pi4p$q&+C@AI*p$ zTKPe~QiM~*?a?X}1b;OUUwwGLagJWUIzC6|KOUcCf*S&hroG=aW~5=dS@mFF?N*8}+x%C&h8M1qZ2qJ%9WEe|7rX<`Wf1!oE7zEfb}o z)|tO;KB3-ETjE3zL4HrEq>5r0h zKJ~92Jc_acV<=F9qkBo}?$K_%ZV%l% z`bFSg*iuK3UN;rS@ahS!?LzY+A_~*kbcI(iz$^;>z&q{?%QEaNrH$-jgQ?hE}h4ad8oHCV5PH zPm%U@kst|2IEqkFq9D{%9_;M6v!YX~X6abZlZpi$9NSW8z6b;{B$jMzsourK1yJUX z@Lul+gAT!{l4!yO`cZ?|YB8D>#TP?8ak zuDQ63IgaF@*8@ipm_TFBl~e*J65-OIM)@k^Z=0^gZA*uI?i#<;bX({Z&<$Nr8TvJ+ z*FZVg*(pqIw-AgAXpUcXbLPl&-wot!%XztIjv1a3F{pHfwQs3(E-RqLNg{J-m-Y=1 zzXiRgaYi}0x)Tfv_{k@xdyfnb%3Oo%Hhl5~6_mTSBwp8y2BR1M(F+WKy}@WOwDMHd z+r8d7&mXyo92*!xuoMgPkhFE`PZT!W1*4=MX4|@Nv;bAz20BZvuEctdG_o8 zy`_41#j$HgY31z#8cd@yL%rUpLg!>=b;q3JhR=RactTXuDYjBxzS`=7%=s0O$ccd8 zux?LIA}l2jDJa`aI*hQGo{OP^Co@(~vqscEv#C|$z5a|KFGA`0j9w8L3JPYf{IT`< zj9?`UeeQimLG?kkZ@WCMCP2Q>L)xyTUSya*ToEB?RA|I2Q)mgz7ybSPGLZFPbAT?~ z_cLX@TdvzqQLME+ci0+Yq$-fz2M@Xr+1QXSP-|(1HQfu3r#zX(wKK%lu(Xfx0%UTd z1U7m-Z|6fH@Ios|_-fsJ=^?0Su#Dzke{+y4E2S42vbS)mj00f&2Md`*dG>-*4}SVm zgltxfvmUey$g2P?L5303==?T~q-CS!w&Uy$j~k*(O4SeGZiDnepKeHvY|uHLl7S#o zDwSAVbZM+omjeXkAgrrT%1AFF9$peLpuCyJ0z(OxRPhchH8SKNteY8w^rGHr406SD z;WMQ0v_t2#F{JPmZPNKXRd^i3PiZ}6Gd+n&v~?$jhJ(F74@Rw2dJH9L9GiQ1Zrei| zg1zeJ_H?%(y*Qq{=jucdNtkLNvc!-ja2ZE!47rKjeJ}*ZW=Sc{kRVr7I|)BhsRzJY zI;Twy;9$Q`=VR>+PY{nIG&2>oSrK|R&hlBWmhCYPFVW_)x!Fb%wVgT1zM}#L?!ZtvR-}u_B_yO1N~HD{V1=dKOOP|3#*x3YxbpKET_}-~CBy+kc^=1( zTH!NHIKW}z6NDKeH&iO^X`R14vqI-4*v{?0BnvZ-RNSqot|p#9XhFMOlIm~=hRiz1 z86>dk#L}&M$ga5PvL;^^lIhs_JIfjB+(VZ%IVDCG?w28rNo#S9N_U-^K}DUqN_*ir zmP;r!GYqm2gpuon2+E^wo@uJY@G9(NO%H?1chBT(-#;3qgZino>Zb+umE;kDD zdrG8&{aQ&v&LUX)x*~#37FmdYM^rx2)fxIB6|xIgK0}s#nQ^Ao@=ZweUwUe(yCv4Z z@5iTOqhtURGr&=F?*~;b$u1X(z?7x?#Ph zag1UFI~lJIv|| zNINTqm`~quF~=*Y?IJ@HsEsxixl!BykescDg)-9449)S)DN%wh(QQ8LTy4+s4V|ZR zJrU9n)f?1_(dPg~2#h1$%>gXyI7=k)?qqWns$`st}?{s&! zz3mHc3(af*XS+q~epc`lu$XpL2M%@%LmJwhC~rjCnW30o5k{mu5qwPC>6v!d$K1b- z3N^KxP~1KD_U+fgP}eDVks->cqBwp!G z*kO2A88Y+e238#G6DagBoa79RmUC3YkTQpM+c^4++{xYtHwFnp;83 zl^9yC=GwGeiO2OlD`>eAL(A1%t(LntPI892YPk|a%hg=Hmb+(;Za;>WtGOmEcdsn1 zpyf&oEmw0*TJF9X>e@q6VWHBbvn!WtIltyTyK<{c@CpodaOGOHT!F`RJ}YRs0z(~K zxq2;kZ=7UEJ8QWDLmgbX1}%5b9Nl&db#UbxwcNe3w1So^Fx0`7Yt(Z0%~01K3R9{0 z{H^aR`u2&$C4Q3$AYfrhdWwaeL^Ib30F+c0!mFd|FTwq>Yfcl^HtoliA?*!_0UDhy?Tkpoy0?6RG54so9@p3+pyV(#z9yxxi-x4*cwhYUkdxDYCOk36li z;RS{?6;v&bOs0V)4v=$wq7vZ=kK_h&u#g3I2PR4kb)DeVFf@^Hm02T0XGB$**^pIc zETHu;^y2yRz5NcpTn$5#gdv~n(LSNE$q%g4$+2;K@J*T|4IGap#IIOSZup)rvQsmS~SeMbM)v@7H-a?h|t7)(_F zhinDs${c71FkgkClpV_VoN0zG3b2n^1c5E~yiFTl^HeG%Qigy(##sQIrILuR!_d#N z6607mhFZlf1GEwg6^2H`;WBrwogs*JIT7@V#$-xf%MhEhO&3d9N?avGvRZdw2CX(@ zZDc6K2_Dm!s?vV)XLJ}v68VRqPClF+{~zR6Kog<8J$wAzv#pzw5Oi^6vhFPKJih3( zS^2pe+nS*nmrBb+=UuP5O=B(~=vTvnzq2c8VYEmuj241|R)0RD3zo*qf+?IG>KGG~ z!F~+~d~9Tl_IIi-!!2lDf^-$vr(@Jo2HQVi^f3Ia7`((`=)_pcF44}PYkjy1nDsG( zR@(&^#-r%WPXj|`Fl%GQA?+RjIGIpJRhN@P4)&p~(j;$KN;+k5?s#3#3L?jNl%=oj z7`OeNM`VdkST|2AFr;`)L}!g)CU|+32V|&o;6)a5`U{WK`SPGFr?zeJ`gyAK4*B~B z_wT?^*B&Y}^p2;jbsFv%y7G#5;3{`m@0lTO-QN=dq!?T0bW{fi=#XBNDV{Z55HfwTwlkK%>dIX zaxQhuLvfQa)M@&lMWt)!SlCN@X#LL$hBaqsdFNQz?LBla&k77hOm;l)nZd4A3K^Wc zQ(ud;8$)pTy(M>3$K&r`<-B{DgvQhF-HyC}l{4<0NpR;S^J~AFb|Z^kj;(Qr1;mw~ z&*&n%kgU9V<19=X!1JE+52L$|Jr~=8`)xu zLc#-)9c9#dx5~$QpB7KEz(j)8?7UV(eMZNYdPrCMfJ(_D;o^9n#E=jSn$0fmg%?F8 z@}%z7@ai{Qgd}6-@Z>m4N3@Ak#phVj5ON7cM3GRD2+=G_z*^1#EgKV#3HyJ|I!)FS zMvubY0GxFhlWf&eaYS8Hfdl3^UeD8&36~AOPMqA~WLSuGQ^(Q>x!0$X8(0f-%VK3R=V@qxG}mi*oguwkpyP$fe7H^~AkCPb)YY6|Ib;Y! zIx@&PmM<+K*U+1C%bw|lB*lIPy|oOTmX*9J6DL^BR$&5*F;xPK1&n#Ce&=|B7%_Tx zOmuPcx6e|_BD*;~$CMdyTo)7Pbpzvb!(dpYN2+4C($kd**?0;xi^c+8d;!Pu{xTJ< z!~`?zgJwyf)(x!NhQ#Q-UvC}RdzLWKIwHf1T599jR{zpD(3|6upIS(OHthtF5V9G(j}`0T&}uDRD~)0VHon1sj{27Y;bWeXcJo3V-*X5hsx9A#1%>wo* zk4uP}GKkm}Z=`EvOy7;?hi0_AKveV(K#1KmxSrcvQ{xgr${=O1n$j&~WhF-Q5Is$_ ztY_5kQ7@(sYSeV*CM1aqXKrvy3n)T$3B|TLZq=`s(Y#k%d$h#u9Xs_wdNghddTci@ zCAD-%YVO&*0HcXaUf1pmd`2hv8H9V>P3|0Jay!r&qt=+72!2C}@T^Vk80B^xg8cRq zQ>l*xkI8nPsF&O*A{dTsV6J}e&H}n1BkM;Vo*X}v)-5qQrmSIpTx1l(*!+PqxGB&L z-6HGVsrd?w%GBH`P@R6lsC1t-%Ts~vu0x4G#kbuWfz!i&tJE?2mqd`i{w3rQ`D=i1 zLgBE`0Rjqfs%Bi!f0}Hkm*2|)<$oEAzanJr@rAPHg}J}i9P&8O^$1h2juic62Y~-& zM)Og!d~H;9x~-!QDV6?3d>wnx_x9VUsH4&BH{|ig&EwB{2EQ*oG4Q<zzIPX$ZZ;G zr5-fsY?1+ICS1+|Jkfr5p6l4sMkRu)5blqv8E0G+&z%&;V5!Rpi%vLYN}90%d^vjovss!aUx3^W3X7H$L z*!8a5YP2SzI#N|*ZBVVnX(NNm+$1h}mTQI;q7t2Jbm!>AVys~;Ro%l3%T(Pu+^|Di ztsXa62#dZ={9rK*y_Tx45D3_zt=1XYSMK9xstRKe9QyWKWE-9PySeeXuioUR-_0Y> zYumGm(YRtA>diu3bJQ((=DI&aFsJPB3e#A-@fX=T`J6IHG0n21({M&>lX2$WDUSG@ zmV)T=R698WeDgEIISPxw=CIBYq&2mX%&+o`EG4lwch;m>(eV9%C(Y6B^ZCV~*E@`1*~MIzyNxjV@56U*k;!E- z!zx=UHL%Tj@66pd6nIyK+FL>s!LO*cu-7vRk+6m9J>lZamNsl^!C->C^X47z5iZ^Z z-Rm8D*S)&8=;-Y+8ZS`9ubH+bj?gh>SS-vD_+Lxt+?}Q?T+o}<*&6hEZ-}xpfg~Nr zG=%F*#tW2SnaOA2{#o6}nJ;1PIvry<>t##?!9>FhLLwCUdoS>=b_;aHmjz+0dC<9i z?@nH1`IxMn$npg;S&*5zytfGcV%th4j2B1!MK+dV%CyufA|{&u&7-%+Tgar-FRn{= zMd)9%H$eZ*Qy3}aCW&cC^=wslyVgggPPuSC>e1Wd`aUmJDBsup7c8doucpIFLw#YX z$ZkBXxggaZ=<=H0wzs+8w%ZlzyGMruLboB>t-Nnr?3D^q{r1^2bF&SV3VpN-mQt6_2LP5PIu4rPBN~$lx7Ual zZ$A#u@uZR9ZC`AkdHZ?tnYqW@7-9&xmDd#11NZlPo|(c2J%mOBb4{Jij70^B{0nX< zL(iVoZEZb!)}d-e=PoJa_TTA`=6brGgVfip*(k!+DN>o6Zbj?Go@fJJ(d zl|Yld=1%vJ)I-jJN+pRjCm#~R&SrF?4p7Rn9?ml3=<(oEXvOrB7|7R}M$g7lhOl$8 zOBO>L&R#VimKG@s_n_Bn$|R#pWwab*7WQ25bQ}{o<6L)RulI(s2+j2fq0C&Z0@?vA z#f)E@dx~*v+QwWKjEE3iNLX7@W@c{hnct8mEG^8gg8vnmRz<96n$n2m7Dn5ffwe7Q zXYA_D&Wv9NitqT<1FhZyKoC$VQ)8gD?~qIdcmwwMB}co1;b7S79iln@2c+Mf;81a4 zm#6Yu!Dm>aF(C{kMCc|kEa8a5m4;Waj$}Dc1P&E-`RqJi2Nu6e!jlMcMR{sv)173= zw!5#nxZKw5tHE#k-kMY*4OJ=#=t@Be3*ovxOU4YdDKU9~7ChaEV>H88#L$ZqWyAT6 zI2njLp2sJ_J}ou`K{z&%>G`-N*Ew?I@PU}JkN|;_fa1d_p4 zWm6qNv`9yKpjNNh)I;b(mhvAxyYM|!jW8mKAg~{#KZu@1%nKb@*EeNckMYpw~O%OlqT|I^FTFXG>$aBsCkO zc5s4ApHH*0x`STt*AEQ6=T`*gTcf>gv^(4#ZX0pE+C?%=V8!7YOLLo2952v>GAd^z zs`dNynA0pi8SqJT6QJ>MTb z-y8jDIC?SK8~zCm?~J*_lS+lfpN4nFRc7vA1n?l z(SA4;ypE|Sv4tvx66AX zV6Ekd$LZX)P=Nj+IXl5>c7O)PK^TObnJU^X8qA55cuIO^ZP_%CxzO9bQVUIiRN6i7 z2vhp?Eyx8k)Gr6=y4*Ocl(Ta>CsN^gQh<1v5pBRlSeX~*^VJB)$qbK7`-U?z#|O4N zPY63aIsRqutneD4DBrj^K%awNzUE$toU;doe)?X|v=Tw2J6jJI%A&sXw_y6Zk32|% zKu@E~@1@(Mft8$Wu48L&+Pm9Hw3V;5dvJ2u-++s{2idno@Pr6Oov@n68;d=EH=&tl z{pe=0{-QYsY!|T2J3aq_CN$GFTH78BaR_r8lt7;mapmO>4LQ3aLcx*ADWm_)U`w}n zr{}a%nFU3LV>63_c|{5G950X{8YfDb2hT2hmrB2L?)w4q9Bikd^z<@iR4sO(!Ra_v zT*#e>T#?vbD|C-mHd-991!Zr+ z%zD8sfuFuUJI`aBp{GoznoVEgoIAX z*o~vm(=UF}VguEWe85#9vqHfutgwxcaMOA{Wp`_9Cb@Bhh;Fb{&rIR&_zFyf5+VX4 zhp(LqGq9Od1XubS*^7e@(0HM$@EY1)Kg0)L<<7T^P3^J-Lt}56=O)lDhhRhz8NfIa zS0qT;CF9pDm{1Z&@&GB3mf2Edo@jNpq)RH}T|eixZb2dEi&NRbtK78MF06s&cCGE8 zh9k*fePoSvp;ie)jZ%hI=nJ&0KPqkX6Is}V0{LdVYhHIEHzHP0fWj(Q`eA7d3pTa= zBWE;_m*`46X?0XO=C0OX<9|dCZ_M zAH_f0%v}>4(wHi37Zbs!0?#2W8Jb}hxwvPU&(v$6HjeMx`3G)8xyVCMbXqz&jxd?- z>N-MU=RD52gb9@i<>zDQfXG5bd{XvGN=L-HI+yw6e~CYHnoTzR30=NdVkor1jNEJo zYjSG3#q{NdL}4lfOg(hpS39s#Q#3Z=k>kb|8D}n*7Or-xP_}=q5Qfw{m@)*@q&nGJ zrm15r)w#e-Qnw7!G+YbZyv0(1t#!dQmLHXYaxNcd1Qix*s*mCbGp=StG+96AzH7H4 z&}eV#*J*Zt2JfUZtLGp_IlEMP{9a?(G|5~$?RFWh6VZogmd-JQE0sX*ZDmBw%h; zrXUjx6XUdGs^gwta7-gVWV3J9GW!Rpe=bte-$wm6IF|Yk{q<*K-}<-az1i}0=lpz; zfUdeb&j%U5x8tYY4w@%uRz3m1ZJez)cpc3ioil!a%aScFu~i=`6_6m4*qqm$5kC=a z!OYf>oEhHn!dQ}GaG@8T(YQ21nR>C`z%FHqOo>?TOH{iefc2$bV=Y6s=cDNvr&e>` zn{=ElaXP?u^rBB+9`|$qH$SEQ-~2e&PGel};2)B+RdBTL|L%@9&f?=u>;e5E00M?B_2;}X*`-W+bD-O*?p?LL3LjYeB_DD`Yxm-kOl z{{PTnOoWnk<+UEx<+A}(w7p-lU%$a$Ukr%8XTNmq#w&#^%07vxsMt^Usb&dy=3h8dzPjMIp~1+08*Vsm+t-DD=yaE7o%5s3-R zj7qS|L``TMR}}@k{+qxNB~0ZKoPC}O8lCW>ddfcPCj4{FFum4zc56P|R58H&g??Wg z$|X8xG>Qm2BZ4+|4-C2z)_zQ;ghln_GNYjS?Xp&vXvGKF8{Tm+1@NLQXFRDIwCtlEGjB8S zt;8op=!pZKl7{|<)gvvrsjTUE_}U~Yg0P4P0=8-rb5-U+f}FW?O0{hPi^R=}L@FF! zHei>EBngS$Qr5(p!eUC4thfNE)(wCvp#Nj`Py&as;6H2VSTRp-pa0e)A(BMtIudeUe6P?SW@Qy62X_c{Ec5}n-W-)(+>r{ zzSpk@=09~~J$nEDn%=)r&er!&c=Ymr{@#C@@aXS-I}y<8Z`15(u4__oOLza%C%3cu z<;x%0?|%)Z@6qdj^!gvY{s-jwt9$)D53yEcS|1hR_RWbOd*VpjyIuD|En>SRBHVg> zc`u-E!@en--fo*I_pchHL6IAfg(S;r+$0b%2unq~h@snks?%Y1vTzu;IZ*AA*q^7d zqAk_kPF3S12o=4bvMqqmzo$ejmbQ~80(HB3f=r1X5B<8T@{%S$i}-B8!WL%oZM2M; zHjP*-`|&TfCmR}csmw?cLt>>Ri-bYpo__p@C~!+1ww-uZuw(h_nhlDR)_mKL1|;00960JEn1Y05k#s D10cTg literal 0 HcmV?d00001 diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/.helmignore b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/.helmignore new file mode 100644 index 00000000..f0c13194 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/Chart.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/Chart.yaml new file mode 100644 index 00000000..3196ce77 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/Chart.yaml @@ -0,0 +1,19 @@ +annotations: + category: DeveloperTools +apiVersion: v2 +appVersion: 0.39.1 +description: Helm chart for the sealed-secrets controller. +home: https://github.com/bitnami/sealed-secrets +icon: https://bitnami.com/assets/stacks/sealed-secrets/img/sealed-secrets-stack-220x234.png +keywords: +- secrets +- sealed-secrets +kubeVersion: '>=1.16.0-0' +maintainers: +- name: Bitnami + url: https://github.com/bitnami/sealed-secrets +name: sealed-secrets +sources: +- https://github.com/bitnami/sealed-secrets +type: application +version: 2.19.3 diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/README.md b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/README.md new file mode 100644 index 00000000..a4a69f81 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/README.md @@ -0,0 +1,318 @@ +# Sealed Secrets + +Sealed Secrets are "one-way" encrypted K8s Secrets that can be created by anyone, but can only be decrypted by the controller running in the target cluster recovering the original object. + + + + +- [Sealed Secrets](#sealed-secrets) + - [TL;DR](#tldr) + - [Introduction](#introduction) + - [Prerequisites](#prerequisites) + - [Installing the Chart](#installing-the-chart) + - [Uninstalling the Chart](#uninstalling-the-chart) + - [Parameters](#parameters) + - [Common parameters](#common-parameters) + - [Sealed Secrets Parameters](#sealed-secrets-parameters) + - [Traffic Exposure Parameters](#traffic-exposure-parameters) + - [Other Parameters](#other-parameters) + - [Metrics parameters](#metrics-parameters) + - [PodDisruptionBudget Parameters](#poddisruptionbudget-parameters) + - [Using kubeseal](#using-kubeseal) + - [Configuration and installation details](#configuration-and-installation-details) + - [Troubleshooting](#troubleshooting) + - [Upgrading](#upgrading) + - [To 2.0.0](#to-200) + + + +## TL;DR + +```console +$ helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets +$ helm install my-release sealed-secrets/sealed-secrets +``` + +## Introduction + +Bitnami charts for Helm are carefully engineered, actively maintained and are the quickest and easiest way to deploy containers on a Kubernetes cluster that are ready to handle production workloads. + +This chart bootstraps a [Sealed Secret Controller](https://github.com/bitnami/sealed-secrets) Deployment in [Kubernetes](http://kubernetes.io) using the [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for the deployment and management of Helm Charts in clusters. + +## Prerequisites + +- Kubernetes 1.16+ +- Helm 3.1.0 + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +helm install my-release sealed-secrets/sealed-secrets +``` + +The command deploys the Sealed Secrets controller on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +### Common parameters + +| Name | Description | Value | +| ------------------- | ------------------------------------------------------- | ----- | +| `kubeVersion` | Override Kubernetes version | `""` | +| `nameOverride` | String to partially override sealed-secrets.fullname | `""` | +| `fullnameOverride` | String to fully override sealed-secrets.fullname | `""` | +| `namespace` | Namespace where to deploy the Sealed Secrets controller | `""` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | +| `commonAnnotations` | Annotations to add to all deployed resources | `{}` | +| `commonLabels` | Labels to add to all deployed resources | `{}` | + +### Sealed Secrets Parameters + +| Name | Description | Value | +| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ----------------------------------- | +| `image.registry` | Sealed Secrets image registry | `docker.io` | +| `image.repository` | Sealed Secrets image repository | `bitnami/sealed-secrets-controller` | +| `image.tag` | Sealed Secrets image tag (immutable tags are recommended) | `0.39.1` | +| `image.pullPolicy` | Sealed Secrets image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Sealed Secrets image pull secrets | `[]` | +| `revisionHistoryLimit` | Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) | `""` | +| `createController` | Specifies whether the Sealed Secrets controller should be created | `true` | +| `secretName` | The name of an existing TLS secret containing the key used to encrypt secrets | `sealed-secrets-key` | +| `updateStatus` | Specifies whether the Sealed Secrets controller should update the status subresource | `true` | +| `skipRecreate` | Specifies whether the Sealed Secrets controller should skip recreating removed secrets | `false` | +| `keyrenewperiod` | Specifies key renewal period. Default 30 days | `""` | +| `keyttl` | Specifies the certificate validity duration. Default 10 years. | `""` | +| `keycutofftime` | Specifies a date at which the controller should generate a new certificate. Useful in early key renewal scenarios. | `""` | +| `rateLimit` | Number of allowed sustained request per second for verify endpoint | `""` | +| `rateLimitBurst` | Number of requests allowed to exceed the rate limit per second for verify endpoint | `""` | +| `additionalNamespaces` | List of namespaces used to manage the Sealed Secrets | `[]` | +| `privateKeyAnnotations` | Map of annotations to be set on the sealing keypairs | `{}` | +| `privateKeyLabels` | Map of labels to be set on the sealing keypairs | `{}` | +| `logInfoStdout` | Specifies whether the Sealed Secrets controller will log info to stdout | `false` | +| `logLevel` | Specifies log level of controller (INFO,ERROR) | `""` | +| `logFormat` | Specifies log format (text,json) | `""` | +| `maxRetries` | Number of maximum retries | `""` | +| `watchForSecrets` | Specifies whether the Sealed Secrets controller will watch for new secrets | `false` | +| `kubeClientQPS` | Kubeclient QPS (negative value disables ratelimiting) | `""` | +| `kubeClientBurst` | Kubeclient Burst | `""` | +| `command` | Override default container command | `[]` | +| `args` | Override default container args | `[]` | +| `livenessProbe.enabled` | Enable livenessProbe on Sealed Secret containers | `true` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `0` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe on Sealed Secret containers | `true` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `0` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `startupProbe.enabled` | Enable startupProbe on Sealed Secret containers | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `0` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `customStartupProbe` | Custom startupProbe that overrides the default one | `{}` | +| `resources.limits` | The resources limits for the Sealed Secret containers | `{}` | +| `resources.requests` | The requested resources for the Sealed Secret containers | `{}` | +| `podSecurityContext.enabled` | Enabled Sealed Secret pods' Security Context | `true` | +| `podSecurityContext.fsGroup` | Set Sealed Secret pod's Security Context fsGroup | `65534` | +| `podSecurityContext.seccompProfile.type` | Set Sealed Secret pod's Security Context seccomp profile type | `RuntimeDefault` | +| `containerSecurityContext.enabled` | Enabled Sealed Secret containers' Security Context | `true` | +| `containerSecurityContext.readOnlyRootFilesystem` | Whether the Sealed Secret container has a read-only root filesystem | `true` | +| `containerSecurityContext.runAsNonRoot` | Indicates that the Sealed Secret container must run as a non-root user | `true` | +| `containerSecurityContext.runAsUser` | Set Sealed Secret containers' Security Context runAsUser | `1001` | +| `containerSecurityContext.allowPrivilegeEscalation` | Set Sealed Secret containers' privilege escalation | `false` | +| `containerSecurityContext.capabilities` | Adds and removes POSIX capabilities from running containers (see `values.yaml`) | | +| `hostUsers` | Specifies whether or not host or namespaced users should be used | `null` | +| `podLabels` | Extra labels for Sealed Secret pods | `{}` | +| `podAnnotations` | Annotations for Sealed Secret pods | `{}` | +| `priorityClassName` | Sealed Secret pods' priorityClassName | `""` | +| `runtimeClassName` | Sealed Secret pods' runtimeClassName | `""` | +| `affinity` | Affinity for Sealed Secret pods assignment | `{}` | +| `nodeSelector` | Node labels for Sealed Secret pods assignment | `{}` | +| `tolerations` | Tolerations for Sealed Secret pods assignment | `[]` | +| `additionalVolumes` | Extra Volumes for the Sealed Secrets Controller Deployment | `{}` | +| `additionalVolumeMounts` | Extra volumeMounts for the Sealed Secrets Controller container | `{}` | +| `hostNetwork` | Sealed Secrets pods' hostNetwork | `false` | +| `containerPorts.http` | Controller HTTP Port on the Host and Container | `8080` | +| `containerPorts.metrics` | Metrics HTTP Port on the Host and Container | `8081` | +| `hostPorts.http` | Controller HTTP Port on the Host | `""` | +| `hostPorts.metrics` | Metrics HTTP Port on the Host | `""` | +| `dnsPolicy` | Sealed Secrets pods' dnsPolicy | `""` | + +### Traffic Exposure Parameters + +| Name | Description | Value | +| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `service.type` | Sealed Secret service type | `ClusterIP` | +| `service.loadBalancerClass` | Sealed Secret service loadBalancerClass | `""` | +| `service.port` | Sealed Secret service HTTP port | `8080` | +| `service.nodePort` | Node port for HTTP | `""` | +| `service.annotations` | Additional custom annotations for Sealed Secret service | `{}` | +| `ingress.enabled` | Enable ingress record generation for Sealed Secret | `false` | +| `ingress.pathType` | Ingress path type | `ImplementationSpecific` | +| `ingress.apiVersion` | Force Ingress API version (automatically detected if not set) | `""` | +| `ingress.ingressClassName` | IngressClass that will be be used to implement the Ingress | `""` | +| `ingress.hostname` | Default host for the ingress record | `sealed-secrets.local` | +| `ingress.path` | Default path for the ingress record | `/v1/cert.pem` | +| `ingress.annotations` | Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. | `{}` | +| `ingress.tls` | Enable TLS configuration for the host defined at `ingress.hostname` parameter | `false` | +| `ingress.selfSigned` | Create a TLS secret for this ingress record using self-signed certificates generated by Helm | `false` | +| `ingress.extraHosts` | An array with additional hostname(s) to be covered with the ingress record | `[]` | +| `ingress.extraPaths` | An array with additional arbitrary paths that may need to be added to the ingress under the main host | `[]` | +| `ingress.extraTls` | TLS configuration for additional hostname(s) to be covered with this ingress record | `[]` | +| `ingress.secrets` | Custom TLS certificates as secrets | `[]` | +| `networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `false` | +| `networkPolicy.egress.enabled` | Specifies wheter a egress is set in the NetworkPolicy | `false` | +| `networkPolicy.egress.kubeapiCidr` | Specifies the kubeapiCidr, which is the only egress allowed. If not set, kubeapiCidr will be found using Helm lookup | `""` | +| `networkPolicy.egress.kubeapiPort` | Specifies the kubeapiPort, which is the only egress allowed. If not set, kubeapiPort will be found using Helm lookup | `""` | + +### Other Parameters + +| Name | Description | Value | +| ------------------------------ | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | +| `serviceAccount.annotations` | Annotations for Sealed Secret service account | `{}` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.labels` | Extra labels to be added to the ServiceAccount | `{}` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `rbac.clusterRole` | Specifies whether the Cluster Role resource should be created | `true` | +| `rbac.clusterRoleName` | Specifies the name for the Cluster Role resource | `secrets-unsealer` | +| `rbac.namespacedRoles` | Specifies whether the namespaced Roles should be created (in each of the specified additionalNamespaces) | `false` | +| `rbac.namespacedRolesName` | Specifies the name for the namespaced Role resource | `secrets-unsealer` | +| `rbac.labels` | Extra labels to be added to RBAC resources | `{}` | +| `rbac.pspEnabled` | PodSecurityPolicy | `false` | +| `rbac.serviceProxier.create` | Specifies whether to create the "proxier" role, to allow external users to access the SealedSecret API | `true` | +| `rbac.serviceProxier.bind` | Specifies whether to create a RoleBinding for the "proxier" role | `true` | +| `rbac.serviceProxier.subjects` | Specifies the RBAC subjects to grant the "proxier" role to, in the created RoleBinding | 
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: system:authenticated
| + +### Metrics parameters + +| Name | Description | Value | +| ------------------------------------------ | -------------------------------------------------------------------------------------- | ----------- | +| `metrics.serviceMonitor.enabled` | Specify if a ServiceMonitor will be deployed for Prometheus Operator | `false` | +| `metrics.serviceMonitor.namespace` | Namespace where Prometheus Operator is running in | `""` | +| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.annotations` | Extra annotations for the ServiceMonitor | `{}` | +| `metrics.serviceMonitor.interval` | How frequently to scrape metrics | `""` | +| `metrics.serviceMonitor.scrapeTimeout` | Timeout after which the scrape is ended | `""` | +| `metrics.serviceMonitor.honorLabels` | Specify if ServiceMonitor endPoints will honor labels | `true` | +| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics | `[]` | +| `metrics.serviceMonitor.relabelings` | Specify general relabeling | `[]` | +| `metrics.dashboards.create` | Specifies whether a ConfigMap with a Grafana dashboard configuration should be created | `false` | +| `metrics.dashboards.labels` | Extra labels to be added to the Grafana dashboard ConfigMap | `{}` | +| `metrics.dashboards.annotations` | Annotations to be added to the Grafana dashboard ConfigMap | `{}` | +| `metrics.dashboards.namespace` | Namespace where Grafana dashboard ConfigMap is deployed | `""` | +| `metrics.service.type` | Sealed Secret Metrics service type | `ClusterIP` | +| `metrics.service.loadBalancerClass` | Sealed Secret Metrics service loadBalancerClass | `""` | +| `metrics.service.port` | Sealed Secret service Metrics HTTP port | `8081` | +| `metrics.service.nodePort` | Node port for HTTP | `""` | +| `metrics.service.annotations` | Additional custom annotations for Sealed Secret Metrics service | `{}` | + +### PodDisruptionBudget Parameters + +| Name | Description | Value | +| -------------------- | ----------------------------------------------------------- | ------- | +| `pdb.create` | Specifies whether a PodDisruptionBudget should be created | `false` | +| `pdb.minAvailable` | The minimum number of pods (non number to omit) | `1` | +| `pdb.maxUnavailable` | The maximum number of unavailable pods (non number to omit) | `""` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release \ + --set resources.requests.cpu=25m \ + sealed-secrets/sealed-secrets +``` + +The above command sets the `resources.requests.cpu` parameter to `25m`. + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml sealed-secrets/sealed-secrets +``` + +## Using kubeseal + +Install the kubeseal CLI by downloading the binary from [sealed-secrets/releases](https://github.com/bitnami/sealed-secrets/releases). + +Fetch the public key by passing the release name and namespace: + +```bash +kubeseal --fetch-cert \ +--controller-name=my-release \ +--controller-namespace=my-release-namespace \ +> pub-cert.pem +``` + +Read about kubeseal usage on [sealed-secrets docs](https://github.com/bitnami/sealed-secrets#usage). + +NOTE: the helm chart by default installs the controller with the name `sealed-secrets`, while the `kubeseal` command line interface (CLI) tries to access the controller with the name `sealed-secrets-controller`. You can explicitly pass `--controller-name` to the CLI: + +```bash +kubeseal --controller-name sealed-secrets +``` + +Alternatively, you can override `fullnameOverride` on the helm chart install. + +## Configuration and installation details + +- In the case that **serviceAccount.create** is `false` and **rbac.create** is `true` it is expected for a ServiceAccount with the name **serviceAccount.name** to exist _in the same namespace as this chart_ before the installation. +- If **rbac.create** is `true, by default *clusterRoles* are created. To switch to namespaced *Roles*: + 1. set the required namespaces in **additionalNamespaces** + 2. set **rbac.clusterRole** to `false` + 3. set **rbac.namespacedRoles** to `true` +- If **serviceAccount.create** is `true` there cannot be an existing service account with the name **serviceAccount.name**. +- If a secret with name **secretName** does not exist _in the same namespace as this chart_, then on install one will be created. If a secret already exists with this name the keys inside will be used. +- OpenShift: unset the runAsUser and fsGroup like this when installing in a custom namespace: + +```yaml +podSecurityContext: + fsGroup: + +containerSecurityContext: + runAsUser: +``` + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 2.0.0 + +A major refactoring of the chart has been performed to adopt several common practices for Helm charts. Upgrades from previous chart versions should work, however, the values structure experienced several changes and you'll have to adapt your custom values/parameters so they're aligned with the new structure. For instance, these are a couple of examples: + +- `controller.create` renamed as `createController`. +- `securityContext.*` parameters are deprecated in favor of `podSecurityContext.*`, and `containerSecurityContext.*` ones. +- `image.repository` changed to `image.registry`/`image.repository`. +- `ingress.hosts[0]` changed to `ingress.hostname`. + +Consult the [Parameters](#parameters) section to obtain more info about the available parameters. + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this new major version is no longer compatible with Helm v2. diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/artifacthub-repo.yml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/artifacthub-repo.yml new file mode 100644 index 00000000..b3b6b010 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/artifacthub-repo.yml @@ -0,0 +1 @@ +repositoryID: f0e7bfa1-6890-4088-af4b-cfc07f11ab84 diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml new file mode 100644 index 00000000..a41921e4 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/crds/bitnami.com_sealedsecrets.yaml @@ -0,0 +1,168 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: sealedsecrets.bitnami.com +spec: + group: bitnami.com + names: + kind: SealedSecret + listKind: SealedSecretList + plural: sealedsecrets + singular: sealedsecret + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[0].message + name: Status + type: string + - jsonPath: .status.conditions[0].status + name: Synced + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + SealedSecret is the K8s representation of a "sealed Secret" - a + regular k8s Secret that has been sealed (encrypted) using the + controller's key. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SealedSecretSpec is the specification of a SealedSecret. + properties: + data: + description: Data is deprecated and will be removed eventually. Use + per-value EncryptedData instead. + format: byte + type: string + encryptedData: + additionalProperties: + type: string + type: object + x-kubernetes-preserve-unknown-fields: true + template: + description: |- + Template defines the structure of the Secret that will be + created from this sealed secret. + properties: + data: + additionalProperties: + type: string + description: Keys that should be templated using decrypted data. + nullable: true + type: object + immutable: + description: |- + Immutable, if set to true, ensures that data stored in the Secret cannot + be updated (only object metadata can be modified). + If not set to true, the field can be modified at any time. + Defaulted to nil. + type: boolean + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata + nullable: true + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + x-kubernetes-preserve-unknown-fields: true + type: + description: Used to facilitate programmatic handling of secret + data. + type: string + type: object + required: + - encryptedData + type: object + status: + description: SealedSecretStatus is the most recently observed status of + the SealedSecret. + properties: + conditions: + description: Represents the latest available observations of a sealed + secret's current state. + items: + description: SealedSecretCondition describes the state of a sealed + secret at a certain point. + properties: + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + lastUpdateTime: + description: The last time this condition was updated. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: |- + Status of the condition for a sealed secret. + Valid values for "Synced": "True", "False", or "Unknown". + type: string + type: + description: |- + Type of condition for a sealed secret. + Valid value: "Synced" + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration reflects the generation most recently + observed by the sealed-secrets controller. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/dashboards/sealed-secrets-controller.json b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/dashboards/sealed-secrets-controller.json new file mode 100644 index 00000000..ed38feab --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/dashboards/sealed-secrets-controller.json @@ -0,0 +1,302 @@ +{ + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": "-- Grafana --", + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "type": "dashboard" + } + ] + }, + "description": "Sealed Secrets Controller", + "editable": true, + "gnetId": null, + "graphTooltip": 0, + "id": 3, + "iteration": 1585599163503, + "links": [ + { + "icon": "external link", + "tags": [], + "title": "GitHub", + "tooltip": "View Project on GitHub", + "type": "link", + "url": "https://github.com/bitnami/sealed-secrets" + } + ], + "panels": [ + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "$datasource", + "description": "Rate of requests to unseal a SealedSecret.\n\nThis can include non-obvious operations such as deleting a SealedSecret.", + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 9, + "w": 12, + "x": 0, + "y": 0 + }, + "hiddenSeries": false, + "id": 2, + "legend": { + "avg": true, + "current": false, + "max": true, + "min": true, + "show": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null", + "options": { + "dataLinks": [] + }, + "percentage": false, + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(sealed_secrets_controller_unseal_requests_total{}[1m]))", + "format": "time_series", + "instant": false, + "intervalFactor": 1, + "legendFormat": "rps", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Unseal Request Rate/s", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": "$datasource", + "description": "Rate of errors when unsealing a SealedSecret. \n\nReason for error included as label value, eg:\n- unseal = cryptography issue (key/namespace) or RBAC\n- unmanaged = destination Secret wasn't created by SealedSecrets\n- update = potentially RBAC\n- status = potentially RBAC\n- fetch = potentially RBAC\n", + "fill": 1, + "fillGradient": 0, + "gridPos": { + "h": 9, + "w": 12, + "x": 12, + "y": 0 + }, + "hiddenSeries": false, + "id": 3, + "legend": { + "avg": false, + "current": false, + "hideEmpty": false, + "hideZero": false, + "max": false, + "min": false, + "show": true, + "total": false, + "values": false + }, + "lines": true, + "linewidth": 1, + "links": [], + "nullPointMode": "null as zero", + "options": { + "dataLinks": [] + }, + "percentage": false, + "pointradius": 2, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "expr": "sum(rate(sealed_secrets_controller_unseal_errors_total{pod=~\"$pod\"}[1m])) by (reason)", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ reason }}", + "refId": "A" + } + ], + "thresholds": [], + "timeFrom": null, + "timeRegions": [], + "timeShift": null, + "title": "Unseal Error Rate/s", + "tooltip": { + "shared": true, + "sort": 0, + "value_type": "individual" + }, + "type": "graph", + "xaxis": { + "buckets": null, + "mode": "time", + "name": null, + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + }, + { + "format": "short", + "label": null, + "logBase": 1, + "max": null, + "min": null, + "show": true + } + ], + "yaxis": { + "align": false, + "alignLevel": null + } + } + ], + "refresh": false, + "schemaVersion": 22, + "style": "dark", + "tags": [], + "templating": { + "list": [ + { + "current": { + "text": "prometheus", + "value": "prometheus" + }, + "hide": 0, + "includeAll": false, + "label": null, + "multi": false, + "name": "datasource", + "options": [], + "query": "prometheus", + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "type": "datasource" + }, + { + "allValue": null, + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": "$datasource", + "definition": "label_values(kube_pod_info, pod)", + "hide": 0, + "includeAll": true, + "label": null, + "multi": false, + "name": "pod", + "options": [], + "query": "label_values(kube_pod_info, pod)", + "refresh": 1, + "regex": "/^sealed-secrets-controller.*$/", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tags": [], + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-1h", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "1m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "", + "title": "Sealed Secrets Controller", + "uid": "UuEtZCVWz", + "version": 2 +} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/NOTES.txt b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/NOTES.txt new file mode 100644 index 00000000..b23e56c7 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/NOTES.txt @@ -0,0 +1,46 @@ +{{ if .Values.createController -}} + +** Please be patient while the chart is being deployed ** + +You should now be able to create sealed secrets. + +1. Install the client-side tool (kubeseal) as explained in the docs below: + + https://github.com/bitnami/sealed-secrets#installation-from-source + +2. Create a sealed secret file running the command below: + + kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o [json|yaml] | \ + kubeseal \ + --controller-name={{ include "sealed-secrets.fullname" . }} \ + --controller-namespace={{ include "sealed-secrets.namespace" . }} \ + --format yaml > mysealedsecret.[json|yaml] + +The file mysealedsecret.[json|yaml] is a commitable file. + +If you would rather not need access to the cluster to generate the sealed secret you can run: + + kubeseal \ + --controller-name={{ include "sealed-secrets.fullname" . }} \ + --controller-namespace={{ include "sealed-secrets.namespace" . }} \ + --fetch-cert > mycert.pem + +to retrieve the public cert used for encryption and store it locally. You can then run 'kubeseal --cert mycert.pem' instead to use the local cert e.g. + + kubectl create secret generic secret-name --dry-run=client --from-literal=foo=bar -o [json|yaml] | \ + kubeseal \ + --controller-name={{ include "sealed-secrets.fullname" . }} \ + --controller-namespace={{ include "sealed-secrets.namespace" . }} \ + --format [json|yaml] --cert mycert.pem > mysealedsecret.[json|yaml] + +3. Apply the sealed secret + + kubectl create -f mysealedsecret.[json|yaml] + +Running 'kubectl get secret secret-name -o [json|yaml]' will show the decrypted secret that was generated from the sealed secret. + +Both the SealedSecret and generated Secret must have the same name and namespace. +{{- else }} +Sealed Secrets controller not installed, You need to install controller before +sealed secrets can be created. +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/_helpers.tpl b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/_helpers.tpl new file mode 100644 index 00000000..b6e6e743 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/_helpers.tpl @@ -0,0 +1,203 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "sealed-secrets.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "sealed-secrets.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Expand to the namespace sealed-secrets installs into. +*/}} +{{- define "sealed-secrets.namespace" -}} +{{- default .Release.Namespace .Values.namespace -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "sealed-secrets.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "sealed-secrets.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "sealed-secrets.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Kubernetes standard labels +*/}} +{{- define "sealed-secrets.labels" -}} +app.kubernetes.io/name: {{ include "sealed-secrets.name" . }} +helm.sh/chart: {{ include "sealed-secrets.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/version: {{ .Chart.AppVersion }} +app.kubernetes.io/part-of: sealed-secrets +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "sealed-secrets.matchLabels" -}} +app.kubernetes.io/name: {{ include "sealed-secrets.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +*/}} +{{- define "sealed-secrets.ingress.certManagerRequest" -}} +{{ if or (hasKey . "cert-manager.io/cluster-issuer") (hasKey . "cert-manager.io/issuer") }} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Renders a value that contains template. +Usage: +{{ include "sealed-secrets.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "sealed-secrets.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "sealed-secrets.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "sealed-secrets.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "sealed-secrets.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "sealed-secrets.networkPolicy.apiVersion" -}} +{{- if semverCompare "<1.7-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +Usage: +{{ include "sealed-secrets.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "sealed-secrets.backend" -}} +{{- $apiVersion := (include "sealed-secrets.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "sealed-secrets.supportsPathType" . }} +*/}} +{{- define "sealed-secrets.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "sealed-secrets.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "sealed-secrets.supportsIngressClassname" . }} +*/}} +{{- define "sealed-secrets.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "sealed-secrets.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role-binding.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..a9227b60 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role-binding.yaml @@ -0,0 +1,26 @@ +{{ if and .Values.rbac.create (not .Values.rbac.namespacedRoles)}} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "sealed-secrets.fullname" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Values.rbac.clusterRoleName }} +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "sealed-secrets.serviceAccountName" . }} + namespace: {{ include "sealed-secrets.namespace" . }} +{{ end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role.yaml new file mode 100644 index 00000000..5326f3ba --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/cluster-role.yaml @@ -0,0 +1,60 @@ +{{ if and (and .Values.rbac.create .Values.rbac.clusterRole) (not .Values.rbac.namespacedRoles) }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Values.rbac.clusterRoleName }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - bitnami.com + resources: + - sealedsecrets + verbs: + - get + - list + - watch + - apiGroups: + - bitnami.com + resources: + - sealedsecrets/status + verbs: + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - delete + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + {{- if .Values.additionalNamespaces }} + - apiGroups: + - "" + resources: + - namespaces + resourceNames: + {{- include "sealed-secrets.render" (dict "value" .Values.additionalNamespaces "context" $) | nindent 6 }} + verbs: + - get + {{- end }} +{{ end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/configmap-dashboards.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/configmap-dashboards.yaml new file mode 100644 index 00000000..e49974c2 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/configmap-dashboards.yaml @@ -0,0 +1,29 @@ +{{- if .Values.metrics.dashboards.create }} +{{- $namespace := .Values.metrics.dashboards.namespace | default $.Release.Namespace }} +{{- range $path, $_ := .Files.Glob "dashboards/*.json" }} +{{- $filename := trimSuffix (ext $path) (base $path) }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-%s" (include "sealed-secrets.fullname" $) $filename }} + namespace: {{ $namespace }} + labels: {{- include "sealed-secrets.labels" $ | nindent 4 }} + {{- if $.Values.metrics.dashboards.labels }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.metrics.dashboards.labels "context" $) | nindent 4 }} + {{- end }} + {{- if $.Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" $.Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if $.Values.metrics.dashboards.annotations }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.metrics.dashboards.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if $.Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + {{ base $path }}: |- +{{ $.Files.Get $path | indent 4 }} +--- +{{- end }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/deployment.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/deployment.yaml new file mode 100644 index 00000000..973643c1 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/deployment.yaml @@ -0,0 +1,242 @@ +{{- if .Values.createController }} +apiVersion: {{ include "sealed-secrets.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ include "sealed-secrets.fullname" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: 1 + {{- if .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + {{- end }} + selector: + matchLabels: {{- include "sealed-secrets.matchLabels" . | nindent 6 }} + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: {{- toYaml .Values.podAnnotations | nindent 8 }} + {{- end }} + labels: {{- include "sealed-secrets.matchLabels" . | nindent 8 }} + {{- if .Values.podLabels }} + {{- toYaml .Values.podLabels | nindent 8 }} + {{- end }} + spec: + {{- if .Values.image.pullSecrets }} + imagePullSecrets: + {{- range .Values.image.pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{- toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{- toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{- toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + {{- if .Values.runtimeClassName }} + runtimeClassName: {{ .Values.runtimeClassName | quote }} + {{- end }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "sealed-secrets.serviceAccountName" . }} + {{- if kindIs "bool" .Values.hostUsers }} + hostUsers: {{ .Values.hostUsers }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} + {{- if .Values.dnsPolicy }} + dnsPolicy: {{ .Values.dnsPolicy }} + {{- end }} + containers: + - name: controller + command: + {{- if .Values.command }} + {{- include "sealed-secrets.render" (dict "value" .Values.command "context" $) | nindent 12 }} + {{- else }} + - controller + {{- end }} + args: + {{- if .Values.args }} + {{- include "sealed-secrets.render" (dict "value" .Values.args "context" $) | nindent 12 }} + {{- else }} + {{- if .Values.updateStatus }} + - --update-status + {{- end }} + {{- if .Values.skipRecreate }} + - --skip-recreate + {{- end }} + {{- if ne (.Values.keyrenewperiod | toString) "" }} + - --key-renew-period + - {{ .Values.keyrenewperiod | quote }} + {{- end }} + {{- if .Values.keyttl }} + - --key-ttl + - {{ .Values.keyttl | quote }} + {{- end }} + {{- if .Values.keycutofftime }} + - --key-cutoff-time + - {{ .Values.keycutofftime | quote }} + {{- end }} + {{- if .Values.rateLimit }} + - --rate-limit + - {{ .Values.rateLimit | quote }} + {{- end }} + {{- if .Values.rateLimitBurst }} + - --rate-limit-burst + - {{ .Values.rateLimitBurst | quote }} + {{- end }} + - --key-prefix + - {{ .Values.secretName | quote }} + {{- if .Values.additionalNamespaces }} + - --additional-namespaces + - {{ join "," .Values.additionalNamespaces | quote }} + {{- end }} + {{- if $.Values.privateKeyAnnotations }} + {{- $privatekeyAnnotations := ""}} + {{- range $k, $v := $.Values.privateKeyAnnotations }} + {{- if not (and $v (kindIs "string" $v)) }} + {{ fail "Annotation values have to be strings"}} + {{- end }} + {{- $privatekeyAnnotations = printf "%s=%s,%s" $k $v $privatekeyAnnotations}} + {{- end }} + - --privatekey-annotations + - {{ trimSuffix "," $privatekeyAnnotations | quote }} + {{- end }} + {{- if $.Values.privateKeyLabels }} + {{- $privateKeyLabels := ""}} + {{- range $k, $v := $.Values.privateKeyLabels }} + {{- if not (and $v (kindIs "string" $v)) }} + {{ fail "Label values have to be strings"}} + {{- end }} + {{- $privateKeyLabels = printf "%s=%s,%s" $k $v $privateKeyLabels}} + {{- end }} + - --privatekey-labels + - {{ trimSuffix "," $privateKeyLabels | quote }} + {{- end }} + {{- if .Values.logInfoStdout }} + - --log-info-stdout + {{- end }} + {{- if .Values.logLevel }} + - --log-level + - {{ .Values.logLevel }} + {{- end }} + {{- if .Values.logFormat }} + - --log-format + - {{ .Values.logFormat }} + {{- end }} + {{- if .Values.containerPorts.http }} + - --listen-addr + - {{ printf ":%s" (.Values.containerPorts.http | toString ) }} + {{- end }} + {{- if .Values.containerPorts.metrics }} + - --listen-metrics-addr + - {{ printf ":%s" (.Values.containerPorts.metrics | toString) }} + {{- end }} + {{- if .Values.maxRetries }} + - --max-unseal-retries + - {{ .Values.maxRetries | quote }} + {{- end }} + {{- if .Values.watchForSecrets }} + - --watch-for-secrets + {{- end }} + {{- if .Values.kubeClientQPS }} + - --kubeclient-qps + - {{ .Values.kubeClientQPS | quote }} + {{- end }} + {{- if .Values.kubeClientBurst }} + - --kubeclient-burst + - {{ .Values.kubeClientBurst | quote }} + {{- end }} + {{- end }} + image: {{ printf "%s/%s:%s" .Values.image.registry .Values.image.repository .Values.image.tag }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + {{- if (.Values.resources.limits).cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- if (.Values.resources.limits).memory }} + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + {{- end }} + ports: + - name: http + containerPort: {{ .Values.containerPorts.http | default "8080" }} + protocol: TCP + {{- if .Values.hostNetwork }} + hostPort: {{ .Values.containerPorts.http }} + {{- else if .Values.hostPorts.http }} + hostPort: {{ .Values.hostPorts.http }} + {{- end }} + - name: metrics + containerPort: {{ .Values.containerPorts.metrics | default "8081" }} + protocol: TCP + {{- if .Values.hostNetwork }} + hostPort: {{ .Values.containerPorts.metrics }} + {{- else if .Values.hostPorts.metrics }} + hostPort: {{ .Values.hostPorts.metrics }} + {{- end }} + {{- if .Values.startupProbe.enabled }} + startupProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }} + tcpSocket: + port: http + {{- else if .Values.customStartupProbe }} + startupProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.livenessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /healthz + port: http + {{- else if .Values.customLivenessProbe }} + livenessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: {{- include "sealed-secrets.render" (dict "value" (omit .Values.readinessProbe "enabled") "context" $) | nindent 12 }} + httpGet: + path: /healthz + port: http + {{- else if .Values.customReadinessProbe }} + readinessProbe: {{- include "sealed-secrets.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.resources }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- end }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.additionalVolumeMounts }} + {{- toYaml .Values.additionalVolumeMounts | nindent 12 }} + {{- end }} + - mountPath: /tmp + name: tmp + volumes: + {{- if .Values.additionalVolumes }} + {{- toYaml .Values.additionalVolumes | nindent 8 }} + {{- end }} + - name: tmp + emptyDir: {} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/extra-list.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/extra-list.yaml new file mode 100644 index 00000000..dee3ab60 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "sealed-secrets.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/ingress.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/ingress.yaml new file mode 100644 index 00000000..85b029e8 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/ingress.yaml @@ -0,0 +1,57 @@ +{{- if and .Values.createController .Values.ingress.enabled }} +apiVersion: {{ include "sealed-secrets.ingress.apiVersion" . }} +kind: Ingress +metadata: + name: {{ include "sealed-secrets.fullname" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.ingress.annotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.ingress.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.ingressClassName (eq "true" (include "sealed-secrets.supportsIngressClassname" .)) }} + ingressClassName: {{ .Values.ingress.ingressClassName | quote }} + {{- end }} + rules: + {{- if .Values.ingress.hostname }} + - host: {{ .Values.ingress.hostname }} + http: + paths: + {{- if .Values.ingress.extraPaths }} + {{- toYaml .Values.ingress.extraPaths | nindent 10 }} + {{- end }} + - path: {{ .Values.ingress.path }} + {{- if eq "true" (include "sealed-secrets.supportsPathType" .) }} + pathType: {{ .Values.ingress.pathType }} + {{- end }} + backend: {{- include "sealed-secrets.backend" (dict "serviceName" (include "sealed-secrets.fullname" .) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- range .Values.ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "sealed-secrets.supportsPathType" $) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "sealed-secrets.backend" (dict "serviceName" (include "sealed-secrets.fullname" $) "servicePort" "http" "context" $) | nindent 14 }} + {{- end }} + {{- if or (and .Values.ingress.tls (or (include "sealed-secrets.ingress.certManagerRequest" .Values.ingress.annotations) .Values.ingress.selfSigned)) .Values.ingress.extraTls }} + tls: + {{- if and .Values.ingress.tls (or (include "sealed-secrets.ingress.certManagerRequest" .Values.ingress.annotations) .Values.ingress.selfSigned) }} + - hosts: + - {{ .Values.ingress.hostname | quote }} + secretName: {{ printf "%s-tls" .Values.ingress.hostname }} + {{- end }} + {{- if .Values.ingress.extraTls }} + {{- include "sealed-secrets.render" (dict "value" .Values.ingress.extraTls "context" $) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/networkpolicy.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/networkpolicy.yaml new file mode 100644 index 00000000..ca151bf9 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/networkpolicy.yaml @@ -0,0 +1,46 @@ +{{- if .Values.networkPolicy.enabled }} +apiVersion: {{ include "sealed-secrets.networkPolicy.apiVersion" . }} +kind: NetworkPolicy +metadata: + name: {{ include "sealed-secrets.fullname" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + podSelector: + matchLabels: {{- include "sealed-secrets.matchLabels" . | nindent 6 }} + ingress: + - ports: + - port: {{ .Values.service.port }} + - port: {{ .Values.metrics.service.port }} + {{- if .Values.networkPolicy.egress.enabled }} + egress: + - to: + {{- if not .Values.networkPolicy.egress.kubeapiCidr }} + {{- $kubernetesEndpoint := lookup "v1" "Endpoints" "default" "kubernetes" }} + {{- if $kubernetesEndpoint }} + {{- range $kubernetesAddress := (first $kubernetesEndpoint.subsets).addresses }} + - ipBlock: + cidr: {{ $kubernetesAddress.ip }}/32 + {{- end}} + ports: + {{- range $kubernetesPort := (first $kubernetesEndpoint.subsets).ports }} + - protocol: {{ $kubernetesPort.protocol }} + port: {{ $kubernetesPort.port }} + {{- end }} + {{- end}} + {{- else }} + - ipBlock: + cidr: {{ .Values.networkPolicy.egress.kubeapiCidr }} + ports: + - protocol: TCP + port: {{ .Values.networkPolicy.egress.kubeapiPort }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/pdb.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/pdb.yaml new file mode 100644 index 00000000..a11a8ebe --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/pdb.yaml @@ -0,0 +1,24 @@ +{{- if .Values.pdb.create }} +kind: PodDisruptionBudget +apiVersion: policy/v1 +metadata: + name: {{ include "sealed-secrets.fullname" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + {{- if regexMatch "64$" (typeOf .Values.pdb.minAvailable) }} + minAvailable: {{ .Values.pdb.minAvailable }} + {{- end }} + {{- if regexMatch "64$" (typeOf .Values.pdb.maxUnavailable) }} + maxUnavailable: {{ .Values.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: {{- include "sealed-secrets.matchLabels" . | nindent 6 }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/prometheusrule.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/prometheusrule.yaml new file mode 100644 index 00000000..58dc36e6 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/prometheusrule.yaml @@ -0,0 +1,54 @@ +{{- if .Values.metrics.prometheusRule.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: PrometheusRule +metadata: + name: {{ include "sealed-secrets.fullname" . }} + + {{- if .Values.metrics.prometheusRule.namespace }} + namespace: {{ .Values.metrics.prometheusRule.namespace }} + {{- else }} + namespace: {{ include "sealed-secrets.namespace" . }} + {{- end }} + + labels: + {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.metrics.prometheusRule.labels }} + {{- include "sealed-secrets.render" (dict "value" .Values.metrics.prometheusRule.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + + annotations: + {{- if .Values.metrics.prometheusRule.annotations }} + {{- include "sealed-secrets.render" (dict "value" .Values.metrics.prometheusRule.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} + +spec: + groups: + {{- range .Values.metrics.prometheusRule.groups }} + - name: {{ .name }} + rules: + {{- range .rules }} + - alert: {{ .alert }} + expr: | + {{ .expr | nindent 12 }} + {{- if .for }} + for: {{ .for }} + {{- end }} + + {{- if .labels }} + labels: + {{- toYaml .labels | nindent 12 }} + {{- end }} + + {{- if .annotations }} + annotations: + {{- toYaml .annotations | nindent 12 }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} \ No newline at end of file diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrole.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrole.yaml new file mode 100644 index 00000000..e197f873 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrole.yaml @@ -0,0 +1,23 @@ +{{- if .Values.rbac.pspEnabled }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ printf "%s-psp" (include "sealed-secrets.fullname" .) }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: + - {{ include "sealed-secrets.fullname" . }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrolebinding.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrolebinding.yaml new file mode 100644 index 00000000..cf7a2a0d --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp-clusterrolebinding.yaml @@ -0,0 +1,25 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ printf "%s-psp" (include "sealed-secrets.fullname" .) }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ printf "%s-psp" (include "sealed-secrets.fullname" .) }} +subjects: + - kind: ServiceAccount + name: {{ include "sealed-secrets.serviceAccountName" . }} + namespace: {{ include "sealed-secrets.namespace" . }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp.yaml new file mode 100644 index 00000000..28822cf3 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/psp.yaml @@ -0,0 +1,38 @@ +{{- if .Values.rbac.pspEnabled }} +apiVersion: policy/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ include "sealed-secrets.fullname" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + privileged: false + allowPrivilegeEscalation: false + allowedCapabilities: [] + volumes: + - 'configMap' + - 'emptyDir' + - 'projected' + - 'secret' + - 'downwardAPI' + - 'persistentVolumeClaim' + {{- if not .Values.hostNetwork }} + hostNetwork: false + {{- end }} + hostIPC: false + hostPID: false + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role-binding.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role-binding.yaml new file mode 100644 index 00000000..48d12eea --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role-binding.yaml @@ -0,0 +1,80 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ printf "%s-key-admin" (include "sealed-secrets.fullname" .) }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "%s-key-admin" (include "sealed-secrets.fullname" .) }} +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "sealed-secrets.serviceAccountName" . }} + namespace: {{ include "sealed-secrets.namespace" . }} +--- +{{ end }} +{{ if and (and .Values.rbac.create .Values.rbac.serviceProxier.create) .Values.rbac.serviceProxier.bind }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ printf "%s-service-proxier" (include "sealed-secrets.fullname" .) }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ printf "%s-service-proxier" (include "sealed-secrets.fullname" .) }} +subjects: + {{- include "sealed-secrets.render" (dict "value" .Values.rbac.serviceProxier.subjects "context" $) | nindent 2 }} +--- +{{ end }} +{{ if and (and .Values.rbac.create .Values.rbac.namespacedRoles) (not $.Values.rbac.clusterRole) }} + {{- range $additionalNamespace := $.Values.additionalNamespaces }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "sealed-secrets.fullname" $ }} + namespace: {{ $additionalNamespace }} + labels: {{- include "sealed-secrets.labels" $ | nindent 4 }} + {{- if $.Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if $.Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ $.Values.rbac.namespacedRolesName }} +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "sealed-secrets.serviceAccountName" $ }} + namespace: {{ include "sealed-secrets.namespace" $ }} +--- + {{ end }} +{{ end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role.yaml new file mode 100644 index 00000000..b5d39ef4 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/role.yaml @@ -0,0 +1,125 @@ +{{ if .Values.rbac.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ printf "%s-key-admin" (include "sealed-secrets.fullname" .) }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - "" + resourceNames: + - {{ .Values.secretName }} + resources: + - secrets + verbs: + - get + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - list +--- +{{- end }} +{{- if and .Values.rbac.create .Values.rbac.serviceProxier.create }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ printf "%s-service-proxier" (include "sealed-secrets.fullname" .) }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - "" + resourceNames: + - {{ include "sealed-secrets.fullname" . }} + resources: + - services + verbs: + - get + - apiGroups: + - "" + resourceNames: + - 'http:{{ include "sealed-secrets.fullname" . }}:' + - 'http:{{ include "sealed-secrets.fullname" . }}:http' + - {{ include "sealed-secrets.fullname" . }} + resources: + - services/proxy + verbs: + - create + - get +--- +{{- end }} +{{ if and (and .Values.rbac.create .Values.rbac.namespacedRoles) (not $.Values.rbac.clusterRole) }} + {{- range $additionalNamespace := $.Values.additionalNamespaces }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $.Values.rbac.namespacedRolesName }} + namespace: {{ $additionalNamespace }} + labels: {{- include "sealed-secrets.labels" $ | nindent 4 }} + {{- if $.Values.rbac.labels }} + {{- include "sealed-secrets.render" ( dict "value" $.Values.rbac.labels "context" $) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - bitnami.com + resources: + - sealedsecrets + verbs: + - get + - list + - watch + - apiGroups: + - bitnami.com + resources: + - sealedsecrets/status + verbs: + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - create + - update + - delete + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - "" + resources: + - namespaces + resourceNames: + {{- include "sealed-secrets.render" (dict "value" $.Values.additionalNamespaces "context" $) | nindent 6 }} + verbs: + - get +--- + {{- end }} +{{ end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service-account.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service-account.yaml new file mode 100644 index 00000000..a205bfec --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service-account.yaml @@ -0,0 +1,23 @@ +{{ if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "sealed-secrets.serviceAccountName" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + {{- if or (.Values.commonAnnotations) (.Values.serviceAccount.annotations) }} + annotations: + {{- if .Values.commonAnnotations }} + {{- toYaml .Values.commonAnnotations | nindent 4 }} + {{- end}} + {{- if .Values.serviceAccount.annotations }} + {{- toYaml .Values.serviceAccount.annotations | nindent 4 }} + {{- end}} + {{- end }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.serviceAccount.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.serviceAccount.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} +{{ end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service.yaml new file mode 100644 index 00000000..f082c5f2 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/service.yaml @@ -0,0 +1,78 @@ +{{- if .Values.createController -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "sealed-secrets.fullname" . }} + namespace: {{ include "sealed-secrets.namespace" . }} + {{- if or .Values.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.service.annotations }} + {{- include "sealed-secrets.render" (dict "value" .Values.service.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.service.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.service.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- with .Values.service.loadBalancerClass }} + loadBalancerClass: {{ . }} + {{- end }} + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) (not (empty .Values.service.nodePort)) }} + nodePort: {{ .Values.service.nodePort }} + {{- else if eq .Values.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "sealed-secrets.matchLabels" . | nindent 4 }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "sealed-secrets.fullname" . }}-metrics + namespace: {{ include "sealed-secrets.namespace" . }} + {{- if or .Values.metrics.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.metrics.service.annotations }} + {{- include "sealed-secrets.render" (dict "value" .Values.metrics.service.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.metrics.service.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.metrics.service.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + app.kubernetes.io/component: metrics +spec: + type: {{ .Values.metrics.service.type }} + {{- with .Values.metrics.service.loadBalancerClass }} + loadBalancerClass: {{ . }} + {{- end }} + ports: + - name: metrics + port: {{ .Values.metrics.service.port }} + targetPort: metrics + protocol: TCP + {{- if and (or (eq .Values.metrics.service.type "NodePort") (eq .Values.metrics.service.type "LoadBalancer")) (not (empty .Values.metrics.service.nodePort)) }} + nodePort: {{ .Values.metrics.service.nodePort }} + {{- else if eq .Values.metrics.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "sealed-secrets.matchLabels" . | nindent 4 }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/servicemonitor.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/servicemonitor.yaml new file mode 100644 index 00000000..0820724c --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/servicemonitor.yaml @@ -0,0 +1,50 @@ +{{- if .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "sealed-secrets.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- else }} + namespace: {{ include "sealed-secrets.namespace" . }} + {{- end }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.metrics.serviceMonitor.labels }} + {{- include "sealed-secrets.render" ( dict "value" .Values.metrics.serviceMonitor.labels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.metrics.serviceMonitor.annotations }} + {{- include "sealed-secrets.render" (dict "value" .Values.metrics.serviceMonitor.annotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + endpoints: + - port: metrics + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.metricRelabelings }} + metricRelabelings: {{ toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 8 }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabelings }} + relabelings: {{ toYaml .Values.metrics.serviceMonitor.relabelings | nindent 8 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ include "sealed-secrets.namespace" . }} + selector: + matchLabels: + {{- include "sealed-secrets.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: metrics +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/tls-secret.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/tls-secret.yaml new file mode 100644 index 00000000..8c2613aa --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/templates/tls-secret.yaml @@ -0,0 +1,46 @@ +{{- if and .Values.createController .Values.ingress.enabled }} +{{- if .Values.ingress.secrets }} +{{- range .Values.ingress.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + namespace: {{ include "sealed-secrets.namespace" $ | quote }} + labels: {{- include "sealed-secrets.labels" $ | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- end }} +{{- if and .Values.ingress.tls .Values.ingress.selfSigned }} +{{- $ca := genCA "sealed-secrets-ca" 365 }} +{{- $cert := genSignedCert .Values.ingress.hostname nil (list .Values.ingress.hostname) 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-tls" .Values.ingress.hostname }} + namespace: {{ include "sealed-secrets.namespace" . }} + labels: {{- include "sealed-secrets.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "sealed-secrets.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "sealed-secrets.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + tls.crt: {{ $cert.Cert | b64enc | quote }} + tls.key: {{ $cert.Key | b64enc | quote }} + ca.crt: {{ $ca.Cert | b64enc | quote }} +{{- end }} +{{- end }} diff --git a/packs/sealed-secrets-2.19.3/charts/sealed-secrets/values.yaml b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/values.yaml new file mode 100644 index 00000000..bd329924 --- /dev/null +++ b/packs/sealed-secrets-2.19.3/charts/sealed-secrets/values.yaml @@ -0,0 +1,594 @@ +## @section Common parameters + +## @param kubeVersion Override Kubernetes version +## +kubeVersion: "" +## @param nameOverride String to partially override sealed-secrets.fullname +## +nameOverride: "" +## @param fullnameOverride String to fully override sealed-secrets.fullname +## +fullnameOverride: "" +## @param namespace Namespace where to deploy the Sealed Secrets controller +## +namespace: "" + +## @param extraDeploy [array] Array of extra objects to deploy with the release +## +extraDeploy: [] +## @param commonAnnotations [object] Annotations to add to all deployed resources +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +## +commonAnnotations: {} + +## @param commonLabels [object] Labels to add to all deployed resources +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +## +commonLabels: {} + +## @section Sealed Secrets Parameters + +## Sealed Secrets image +## ref: https://hub.docker.com/r/bitnami/sealed-secrets-controller/tags +## @param image.registry Sealed Secrets image registry +## @param image.repository Sealed Secrets image repository +## @param image.tag Sealed Secrets image tag (immutable tags are recommended) +## @param image.pullPolicy Sealed Secrets image pull policy +## @param image.pullSecrets [array] Sealed Secrets image pull secrets +## +image: + registry: docker.io + repository: bitnami/sealed-secrets-controller + tag: 0.39.1 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] +## @param revisionHistoryLimit Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) +## e.g: +revisionHistoryLimit: "" +## @param createController Specifies whether the Sealed Secrets controller should be created +## +createController: true +## @param secretName The name of an existing TLS secret containing the key used to encrypt secrets +## +secretName: "sealed-secrets-key" +## @param updateStatus Specifies whether the Sealed Secrets controller should update the status subresource +## +updateStatus: true +## @param skipRecreate Specifies whether the Sealed Secrets controller should skip recreating removed secrets +## Setting it to true allows to optionally restore backward compatibility in low priviledge +## environments when old versions of the controller did not require watch permissions on secrets +## for secret re-creation. +## +skipRecreate: false +## @param keyrenewperiod Specifies key renewal period. Default 30 days +## e.g +## keyrenewperiod: "720h30m" +## To disable use "0", with quotes! +## +keyrenewperiod: "" +## @param keyttl Specifies the certificate validity duration. Default 10 years. +## e.g for one year +## keyttl: "8760h00m00s" +## +keyttl: "" +## @param keycutofftime Specifies a date at which the controller should generate a new certificate. Useful in early key renewal scenarios. +## Takes a date formated according to RFC1123. Can be obtained with the 'date -R' command on a unix system. +## e.g +## keycutofftime: "Mon, 14 Oct 2024 21:45:30 +0200" +## +keycutofftime: "" +## @param rateLimit Number of allowed sustained request per second for verify endpoint +## +rateLimit: "" +## @param rateLimitBurst Number of requests allowed to exceed the rate limit per second for verify endpoint +## +rateLimitBurst: "" +## @param additionalNamespaces List of namespaces used to manage the Sealed Secrets +## +additionalNamespaces: [] +## @param privateKeyAnnotations Map of annotations to be set on the sealing keypairs +## +privateKeyAnnotations: {} +## @param privateKeyLabels Map of labels to be set on the sealing keypairs +## +privateKeyLabels: {} +## @param logInfoStdout Specifies whether the Sealed Secrets controller will log info to stdout +## +logInfoStdout: false +## @param logLevel Specifies log level of controller (INFO,ERROR) +## +logLevel: "" +## @param logFormat Specifies log format (text,json) +## +logFormat: "" +## @param maxRetries Number of maximum retries +## +maxRetries: "" +## @param watchForSecrets Specifies whether the Sealed Secrets controller will watch for new secrets +## +watchForSecrets: false +## @param kubeClientQPS Kubeclient QPS (negative value disables ratelimiting) +## +kubeClientQPS: "" +## @param kubeClientBurst Kubeclient Burst +## +kubeClientBurst: "" +## @param command Override default container command +## +command: [] +## @param args Override default container args +## +args: [] +## Configure extra options for Sealed Secret containers' liveness, readiness and startup probes +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes +## @param livenessProbe.enabled Enable livenessProbe on Sealed Secret containers +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.periodSeconds Period seconds for livenessProbe +## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe +## @param livenessProbe.failureThreshold Failure threshold for livenessProbe +## @param livenessProbe.successThreshold Success threshold for livenessProbe +## +livenessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## @param readinessProbe.enabled Enable readinessProbe on Sealed Secret containers +## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe +## @param readinessProbe.periodSeconds Period seconds for readinessProbe +## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe +## @param readinessProbe.failureThreshold Failure threshold for readinessProbe +## @param readinessProbe.successThreshold Success threshold for readinessProbe +## +readinessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## @param startupProbe.enabled Enable startupProbe on Sealed Secret containers +## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe +## @param startupProbe.periodSeconds Period seconds for startupProbe +## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe +## @param startupProbe.failureThreshold Failure threshold for startupProbe +## @param startupProbe.successThreshold Success threshold for startupProbe +## +startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## @param customLivenessProbe Custom livenessProbe that overrides the default one +## +customLivenessProbe: {} +## @param customReadinessProbe Custom readinessProbe that overrides the default one +## +customReadinessProbe: {} +## @param customStartupProbe Custom startupProbe that overrides the default one +## +customStartupProbe: {} +## Sealed Secret resource requests and limits +## ref: http://kubernetes.io/docs/user-guide/compute-resources/ +## @param resources.limits [object] The resources limits for the Sealed Secret containers +## @param resources.requests [object] The requested resources for the Sealed Secret containers +## +resources: + limits: {} + requests: {} +## Configure Pods Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +## @param podSecurityContext.enabled Enabled Sealed Secret pods' Security Context +## @param podSecurityContext.fsGroup Set Sealed Secret pod's Security Context fsGroup +## @param podSecurityContext.seccompProfile.type Set Sealed Secret pod's Security Context seccomp profile type +## +podSecurityContext: + enabled: true + fsGroup: 65534 + seccompProfile: + type: RuntimeDefault +## Configure Container Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +## @param containerSecurityContext.enabled Enabled Sealed Secret containers' Security Context +## @param containerSecurityContext.readOnlyRootFilesystem Whether the Sealed Secret container has a read-only root filesystem +## @param containerSecurityContext.runAsNonRoot Indicates that the Sealed Secret container must run as a non-root user +## @param containerSecurityContext.runAsUser Set Sealed Secret containers' Security Context runAsUser +## @param containerSecurityContext.allowPrivilegeEscalation Set Sealed Secret containers' privilege escalation +## @extra containerSecurityContext.capabilities Adds and removes POSIX capabilities from running containers (see `values.yaml`) +## @skip containerSecurityContext.capabilities.drop +## +containerSecurityContext: + enabled: true + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL +## @param hostUsers Specifies whether or not host or namespaced users should be used +## ref: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/ +## +hostUsers: ~ + +## @param podLabels [object] Extra labels for Sealed Secret pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +## +podLabels: {} +## @param podAnnotations [object] Annotations for Sealed Secret pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +## +podAnnotations: {} +## @param priorityClassName Sealed Secret pods' priorityClassName +## +priorityClassName: "" +## @param runtimeClassName Sealed Secret pods' runtimeClassName +## +runtimeClassName: "" +## @param affinity [object] Affinity for Sealed Secret pods assignment +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +## +affinity: {} +## @param nodeSelector [object] Node labels for Sealed Secret pods assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## @param tolerations [array] Tolerations for Sealed Secret pods assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] +## @param additionalVolumes [object] Extra Volumes for the Sealed Secrets Controller Deployment +## ref: https://kubernetes.io/docs/concepts/storage/volumes/ +## +additionalVolumes: [] +## @param additionalVolumeMounts [object] Extra volumeMounts for the Sealed Secrets Controller container +## ref: https://kubernetes.io/docs/concepts/storage/volumes/ +## +additionalVolumeMounts: [] +## @param hostNetwork Sealed Secrets pods' hostNetwork +hostNetwork: false +## Sealed Secrets controller ports to open +## If hostNetwork true: the hostPort is set identical to the containerPort +## @param containerPorts.http Controller HTTP Port on the Host and Container +## @param containerPorts.metrics Metrics HTTP Port on the Host and Container +## +containerPorts: + http: 8080 + metrics: 8081 +## Sealed Secrets controller ports to be exposed as hostPort +## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string) +## @param hostPorts.http Controller HTTP Port on the Host +## @param hostPorts.metrics Metrics HTTP Port on the Host +## +hostPorts: + http: "" + metrics: "" + +## @param dnsPolicy Sealed Secrets pods' dnsPolicy +dnsPolicy: "" +## @section Traffic Exposure Parameters + +## Sealed Secret service parameters +## +service: + ## @param service.type Sealed Secret service type + ## + type: ClusterIP + ## @param service.loadBalancerClass Sealed Secret service loadBalancerClass + ## + loadBalancerClass: "" + ## @param service.port Sealed Secret service HTTP port + ## + port: 8080 + ## @param service.nodePort Node port for HTTP + ## Specify the nodePort value for the LoadBalancer and NodePort service types + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: "" + ## @param service.annotations [object] Additional custom annotations for Sealed Secret service + ## + annotations: {} +## Sealed Secret ingress parameters +## ref: http://kubernetes.io/docs/user-guide/ingress/ +## +ingress: + ## @param ingress.enabled Enable ingress record generation for Sealed Secret + ## + enabled: false + ## @param ingress.pathType Ingress path type + ## + pathType: ImplementationSpecific + ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster. + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.hostname Default host for the ingress record + ## + hostname: sealed-secrets.local + ## @param ingress.path Default path for the ingress record + ## + path: /v1/cert.pem + ## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. + ## Use this parameter to set the required annotations for cert-manager, see + ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations + ## e.g: + ## annotations: + ## kubernetes.io/ingress.class: nginx + ## cert-manager.io/cluster-issuer: cluster-issuer-name + ## + annotations: {} + ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` + ## You can: + ## - Use the `ingress.secrets` parameter to create this TLS secret + ## - Relay on cert-manager to create it by setting the corresponding annotations + ## - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true` + ## + tls: false + ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.extraHosts [array] An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: sealed-secrets.local + ## path: / + ## + extraHosts: [] + ## @param ingress.extraPaths [array] An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.extraTls [array] TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - sealed-secrets.local + ## secretName: sealed-secrets.local-tls + ## + extraTls: [] + ## @param ingress.secrets [array] Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: sealed-secrets.local-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] +## Network policies +## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ +## +networkPolicy: + ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: false + ## NetworkPolicy Egress configuration + ## + egress: + ## @param networkPolicy.egress.enabled Specifies wheter a egress is set in the NetworkPolicy + ## + enabled: false + ## @param networkPolicy.egress.kubeapiCidr Specifies the kubeapiCidr, which is the only egress allowed. If not set, kubeapiCidr will be found using Helm lookup + ## + kubeapiCidr: "" + ## @param networkPolicy.egress.kubeapiPort Specifies the kubeapiPort, which is the only egress allowed. If not set, kubeapiPort will be found using Helm lookup + ## + kubeapiPort: "" + +## @section Other Parameters + +## ServiceAccount configuration +## +serviceAccount: + ## @param serviceAccount.annotations [object] Annotations for Sealed Secret service account + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + annotations: {} + ## @param serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param serviceAccount.labels Extra labels to be added to the ServiceAccount + ## + labels: {} + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the sealed-secrets.fullname template + ## + name: "" +## RBAC configuration +## +rbac: + ## @param rbac.create Specifies whether RBAC resources should be created + ## + create: true + ## @param rbac.clusterRole Specifies whether the Cluster Role resource should be created + ## + clusterRole: true + ## @param rbac.clusterRoleName Specifies the name for the Cluster Role resource + ## + clusterRoleName: "secrets-unsealer" + ## @param rbac.namespacedRoles Specifies whether the namespaced Roles should be created (in each of the specified additionalNamespaces) + ## + namespacedRoles: false + ## @param rbac.namespacedRolesName Specifies the name for the namespaced Role resource + ## + namespacedRolesName: "secrets-unsealer" + ## @param rbac.labels Extra labels to be added to RBAC resources + ## + labels: {} + ## @param rbac.pspEnabled PodSecurityPolicy + ## + pspEnabled: false + ## "Proxier" RBAC Role configuration + ## + serviceProxier: + ## @param rbac.serviceProxier.create Specifies whether to create the "proxier" role, to allow external users to access the SealedSecret API + ## + create: true + ## @param rbac.serviceProxier.bind Specifies whether to create a RoleBinding for the "proxier" role + ## + bind: true + ## @param rbac.serviceProxier.subjects Specifies the RBAC subjects to grant the "proxier" role to, in the created RoleBinding + ## It is best to change this to something narrower, as the default binding gives `system:authenticated` access, which is very broad + ## + subjects: | + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + +## @section Metrics parameters + +metrics: + prometheusRule: + ## @param metrics.prometheusRule.enabled Specify if a PrometheusRule will be deployed for Prometheus Operator + ## + enabled: false + + ## @param metrics.prometheusRule.namespace Namespace where Prometheus Operator is running in + ## + namespace: "" + + ## @param metrics.prometheusRule.labels Extra labels for the PrometheusRule + ## + labels: {} + + ## @param metrics.prometheusRule.annotations Extra annotations for the PrometheusRule + ## + annotations: {} + + ## @param metrics.prometheusRule.groups Prometheus alerting rule groups + ## + groups: + - name: sealed-secrets-controller.rules + rules: + - alert: SealedSecretsControllerNotReady + expr: | + sealed_secrets_controller_condition_info != 1 + for: 10m + labels: + severity: critical + annotations: + summary: "Sealed Secrets controller is not Synced" + description: "At least one SealedSecret is in a non-synced state (0 or -1). Check controller logs and secret reconciliation status." + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled Specify if a ServiceMonitor will be deployed for Prometheus Operator + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace where Prometheus Operator is running in + ## + namespace: "" + ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## @param metrics.serviceMonitor.annotations Extra annotations for the ServiceMonitor + ## + annotations: {} + ## @param metrics.serviceMonitor.interval How frequently to scrape metrics + ## e.g: + ## interval: 10s + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## e.g: + ## scrapeTimeout: 10s + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.honorLabels Specify if ServiceMonitor endPoints will honor labels + ## + honorLabels: true + ## @param metrics.serviceMonitor.metricRelabelings [array] Specify additional relabeling of metrics + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.relabelings [array] Specify general relabeling + ## + relabelings: [] + ## Grafana dashboards configuration + ## + dashboards: + ## @param metrics.dashboards.create Specifies whether a ConfigMap with a Grafana dashboard configuration should be created + ## ref https://github.com/helm/charts/tree/master/stable/grafana#configuration + ## + create: false + ## @param metrics.dashboards.labels Extra labels to be added to the Grafana dashboard ConfigMap + ## + labels: {} + ## @param metrics.dashboards.annotations Annotations to be added to the Grafana dashboard ConfigMap + ## + annotations: {} + ## @param metrics.dashboards.namespace Namespace where Grafana dashboard ConfigMap is deployed + ## + namespace: "" + + ## Sealed Secret Metrics service parameters + ## + service: + ## @param metrics.service.type Sealed Secret Metrics service type + ## + type: ClusterIP + ## @param metrics.service.loadBalancerClass Sealed Secret Metrics service loadBalancerClass + ## + loadBalancerClass: "" + ## @param metrics.service.port Sealed Secret service Metrics HTTP port + ## + port: 8081 + ## @param metrics.service.nodePort Node port for HTTP + ## Specify the nodePort value for the LoadBalancer and NodePort service types + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: "" + ## @param metrics.service.annotations [object] Additional custom annotations for Sealed Secret Metrics service + ## + annotations: {} + +## @section PodDisruptionBudget Parameters + +pdb: + ## @param pdb.create Specifies whether a PodDisruptionBudget should be created + ## + create: false + ## @param pdb.minAvailable The minimum number of pods (non number to omit) + ## + minAvailable: 1 + ## @param pdb.maxUnavailable The maximum number of unavailable pods (non number to omit) + ## + maxUnavailable: "" diff --git a/packs/sealed-secrets-2.19.3/logo.png b/packs/sealed-secrets-2.19.3/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..af90e709f7199036327e8ef9d00f3942366f7028 GIT binary patch literal 12653 zcmZ{LWmH?w7j1$DcP*0QUYw#0ZpGc5;!s>maCd8QcZ$0^6nD24cP&!n<@f*a*8B33 zb#qseHFMAGd(PfxX3mXJR+Pp-B}D}Q02s0|5~{HC$bSb23HDi~{WBYOLii%8APNA~ z#-Tl%Ai}{H|5rX}JWGXK$ z0eJiGo!eQG1OTuH%Swo$C&WiESGk)U*s;v$3seX+-7Bv>Q>L zv1wckXc=5-Yt(GFvnOYu_Ss&RJ>izwGc2HpWeiXBUIJ_nEvWQ@0WB-g>#L z^l=1)|KAsBLEHBrGbJ@V^U`<`zNtX?7#3i6tYsnh&5ojPw< z>QN?@8jIAbam&#<@0;HJ(<$3np2}YKuQ`r*39HEF{^z6-@v^Kzbh>5Ky2cbQJk^2h z25?2SLIGIrzQ^TJyo+$-eb+>@>AcICeRsH5Z8uyg(O#RAw}G6K_kvt8{o1dweA>UT z?7M!j{9G_qJ1A{iGx&h&-|*x=A)@csXL@?Aa=DqiziWcagWJdvr1(0y-}_ZolR8bd zO4|RaZ~ukBipvslHC890$xKTVZWh)VXPjQl#HVto`7^2A;}wx}TH}M~ME(9BO@CW1 z*Tt~u5U7~>DrZ<;G>T<^nqfU@>*=SHnVkH)L#3Jh7u1hTfZ8|Xg?13LJ%~MhB}vGVYEIR~k@=7_+LG7x%KBzU{;iIz6}?J&bUPki z6(xcc!Yzp{2_d8VDIPZ6=%}lp?bE!1ob$8cRP+MGx-mZ5PtWP#mcEE%71i8RL+h^- zs~?(5otC#yx@W~>!><_uHcL@sSs<0b16PSH<@XP`Eqnj=wiC7%7Wl0HR=hCK=yCQ* zn)Out|S?SQzi!;QDfmJJ62_h zk!+&^6F4ydIj!NFvNGvzlDX~pEW~B&uWa|>d6Hp9U@#2t7=YPL7^k)UzhfAv8Y0Hy z+~JAN17|I-k?aJE;Nr{P)t)6cq}dnSjnrYpqBfpNIihSsR6kI`Gk@G8p4Q%DH|I#l z&Y8K0@gE(Y z`2xriXYL;4aqGwH`x=0OuQqK%ywx}KdMUQ?D{B>n+RhLG>GMQ>8zT4ERgFassz0@3 z^ckP%KID{I+HXF64~kx@MN;8HRyi{rJpjuwrjkN-8B?ji2KnwcB$W*u#y7&2`~rw@pJ|$MftZ18Oe!9J1*HJi}v{6ltW4XS*kirQnm`o79XRbbmHV5$2-GU& zAp7NjI%7(AqZ&#dmSl_Ng*~?jZRJQQzH=&i)RG&eJ+q} zx}%M~;ULvU?%D=Hn|3+$FvWDDid2*dn9$nsFYrT-TSoVN$zsxyVuSV8LM)5Ec&Sn$ zmvUk^kn~@S?^jX+Fw*k*PY;azyorhnG6}<6*w{Aq&(zRlrX-C_s=vb%ydEpWh5YL} z=d@*BQ8iNHgy;LDbs4LN!o8RS`I4s5XTkzK{D`d5ywSNzWe_I+Zr;Hor+C=i!*8|2 z25{76+&zwVZx$!X3Gp6Mhv51EdltR8j?$YH(aPcSlT8Q9kP97uRM#vs zG$!`Jm%{Hx;qwwe zK7Va*Uj*e>O;m^@B*4#p+9UoeFY>q8Xg0y;tluNfFGo%Vi1JikQ?PA>1kPBU=1oJDR(p(ssW zFxI=qA9FbUV#W8j9(S!a=Vb*Z`fm$MG#lEh9Sf520nvCLW;XKC!(u&lvzl z|Cu$6KqhMVo3R$&w9tIl5ZY5X12GFX3IB!AF$sv^dt%dcTidW7uIzB+h~_7i;%r-v zF}O;3k>-^7Y~9|jDA^_gRhNL_mwlRa*!$XM2mTX0AiQ_T;4_s+m+8*qVvPiUFbAfw z{-CU*bb^2&px3DYz;~nL7bp#$-&t;A3Zb<{n=}1e4@T~RMYAPdDtbyTYO%%>02d|!!dWJw!S%54l0HF zo$D2P*21j~h*x8ed0U}jfky;$&eAl#FwxYafnak$NHSnq5@-`6%Gw-Bs_4Ddw zd2O@T0$iOs33m71R^C*d;~PcG?g{&$n04ukek>vO_XnMnIltpv;=V-;O!5GBHSUFv zfPlQHv58PNFC^}L4$li}frdldo}ZBgB(9Xdm!lJj7c6I={@Irlrttjbb##NG>%JPa zUR*n(2`K53O|$zxOkAL-?>naNOe01gQ-xYG;BQ<)Yj6%(fWd{IgZ~Dl^BI5UtEad+ z%56$o%yQs!`!hDQxxauqQnFRB1vBu3qSJ>9+MHryBreY<50cddx`ssI-6|AVc^4{c z^cXXci2Wu-jYorgd4Yc)ZLrN*nxxV|OinhQYirEB)-y7CR$OQysHot-V71l}31v~M z6z%d`6FfJTJ&8EEo(N;>LVJxWMfxfHoCW>mTa3?ojD}ur$-W81U1NtLlvIZ17D51g z@&$ICSUEG5ce@{cuPQ0{&o8faq(BR^zpe3jPZ`w1TpBJ$1Jl)=Ke#XxC~X8U_4k}B z6cD4)Kbb@YVCpXJs^Ze2&VTFKD+q&TEbRWuxMjo-xGDRIgCwDQ#UtJO8-?7W;OylrhG z1+21sZg>L92VyJzl0n-%{c30@!~#t&&R(VwyshE6Nh_)ZIltl`n>9V zV`O5uyoVZgYPQ)TWgd0o??lUFSaBC zAieSDSzVMcBM|R-oLWi%{JW8U%cP5@+SqA1QGwkc|^Ruv}(eFDw;yQ%z z>;DYy-;@2Q-z9N%@8#PSJWM3>0GB5L#+45?jgX*8kfWIuqK%^UqWZd-f~QuZSoK0b z#p}Uae<*2t!tVZPw^U>Qh#`Pn77l(b{w98^hD zeAz;VR2h{-55yv^pT9CaBzwL5rKP02=l8msA4k-&mTIc#1twM=H5;RftTFT10vWPo z<9wQlpv#yPH8FJwZgEZ+QobA87Ev2~wdyO5&$QoDfT7 zuA&H~u|OU}e;vv(wO?slNbCO-(JJ(s(a}-yJtrqlGDK2aT|IbEa!^}eyYl%Y-;{-k zY3O%8E(;q|Z{lxU7FNGtTH2zAgB%Z)bPq&YTx*fAv8?rKqwcn?_@#}h;=Ae6IKj}1 zZI9Ry&phvTQ@;t(CpvP!HCh`jld(9>Ptd$5BTaXCTdWb=OP%>CW9YnOt-WD_*by%6 ze1HmyOuY3xxV5$Qg`bQfY#1-usQW9te5CxP$`Q4%{u41}n#hoJQ5=(h)x+JN+2MzW z88hGO2b9fj56YXL`jWL0PoHUU!Q4aYzQU3OIiqpJ*m^$x8p)_=DN) zn%#K!UksMrLpGPNx-!r=S!&Hk}8m&@xtyYa~#V?|8lYQxUhBHAKO2#r^W z>XBQ&zf5sfg$`Goio;p4{r4q{bB7rpm-}a}IbO${2XPBw!gK#w_thb>6P2+XfWmOb zvjS4QjT${aK4YU?PD8+ZK6FlU$o_c5={Vj9fRT|&B|~$gXG^$A9GVcdf?>gJ>Iq1WJbXNGkC-wL0V`5bswdcWw zH}rn8Tv?sz?+W?ioNN0KD{OFZ=BHzj(d=;=z~^8hNWuHAxoyPm@b`h6H*NA)AZ}VQ zVYn{gny!g5ppS|{bab0*YXE?=i7iXxO>`6|M@d2eMkW6c)ilTZQuHtI#b&Kz zWB=l%{jo)3DPYoDr2+;Ca{Mu}XB)xl1+)|{oD{|)g@B0g)A2nthj0SG%x)ku*46%m zp6AIvd56!vp#_GiD^z`?_)Vrc7KbFG?ZfhY<#7IoTG%lLo4(yNOzhqvYEr9G_GACm zTald`Ts{QOkTE8@{$yt1mP9AdjpwIe4g9Tu8edbxpT#dk0v;S3)YjE4Zwk6A-Ni9% zcPGc96pkH^%^8r_;n&tzx0{EKEU?+>RXg1Ly>}Z~>qw)Tm2B;J^T2CQ<5WHbB*um0cTYsKCNF zGZBUlzl*?EuZ|NKN%JzWcxm}KIlM$>aQ&MjEk;goY1rLgeH(CF2Djm#)}7;EQwQdu}gQJOysBw7$gxL$+^TQN^4(UibS59=N&fN zv3P#3p5I_%Wb4h~bIeosE`qRh?JEK}Od&SeVuQ9-tn*?xxs$aiNI9*=^+XkL*bAhE z4Tb6^E~bnkOpJr={+r?yN>JY}Y{&JMh{2FS&p$&7$uc(}Fda}v`Am($k1B);KeCDQ zJuEbT%tg>67v>`|GBOUGcno^}+g$jSeDd|kti$CWpU};m&hycMQTzvNQxy}O&6aQQ zgSgfK+AMTX;tyc7IrAuy+C?|Xy96;V;#6R*)sdqv4$WtdK=pZW_rcbHF#i|~5#jw$ z9eOA-)?dr|dKrJfI6Z)>HW*+^3bm3gP|pu;VoRQ!=`-rA`izZT`(S|KeDKP%{$p_H zB~!z*ds~SGh5{@?YPUs2i_jP<2A>Wul{;s3ZN1d~=4 z7M4ESrRo9*4b!$W3Rns){0AXqUMh;TNLjb16i%iv0@&AD+(IPp*52MxP_(?l#LDd{L-4Wvbk)O+?&LEs_GaFP1R<73o{<4P1vnBgoem3V1W z-R0VaV+GRIvW%Of-LXE-sU}ZF#Gj|4d!sYepIP5R(c@v*xEo-CBEUl!GSF}JsGX|x z2D!u?pem#f5*4Coun@_a$|g_i-w{cWyD7KR^i}qxR01^_ds}`k;J{3>TUy?9)UNHvASlMwGnK zdZU+ed+gBb*dj=;ff9c^PW-G`SHjtcFT?<;m57APJ6zeJmWBiU2P`I!Bs5m}kd$$L z+55lF*uO!L(20$+lKKsLcCKGj)bi0`W7LQQ6IEwvK6MFtd=pR5 z4us3Qd^laH&%l91W5z#Pw-u^328q2_Mc2d%ZA1Y&?;qp{JG<~d`Ucbpy?qlAVJh>c z)Pw=|`osSnmQzAf<; z=7Is5x~^)Z$N6*UYzMQ2Z-AAWl~pMs%oe~^Mp`jWcyE-ArWJEQO>X(iyqAdXzX@sP zIHv+c^WTNCKU?+L!utQD7<9W4To64+U{P%LKZo642CRoLeJdRbxo3Xs$UPJx#NQZh zf9x*Ujl>_sJ#y61(RoF{E&!T4=vE0Tqe8W{@ZOgr(~MgIcbr zwPa(4VE%M_H1SdYb(DNAQew+dSbSk77;(yvdm$mOZ|m9kivrJ>%uFKW?X0 z|GfK)OBeH2@(%`h2qk3KsT5F`l@u-5!q}2D>`5dkF?Lz`V2dw1_?9i;CV-EA>$Qy# zpAN@aY7Kw=C+?HLp7TfkRw0MSE_vIA5)HXnzcfpO$SMRW0&ISoYjxY^_?UmeIi{%( zLXk9y@@XH8-2Z1&TZ0+VA|{eiYf3;3Oe>Hu$*hvHCUmlsGX9;eol>_ja*5J^+zslz z{hY#(4;U>T``SV)2y8Z|XAq@A-YaB>N2J%CWtO* zKresj4GzJDxBHapIIww8gpK*R(H&%5EBv@hLF*PMVTQ}!S-J+*A35t=NUWqMg|9g$ zIU(~QdR#4gie7R>4*X7A^DzHR3*`obNvS0vfQxwwD9*=ji>jfW*45j1hjW^Pe&|vlsb|| z@IZzrA^B56!op`DFcQ*0zAmJ^g1I~jzZiMsaeaM;jN)y}B{S!%9-TZrXqJb?ckd!* z0hH1i7g>&aIV9N+(;of+w#q->*iqnIdKIy9Uzo3$+)aQ3MI* zKD=ljuKgK_KoUw`LZT0)Dg`Vca46gWHC5Gq7K4Er{oRb%Ow*={)d~4RF7$H-??h<- z-uc9?KEsxuba z3>R>Tku&wymy7q84r8Pzyus#xAQJK)t4pC+5SK4k>;QDyxbHgkF{RT7TlKrRTo@hH z0W=12E5lOujG7q7gkA$HuKbwyyS|Y+&!6!@l2~`&(-+rRHah!rQicz#IXZ3?>N2RIc=Pl;e= zV4)~r1|Ag=luRw@29YRl%mW^+)R(NZp4x5cv)wDw9Z*@Cv(2^j%$C zDc)ooKiQW7gD%Gt_7513riQJ`EUl?YNpmp()oSRt>>Q?K!w{Q#<53bOPQiQNS6I(u zlanY@J5H~Uj0ft21HK89*05@Uvak3m0GgoTKFZ)Q6)Ja0k5pAu(gsYI`Hzf`)=*=klrgT(DBGEVf)!6nvOP)Ttk63TJ|xvf-HRJrLT zou@9=(<}h$^hSo%@;4X~!^Z{_JLGqEb}$j*z2OT5z^jI@%S^>>-u%{Y&GQP8yA377sjInVPx^b`GcO?b(pP*`uOrU zsIzl(FCg$8ApBd1yLuH>FbClJq`JFp*U2R(XM8g*gN@eeg5sz}PireFbV0Pt`&t<% z_Ln@xfV@+VIpa6#l?bY`7JZfk^KXxPX^IH(0?35|9~-1Y+XDNQp_!j@PM&NhSJKwl zI5Z|>hBY^oOM%dIsOs50!}B|QB~ph28s;pWwEp+V<~cM3Q}SKX2@==(EQHcZu;2>> zsD6QtE6#an=3!#D3)Gna_%FOUecr|73f zHACHtP=Drn48I9R_mF~1HN!QYPXZLxDbk?9>b*Cm#{|8{6o{P17e+};e(--|C$W_O zkgLtY7#$u?Dg!8Eh9Hg0*;+B6V~m{Nl>KaXChCT%uW0L@*5ybiD__~{bqKT3^hN%d zAVc|PkOq&1Dx!(Jd*G}EhBN!_T__pmMA?EM(BI_B!P2yimOaHdNmz?Gc#p*#7R$h7Oh6066)byjn&{TJtWb%tKMjUm zFhgIi)u4blIe2w@nOP_BplGW=o9cy6!228oCqoW2OQ6ZSY|a zO@6Mgq7Iw+TjZFiDxwT#f(^HF45-|wLJGy6-3o4(c~ov!rhaTt^=RYp@Ng3W8%`#M zHXc>KevrtJBFS#RFHt?~y^4NMdVXv%V)aG-5<&ETNd@GZKRd}cjH+z6NINr)*JZ!b z^1r54yo_?!*RMOWt$Uy3Fn2^pN!RIhials%7ThpGeg9q+nbT$`nj5F?Qo&}I$+AUW zI=&*^)Fk-05StuMm#H5!rtViI$=x`h zNdE3F^3pPtFZ8nT()yXtp$l86E1KFk2mV|xzBCR-7$$XCCILhj7Jt7pa z0v2|w za7akwI=fE=eQS2udH<5pIb$UIn8x5eD?z_LVPHE!T74#qzhU% zBG!9`TKvOG&Rq6$2;?`a)76MHlk2)+8QROk#j&gl)ht7Jxwe zxK*#!I8@t9S|k|y&D_wwSsCbCiAkITb$ zRctwpx#=KwLi-)Hw^_^~@yYb;!5T=e?tVh0oUl|z%<108`YpJWuZX^XhyvEO6^$3#tO>8( zU+lL#?~%owuJ2=zqCKD;fSd;rB;Y{)!R=mS8CPW|)rGjRuZZ%GAzu3ztkTbn2t(hN zcaQP3w%j4II;h;5d7~w2$Nr#KjQNlKr*$=l9Q>_FjYGEb7p2nsuThcEp$GXtxl2e=b;~P;KV2@m7c^n*5?ugM8@*qROKKuWour$0m03tY#*01(3Y^w;y64 zW~u4(HPyVu?33^2$#eRTy9^4GKO6@szlHi2xqep_eVNCL>P15f z_~kkKQJm)=Y**|QsyK%v>Y_FGeaPd|1^Q}|6p-kQav0MxIc<3%>4N@m8adjdo`m>Y zd)?$^=1t$M$2Ux6wd^0h1JkVeLP7BZ8q)#|DJuOtM8W`uaoBEOw@sq)$Z=fS_Wo9X zk5X4mh(-5`U}eYuP|!jTKnby#`ois?ya@>D4R}R6fZV*Y#vn!R3s>cye8d9D=wqmB zeoI0WU+nb8z#sCiIaveDY(}giizU7ykp8nTxCm6|vqG2M4^;Y0<9h93!_H2YS(WQ} zCS%Gg%#p|?cPIvdv_83mm{$20j4jYbN9BQ13reqR zS1+&Fnb+jXBp*h&v|{$7)gTx=>3Fh1t-8Mm)e>j5BCP@5g@@Bdr^PECM zfTo`jy1!e-4gB2??Q2mu7K!;3PXWmRmDjp&O!WBmY3FhdK+L+SKCR3b8(_U>x5jfN z=fEZta;;F(^=t|hNw^RP{gKYCH;fl3_~pWiEO5e)Kud|(4DhINPM9okl3K1 z$(=}4+VwK>49_rnwS9U}+9-d>Q;ii&bAec%&DX}AW!gbjIxdL)oeV?q8|!B)wahQ_ zpznf&Vu}6$(i5X=H6;ZBn4=(|{=vPCOGmXA-n=`mB4h1YsDAfA%ZAK!|CBBT1%rp~xhr|%gjGgF=1FNi%^2@E< z$)2;#We;XI?&Eg4vc{NRM<>nlo;XLw-yfxGuSjkwR{2AMKvx7w(^1$)O4od`&zlO4 zgZ7QQzeA}_B|T$R{t@?{{XM+EV|$Q-kGz%cb#u^mA#rZ)E7cv!*Az5v2F3$0LjtP9 zxdI0IAg~~b_Lf2rSB!WI#wC1ZO6lIa#+?E2_#&P|lL459KnG35{ zg0Xm2h=+UaYtVK?vnt70a@8P2moWzD+>4HoFF4BS1NfOQaIh=nZe^lOJ3!%qc~8_| zEn(a3tezh-VN!7eG3%s?Dx1k#faKO^iz)whzx+-KnDALkaxu8X#HpqMA`LTT*G4$7yP5^+5x z+d5AS#u8C`FoQMXwDt#CZjN7QEHvy4uhi_@F`*LWb@vUS(8DWO$Ov1by&E$y`H$^~ z#14A1fMla##iSwYNKMe(;1!6)t0;DuLxuH?O?IeB`ZfZ_$Rt0vpD431HE8coexNbZ0I;JgsP$M1G&jpSEA zFADm@2`q|j4x9e|21`j45AnCr{<0xpCTT%T;gr7@DV)1-9KY&jy+Ql71D2>9>q<$J z(gk%y>E8li7!a0@hbinQr5yhR_@m)Vu{{h(i1|2b)#Z{_!3waYE0KfQzuDDHS@Lz- zx<&q1ZPxOcW^FnnTHi0ThuMZyS#>h0(}1*On-b5b z(x`QWvX7@|ChI`CXPG)kI6$|h85X)`;E#{41+SG(8%^Q(fm0o=)4fYLx`~V*6Y~G_ z8nbw01X@c#j1C;PCLY5svw)g2UQl15tGiGL~fLk-*Lixk&~+mK=lVX2G2c5iD2T-M+65s;5~g0*#Cwt+ zuDozC3mHa-dxf28xLs(Mj5LYDk6(oii}Taz@~M1GSL@9831v6i3jsk1W!zR*n| zF;SygRUTk0p5@p6f^j6U_lh}BL%J?6eq?0c#FGnTSqR9w8n~1csz5JA$83@AmNrC4 zxcXIIh3J}jjL|Er7cj(Bx^zQdH@0jDAJU8b_JDA>y(eV|NQl6{rbyk!yFkGo`f&GM zRX8Ab*KL|FvQSNeuH1by7Q2C6tf?ydPO0jXLe!*GE+-{`_7QN4L7so}r3w#+q)~s% z1Lo9>5DWdXM@7ATSV;{($~TTzb5zB7Vhbe2F1Bgga~fE2AEr7TmQ^KO4AJI{_Ef;+ z6S8c1{jfc1~7yE_HTp y0d774b`EBCb^&&FXZTjwV-EjM1A9kvYfG>He*<_!pgODpKvq&w;-{E#;Qs*v@a$#) literal 0 HcmV?d00001 diff --git a/packs/sealed-secrets-2.19.3/pack.json b/packs/sealed-secrets-2.19.3/pack.json new file mode 100644 index 00000000..6db2835f --- /dev/null +++ b/packs/sealed-secrets-2.19.3/pack.json @@ -0,0 +1,28 @@ +{ + "addonType": "system app", + "cloudTypes": [ + "all" + ], + "displayName": "Sealed Secrets", + "charts": [ + "charts/sealed-secrets-2.19.3.tgz" + ], + "layer": "addon", + "name": "sealed-secrets", + "version": "2.19.3", + "annotations": { + "source": "community", + "contributor": "spectrocloud" + }, + "constraints": { + "dependencies": [ + { + "packName": "kubernetes", + "layer": "k8s", + "minVersion": "1.29", + "maxVersion": "", + "type": "optional" + } + ] + } +} \ No newline at end of file diff --git a/packs/sealed-secrets-2.19.3/values.yaml b/packs/sealed-secrets-2.19.3/values.yaml new file mode 100644 index 00000000..0735df3e --- /dev/null +++ b/packs/sealed-secrets-2.19.3/values.yaml @@ -0,0 +1,609 @@ +pack: + # The namespace (on the target cluster) to install this chart + # When not found, a new namespace will be created + namespace: "sealed-secrets" + content: + images: + - image: bitnami/sealed-secrets-controller:0.39.1 + + charts: + - repo: https://bitnami.github.io/sealed-secrets + name: sealed-secrets + version: 2.19.3 + +charts: + sealed-secrets: + ## @section Common parameters + + ## @param kubeVersion Override Kubernetes version + ## + kubeVersion: "" + ## @param nameOverride String to partially override sealed-secrets.fullname + ## + nameOverride: "" + ## @param fullnameOverride String to fully override sealed-secrets.fullname + ## + fullnameOverride: "" + ## @param namespace Namespace where to deploy the Sealed Secrets controller + ## + namespace: "" + + ## @param extraDeploy [array] Array of extra objects to deploy with the release + ## + extraDeploy: [] + ## @param commonAnnotations [object] Annotations to add to all deployed resources + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + commonAnnotations: {} + + ## @param commonLabels [object] Labels to add to all deployed resources + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + commonLabels: {} + + ## @section Sealed Secrets Parameters + + ## Sealed Secrets image + ## ref: https://hub.docker.com/r/bitnami/sealed-secrets-controller/tags + ## @param image.registry Sealed Secrets image registry + ## @param image.repository Sealed Secrets image repository + ## @param image.tag Sealed Secrets image tag (immutable tags are recommended) + ## @param image.pullPolicy Sealed Secrets image pull policy + ## @param image.pullSecrets [array] Sealed Secrets image pull secrets + ## + image: + registry: docker.io + repository: bitnami/sealed-secrets-controller + tag: 0.39.1 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param revisionHistoryLimit Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) + ## e.g: + revisionHistoryLimit: "" + ## @param createController Specifies whether the Sealed Secrets controller should be created + ## + createController: true + ## @param secretName The name of an existing TLS secret containing the key used to encrypt secrets + ## + secretName: "sealed-secrets-key" + ## @param updateStatus Specifies whether the Sealed Secrets controller should update the status subresource + ## + updateStatus: true + ## @param skipRecreate Specifies whether the Sealed Secrets controller should skip recreating removed secrets + ## Setting it to true allows to optionally restore backward compatibility in low priviledge + ## environments when old versions of the controller did not require watch permissions on secrets + ## for secret re-creation. + ## + skipRecreate: false + ## @param keyrenewperiod Specifies key renewal period. Default 30 days + ## e.g + ## keyrenewperiod: "720h30m" + ## To disable use "0", with quotes! + ## + keyrenewperiod: "" + ## @param keyttl Specifies the certificate validity duration. Default 10 years. + ## e.g for one year + ## keyttl: "8760h00m00s" + ## + keyttl: "" + ## @param keycutofftime Specifies a date at which the controller should generate a new certificate. Useful in early key renewal scenarios. + ## Takes a date formated according to RFC1123. Can be obtained with the 'date -R' command on a unix system. + ## e.g + ## keycutofftime: "Mon, 14 Oct 2024 21:45:30 +0200" + ## + keycutofftime: "" + ## @param rateLimit Number of allowed sustained request per second for verify endpoint + ## + rateLimit: "" + ## @param rateLimitBurst Number of requests allowed to exceed the rate limit per second for verify endpoint + ## + rateLimitBurst: "" + ## @param additionalNamespaces List of namespaces used to manage the Sealed Secrets + ## + additionalNamespaces: [] + ## @param privateKeyAnnotations Map of annotations to be set on the sealing keypairs + ## + privateKeyAnnotations: {} + ## @param privateKeyLabels Map of labels to be set on the sealing keypairs + ## + privateKeyLabels: {} + ## @param logInfoStdout Specifies whether the Sealed Secrets controller will log info to stdout + ## + logInfoStdout: false + ## @param logLevel Specifies log level of controller (INFO,ERROR) + ## + logLevel: "" + ## @param logFormat Specifies log format (text,json) + ## + logFormat: "" + ## @param maxRetries Number of maximum retries + ## + maxRetries: "" + ## @param watchForSecrets Specifies whether the Sealed Secrets controller will watch for new secrets + ## + watchForSecrets: false + ## @param kubeClientQPS Kubeclient QPS (negative value disables ratelimiting) + ## + kubeClientQPS: "" + ## @param kubeClientBurst Kubeclient Burst + ## + kubeClientBurst: "" + ## @param command Override default container command + ## + command: [] + ## @param args Override default container args + ## + args: [] + ## Configure extra options for Sealed Secret containers' liveness, readiness and startup probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#configure-probes + ## @param livenessProbe.enabled Enable livenessProbe on Sealed Secret containers + ## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param livenessProbe.successThreshold Success threshold for livenessProbe + ## + livenessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param readinessProbe.enabled Enable readinessProbe on Sealed Secret containers + ## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param readinessProbe.successThreshold Success threshold for readinessProbe + ## + readinessProbe: + enabled: true + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param startupProbe.enabled Enable startupProbe on Sealed Secret containers + ## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe + ## @param startupProbe.periodSeconds Period seconds for startupProbe + ## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe + ## @param startupProbe.failureThreshold Failure threshold for startupProbe + ## @param startupProbe.successThreshold Success threshold for startupProbe + ## + startupProbe: + enabled: false + initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 + ## @param customLivenessProbe Custom livenessProbe that overrides the default one + ## + customLivenessProbe: {} + ## @param customReadinessProbe Custom readinessProbe that overrides the default one + ## + customReadinessProbe: {} + ## @param customStartupProbe Custom startupProbe that overrides the default one + ## + customStartupProbe: {} + ## Sealed Secret resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param resources.limits [object] The resources limits for the Sealed Secret containers + ## @param resources.requests [object] The requested resources for the Sealed Secret containers + ## + resources: + limits: {} + requests: {} + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param podSecurityContext.enabled Enabled Sealed Secret pods' Security Context + ## @param podSecurityContext.fsGroup Set Sealed Secret pod's Security Context fsGroup + ## @param podSecurityContext.seccompProfile.type Set Sealed Secret pod's Security Context seccomp profile type + ## + podSecurityContext: + enabled: true + fsGroup: 65534 + seccompProfile: + type: RuntimeDefault + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param containerSecurityContext.enabled Enabled Sealed Secret containers' Security Context + ## @param containerSecurityContext.readOnlyRootFilesystem Whether the Sealed Secret container has a read-only root filesystem + ## @param containerSecurityContext.runAsNonRoot Indicates that the Sealed Secret container must run as a non-root user + ## @param containerSecurityContext.runAsUser Set Sealed Secret containers' Security Context runAsUser + ## @param containerSecurityContext.allowPrivilegeEscalation Set Sealed Secret containers' privilege escalation + ## @extra containerSecurityContext.capabilities Adds and removes POSIX capabilities from running containers (see `values.yaml`) + ## @skip containerSecurityContext.capabilities.drop + ## + containerSecurityContext: + enabled: true + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + ## @param hostUsers Specifies whether or not host or namespaced users should be used + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/user-namespaces/ + ## + hostUsers: ~ + + ## @param podLabels [object] Extra labels for Sealed Secret pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param podAnnotations [object] Annotations for Sealed Secret pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param priorityClassName Sealed Secret pods' priorityClassName + ## + priorityClassName: "" + ## @param runtimeClassName Sealed Secret pods' runtimeClassName + ## + runtimeClassName: "" + ## @param affinity [object] Affinity for Sealed Secret pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + ## @param nodeSelector [object] Node labels for Sealed Secret pods assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param tolerations [array] Tolerations for Sealed Secret pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param additionalVolumes [object] Extra Volumes for the Sealed Secrets Controller Deployment + ## ref: https://kubernetes.io/docs/concepts/storage/volumes/ + ## + additionalVolumes: [] + ## @param additionalVolumeMounts [object] Extra volumeMounts for the Sealed Secrets Controller container + ## ref: https://kubernetes.io/docs/concepts/storage/volumes/ + ## + additionalVolumeMounts: [] + ## @param hostNetwork Sealed Secrets pods' hostNetwork + hostNetwork: false + ## Sealed Secrets controller ports to open + ## If hostNetwork true: the hostPort is set identical to the containerPort + ## @param containerPorts.http Controller HTTP Port on the Host and Container + ## @param containerPorts.metrics Metrics HTTP Port on the Host and Container + ## + containerPorts: + http: 8080 + metrics: 8081 + ## Sealed Secrets controller ports to be exposed as hostPort + ## If hostNetwork is false, only the ports specified here will be exposed (or not if set to an empty string) + ## @param hostPorts.http Controller HTTP Port on the Host + ## @param hostPorts.metrics Metrics HTTP Port on the Host + ## + hostPorts: + http: "" + metrics: "" + + ## @param dnsPolicy Sealed Secrets pods' dnsPolicy + dnsPolicy: "" + ## @section Traffic Exposure Parameters + + ## Sealed Secret service parameters + ## + service: + ## @param service.type Sealed Secret service type + ## + type: ClusterIP + ## @param service.loadBalancerClass Sealed Secret service loadBalancerClass + ## + loadBalancerClass: "" + ## @param service.port Sealed Secret service HTTP port + ## + port: 8080 + ## @param service.nodePort Node port for HTTP + ## Specify the nodePort value for the LoadBalancer and NodePort service types + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: "" + ## @param service.annotations [object] Additional custom annotations for Sealed Secret service + ## + annotations: {} + ## Sealed Secret ingress parameters + ## ref: http://kubernetes.io/docs/user-guide/ingress/ + ## + ingress: + ## @param ingress.enabled Enable ingress record generation for Sealed Secret + ## + enabled: false + ## @param ingress.pathType Ingress path type + ## + pathType: ImplementationSpecific + ## @param ingress.apiVersion Force Ingress API version (automatically detected if not set) + ## + apiVersion: "" + ## @param ingress.ingressClassName IngressClass that will be be used to implement the Ingress + ## This is supported in Kubernetes 1.18+ and required if you have more than one IngressClass marked as the default for your cluster. + ## ref: https://kubernetes.io/blog/2020/04/02/improvements-to-the-ingress-api-in-kubernetes-1.18/ + ## + ingressClassName: "" + ## @param ingress.hostname Default host for the ingress record + ## + hostname: sealed-secrets.local + ## @param ingress.path Default path for the ingress record + ## + path: /v1/cert.pem + ## @param ingress.annotations [object] Additional annotations for the Ingress resource. To enable certificate autogeneration, place here your cert-manager annotations. + ## Use this parameter to set the required annotations for cert-manager, see + ## ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations + ## e.g: + ## annotations: + ## kubernetes.io/ingress.class: nginx + ## cert-manager.io/cluster-issuer: cluster-issuer-name + ## + annotations: {} + ## @param ingress.tls Enable TLS configuration for the host defined at `ingress.hostname` parameter + ## TLS certificates will be retrieved from a TLS secret with name: `{{- printf "%s-tls" .Values.ingress.hostname }}` + ## You can: + ## - Use the `ingress.secrets` parameter to create this TLS secret + ## - Relay on cert-manager to create it by setting the corresponding annotations + ## - Relay on Helm to create self-signed certificates by setting `ingress.selfSigned=true` + ## + tls: false + ## @param ingress.selfSigned Create a TLS secret for this ingress record using self-signed certificates generated by Helm + ## + selfSigned: false + ## @param ingress.extraHosts [array] An array with additional hostname(s) to be covered with the ingress record + ## e.g: + ## extraHosts: + ## - name: sealed-secrets.local + ## path: / + ## + extraHosts: [] + ## @param ingress.extraPaths [array] An array with additional arbitrary paths that may need to be added to the ingress under the main host + ## e.g: + ## extraPaths: + ## - path: /* + ## backend: + ## serviceName: ssl-redirect + ## servicePort: use-annotation + ## + extraPaths: [] + ## @param ingress.extraTls [array] TLS configuration for additional hostname(s) to be covered with this ingress record + ## ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + ## e.g: + ## extraTls: + ## - hosts: + ## - sealed-secrets.local + ## secretName: sealed-secrets.local-tls + ## + extraTls: [] + ## @param ingress.secrets [array] Custom TLS certificates as secrets + ## NOTE: 'key' and 'certificate' are expected in PEM format + ## NOTE: 'name' should line up with a 'secretName' set further up + ## If it is not set and you're using cert-manager, this is unneeded, as it will create a secret for you with valid certificates + ## If it is not set and you're NOT using cert-manager either, self-signed certificates will be created valid for 365 days + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + ## e.g: + ## secrets: + ## - name: sealed-secrets.local-tls + ## key: |- + ## -----BEGIN RSA PRIVATE KEY----- + ## ... + ## -----END RSA PRIVATE KEY----- + ## certificate: |- + ## -----BEGIN CERTIFICATE----- + ## ... + ## -----END CERTIFICATE----- + ## + secrets: [] + ## Network policies + ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ + ## + networkPolicy: + ## @param networkPolicy.enabled Specifies whether a NetworkPolicy should be created + ## + enabled: false + ## NetworkPolicy Egress configuration + ## + egress: + ## @param networkPolicy.egress.enabled Specifies wheter a egress is set in the NetworkPolicy + ## + enabled: false + ## @param networkPolicy.egress.kubeapiCidr Specifies the kubeapiCidr, which is the only egress allowed. If not set, kubeapiCidr will be found using Helm lookup + ## + kubeapiCidr: "" + ## @param networkPolicy.egress.kubeapiPort Specifies the kubeapiPort, which is the only egress allowed. If not set, kubeapiPort will be found using Helm lookup + ## + kubeapiPort: "" + + ## @section Other Parameters + + ## ServiceAccount configuration + ## + serviceAccount: + ## @param serviceAccount.annotations [object] Annotations for Sealed Secret service account + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + annotations: {} + ## @param serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param serviceAccount.labels Extra labels to be added to the ServiceAccount + ## + labels: {} + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the sealed-secrets.fullname template + ## + name: "" + ## RBAC configuration + ## + rbac: + ## @param rbac.create Specifies whether RBAC resources should be created + ## + create: true + ## @param rbac.clusterRole Specifies whether the Cluster Role resource should be created + ## + clusterRole: true + ## @param rbac.clusterRoleName Specifies the name for the Cluster Role resource + ## + clusterRoleName: "secrets-unsealer" + ## @param rbac.namespacedRoles Specifies whether the namespaced Roles should be created (in each of the specified additionalNamespaces) + ## + namespacedRoles: false + ## @param rbac.namespacedRolesName Specifies the name for the namespaced Role resource + ## + namespacedRolesName: "secrets-unsealer" + ## @param rbac.labels Extra labels to be added to RBAC resources + ## + labels: {} + ## @param rbac.pspEnabled PodSecurityPolicy + ## + pspEnabled: false + ## "Proxier" RBAC Role configuration + ## + serviceProxier: + ## @param rbac.serviceProxier.create Specifies whether to create the "proxier" role, to allow external users to access the SealedSecret API + ## + create: true + ## @param rbac.serviceProxier.bind Specifies whether to create a RoleBinding for the "proxier" role + ## + bind: true + ## @param rbac.serviceProxier.subjects Specifies the RBAC subjects to grant the "proxier" role to, in the created RoleBinding + ## It is best to change this to something narrower, as the default binding gives `system:authenticated` access, which is very broad + ## + subjects: | + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + + ## @section Metrics parameters + + metrics: + prometheusRule: + ## @param metrics.prometheusRule.enabled Specify if a PrometheusRule will be deployed for Prometheus Operator + ## + enabled: false + + ## @param metrics.prometheusRule.namespace Namespace where Prometheus Operator is running in + ## + namespace: "" + + ## @param metrics.prometheusRule.labels Extra labels for the PrometheusRule + ## + labels: {} + + ## @param metrics.prometheusRule.annotations Extra annotations for the PrometheusRule + ## + annotations: {} + + ## @param metrics.prometheusRule.groups Prometheus alerting rule groups + ## + groups: + - name: sealed-secrets-controller.rules + rules: + - alert: SealedSecretsControllerNotReady + expr: | + sealed_secrets_controller_condition_info != 1 + for: 10m + labels: + severity: critical + annotations: + summary: "Sealed Secrets controller is not Synced" + description: "At least one SealedSecret is in a non-synced state (0 or -1). Check controller logs and secret reconciliation status." + ## Prometheus Operator ServiceMonitor configuration + ## + serviceMonitor: + ## @param metrics.serviceMonitor.enabled Specify if a ServiceMonitor will be deployed for Prometheus Operator + ## + enabled: false + ## @param metrics.serviceMonitor.namespace Namespace where Prometheus Operator is running in + ## + namespace: "" + ## @param metrics.serviceMonitor.labels Extra labels for the ServiceMonitor + ## + labels: {} + ## @param metrics.serviceMonitor.annotations Extra annotations for the ServiceMonitor + ## + annotations: {} + ## @param metrics.serviceMonitor.interval How frequently to scrape metrics + ## e.g: + ## interval: 10s + ## + interval: "" + ## @param metrics.serviceMonitor.scrapeTimeout Timeout after which the scrape is ended + ## e.g: + ## scrapeTimeout: 10s + ## + scrapeTimeout: "" + ## @param metrics.serviceMonitor.honorLabels Specify if ServiceMonitor endPoints will honor labels + ## + honorLabels: true + ## @param metrics.serviceMonitor.metricRelabelings [array] Specify additional relabeling of metrics + ## + metricRelabelings: [] + ## @param metrics.serviceMonitor.relabelings [array] Specify general relabeling + ## + relabelings: [] + ## Grafana dashboards configuration + ## + dashboards: + ## @param metrics.dashboards.create Specifies whether a ConfigMap with a Grafana dashboard configuration should be created + ## ref https://github.com/helm/charts/tree/master/stable/grafana#configuration + ## + create: false + ## @param metrics.dashboards.labels Extra labels to be added to the Grafana dashboard ConfigMap + ## + labels: {} + ## @param metrics.dashboards.annotations Annotations to be added to the Grafana dashboard ConfigMap + ## + annotations: {} + ## @param metrics.dashboards.namespace Namespace where Grafana dashboard ConfigMap is deployed + ## + namespace: "" + + ## Sealed Secret Metrics service parameters + ## + service: + ## @param metrics.service.type Sealed Secret Metrics service type + ## + type: ClusterIP + ## @param metrics.service.loadBalancerClass Sealed Secret Metrics service loadBalancerClass + ## + loadBalancerClass: "" + ## @param metrics.service.port Sealed Secret service Metrics HTTP port + ## + port: 8081 + ## @param metrics.service.nodePort Node port for HTTP + ## Specify the nodePort value for the LoadBalancer and NodePort service types + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: "" + ## @param metrics.service.annotations [object] Additional custom annotations for Sealed Secret Metrics service + ## + annotations: {} + + ## @section PodDisruptionBudget Parameters + + pdb: + ## @param pdb.create Specifies whether a PodDisruptionBudget should be created + ## + create: false + ## @param pdb.minAvailable The minimum number of pods (non number to omit) + ## + minAvailable: 1 + ## @param pdb.maxUnavailable The maximum number of unavailable pods (non number to omit) + ## + maxUnavailable: ""