From d6908b2fcd535c6686fd65161922b8159c1c4a6c Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 26 Sep 2024 14:42:44 +0000 Subject: [PATCH] Update Helm release teleport-kube-agent to v16.4.2 --- helm/teleport-kube-agent/Chart.yaml | 16 +--- helm/teleport-kube-agent/ci/ci-values.yaml | 4 - .../teleport-kube-agent/templates/_config.tpl | 10 ++ .../templates/_helpers.tpl | 12 +-- .../templates/delete_hook.yaml | 11 ++- .../templates/deployment.yaml | 32 +++---- helm/teleport-kube-agent/templates/hook.yaml | 9 ++ .../templates/networkpolicy.yaml | 18 ---- helm/teleport-kube-agent/templates/psp.yaml | 2 +- .../teleport-kube-agent/templates/secret.yaml | 39 ++++---- .../templates/statefulset.yaml | 55 +++++------ helm/teleport-kube-agent/values.schema.json | 84 ++-------------- helm/teleport-kube-agent/values.yaml | 96 ++++++------------- vendir.lock.yml | 4 +- vendir.yml | 2 +- 15 files changed, 134 insertions(+), 260 deletions(-) delete mode 100644 helm/teleport-kube-agent/ci/ci-values.yaml delete mode 100644 helm/teleport-kube-agent/templates/networkpolicy.yaml diff --git a/helm/teleport-kube-agent/Chart.yaml b/helm/teleport-kube-agent/Chart.yaml index d93b395..586e1d7 100644 --- a/helm/teleport-kube-agent/Chart.yaml +++ b/helm/teleport-kube-agent/Chart.yaml @@ -1,17 +1,9 @@ apiVersion: v2 -name: teleport-kube-agent -version: [[ .Version ]] -appVersion: 16.1.7 +appVersion: 16.4.2 description: Teleport provides a secure SSH, Kubernetes, database and application remote access solution that doesn't get in the way. -icon: https://s.giantswarm.io/app-icons/teleport/1/light.png -type: application -sources: -- https://github.com/gravitational/teleport +icon: https://goteleport.com/static/teleport-symbol-bimi.svg keywords: - Teleport -annotations: - application.giantswarm.io/team: shield -maintainers: - - name: giantswarm/team-shield - email: team-shield@giantswarm.io +name: teleport-kube-agent +version: 16.4.2 diff --git a/helm/teleport-kube-agent/ci/ci-values.yaml b/helm/teleport-kube-agent/ci/ci-values.yaml deleted file mode 100644 index 2579ac1..0000000 --- a/helm/teleport-kube-agent/ci/ci-values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -proxyAddr: "teleport.demo.gaws.gigantic.io:443" -authToken: "test" -kubeClusterName: "test" -roles: "kube" diff --git a/helm/teleport-kube-agent/templates/_config.tpl b/helm/teleport-kube-agent/templates/_config.tpl index 565e809..adb708d 100644 --- a/helm/teleport-kube-agent/templates/_config.tpl +++ b/helm/teleport-kube-agent/templates/_config.tpl @@ -128,6 +128,16 @@ discovery_service: enabled: false {{- end }} +jamf_service: + {{- if contains "jamf" (.Values.roles | toString) }} + enabled: true + api_endpoint: {{ required "jamfApiEndpoint is required in chart values when jamf role is enabled, see README" .Values.jamfApiEndpoint }} + client_id: {{ required "jamfClientId is required in chart values when jamf role is enabled, see README" .Values.jamfClientId }} + client_secret_file: "/etc/teleport-jamf-api-credentials/credential" + {{- else }} + enabled: false + {{- end }} + auth_service: enabled: false ssh_service: diff --git a/helm/teleport-kube-agent/templates/_helpers.tpl b/helm/teleport-kube-agent/templates/_helpers.tpl index 2ef4c56..3e00e27 100644 --- a/helm/teleport-kube-agent/templates/_helpers.tpl +++ b/helm/teleport-kube-agent/templates/_helpers.tpl @@ -33,7 +33,7 @@ if serviceAccount is not defined or serviceAccount.name is empty, use .Release.N {{- if .Values.teleportVersionOverride -}} {{- .Values.teleportVersionOverride -}} {{- else -}} - {{- .Chart.AppVersion -}} + {{- .Chart.Version -}} {{- end -}} {{- end -}} @@ -41,18 +41,10 @@ if serviceAccount is not defined or serviceAccount.name is empty, use .Release.N {{- if .Values.enterprise -}} {{- .Values.enterpriseImage -}} {{- else -}} - {{- .Values.image.repository -}} + {{- .Values.image -}} {{- end -}} {{- end -}} {{- define "teleport-kube-agent.image" -}} {{ include "teleport-kube-agent.baseImage" . }}:{{ include "teleport-kube-agent.version" . }} {{- end -}} - -{{- define "registry" }} -{{- $registry := .Values.image.registry -}} -{{- if and .Values.global (and .Values.global.image .Values.global.image.registry) -}} -{{- $registry = .Values.global.image.registry -}} -{{- end -}} -{{- printf "%s" $registry -}} -{{- end -}} diff --git a/helm/teleport-kube-agent/templates/delete_hook.yaml b/helm/teleport-kube-agent/templates/delete_hook.yaml index c6056b0..f0a4b2e 100644 --- a/helm/teleport-kube-agent/templates/delete_hook.yaml +++ b/helm/teleport-kube-agent/templates/delete_hook.yaml @@ -73,6 +73,15 @@ spec: template: metadata: name: {{ .Release.Name }}-delete-hook +{{- if .Values.annotations.pod }} + annotations: + {{- toYaml .Values.annotations.pod | nindent 8 }} +{{- end }} + labels: + app: {{ .Release.Name }} +{{- if .Values.extraLabels.pod }} + {{- toYaml .Values.extraLabels.pod | nindent 8 }} +{{- end }} spec: {{- if .Values.imagePullSecrets }} imagePullSecrets: @@ -100,7 +109,7 @@ spec: fieldPath: metadata.namespace - name: RELEASE_NAME value: {{ .Release.Name }} - image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}' + image: {{ include "teleport-kube-agent.image" . | quote }} {{- if .Values.imagePullPolicy }} imagePullPolicy: {{ toYaml .Values.imagePullPolicy }} {{- end }} diff --git a/helm/teleport-kube-agent/templates/deployment.yaml b/helm/teleport-kube-agent/templates/deployment.yaml index 592ee4e..4eb3f5d 100644 --- a/helm/teleport-kube-agent/templates/deployment.yaml +++ b/helm/teleport-kube-agent/templates/deployment.yaml @@ -111,11 +111,11 @@ spec: name: "teleport-tls-ca" readOnly: true {{- end }} - # {{- if contains "jamf" (.Values.roles | toString) }} - #- mountPath: /etc/teleport-jamf-api-credentials - # name: "jamf-api-credentials" - # readOnly: true - # {{- end }} + {{- if contains "jamf" (.Values.roles | toString) }} + - mountPath: /etc/teleport-jamf-api-credentials + name: "jamf-api-credentials" + readOnly: true + {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 8 }} {{- end }} @@ -126,7 +126,7 @@ spec: {{- end }} containers: - name: "teleport" - image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}' + image: {{ include "teleport-kube-agent.image" . | quote }} {{- if .Values.imagePullPolicy }} imagePullPolicy: {{ toYaml .Values.imagePullPolicy }} {{- end }} @@ -201,11 +201,11 @@ spec: name: "teleport-tls-ca" readOnly: true {{- end }} - # {{- if contains "jamf" (.Values.roles | toString) }} - #- mountPath: /etc/teleport-jamf-api-credentials - # name: "jamf-api-credentials" - # readOnly: true - # {{- end }} + {{- if contains "jamf" (.Values.roles | toString) }} + - mountPath: /etc/teleport-jamf-api-credentials + name: "jamf-api-credentials" + readOnly: true + {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 8 }} {{- end }} @@ -228,11 +228,11 @@ spec: secret: secretName: {{ .Values.tls.existingCASecretName }} {{- end }} - #{{- if contains "jamf" (.Values.roles | toString) }} - #- name: "jamf-api-credentials" - # secret: - # secretName: {{ .Values.jamfCredentialsSecret.name }} - #{{- end }} + {{- if contains "jamf" (.Values.roles | toString) }} + - name: "jamf-api-credentials" + secret: + secretName: {{ .Values.jamfCredentialsSecret.name }} + {{- end }} {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 6 }} {{- end }} diff --git a/helm/teleport-kube-agent/templates/hook.yaml b/helm/teleport-kube-agent/templates/hook.yaml index e6d7de5..3a2f13e 100644 --- a/helm/teleport-kube-agent/templates/hook.yaml +++ b/helm/teleport-kube-agent/templates/hook.yaml @@ -63,6 +63,15 @@ spec: template: metadata: name: {{ .Release.Name }}-hook +{{- if .Values.annotations.pod }} + annotations: + {{- toYaml .Values.annotations.pod | nindent 8 }} +{{- end }} + labels: + app: {{ .Release.Name }} +{{- if .Values.extraLabels.pod }} + {{- toYaml .Values.extraLabels.pod | nindent 8 }} +{{- end }} spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} diff --git a/helm/teleport-kube-agent/templates/networkpolicy.yaml b/helm/teleport-kube-agent/templates/networkpolicy.yaml deleted file mode 100644 index 9dd8b40..0000000 --- a/helm/teleport-kube-agent/templates/networkpolicy.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: NetworkPolicy -metadata: - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} - labels: - app: {{ .Release.Name }} -spec: - egress: - - {} - ingress: - - {} - podSelector: - matchLabels: - app: {{ .Release.Name }} - policyTypes: - - Egress - - Ingress diff --git a/helm/teleport-kube-agent/templates/psp.yaml b/helm/teleport-kube-agent/templates/psp.yaml index aa3578c..bdf8b10 100644 --- a/helm/teleport-kube-agent/templates/psp.yaml +++ b/helm/teleport-kube-agent/templates/psp.yaml @@ -2,7 +2,7 @@ We must remove them before 1.25 to ensure the Helm state doesn't corrupt. As this is a breaking change, this only applies to v12+ charts. v11 and below will only show a warning from the NOTES.txt. Users must use PSAs instead (beta in 1.23, GA in 1.25). The "teleport-cluster" chart runs in "baseline" mode */}} -{{- if and (not .Values.global.podSecurityStandards.enforced) .Values.podSecurityPolicy.enabled (semverCompare "<1.25.0" .Capabilities.KubeVersion.Version) -}} +{{- if and .Values.podSecurityPolicy.enabled (semverCompare "<1.23.0-0" .Capabilities.KubeVersion.Version) -}} apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: diff --git a/helm/teleport-kube-agent/templates/secret.yaml b/helm/teleport-kube-agent/templates/secret.yaml index 615c79c..3489968 100644 --- a/helm/teleport-kube-agent/templates/secret.yaml +++ b/helm/teleport-kube-agent/templates/secret.yaml @@ -17,22 +17,23 @@ stringData: auth-token: | {{ coalesce .Values.joinParams.tokenName .Values.authToken }} {{- end}} -#{{- if and (contains "jamf" (.Values.roles | toString)) .Values.jamfCredentialsSecret.create }} -#--- -#apiVersion: v1 -#kind: Secret -#metadata: -# name: {{ .Values.jamfCredentialsSecret.name }} -# namespace: {{ .Release.Namespace }} -# {{- if .Values.extraLabels.secret }} -# labels: -# {{- toYaml .Values.extraLabels.secret | nindent 4 }} -# {{- end }} -# {{- if .Values.annotations.secret }} -# annotations: -# {{- toYaml .Values.annotations.secret | nindent 4 }} -# {{- end }} -#type: Opaque -#stringData: -# credential: {{ required "jamfClientSecret is required in chart values when jamf role is enabled, see README" .Values.jamfClientSecret }} -#{{- end}} + +{{- if and (contains "jamf" (.Values.roles | toString)) .Values.jamfCredentialsSecret.create }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Values.jamfCredentialsSecret.name }} + namespace: {{ .Release.Namespace }} + {{- if .Values.extraLabels.secret }} + labels: + {{- toYaml .Values.extraLabels.secret | nindent 4 }} + {{- end }} + {{- if .Values.annotations.secret }} + annotations: + {{- toYaml .Values.annotations.secret | nindent 4 }} + {{- end }} +type: Opaque +stringData: + credential: {{ required "jamfClientSecret is required in chart values when jamf role is enabled, see README" .Values.jamfClientSecret }} +{{- end}} diff --git a/helm/teleport-kube-agent/templates/statefulset.yaml b/helm/teleport-kube-agent/templates/statefulset.yaml index 3935049..5018a8c 100644 --- a/helm/teleport-kube-agent/templates/statefulset.yaml +++ b/helm/teleport-kube-agent/templates/statefulset.yaml @@ -13,6 +13,10 @@ metadata: {{- if .Values.extraLabels.deployment }} {{- toYaml .Values.extraLabels.deployment | nindent 4 }} {{- end }} + {{- if .Values.annotations.deployment }} + annotations: + {{- toYaml .Values.annotations.deployment | nindent 4 }} + {{- end }} spec: serviceName: {{ .Release.Name }} replicas: {{ $replicaCount }} @@ -107,11 +111,11 @@ spec: name: "teleport-tls-ca" readOnly: true {{- end }} - # {{- if contains "jamf" (.Values.roles | toString) }} - #- mountPath: /etc/teleport-jamf-api-credentials - # name: "jamf-api-credentials" - # readOnly: true - # {{- end }} + {{- if contains "jamf" (.Values.roles | toString) }} + - mountPath: /etc/teleport-jamf-api-credentials + name: "jamf-api-credentials" + readOnly: true + {{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 8 }} {{- end }} @@ -126,26 +130,11 @@ spec: {{- end }} containers: - name: "teleport" - image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}' + image: {{ include "teleport-kube-agent.image" . | quote }} {{- if .Values.imagePullPolicy }} imagePullPolicy: {{ toYaml .Values.imagePullPolicy }} {{- end }} env: - {{- $proxy := deepCopy .Values.cluster.proxy | mustMerge .Values.proxy }} - {{- if and $proxy.noProxy $proxy.http $proxy.https }} - - name: NO_PROXY - value: {{ $proxy.noProxy }} - - name: no_proxy - value: {{ $proxy.noProxy }} - - name: HTTP_PROXY - value: {{ $proxy.http }} - - name: http_proxy - value: {{ $proxy.http }} - - name: HTTPS_PROXY - value: {{ $proxy.https }} - - name: https_proxy - value: {{ $proxy.https }} - {{- end }} # This variable is set for telemetry purposes. # Telemetry is opt-in and controlled at the auth level. - name: TELEPORT_INSTALL_METHOD_HELM_KUBE_AGENT @@ -166,6 +155,10 @@ spec: - name: TELEPORT_EXT_UPGRADER_VERSION value: {{ include "teleport-kube-agent.version" . }} {{- end }} + {{- if .Values.clusterDomain }} + - name: TELEPORT_KUBE_CLUSTER_DOMAIN + value: {{ .Values.clusterDomain | quote }} + {{- end }} {{- if .Values.tls.existingCASecretName }} - name: SSL_CERT_FILE value: /etc/teleport-tls-ca/ca.pem @@ -227,11 +220,11 @@ spec: name: "teleport-tls-ca" readOnly: true {{- end }} -#{{- if contains "jamf" (.Values.roles | toString) }} -# - mountPath: /etc/teleport-jamf-api-credentials -# name: "jamf-api-credentials" -# readOnly: true -#{{- end }} +{{- if contains "jamf" (.Values.roles | toString) }} + - mountPath: /etc/teleport-jamf-api-credentials + name: "jamf-api-credentials" + readOnly: true +{{- end }} {{- if .Values.extraVolumeMounts }} {{- toYaml .Values.extraVolumeMounts | nindent 8 }} {{- end }} @@ -254,11 +247,11 @@ spec: secret: secretName: {{ .Values.tls.existingCASecretName }} {{- end }} -#{{- if contains "jamf" (.Values.roles | toString) }} -# - name: "jamf-api-credentials" -# secret: -# secretName: {{ .Values.jamfCredentialsSecret.name }} -#{{- end }} +{{- if contains "jamf" (.Values.roles | toString) }} + - name: "jamf-api-credentials" + secret: + secretName: {{ .Values.jamfCredentialsSecret.name }} +{{- end }} {{- if .Values.extraVolumes }} {{- toYaml .Values.extraVolumes | nindent 6 }} {{- end }} diff --git a/helm/teleport-kube-agent/values.schema.json b/helm/teleport-kube-agent/values.schema.json index c289698..e189523 100644 --- a/helm/teleport-kube-agent/values.schema.json +++ b/helm/teleport-kube-agent/values.schema.json @@ -2,7 +2,6 @@ "$schema": "http://json-schema.org/draft-07/schema", "type": "object", "required": [ - "global", "proxyAddr", "roles", "joinParams", @@ -38,34 +37,9 @@ "initContainers", "resources", "tolerations", - "probeTimeoutSeconds", - "proxy", - "cluster" + "probeTimeoutSeconds" ], "properties": { - "global": { - "$id": "#/properties/global", - "type": "object", - "required": [ - "podSecurityStandards" - ], - "properties": { - "podSecurityStandards": { - "$id": "#/properties/global/properties/podSecurityStandards", - "type": "object", - "required": [ - "enforced" - ], - "properties": { - "enforced": { - "$id": "#/properties/global/properties/podSecurityStandards/properties/enforced", - "type": "boolean", - "default": false - } - } - } - } - }, "authToken": { "$id": "#/properties/authToken", "type": "string", @@ -368,19 +342,8 @@ }, "image": { "$id": "#/properties/image", - "type": "object", - "properties": { - "registry": { - "$id": "#/properties/image/registry", - "type": "string", - "default": "public.ecr.aws" - }, - "repository": { - "$id": "#/properties/image/repository", - "type": "string", - "default": "gravitational/teleport-distroless" - } - } + "type": "string", + "default": "public.ecr.aws/gravitational/teleport-distroless" }, "enterpriseImage": { "$id": "#/properties/enterpriseImage", @@ -395,7 +358,7 @@ "replicaCount": { "$id": "#/properties/replicaCount", "type": "integer", - "default": 2 + "default": 1 }, "clusterRoleName": { "$id": "#/properties/clusterRoleName", @@ -437,7 +400,7 @@ "enabled": { "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/enabled", "type": "boolean", - "default": true + "default": false }, "minAvailable": { "$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/minAvailable", @@ -790,7 +753,7 @@ "create": { "$id": "#/properties/jamfCredentialsSecret/create", "type": "boolean", - "default": false + "default": true }, "name": { "$id": "#/properties/jamfCredentialsSecret/name", @@ -814,41 +777,6 @@ "$id": "#/properties/jamfSecret", "type": "string", "default": "" - }, - "proxy": { - "$id": "#/properties/proxy", - "type": "object", - "properties": { - "http": { - "type": ["null", "string"] - }, - "https": { - "type": ["null", "string"] - }, - "noProxy": { - "type": ["null", "string"] - } - } - }, - "cluster": { - "$id": "#/properties/cluster", - "type": "object", - "properties": { - "proxy": { - "type": "object", - "properties": { - "http": { - "type": ["null", "string"] - }, - "https": { - "type": ["null", "string"] - }, - "noProxy": { - "type": ["null", "string"] - } - } - } - } } } } diff --git a/helm/teleport-kube-agent/values.yaml b/helm/teleport-kube-agent/values.yaml index 3ad205e..beb0d28 100644 --- a/helm/teleport-kube-agent/values.yaml +++ b/helm/teleport-kube-agent/values.yaml @@ -1,12 +1,7 @@ ################################################################ # Values that must always be provided by the user. ################################################################ -global: - podSecurityStandards: - enforced: false - image: - registry: "" # roles(string) -- is a comma-separated list of services which will be enabled # when running the `teleport-kube-agent` chart. # @@ -71,7 +66,7 @@ joinParams: # joinParams.method(string) -- controls which join method will be used by the # instance to join the Teleport cluster. # - # See [the join method reference](../../join-methods.mdx) for the list of possible + # See [the join method reference](../../reference/join-methods.mdx) for the list of possible # values, the implications of each join method, and guides to set up each method. # # Common join-methods for the `teleport-kube-agent` are: @@ -85,7 +80,7 @@ joinParams: # joinParams.tokenName(string) -- controls which token is used by the agent to # join the Teleport cluster. # - # When `joinParams.method` is [a delegated join method](../../join-methods.mdx#delegated-join-methods), + # When `joinParams.method` is [a delegated join method](../../reference/join-methods.mdx#delegated-join-methods), # the value is not sensitive. # # When `joinParams.method` is `token` (by default), `joinParams.tokenName` @@ -114,7 +109,7 @@ kubeClusterName: "" ################################################################ # apps(list) -- is a static list of applications that should be proxied by -# the agent. See [the Teleport Application access documentation](../../../enroll-resources/application-access/introduction.mdx) +# the agent. See [the Teleport Application access documentation](../../reference/agent-services/application-access.mdx#configuration) # for more details. # # Proxied applications can be defined statically (through this value) or dynamically @@ -139,13 +134,13 @@ kubeClusterName: "" # # You can see a list of all the supported values that can be used in a Teleport # Application Service configuration in the [Application Service Configuration -# Reference](../../../enroll-resources/application-access/reference.mdx#configuration). +# Reference](../../reference/agent-services/application-access.mdx#configuration). # apps: [] # appResources(list) -- is a set of labels the agent will monitor. Any application # matching those labels will be proxied by the agent. See [the Teleport -# Application access documentation](../../../enroll-resources/application-access/introduction.mdx) +# Application access documentation](../../enroll-resources/application-access/introduction.mdx) # for more details. # # Proxied applications can be defined statically (through [`apps`](#apps)) or @@ -164,7 +159,7 @@ apps: [] # # # Once `appResources` is set, you can dynamically register application with -# `tsh` by following [the Dynamic App Registration guide](../../../enroll-resources/application-access/guides/dynamic-registration.mdx). +# `tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/guides/dynamic-registration.mdx). # appResources: [] @@ -184,7 +179,7 @@ clusterDomain: "cluster.local" # awsDatabases(list) -- configures AWS database auto-discovery. # # -# For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport). +# For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport). # After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions: # # ```yaml @@ -224,7 +219,7 @@ awsDatabases: [] # azureDatabases(list) -- configures Azure database auto-discovery. # -# For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-35-configure-iam-permissions-for-teleport). +# For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-35-configure-iam-permissions-for-teleport). # # After configuring a service principal with appropriate IAM permissions, you must pass credentials to the pods. # The easiest way is to use an Azure client secret. @@ -296,7 +291,7 @@ awsDatabases: [] azureDatabases: [] # databases(list) -- is a static list of databases that should be proxied by -# the agent. See [the Teleport Database access documentation](../../../enroll-resources/database-access/database-access.mdx) +# the agent. See [the Teleport Database access documentation](../../enroll-resources/database-access/database-access.mdx) # for more details. # # Proxied applications can be defined statically (through this value) or dynamically @@ -325,7 +320,7 @@ azureDatabases: [] # ``` # # -# You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../../enroll-resources/database-access/reference/configuration.mdx). +# You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../reference/agent-services/database-access-reference/configuration.mdx). # # # @@ -360,7 +355,7 @@ databases: [] # databaseResources(list) -- is a set of labels the agent will monitor. # Any database matching those labels will be proxied by the agent. See [the Teleport # Database access -# documentation](../../../enroll-resources/database-access/database-access.mdx) +# documentation](../../enroll-resources/database-access/database-access.mdx) # for more details. # # Proxied databases can be defined statically (through [`databases`](#databases)) or @@ -380,7 +375,7 @@ databases: [] # # # Once `databaseResources` is set, you can dynamically register database with -# `tsh` by following [this guide](../../../enroll-resources/database-access/guides/dynamic-registration.mdx). +# `tsh` by following [this guide](../../enroll-resources/database-access/guides/dynamic-registration.mdx). # databaseResources: [] @@ -394,7 +389,7 @@ databaseResources: [] # The Discovery Service is enabled when the agent `roles` contains "discovery". # The Discovery service automatically detects Kubernetes Services and configures # the agent to provide access to them. See [the Kubernetes App Discovery -# documentation](../../../enroll-resources/auto-discovery/kubernetes-applications/architecture.mdx) +# documentation](../../reference/architecture/kubernetes-applications-architecture.mdx) # for more details. # # @@ -448,7 +443,7 @@ jamfCredentialsSecret: # Kubernetes `Secret` containing the Jamf Pro API Client Secret. # If false, you must create a Kubernetes Secret with the configured name in # the Helm release namespace. - create: false + create: true # jamfCredentialsSecret.name(string) -- is the name of the Kubernetes Secret # containing the Jamf Pro API Client Secret used by the chart. # @@ -520,7 +515,7 @@ caPin: [] # Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport # cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads. # -# One option might be to use Teleport's built-in [ACME support](../teleport-cluster.mdx#acme) or enable [cert-manager support](../teleport-cluster.mdx#highavailabilitycertmanager). +# One option might be to use Teleport's built-in [ACME support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable [cert-manager support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager). # insecureSkipProxyTLSVerify: false @@ -528,7 +523,7 @@ insecureSkipProxyTLSVerify: false # Teleport pods. The configuration will be merged with the chart-generated # configuration and will take precedence in case of conflict. # -# See the [Teleport Configuration Reference](../../config.mdx) for the list of supported fields. +# See the [Teleport Configuration Reference](../../reference/config.mdx) for the list of supported fields. # # ```yaml # teleportConfig: @@ -709,7 +704,7 @@ podSecurityPolicy: # and replaced since 1.23 by PodSecurityAdmission (PSA). If you are running on # Kubernetes 1.23 or later, it is recommended to disable PSPs and use PSAs. # The steps are documented in the - # [PSP removal guide](../../../deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx). + # [PSP removal guide](../../admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx). # # This value will be removed in a future chart version. enabled: true @@ -730,7 +725,7 @@ podSecurityPolicy: # To set labels for applications, add a `labels` element to the [`apps`](#apps) section. # To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section. # -# For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../../management/admin/labels.mdx). +# For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../admin-guides/management/admin/labels.mdx). # # # For example: @@ -771,7 +766,7 @@ highAvailability: # (via [`authToken`](#authToken), [`joinParams`](#joinParams), or [`joinTokenSecret`](#joinTokenSecret)) # is still valid. Each replica has its own identity and needs to join the Teleport # cluster on its first startup. - replicaCount: 3 + replicaCount: 1 # highAvailability.requireAntiAffinity(bool) -- configures Kubernetes `requiredDuringSchedulingIgnoredDuringExecution` # to require that multiple Teleport pods must not be scheduled on the same physical host. @@ -796,7 +791,7 @@ highAvailability: podDisruptionBudget: # highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create # a Kubernetes PodDisruptionBudget for the agent pods. - enabled: true + enabled: false # highAvailability.podDisruptionBudget.minAvailable(int) -- is the minimum # available pod specified on the PodDisruptionBudget. @@ -893,9 +888,8 @@ adminClusterRoleBinding: # This setting only takes effect when [`enterprise`](#enterprise) is `false`. # When running an enterprise version, you must use # [`enterpriseImage`](#enterpriseImage) instead. -image: - registry: ®istry gsoci.azurecr.io - repository: giantswarm/teleport-distroless +image: public.ecr.aws/gravitational/teleport-distroless + # enterpriseImage(string) -- sets the container image used for Teleport Enterprise # agent pods created by the chart. # @@ -1059,7 +1053,7 @@ log: format: text # log.extraFields(list) -- sets the fields used in logging for the Teleport process. # - # See the [Teleport config file reference](../../config.mdx) for + # See the [Teleport config file reference](../../reference/config.mdx) for # more details on possible values for `extra_fields`. extraFields: ["timestamp", "level", "component", "caller"] @@ -1070,22 +1064,7 @@ log: # affinity(object) -- sets the affinities for any pods created by the chart. # See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) # for more details. -affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - weight: 100 - podAffinityTerm: - labelSelector: - matchLabels: - app: teleport-kube-agent - topologyKey: "kubernetes.io/hostname" - nodeAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - preference: - matchExpressions: - - key: node-role.kubernetes.io/control-plane - operator: Exists - weight: 10 +affinity: {} # dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods. # This value is useful if you need to reduce the DNS load: set "ndots" to 0 and @@ -1141,7 +1120,7 @@ extraLabels: # extraLabels.job(object) -- are labels to set on the post-delete Job created by the chart. job: {} # extraLabels.pod(object) -- are labels to set on the Pods created by the - # Deployment or StatefulSet. + # Deployment, StatefulSet, or Job. pod: {} # extraLabels.podDisruptionBudget(object) -- are labels to set on the podDisruptionBudget. podDisruptionBudget: {} @@ -1319,8 +1298,6 @@ securityContext: # To unset the security context, set it to `null` or `~`. podSecurityContext: fsGroup: 9807 - seccompProfile: - type: RuntimeDefault # priorityClassName(string) -- sets the priority class used by any pods created by the chart. # The user is responsible for creating the `PriorityClass` resource before deploying the chart. @@ -1328,26 +1305,11 @@ podSecurityContext: # for more details. priorityClassName: "" -tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/control-plane - - effect: NoSchedule - key: node.cluster.x-k8s.io/uninitialized - operator: "Exists" +# tolerations(list) -- sets the tolerations for any pods created by the chart. +# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) +# for more details. +tolerations: [] # probeTimeoutSeconds(int) -- sets the timeout for the readiness and liveness probes # https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/ probeTimeoutSeconds: 1 - -# set the HTTP_PROXY, HTTPS_PROXY and NO_PROXY variable -proxy: - noProxy: - http: - https: -cluster: - # is getting overwritten by the top level proxy if set - # These values are generated via cluster-apps-operator - proxy: - noProxy: - http: - https: diff --git a/vendir.lock.yml b/vendir.lock.yml index f2f421c..e9c50aa 100644 --- a/vendir.lock.yml +++ b/vendir.lock.yml @@ -2,8 +2,8 @@ apiVersion: vendir.k14s.io/v1alpha1 directories: - contents: - helmChart: - appVersion: 16.1.7 - version: 16.1.7 + appVersion: 16.4.2 + version: 16.4.2 path: teleport-kube-agent path: helm kind: LockConfig diff --git a/vendir.yml b/vendir.yml index f28769e..67f3f9c 100644 --- a/vendir.yml +++ b/vendir.yml @@ -6,7 +6,7 @@ directories: - path: teleport-kube-agent helmChart: name: "teleport-kube-agent" - version: "16.1.7" + version: "16.4.2" repository: url: https://charts.releases.teleport.dev newRootPath: .