feat(helm): add kubernetes access account token projection support

gravitee-io · Jan 31, 2025 · 37f86d6 · 37f86d6
1 parent e435fd0
commit 37f86d6
Show file tree

Hide file tree

Showing 8 changed files with 138 additions and 2 deletions.
diff --git a/helm/CHANGELOG.md b/helm/CHANGELOG.md
@@ -3,6 +3,10 @@
 
 This file documents all notable changes to [Gravitee.io API Management 3.x](https://github.com/gravitee-io/helm-charts/tree/master/apim/3.x) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
 
+### 4.4.19
+
+- add kubernetes access account token projection support
+
 ### 4.4.16
 
 - Improve HPA by allowing custom annotation, custom metrics and define the behavior spec (APIM-8186)

diff --git a/helm/Chart.yaml b/helm/Chart.yaml
@@ -23,4 +23,9 @@ annotations:
   ###########
   # "changes" must be the last section in this file, because a CI job clean it after each release
   ###########
-  artifacthub.io/changes: 
+  artifacthub.io/changes: |
+    - kind: added
+      description: 'Add support of the kubernetes service account token projection'
+      links:
+        - name: Github Issue
+          url: https://github.com/gravitee-io/issues/issues/10225
diff --git a/helm/templates/api/api-deployment.yaml b/helm/templates/api/api-deployment.yaml
@@ -149,6 +149,16 @@ spec:
               containerPort: {{ .Values.api.services.bridge.service.internalPort }}
             {{- end }}
           env:
+            {{- if .Values.apim.kubernetes }}
+            {{- with .Values.apim.kubernetes.projection }}
+            {{- if .enabled }}
+            - name: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PROJECTION_ENABLED
+              value: 'true'
+            - name: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH
+              value: '/var/run/secrets/tokens/vault-token'
+            {{- end }}
+            {{- end }}
+            {{- end }}
             {{- if $plugins }}
             - name: GRAVITEE_PLUGINS_PATH_0
               value: '${gravitee.home}/plugins'
@@ -222,6 +232,14 @@ spec:
 
           resources: {{ toYaml .Values.api.resources | nindent 12 }}
           volumeMounts:
+          {{- if .Values.apim.kubernetes }}
+          {{- with .Values.apim.kubernetes.projection }}
+          {{- if .enabled }}
+            - name: vault-token
+              mountPath: /var/run/secrets/tokens
+          {{- end }}
+          {{- end }}
+          {{- end }}
             - name: config
               mountPath: /opt/graviteeio-management-api/config/gravitee.yml
               subPath: gravitee.yml
@@ -275,6 +293,19 @@ spec:
         - name: {{ .Values.api.image.pullSecrets }}
       {{- end }}
       volumes:
+        {{- if .Values.apim.kubernetes }}
+        {{- with .Values.apim.kubernetes.projection }}
+        {{- if .enabled }}
+        - name: vault-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  path: vault-token
+                  expirationSeconds: {{ .expirationSeconds }}
+                  audience: {{ .audience }}
+        {{- end }}
+        {{- end }}
+        {{- end }}
         {{- if not (include "api.externalConfig" .) }}
         - name: config
           configMap:

diff --git a/helm/templates/gateway/gateway-deployment.yaml b/helm/templates/gateway/gateway-deployment.yaml
@@ -152,6 +152,16 @@ spec:
             - name: GRAVITEE_PLUGINS_PATH_1
               value: '${gravitee.home}/plugins-ext'
             {{- end }}
+            {{- if .Values.apim.kubernetes }}
+            {{- with .Values.apim.kubernetes.projection }}
+            {{- if .enabled }}
+            - name: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PROJECTION_ENABLED
+              value: 'true'
+            - name: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH
+              value: '/var/run/secrets/tokens/vault-token'
+            {{- end }}
+            {{- end }}
+            {{- end }}
 {{- if .Values.gateway.env | default .Values.gateway.deployment.extraEnvs }}
 {{ toYaml ( .Values.gateway.env | default .Values.gateway.deployment.extraEnvs ) | indent 12 }}
 {{- end }}
@@ -226,6 +236,14 @@ spec:
           {{- end }}
           resources: {{ toYaml .Values.gateway.resources | nindent 12 }}
           volumeMounts:
+          {{- if .Values.apim.kubernetes }}
+          {{- with .Values.apim.kubernetes.projection }}
+          {{- if .enabled }}
+            - name: vault-token
+              mountPath: /var/run/secrets/tokens
+          {{- end }}
+          {{- end }}
+          {{- end }}
             - name: config
               mountPath: /opt/graviteeio-gateway/config/gravitee.yml
               subPath: gravitee.yml
@@ -259,6 +277,19 @@ spec:
         - name: {{ .Values.gateway.image.pullSecrets }}
       {{- end }}
       volumes:
+        {{- if .Values.apim.kubernetes }}
+        {{- with .Values.apim.kubernetes.projection }}
+        {{- if .enabled }}
+        - name: vault-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  path: vault-token
+                  expirationSeconds: {{ .expirationSeconds }}
+                  audience: {{ .audience }}
+        {{- end }}
+        {{- end }}
+        {{- end }}
         {{- if not (include "gateway.externalConfig" .) }}
         - name: config
           configMap:

diff --git a/helm/tests/api/deployment_test.yaml b/helm/tests/api/deployment_test.yaml
@@ -272,3 +272,32 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].securityContext.runAsNonRoot
           value: true
+
+  - it: kubernetes service account projection enabled tests
+    template: api/api-deployment.yaml
+    set:
+      apim:
+        kubernetes:
+          projection:
+            enabled: true
+            expirationSeconds: 600
+            audience: all
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PROJECTION_ENABLED
+      - equal:
+          path: spec.template.spec.containers[0].env[0].value
+          value: 'true'
+      - equal:
+          path: spec.template.spec.containers[0].env[1].name
+          value: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH
+      - equal:
+          path: spec.template.spec.containers[0].env[1].value
+          value: '/var/run/secrets/tokens/vault-token'
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: vault-token
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: vault-token
diff --git a/helm/tests/gateway/deployment_test.yaml b/helm/tests/gateway/deployment_test.yaml
@@ -314,3 +314,33 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].ports[1].containerPort
           value: 9090
+
+  - it: kubernetes service account projection enabled tests
+    template: gateway/gateway-deployment.yaml
+    set:
+      apim:
+        kubernetes:
+          projection:
+            enabled: true
+            expirationSeconds: 600
+            audience: all
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].env[0].name
+          value: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PROJECTION_ENABLED
+      - equal:
+          path: spec.template.spec.containers[0].env[0].value
+          value: 'true'
+      - equal:
+          path: spec.template.spec.containers[0].env[1].name
+          value: KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH
+      - equal:
+          path: spec.template.spec.containers[0].env[1].value
+          value: '/var/run/secrets/tokens/vault-token'
+      - equal:
+          path: spec.template.spec.volumes[0].name
+          value: vault-token
+      - equal:
+          path: spec.template.spec.containers[0].volumeMounts[0].name
+          value: vault-token
+
diff --git a/helm/values.yaml b/helm/values.yaml
@@ -75,6 +75,12 @@ apim:
   # Only Gateway will be deployed to the cluster in DB less mode
   dbLess: false
 
+  kubernetes:
+    projection:
+      enabled: false
+      expirationSeconds: 2592000
+      audience: vault
+
 chaos:
   enabled: false
 

diff --git a/pom.xml b/pom.xml
@@ -68,7 +68,7 @@
         <gravitee-gateway-api.version>3.5.3</gravitee-gateway-api.version>
         <gravitee-integration-api.version>1.1.0</gravitee-integration-api.version>
         <gravitee-node.version>6.0.10</gravitee-node.version>
-        <gravitee-kubernetes.version>3.4.2</gravitee-kubernetes.version>
+        <gravitee-kubernetes.version>3.4.3</gravitee-kubernetes.version>
         <gravitee-notifier-api.version>1.4.3</gravitee-notifier-api.version>
         <gravitee-plugin.version>3.1.1</gravitee-plugin.version>
         <gravitee-platform-repository-api.version>1.3.0</gravitee-platform-repository-api.version>