diff --git a/templates/helm/templates/_helpers.tpl b/templates/helm/templates/_helpers.tpl index 29265d70..973704c1 100644 --- a/templates/helm/templates/_helpers.tpl +++ b/templates/helm/templates/_helpers.tpl @@ -36,3 +36,13 @@ If release name contains chart name it will be used as a full name. {{- .Release.Namespace -}} {{- end -}} {{- end -}} + +{{/* The mount path for the shared credentials file */}} +{{- define "aws.credentials.secret_mount_path" -}} +{{- "/var/run/secrets/aws" -}} +{{- end -}} + +{{/* The path the shared credentials file is mounted */}} +{{- define "aws.credentials.path" -}} +{{- printf "%s/%s" (include "aws.credentials.secret_mount_path" .) .Values.aws.credentials.secretKey -}} +{{- end -}} diff --git a/templates/helm/templates/deployment.yaml b/templates/helm/templates/deployment.yaml index d3a307a7..9fd82f76 100644 --- a/templates/helm/templates/deployment.yaml +++ b/templates/helm/templates/deployment.yaml @@ -80,6 +80,16 @@ spec: value: {{ .Values.log.level | quote }} - name: ACK_RESOURCE_TAGS value: {{ join "," .Values.resourceTags | quote }} + {{- if .Values.aws.credentials.secretName }} + - name: AWS_SHARED_CREDENTIALS_FILE + value: {{ include "aws.credentials.path" . }} + - name: AWS_PROFILE + value: {{ .Values.aws.credentials.profile }} + volumeMounts: + - name: {{ .Values.aws.credentials.secretName }} + mountPath: {{ include "aws.credentials.secret_mount_path" . }} + readOnly: true + {{- end }} securityContext: allowPrivilegeEscalation: false privileged: false @@ -101,3 +111,9 @@ spec: hostIPC: false hostNetwork: false hostPID: false + {{ if .Values.aws.credentials.secretName -}} + volumes: + - name: {{ .Values.aws.credentials.secretName }} + secret: + secretName: {{ .Values.aws.credentials.secretName }} + {{ end -}} diff --git a/templates/helm/values.schema.json b/templates/helm/values.schema.json index e5032484..c80422e6 100644 --- a/templates/helm/values.schema.json +++ b/templates/helm/values.schema.json @@ -153,6 +153,21 @@ }, "endpoint": { "type": "string" + }, + "credentials": { + "description": "AWS credentials information", + "properties": { + "secretName": { + "type": "string" + }, + "secretKey": { + "type": "string" + }, + "profile": { + "type": "string" + } + }, + "type": "object" } }, "type": "object" diff --git a/templates/helm/values.yaml.tpl b/templates/helm/values.yaml.tpl index 90bb7d9c..ad7be8cc 100644 --- a/templates/helm/values.yaml.tpl +++ b/templates/helm/values.yaml.tpl @@ -50,6 +50,13 @@ aws: # If specified, use the AWS region for AWS API calls region: "" endpoint_url: "" + credentials: + # If specified, Secret with shared credentials file to use. + secretName: "" + # Secret stringData key that contains the credentials + secretKey: "credentials" + # Profile used for AWS credentials + profile: "default" # log level for the controller log: