Initial commit of amazon-eks-pod-identity-webhook (#1)

.github/workflows/lint-test.yaml

@@ -33,7 +33,6 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         with:
           version: v0.12.0
-          kubectl_version: v1.23.5
 
       - name: Run chart-testing (install)
-        run: ct install --config charts/ct.yaml --excluded-charts keycloak-config-cli
+        run: ct install --debug --config charts/ct.yaml --excluded-charts amazon-eks-pod-identity-webhook,keycloak-config-cli

.gitignore

@@ -0,0 +1,3 @@
+.idea
+charts/*/charts/*.tgz
+*.iml

charts/amazon-eks-pod-identity-webhook/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/amazon-eks-pod-identity-webhook/Chart.yaml

@@ -0,0 +1,10 @@
+apiVersion: v2
+name: amazon-eks-pod-identity-webhook
+description: A Kubernetes webhook for pods that need AWS IAM access
+version: 0.1.0
+type: application
+appVersion: "v0.4.0"
+maintainers:
+  - name: jkroepke
+    email: [email protected]
+    url: https://github.com/jkroepke

charts/amazon-eks-pod-identity-webhook/examples/without-cert-manager.yaml

@@ -0,0 +1,82 @@
+pki:
+  certManager:
+    enabled: false
+
+  caBundle: |
+    -----BEGIN CERTIFICATE-----
+    MIID0TCCArmgAwIBAgIRAK7lo9vNaBdCxqZgWIBF6VwwDQYJKoZIhvcNAQELBQAw
+    NjE0MDIGA1UEAxMrYW1hem9uLWVrcy1wb2QtaWRlbnRpdHktd2ViaG9vay5kZWZh
+    dWx0LnN2YzAeFw0yMjAzMzEyMDUwNTNaFw0yMjA2MjkyMDUwNTNaMDYxNDAyBgNV
+    BAMTK2FtYXpvbi1la3MtcG9kLWlkZW50aXR5LXdlYmhvb2suZGVmYXVsdC5zdmMw
+    ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCSsPOw7WZT/bPwCjLc75h6
+    ki6R5gh5jqd34dyild1GD9eMsn5lXDJDJRa+eSboONWGPOhNz5d075TX19m2sTqV
+    DGmKfKaFP9s3Q+tU7EwrAAGVuYvlNbhKrq66S7HcvDSyTyyjNpxqMyKl0FFNzNC0
+    6nx5pObtaTRvijmpyuxzjPpLvCxZx8K/qDBZRoLCzs2sKHYUqQoYBQu/FxGOYL5O
+    C83h5/d6fP29/miBEHuy+onTsT0plIqmjr5tsk+z6oGu0bdQ8b6iZpMUR/TfxMg/
+    jBxDLMMx0w+X99H0WER7RKd1bcJOts+zDIG2VfumkVeNUIlcG1k2J4INzBaXgzeH
+    AgMBAAGjgdkwgdYwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwgbUGA1Ud
+    EQSBrTCBqoIfYW1hem9uLWVrcy1wb2QtaWRlbnRpdHktd2ViaG9va4InYW1hem9u
+    LWVrcy1wb2QtaWRlbnRpdHktd2ViaG9vay5kZWZhdWx0githbWF6b24tZWtzLXBv
+    ZC1pZGVudGl0eS13ZWJob29rLmRlZmF1bHQuc3ZjgjFhbWF6b24tZWtzLXBvZC1p
+    ZGVudGl0eS13ZWJob29rLmRlZmF1bHQuc3ZjLmxvY2FsMA0GCSqGSIb3DQEBCwUA
+    A4IBAQAu4QOVyuyrtEopyhE6ngxb384feymJa3pLLUg52v/QNNqs8wkjZ5PofHO4
+    ieKLGcco797mk3g0ACTG2ne3YHI3GVXMNzqjNlyhoy8rX0aCdz/dBhxYqMOz75u/
+    z7N3UQ9pCKLKDS2pl7ce3TlCX9yZag93rv1MVR4ZbEFNx8Lw35BQ+fr/zB6deCwE
+    kSiEU1cZOVq4pGCq09GrO7DRgOsp+pbNukpR2Bxg9dy/DMpgYiKrZxi9cxMWtc36
+    /xUUuh4lvM3okNFn3gul+X7ts63bk1UurXDuxuxaFCCSYp+eaHV6PSewFp34pFQp
+    4uzkGeuK9kN0uge6DOAe25/ZHVc4
+    -----END CERTIFICATE-----
+  cert: |
+    -----BEGIN CERTIFICATE-----
+    MIID0TCCArmgAwIBAgIRAK7lo9vNaBdCxqZgWIBF6VwwDQYJKoZIhvcNAQELBQAw
+    NjE0MDIGA1UEAxMrYW1hem9uLWVrcy1wb2QtaWRlbnRpdHktd2ViaG9vay5kZWZh
+    dWx0LnN2YzAeFw0yMjAzMzEyMDUwNTNaFw0yMjA2MjkyMDUwNTNaMDYxNDAyBgNV
+    BAMTK2FtYXpvbi1la3MtcG9kLWlkZW50aXR5LXdlYmhvb2suZGVmYXVsdC5zdmMw
+    ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCSsPOw7WZT/bPwCjLc75h6
+    ki6R5gh5jqd34dyild1GD9eMsn5lXDJDJRa+eSboONWGPOhNz5d075TX19m2sTqV
+    DGmKfKaFP9s3Q+tU7EwrAAGVuYvlNbhKrq66S7HcvDSyTyyjNpxqMyKl0FFNzNC0
+    6nx5pObtaTRvijmpyuxzjPpLvCxZx8K/qDBZRoLCzs2sKHYUqQoYBQu/FxGOYL5O
+    C83h5/d6fP29/miBEHuy+onTsT0plIqmjr5tsk+z6oGu0bdQ8b6iZpMUR/TfxMg/
+    jBxDLMMx0w+X99H0WER7RKd1bcJOts+zDIG2VfumkVeNUIlcG1k2J4INzBaXgzeH
+    AgMBAAGjgdkwgdYwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwgbUGA1Ud
+    EQSBrTCBqoIfYW1hem9uLWVrcy1wb2QtaWRlbnRpdHktd2ViaG9va4InYW1hem9u
+    LWVrcy1wb2QtaWRlbnRpdHktd2ViaG9vay5kZWZhdWx0githbWF6b24tZWtzLXBv
+    ZC1pZGVudGl0eS13ZWJob29rLmRlZmF1bHQuc3ZjgjFhbWF6b24tZWtzLXBvZC1p
+    ZGVudGl0eS13ZWJob29rLmRlZmF1bHQuc3ZjLmxvY2FsMA0GCSqGSIb3DQEBCwUA
+    A4IBAQAu4QOVyuyrtEopyhE6ngxb384feymJa3pLLUg52v/QNNqs8wkjZ5PofHO4
+    ieKLGcco797mk3g0ACTG2ne3YHI3GVXMNzqjNlyhoy8rX0aCdz/dBhxYqMOz75u/
+    z7N3UQ9pCKLKDS2pl7ce3TlCX9yZag93rv1MVR4ZbEFNx8Lw35BQ+fr/zB6deCwE
+    kSiEU1cZOVq4pGCq09GrO7DRgOsp+pbNukpR2Bxg9dy/DMpgYiKrZxi9cxMWtc36
+    /xUUuh4lvM3okNFn3gul+X7ts63bk1UurXDuxuxaFCCSYp+eaHV6PSewFp34pFQp
+    4uzkGeuK9kN0uge6DOAe25/ZHVc4
+    -----END CERTIFICATE-----
+
+  key: |-
+    -----BEGIN RSA PRIVATE KEY-----
+    MIIEogIBAAKCAQEAkrDzsO1mU/2z8Aoy3O+YepIukeYIeY6nd+HcopXdRg/XjLJ+
+    ZVwyQyUWvnkm6DjVhjzoTc+XdO+U19fZtrE6lQxpinymhT/bN0PrVOxMKwABlbmL
+    5TW4Sq6uukux3Lw0sk8sozacajMipdBRTczQtOp8eaTm7Wk0b4o5qcrsc4z6S7ws
+    WcfCv6gwWUaCws7NrCh2FKkKGAULvxcRjmC+TgvN4ef3enz9vf5ogRB7svqJ07E9
+    KZSKpo6+bbJPs+qBrtG3UPG+omaTFEf038TIP4wcQyzDMdMPl/fR9FhEe0SndW3C
+    TrbPswyBtlX7ppFXjVCJXBtZNieCDcwWl4M3hwIDAQABAoIBAEdtIAuLXOMSypXb
+    8W5Av+cW3NQvxPqjaonmEU+dV1PxDMy2cPMb1GF7Yrq2NSqn2dh2OcsBhMbsjXYX
+    5Sue2l6O36kODusc77nWOXVtZZ0ecKcd5K9j2+uJaQzPJLjNb39PK/YA9mKDqaBB
+    cgVG8GzXLGryz3rUWjLhhDhX1ZBhXRrE94yDfc3H9W58dyZ6o/l9mX930pc6YS6G
+    ca31OsWJyJAzWnAAcJZ0x4qd5VodXtf9alVRF+/0NDxzuoVjMtSlikXtJVP+cXxw
+    nVM/8dTXi25vckDehsOYSPk0+mLsaAT1NxLxWtaMIh41/ZiEKz4TatsqpD+U9x9Z
+    Z5EHjokCgYEAwV6k1qd5pMc737TMRwOfEk/1nuLvM9tyvngdAiO50PH8cDAzgQyF
+    Q6KXPsz2W4vfESPVSTjrLCgioFRxKbxxRv272m9ASECiAA09WwPw6vf47gThLO7j
+    FrwtqKN2t1gjSEs2esAMK4Z3+T+1p4r2natPVKISTdUNPm76MDksuT0CgYEAwjPv
+    hHiDGAgd3PUJ0dQkdPabgf8qr65T/08lgeZZTCUkkXI7qmETqfmaHuLieZ4UlrAA
+    YzxbUWi4iV4kcdc9/aKaJsFeMmI4DTlrtHhEvuSNcUcnItV7lE5Q2fio+zI0uNXc
+    BHcmVMEIh8VM26H41GsuUvErLx/72I1Vx4Le2BMCgYAKVrUZhPrMBJr+6vvBEECB
+    CiVnyVpgu2r3JBTo+GAG++kzVmBqlfDKHPdZNDw3yNK0Z+YPdCuewMaZK+qhAKJN
+    2WMh2rDlLA99UTfmld9bsMZuc3RWoq8hmA4Y5iSCyQOZ6euPxJTh/t6LRQzBWHy3
+    EWG8dK3l225J2EUoLuZlQQKBgBy81rrBopSRzul9kUBtph9wxr5L5iMtJtzm92Pr
+    lFdCP9EOGGo0B1blyrq7VEwu6lkKHmSQ7+pyFqytM7Ns6I153FnTz36hLi42ywtf
+    qLye0Zdrsgzjjm/5ztkShN73JPodG3vFrfRoxDxjI+Z0Z3/3hFldusg0cW4wK/tk
+    EFnlAoGAegTcZDBpuCzipWT86WrzOteW43+59Go0EafB8WOjBv3Ehxfhw8ZVBZeM
+    tx8s/MxfsaQ7Od56fGK6HiXx9rPiOFFBtQCxQEtNfbOUAf25fGQ6j3YXaqnFslL+
+    SqazraQU+FuqPd9jD+aGKXSzXA7CQpA+93eU1zsdwXD3qE6h+TI=
+    -----END RSA PRIVATE KEY-----
+

charts/amazon-eks-pod-identity-webhook/templates/_helpers.tpl

@@ -0,0 +1,73 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.labels" -}}
+helm.sh/chart: {{ include "amazon-eks-pod-identity-webhook.chart" . }}
+{{ include "amazon-eks-pod-identity-webhook.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "amazon-eks-pod-identity-webhook.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "amazon-eks-pod-identity-webhook.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "amazon-eks-pod-identity-webhook.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/amazon-eks-pod-identity-webhook/templates/certificate.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.pki.certManager.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+  namespace: {{ include "amazon-eks-pod-identity-webhook.namespace" . }}
+spec:
+  secretName: "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}-cert"
+  commonName: "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}.{{ include "amazon-eks-pod-identity-webhook.namespace" . }}.svc"
+  dnsNames:
+    - "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}"
+    - "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}.{{ include "amazon-eks-pod-identity-webhook.namespace" . }}"
+    - "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}.{{ include "amazon-eks-pod-identity-webhook.namespace" . }}.svc"
+    - "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}.{{ include "amazon-eks-pod-identity-webhook.namespace" . }}.svc.local"
+  duration: "{{ .Values.pki.certManager.certificate.duration }}"
+  renewBefore: "{{ .Values.pki.certManager.certificate.renewBefore }}"
+  issuerRef:
+    {{- if .Values.pki.certManager.existingIssuer.enabled }}
+    name: {{ .Values.pki.certManager.existingIssuer.name }}
+    kind: {{ .Values.pki.certManager.existingIssuer.kind }}
+    {{- else }}
+    name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+    kind: Issuer
+    {{- end }}
+{{- end }}

charts/amazon-eks-pod-identity-webhook/templates/clusterrole.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+  labels:
+    {{- include "amazon-eks-pod-identity-webhook.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - serviceaccounts
+    verbs:
+      - get
+      - watch
+      - list

charts/amazon-eks-pod-identity-webhook/templates/clusterrolebinding.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+  labels:
+    {{- include "amazon-eks-pod-identity-webhook.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+    namespace: {{ include "amazon-eks-pod-identity-webhook.namespace" . }}

charts/amazon-eks-pod-identity-webhook/templates/deployment.yaml

@@ -0,0 +1,89 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  {{- with .Values.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+  namespace: {{ include "amazon-eks-pod-identity-webhook.namespace" . }}
+  labels:
+    {{- include "amazon-eks-pod-identity-webhook.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      {{- include "amazon-eks-pod-identity-webhook.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "amazon-eks-pod-identity-webhook.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "amazon-eks-pod-identity-webhook.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - /webhook
+            - --in-cluster=false
+            - --annotation-prefix={{ .Values.config.annotationPrefix }}
+            - --token-audience={{ .Values.config.tokenAudience }}
+            - --sts-regional-endpoint=true
+            - --port={{ .Values.config.ports.webhook }}
+            - --metrics-port={{ .Values.config.ports.metrics }}
+            - --aws-default-region={{ .Values.config.defaultAwsRegion }}
+            - --logtostderr
+            {{- if .Values.config.extraArgs }}
+            {{- toYaml .Values.config.extraArgs | nindent 12 }}
+            {{- end }}
+          volumeMounts:
+            - name: cert
+              mountPath: "/etc/webhook/certs"
+              readOnly: true
+          ports:
+            - name: https
+              containerPort: {{ .Values.config.ports.webhook }}
+              protocol: TCP
+            - name: metrics
+              containerPort: {{ .Values.config.ports.metrics }}
+              protocol: TCP
+          livenessProbe:
+            {{- toYaml .Values.livenessProbe | nindent 12 }}
+          readinessProbe:
+            {{- toYaml .Values.readinessProbe | nindent 12 }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: cert
+          secret:
+            {{- if .Values.pki.existingSecret }}
+            secretName: {{ .Values.pki.existingSecret | quote }}
+            {{- else }}
+            secretName: "{{ include "amazon-eks-pod-identity-webhook.fullname" . }}-cert"
+            {{- end }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/amazon-eks-pod-identity-webhook/templates/issuer.yaml

@@ -0,0 +1,12 @@
+---
+{{- if and .Values.pki.certManager.enabled (not .Values.pki.certManager.existingIssuer.enabled) }}
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "amazon-eks-pod-identity-webhook.fullname" . }}
+  namespace: {{ include "amazon-eks-pod-identity-webhook.namespace" . }}
+  labels:
+    {{- include "amazon-eks-pod-identity-webhook.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+{{- end }}