Merge pull request #289 from timuthy/enhancement.validator-kubeconfig

Add support for projected volume kubeconfig
gardener · Aug 16, 2023 · 13d7454 · 13d7454
2 parents 92c55b6 + aa839dd
commit 13d7454
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml b/charts/gardener-extension-admission-calico/charts/runtime/templates/deplyoment.yaml
@@ -49,6 +49,9 @@ spec:
         {{- if .Values.global.kubeconfig }}
         - --kubeconfig=/etc/gardener-extension-admission-calico/kubeconfig/kubeconfig
         {{- end }}
+        {{- if .Values.global.projectedKubeconfig }}
+        - --kubeconfig={{ required ".Values.global.projectedKubeconfig.baseMountPath is required" .Values.global.projectedKubeconfig.baseMountPath }}/kubeconfig
+        {{- end }}
         - --health-bind-address=:{{ .Values.global.healthPort }}
         ports:
         - name: webhook-server
@@ -85,6 +88,11 @@ spec:
           mountPath: /var/run/secrets/projected/serviceaccount
           readOnly: true
         {{- end }}
+        {{- if .Values.global.projectedKubeconfig }}
+        - name: kubeconfig
+          mountPath: {{ required ".Values.global.projectedKubeconfig.baseMountPath is required" .Values.global.projectedKubeconfig.baseMountPath }}
+          readOnly: true
+        {{- end }}
       volumes:
       - name: gardener-extension-admission-calico-cert
         secret:
@@ -107,3 +115,21 @@ spec:
               audience: {{ .Values.global.serviceAccountTokenVolumeProjection.audience }}
               {{- end }}
       {{- end }}
+      {{- if .Values.global.projectedKubeconfig }}
+      - name: kubeconfig
+        projected:
+          defaultMode: 420
+          sources:
+          - secret:
+              items:
+              - key: kubeconfig
+                path: kubeconfig
+              name: {{ required ".Values.global.projectedKubeconfig.genericKubeconfigSecretName is required" .Values.global.projectedKubeconfig.genericKubeconfigSecretName }}
+              optional: false
+          - secret:
+              items:
+              - key: token
+                path: token
+              name: {{ required ".Values.global.projectedKubeconfig.tokenSecretName is required" .Values.global.projectedKubeconfig.tokenSecretName }}
+              optional: false
+      {{- end }}
diff --git a/charts/gardener-extension-admission-calico/values.yaml b/charts/gardener-extension-admission-calico/values.yaml
@@ -40,6 +40,11 @@ global:
   # Kubeconfig to the target cluster. In-cluster configuration will be used if not specified.
   kubeconfig:
 
+# projectedKubeconfig:
+#   baseMountPath: /var/run/secrets/gardener.cloud
+#   genericKubeconfigSecretName: generic-token-kubeconfig
+#   tokenSecretName: access-calico-admission
+
   serviceAccountTokenVolumeProjection:
     enabled: false
     expirationSeconds: 43200