Charts: [bitnami/redis]: redis-password volume to be made optional if mounting the volume from vault agent injector using podAnnotations

Created on 7 Nov 2020  路  1Comment  路  Source: bitnami/charts

Which chart:
bitnami/redis-11.0.5

Is your feature request related to a problem? Please describe.

We are mounting the volume from the podAnnotations using below snippet in values.yaml:

redis:
  image:
    repository: bitnami/redis
    tag: 6.0-debian-10
  usePassword: true
  cluster:
    enabled: false
  usePasswordFile: true
  existingSecret: redis-password-file
  master:
    podAnnotations: 
      vault.hashicorp.com/agent-init-first: "true"
      vault.hashicorp.com/agent-inject: "true"
      vault.hashicorp.com/agent-pre-populate-only: "true"
      vault.hashicorp.com/tls-skip-verify: "true"
      vault.hashicorp.com/auth-path: "auth/kube"
      vault.hashicorp.com/role: "project_<PRJ>_dev_read"
      vault.hashicorp.com/agent-inject-secret-redis-password: "secret/projects/<PRJ>/dev"
      vault.hashicorp.com/secret-volume-path-redis-password: "/opt/bitnami/redis/secrets"
      vault.hashicorp.com/agent-inject-template-redis-password: | 
        {{- with secret "secret/projects/<PRJ>/dev/secrets/" -}}
        {{ .Data.data.REDIS_PASSWORD }}
        {{- end -}}

Describe the solution you'd like
Is it feasible to provide an option where if we need to inject secret from hashicorp vault using podAnnotations and mount the volume, then the below could be made optional:-

redis-master-statefulset.yaml / redis-slave-statefulset.yaml

          volumeMounts:
            - name: start-scripts
            {{- if .Values.usePasswordFile }}
            - name: redis-password
              mountPath: /opt/bitnami/redis/secrets/
            {{- end }}

      volumes:
        {{- if .Values.usePasswordFile }}
        - name: redis-password
          secret:
            secretName: {{ template "redis.secretName" . }}
            items:
            - key: {{ template "redis.secretPasswordKey" . }}
              path: redis-password
        {{- end }}

Describe alternatives you've considered
So we had to kustomize the redis-master-statefulset.yaml using the below patch to remove the volumeMounts and volumes:-

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
bases:
- ../../base
- target:
    group: apps
    version: v1
    kind: StatefulSet
    name: askc-redis-master
  patch: |-
    - op: remove
      path: /spec/template/spec/containers/0/volumeMounts/2
    - op: remove
      path: /spec/template/spec/volumes/

To Reproduce
NA

Expected behavior
NA
Version Kubernetes:
NA

Additional context
Add any other context about the problem here.

on-hold

Most helpful comment

Hi,
Thank you very much for requesting this.
This would be a nice feature to have, I am creating an internal tasks to study it and maybe bring similar changes to all the charts.
We will come back as soon as we have news.

>All comments

Hi,
Thank you very much for requesting this.
This would be a nice feature to have, I am creating an internal tasks to study it and maybe bring similar changes to all the charts.
We will come back as soon as we have news.

Was this page helpful?
0 / 5 - 0 ratings