Robert Pothier rpothier

Helm Chart for Conjur Kubernetes Cluster Preparation

Preparing the app Namespace

The goal here is to validate if Helm can be used to retrieve values from a Golden ConfigMap that is in a defined Namespace. Helm will read the data from the Golden ConfigMap and make a copy of the config map for the application namespace.

The Helm lookup function

The Helm lookup function can be used to parse the ConfigMap data fields. The an example of the syntax is below, here Helm will do a lookup of Version 1 of a ConfigMap in the

Using Kubeadm

Bring up kubernetes with vagrant cd /etc/systemd/system/kubelet.service.d modify 10-kubeadm.conf add

Environment="KUBELET_NETWORK_ARGS=--network-plugin=kubenet --non-masquerade-cidr=10.10.0.0/16"

	#!/usr/bin/env bash

	set -euo pipefail
	IFS=$'\n\t'
	CONJUR_PLATFORM="${CONJUR_PLATFORM:-gke}"
	APP_PLATFORM="${APP_PLATFORM:-gke}"
	GCLOUD_PROJECT_NAME="${GCLOUD_PROJECT_NAME:-gke}"
	GCLOUD_ZONE="${GCLOUD_ZONE:-gke}"
	GCLOUD_CLUSTER_NAME="${GCLOUD_CLUSTER_NAME:-gke}"
	GCLOUD_SERVICE_KEY="${GCLOUD_SERVICE_KEY:-gke}"

	import sys

	lib = 'ssl'
	libsize = 3

	if len(sys.argv) > 1:
	lib = sys.argv[1]
	libsize = len(sys.argv[1])
	print '/* OpenSSL error counters from {}err.h */'.format(lib)

	// EnsureProxyAddon creates the kube-proxy addons
	func EnsureProxyAddon(cfg *kubeadmapi.MasterConfiguration, client clientset.Interface) error {
	if err := CreateServiceAccount(client); err != nil {
	return fmt.Errorf("error when creating kube-proxy service account: %v", err)
	}

	// Generate Master Enpoint kubeconfig file
	masterEndpoint, err := kubeadmutil.GetMasterEndpoint(cfg)
	if err != nil {
	return err

	Flag --enable-cri has been deprecated, The non-CRI implementation will be deprecated and removed in a future version.
	Flag --rkt-stage1-image has been deprecated, Will be removed in a future version. The default stage1 image will be specified by the rkt configurations, see https://github.com/coreos/rkt/blob/master/Documentation/configuration.md for more details.
	I0607 13:23:23.628530 9970 feature_gate.go:144] feature gates: map[DynamicVolumeProvisioning:true ExperimentalCriticalPodAnnotation:true AllAlpha:true DynamicKubeletConfig:true TaintBasedEvictions:true AffinityInAnnotations:true Accelerators:true]
	I0607 13:23:23.640549 9970 server.go:236] Starting Kubelet configuration sync loop
	E0607 13:23:23.640568 9970 server.go:410] failed to init dynamic Kubelet configuration sync: cloud provider was nil, and attempt to use hostname to find config resulted in: configmaps "kubelet-127.0.0.1" not found
	I0607 13:23:23.640581 9970 plugins.go:101] No cloud provider specified.
	I0607 13:23:23.640589 9970

Robert Pothier rpothier

Helm Chart for Conjur Kubernetes Cluster Preparation

Table of Contents

Preparing the app Namespace

The Helm lookup function

Using Kubeadm