CheckPointSW/charts

Allow custom annotations

Closed this issue · 5 comments

GonCuesMa commented

Hi

So far, we can only set these common annotations in deployments:

Helper

{{- /* Pod annotations commonly used in agents */ -}}
{{- define "common.pod.annotations" -}}
agentVersion: {{ .agentConfig.tag }}
{{- /* Openshift does not allow seccomp - So we don't add seccomp in openshift case */ -}}
{{- /* From k8s 1.19 and up we use the seccomp in securityContext so no need for it here, in case of template we don't know the version so we fall back to annotation */ -}}
{{- if and (not (contains "openshift" (include "get.platform" .))) (semverCompare "<1.19-0" .Capabilities.KubeVersion.Version ) }}
seccomp.security.alpha.kubernetes.io/pod: {{ .Values.podAnnotations.seccomp }}
{{- end }}
{{- if .Values.podAnnotations.apparmor }}
container.apparmor.security.beta.kubernetes.io/{{ template "agent.resource.name" . }}:
{{ toYaml .Values.podAnnotations.apparmor | indent 2 }}
{{- end }}
{{- end -}}

Deployment

annotations:
{{ include "common.pod.annotations" $config | indent 8 }}

It would be nice to be able to add custom annotations. In my case, I want to configure the mutating webhook of Bank-Vaults through the annotations to inject my Cloudguard credentials retrieved from Vault directly into the pods.

Would it be possible to implement this?

Thanks a lot.

Greetings.

chkp-alexgl commented

Hi @GonCuesMa,

Thanks for bringing up this use-case. Indeed, it seems useful and shouldn't be difficult to implement. Will try to add it soon.

GonCuesMa commented

Hi @GonCuesMa,

Thanks for bringing up this use-case. Indeed, it seems useful and shouldn't be difficult to implement. Will try to add it soon.

Great! Thanks a lot!

chkp-alexgl commented

Resolved by #101

chkp-dorcohen commented

Hi @GonCuesMa, just to make sure you noticed the change.

GonCuesMa commented

Hi @chkp-dorcohen !

Yes, I'm using version 2.15.1 and everything works great! Thanks!

PD: I've been able to inject my Cloudguard credentials retrieved from Vault using the following pod annotations:

podAnnotations:
  custom:
    vault.security.banzaicloud.io/vault-addr: "https://vault.vault:8200"
    vault.security.banzaicloud.io/vault-role: "default"
    vault.security.banzaicloud.io/vault-skip-verify: "false"
    vault.security.banzaicloud.io/vault-tls-secret: "vault-tls"
    vault.security.banzaicloud.io/vault-agent: "false"
    vault.security.banzaicloud.io/vault-path: "kubernetes"
    vault.security.banzaicloud.io/vault-namespace: "vault"
  • ❤️1
  • 🚀1