terraform-tinfoil-tiller's Introduction

terraform secure deployment of `helm`'s “a giant sudo server”

This module provides for a simple installation of helms tiller agent that is only accessible by establishing a proxy via the k8s API per this article: https://engineering.bitnami.com/articles/helm-security.html .

helm provider 0.6.2 vendors helm 2.9.0, which does not correctly deploy tiller with rbac enabled. The manual patching is not required with this module.

kubectl patch deploy --namespace kube-system tiller-deploy -p '{"spec":{"template":{"spec":{"automountServiceAccountToken":true}}}}'

Usage

resource "kubernetes_namespace" "tiller" {
  metadata {
    name = "tiller"
  }
}

module "tiller" {
  source = "git::https://github.com/lsst-sqre/terraform-tinfoil-tiller.git?ref=0.10.x"

  namespace = "${kubernetes_namespace.tiller.metadata.0.name}"
}

provider "helm" {
  version = "~> 0.10.0"

  service_account = "${module.tiller.service_account}"
  namespace       = "${module.tiller.namespace}"
  install_tiller  = false

  kubernetes {
    ...
  }
}

Inputs

Name	Description	Type	Default	Required
namespace	kubernetes namespace to deploy into	string	`"kube-system"`	no
service_account	kubernetes service account name	string	`"tiller"`	no
tiller_image	tiller docker image.	string	`"gcr.io/kubernetes-helm/tiller:v2.14.1"`	no

Outputs

Name	Description
namespace	kubernetes namespace in which tiller is installed
service_account	name of kubernetes service account for tiller

`pre-commit` hooks

go get github.com/segmentio/terraform-docs
pip install --user pre-commit
pre-commit install

# manual run
pre-commit run -a

Contributors

Stargazers

Watchers

terraform-tinfoil-tiller's Issues

Created releases

Can you create releases and version them according to the Helm release it supports? For example, your release version would be 0.7 for helm provider version 0.7 etc. You could use minor versions if you have to add bug fixes etc.

Feature Request: Submitt to Terraform Module Registry

This is currently the closest to a separate Tiller resource for the Helm provider. The module works well and it even has tests.

Terraform has a module registry. It would be nice to have this module in the registry.

Wait for tiller to be to be running

Hi.

I think a good option would be to wait for the tiller to be up and running. I'm using current module like:

module "tiller" {
  source = "git::https://github.com/lsst-sqre/terraform-tinfoil-tiller.git//?ref=master"

  namespace = "kube-system"
  service_account = "tiller"
  tiller_image = "gcr.io/kubernetes-helm/tiller:v2.12.2"
}

provider "helm" "k8s_helm" {
  version = "~> 0.7.0"

  install_tiller = false
  debug = true
  service_account = "${module.tiller.service_account}"
  namespace = "${module.tiller.namespace}"


  kubernetes {
    host = "${digitalocean_kubernetes_cluster.k8s.endpoint}"

    client_certificate = "${base64decode(digitalocean_kubernetes_cluster.k8s.kube_config.0.client_certificate)}"
    client_key = "${base64decode(digitalocean_kubernetes_cluster.k8s.kube_config.0.client_key)}"
    cluster_ca_certificate = "${base64decode(digitalocean_kubernetes_cluster.k8s.kube_config.0.cluster_ca_certificate)}"
  }
}

and I can't set depends_on because this works only on resources. But inside module we can add this options.

Thx.

Recommend Projects