Vendor plugin charts

Makefile

@@ -703,12 +703,16 @@ test-helm: helmunit/installed
 	helm unittest -3 --with-subchart=false examples/chart/teleport-cluster
 	helm unittest -3 examples/chart/teleport-kube-agent
 	helm unittest -3 examples/chart/teleport-cluster/charts/teleport-operator
+	helm unittest -3 examples/chart/access/*
+	helm unittest -3 examples/chart/event-handler
 
 .PHONY: test-helm-update-snapshots
 test-helm-update-snapshots: helmunit/installed
 	helm unittest -3 -u --with-subchart=false examples/chart/teleport-cluster
 	helm unittest -3 -u examples/chart/teleport-kube-agent
 	helm unittest -3 -u examples/chart/teleport-cluster/charts/teleport-operator
+	helm unittest -3 -u examples/chart/access/*
+	helm unittest -3 -u examples/chart/event-handler
 
 #
 # Runs all Go tests except integration, called by CI/CD.

examples/chart/access/discord/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

examples/chart/access/discord/Chart.yaml

@@ -0,0 +1,8 @@
+.version: &version "16.0.0-dev"
+
+apiVersion: v2
+name: teleport-plugin-discord
+description: A Helm chart for the Teleport Discord Plugin
+type: application
+version: *version
+appVersion: *version

examples/chart/access/discord/README.md

@@ -0,0 +1,101 @@
+# Teleport Access Request Discord Plugin
+
+This chart sets up and configures a Deployment for the Access Request Discord plugin.
+
+## Installation
+
+See the [Access Requests with Discord guide](https://goteleport.com/docs/access-controls/access-request-plugins/ssh-approval-discord/)
+which covers how to create the Discord bot and how to deploy the access plugin.
+
+## Settings
+
+The following values can be set for the Helm chart:
+
+<table>
+  <tr>
+    <th>Name</th>
+    <th>Description</th>
+    <th>Type</th>
+    <th>Default</th>
+    <th>Required</th>
+  </tr>
+
+  <tr>
+    <td><code>teleport.address</code></td>
+    <td>Host/port combination of the teleport auth server</td>
+    <td>string</td>
+    <td><code>""</code></td>
+    <td>yes</td>
+  </tr>
+  <tr>
+    <td><code>teleport.identitySecretName</code></td>
+    <td>Name of the Kubernetes secret that contains the credentials for the connection</td>
+    <td>string</td>
+    <td><code>""</code></td>
+    <td>yes</td>
+  </tr>
+  <tr>
+    <td><code>teleport.identitySecretPath</code></td>
+    <td>Key of the field in the secret specified by <code>teleport.identitySecretName</code></td>
+    <td>string</td>
+    <td><code>"auth_id"</code></td>
+    <td>yes</td>
+  </tr>
+
+  <tr>
+    <td><code>discord.token</code></td>
+    <td>Discord API token</td>
+    <td>string</td>
+    <td><code>""</code></td>
+    <td>yes</td>
+  </tr>
+  <tr>
+    <td><code>discord.tokenFromSecret</code></td>
+    <td>Kubernetes secret to read the token from instead of <code>discord.token</code></td>
+    <td>string</td>
+    <td><code>""</code></td>
+    <td>no</td>
+  </tr>
+  <tr>
+    <td><code>discord.tokenSecretPath</code></td>
+    <td>The path of the token in the secret described by <code>discord.tokenFromSecret</code></td>
+    <td>string</td>
+    <td><code>"discordToken"</code></td>
+    <td>no</td>
+  </tr>
+
+  <tr>
+    <td><code>roleToRecipients</code></td>
+    <td>
+      Mapping of roles to a list of Discord channel IDs. <br />
+      Example:
+      <pre>
+"dev" = ["0987654321", "1234567890"]
+"*" = ["1234567890"]</pre>
+    </td>
+    <td>map</td>
+    <td><code>{}</code></td>
+    <td>yes</td>
+  </tr>
+
+  <tr>
+    <td><code>log.output</code></td>
+    <td>
+      Logger output. Could be <code>"stdout"</code>, <code>"stderr"</code> or a file name,
+      eg. <code>"/var/lib/teleport/discord.log"</code>
+    </td>
+    <td>string</td>
+    <td><code>"stdout"</code></td>
+    <td>no</td>
+  </tr>
+  <tr>
+    <td><code>log.severity</code></td>
+    <td>
+      Logger severity. Possible values are <code>"INFO"</code>, <code>"ERROR"</code>,
+      <code>"DEBUG"</code> or <code>"WARN"</code>.
+    </td>
+    <td>string</td>
+    <td><code>"INFO"</code></td>
+    <td>no</td>
+  </tr>
+</table>

examples/chart/access/discord/templates/_helpers.tpl

@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "discord.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "discord.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "discord.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "discord.labels" -}}
+helm.sh/chart: {{ include "discord.chart" . }}
+{{ include "discord.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "discord.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "discord.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "discord.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "discord.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

examples/chart/access/discord/templates/configmap.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "discord.fullname" . }}
+  labels:
+    {{- include "discord.labels" . | nindent 4 }}
+data:
+  teleport-discord.toml: |
+    [teleport]
+    addr = "{{ .Values.teleport.address }}"
+    identity = "/var/lib/teleport/plugins/discord/teleport-identity/{{ .Values.teleport.identitySecretPath }}"
+    refresh_identity = true
+
+    [discord]
+    token = "/var/lib/teleport/plugins/discord/discord-token"
+
+    [role_to_recipients]
+    {{- range $role, $recipients := .Values.roleToRecipients }}
+    {{ $role | toJson }} = {{ $recipients | toJson }}
+    {{- end }}
+
+    [log]
+    output = "{{ .Values.log.output }}"
+    severity = "{{ .Values.log.severity }}"

examples/chart/access/discord/templates/deployment.yaml

@@ -0,0 +1,76 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "discord.fullname" . }}
+  labels:
+    {{- include "discord.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "discord.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "discord.labels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command:
+            - /usr/local/bin/teleport-plugin
+            - start
+            - "--config"
+            - "/etc/teleport-discord.toml"
+          env:
+            - name: "TELEPORT_PLUGIN_FAIL_FAST"
+              value: "true"
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: config
+              mountPath: /etc/teleport-discord.toml
+              subPath: teleport-discord.toml
+            - name: teleport-identity
+              mountPath: /var/lib/teleport/plugins/discord/teleport-identity
+            - name: {{ .Values.secretVolumeName }}
+              mountPath: /var/lib/teleport/plugins/discord/discord-token
+              subPath: {{ .Values.discord.tokenSecretPath }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "discord.fullname" . }}
+            defaultMode: 0600
+        - name: teleport-identity
+          secret:
+            secretName: "{{ .Values.teleport.identitySecretName }}"
+            defaultMode: 0600
+        - name: {{ .Values.secretVolumeName }}
+          secret:
+            secretName: "{{ coalesce .Values.discord.tokenFromSecret (printf "%s-secret" (include "discord.fullname" .)) }}"
+            defaultMode: 0600

examples/chart/access/discord/templates/secret.yaml

@@ -0,0 +1,9 @@
+{{- if not .Values.discord.tokenFromSecret -}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ include "discord.fullname" . }}-secret
+data:
+   discordToken: {{ .Values.discord.token | b64enc }}
+{{- end }}

examples/chart/access/discord/tests/__snapshot__/configmap_test.yaml.snap

@@ -0,0 +1,29 @@
+should match the snapshot:
+  1: |
+    apiVersion: v1
+    data:
+      teleport-discord.toml: |
+        [teleport]
+        addr = "teleport.example.com:1234"
+        identity = "/var/lib/teleport/plugins/discord/teleport-identity/auth_id"
+        refresh_identity = true
+
+        [discord]
+        token = "/var/lib/teleport/plugins/discord/discord-token"
+
+        [role_to_recipients]
+        "*" = ["dev-access-requests"]
+        "dev" = ["dev-access-requests","[email protected]"]
+
+        [log]
+        output = "/var/log/teleport-discord.log"
+        severity = "DEBUG"
+    kind: ConfigMap
+    metadata:
+      labels:
+        app.kubernetes.io/instance: RELEASE-NAME
+        app.kubernetes.io/managed-by: Helm
+        app.kubernetes.io/name: teleport-plugin-discord
+        app.kubernetes.io/version: 16.0.0-dev
+        helm.sh/chart: teleport-plugin-discord-16.0.0-dev
+      name: RELEASE-NAME-teleport-plugin-discord