diff --git a/charts/node/Chart.yaml b/charts/node/Chart.yaml index 710baa6..7e5a391 100644 --- a/charts/node/Chart.yaml +++ b/charts/node/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: node description: A Helm chart to deploy Substrate/Polkadot nodes type: application -version: 5.16.0 +version: 5.17.0 maintainers: - name: Parity url: https://github.com/paritytech/helm-charts diff --git a/charts/node/README.md b/charts/node/README.md index a068836..3b10030 100644 --- a/charts/node/README.md +++ b/charts/node/README.md @@ -18,7 +18,7 @@ This is intended behaviour. Make sure to run `git add -A` once again to stage ch # Substrate/Polkadot node Helm chart -![Version: 5.16.0](https://img.shields.io/badge/Version-5.16.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) +![Version: 5.17.0](https://img.shields.io/badge/Version-5.17.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ## Overview The Polkadot Helm Chart provides a convenient way to deploy and manage a Polkadot blockchain node in a Kubernetes cluster. diff --git a/charts/node/templates/statefulset.yaml b/charts/node/templates/statefulset.yaml index 05faa40..0300120 100644 --- a/charts/node/templates/statefulset.yaml +++ b/charts/node/templates/statefulset.yaml @@ -37,14 +37,22 @@ spec: metadata: {{- if or .Values.podAnnotations .Values.node.vault.keys .Values.node.vault.nodeKey }} annotations: - {{- with .Values.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- range $keys := .Values.node.vault.keys }} + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- range $keys := .Values.node.vault.keys }} + {{- if .vaultKeyAppendPodIndex }} + {{- range $index := until ($.Values.node.replicas | int) }} + vault.hashicorp.com/agent-inject-secret-{{ $keys.name }}-{{ $index }}: {{ $keys.vaultPath | squote }} + vault.hashicorp.com/agent-inject-template-{{ $keys.name }}-{{ $index }}: | + {{`{{ with secret "`}}{{ $keys.vaultPath }}{{`" }}{{ .Data.data.`}}{{ printf "%s_%s" $keys.vaultKey ($index | toString) }}{{` }}{{ end }}`}} + {{- end }} + {{- else }} vault.hashicorp.com/agent-inject-secret-{{ .name }}: {{ .vaultPath | squote }} vault.hashicorp.com/agent-inject-template-{{ .name }}: | {{`{{ with secret "`}}{{ .vaultPath }}{{`" }}{{ .Data.data.`}}{{ .vaultKey }}{{` }}{{ end }}`}} - {{- end }} + {{- end }} + {{- end }} {{- if .Values.node.vault.nodeKey }} {{- if .Values.node.vault.nodeKey.vaultKeyAppendPodIndex }} {{- range $index := until (.Values.node.replicas | int) }} @@ -421,8 +429,9 @@ spec: echo "Inserted node key at ${NODE_KEY_PATH} with peer-id: ${NODE_PEER_ID}" {{- end }} {{- range $keys := .Values.node.vault.keys }} - if [ ! -f /vault/secrets/{{ .name }} ]; then - echo "Error: File /vault/secrets/{{ .name }} does not exist" + KEY_PATH="/vault/secrets/{{ .name }}{{ if .vaultKeyAppendPodIndex }}-${HOSTNAME##*-}{{ end }}" + if [ ! -f ${KEY_PATH} ]; then + echo "Error: File ${KEY_PATH} does not exist" exit 1 fi {{ $.Values.node.command }} key insert \ @@ -433,11 +442,11 @@ spec: --chain {{ $.Values.node.customChainspecPath }} \ {{- end }} {{- if .extraDerivation }} - --suri "$(cat /vault/secrets/{{ .name }}){{ .extraDerivation }}" \ + --suri "$(cat ${KEY_PATH}){{ .extraDerivation }}" \ {{- else }} - --suri "/vault/secrets/{{ .name }}" \ + --suri "$(cat ${KEY_PATH})" \ {{- end }} - && echo "Inserted key {{ .name }} (type={{ .type }}, scheme={{ .scheme }}) into Keystore" \ + && echo "Inserted key {{ .name }} (type={{ .type }}, scheme={{ .scheme }}) from ${KEY_PATH} into Keystore" \ || echo "Failed to insert key {{ .name }} (type={{ .type }}, scheme={{ .scheme }}) into Keystore." {{- end }} resources: diff --git a/charts/node/values.yaml b/charts/node/values.yaml index 515eb8d..89df289 100644 --- a/charts/node/values.yaml +++ b/charts/node/values.yaml @@ -421,11 +421,13 @@ node: # vaultPath: kv/secret/grankey # vaultKey: gran # extraDerivation: // + # vaultKeyAppendPodIndex: false # - name: babekey # type: type # scheme: scheme # vaultPath: kv/secrets/babeKey # vaultKey: babe + # vaultKeyAppendPodIndex: false # -- Node key to use via vault nodeKey: {}