Added boundary chart

src/boundary/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: boundary
+description: A Helm chart for HashiCorp Boundary
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.2.7
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.13.1"

src/boundary/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Jacob Garcia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

src/boundary/boundary-config.hcl

@@ -0,0 +1,63 @@
+disable_mlock = true
+log_format    = "standard"
+controller {
+  name        = "kubernetes-controller"
+  description = "A controller for a kubernetes demo!"
+  database {
+    url = "file:///vault/secrets/database-creds.txt"
+  }
+  public_cluster_addr = "localhost"
+}
+worker {
+  name        = "kubernetes-worker"
+  description = "A worker for a kubernetes demo"
+  address     = "localhost"
+  controllers = ["localhost"]
+  public_addr = "192.168.1.101:30202"
+}
+listener "tcp" {
+  address     = "0.0.0.0"
+  purpose     = "api"
+  tls_disable = true
+}
+listener "tcp" {
+  address     = "0.0.0.0"
+  purpose     = "cluster"
+  tls_disable = true
+}
+listener "tcp" {
+  address     = "0.0.0.0"
+  purpose     = "proxy"
+  tls_disable = true
+}
+kms "transit" {
+  purpose         = "root"
+  address         = "{{ .Values.vault.fqdn }}"
+  disable_renewal = false
+
+  key_name   = "root"
+  mount_path = "local-kms/"
+
+  tls_skip_verify = true
+}
+kms "transit" {
+  purpose         = "recovery"
+  address         = "{{ .Values.vault.fqdn }}"
+  disable_renewal = false
+
+  key_name   = "recovery"
+  mount_path = "local-kms/"
+
+  tls_skip_verify = true
+}
+kms "transit" {
+  purpose         = "worker-auth"
+  address         = "{{ .Values.vault.fqdn }}"
+  disable_renewal = false
+
+  key_name   = "worker-auth"
+  mount_path = "local-kms/"
+
+  tls_skip_verify = true
+}
+

src/boundary/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "boundary-chart.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "boundary-chart.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "boundary-chart.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "boundary-chart.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}

src/boundary/templates/_helpers.tpl

@@ -0,0 +1,66 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "boundary-chart.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "boundary-chart.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "boundary-chart.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "boundary-chart.labels" -}}
+helm.sh/chart: {{ include "boundary-chart.chart" . }}
+{{ include "boundary-chart.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- range $key, $value := .Values.extraLabels }}
+{{ $key }}: {{ $value | quote }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "boundary-chart.selectorLabels" -}}
+app: {{ include "boundary-chart.name" . }}
+service: {{ include "boundary-chart.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "boundary-chart.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "boundary-chart.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

src/boundary/templates/configmap.yaml

@@ -0,0 +1,144 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: boundary-config
+  labels:
+    {{- include "boundary-chart.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  creationTimestamp: null
+data:
+  boundary-config-admin.hcl: |
+    disable_mlock = true
+    log_format    = "standard"
+    controller {
+      name        = "kubernetes-controller"
+      description = "Boundary controller"
+      database {
+        url = "file:///vault/secrets/database-creds-admin.txt"
+        url = "postgresql://{{.Values.database.username}}:{{.Values.database.password}}@{{ .Values.database.url }}:{{ .Values.database.port}}/{{.Values.database.dbName}}{{- if ne .Values.database.ssl true }}?sslmode=disable{{- end }}"
+      }
+      public_cluster_addr = "localhost"
+    }
+    worker {
+      name        = "kubernetes-worker"
+      description = "Boundary worker"
+      address     = "localhost"
+      controllers = ["localhost"]
+      public_addr = "{{ .Values.publicAddress }}:{{ .Values.publicPort }}"
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "api"
+      tls_disable = true
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "cluster"
+      tls_disable = true
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "proxy"
+      tls_disable = true
+    }
+    {{- if .Values.vault.enabled }}
+    {{- $fqdn := .Values.vault.fqdn }}
+    {{- $mountPath := .Values.vault.mountPath }}
+    {{- $tlsSkip := .Values.vault.tlsSkipVerify }}
+    {{- range $i, $purpose := list "root" "recovery" "worker-auth" }}
+    kms "transit" {
+      purpose         = "{{ $purpose }}"
+      address         = "{{ $fqdn }}"
+      disable_renewal = false
+
+      key_name   = "{{ $purpose }}"
+      mount_path = "{{ $mountPath }}"
+      {{- if $tlsSkip }}
+      tls_skip_verify = true
+      {{- end }}
+    }
+    {{- end }}
+    {{- else }}
+    {{- range $purpose, $key := .Values.aead.keys }}
+    kms "aead" {
+      purpose = "{{ $purpose }}"
+      key_id = "global_{{ $purpose }}"
+      aead_type = "aes-gcm"
+      key = "{{ $key }}"
+    }
+    {{- end }}
+    {{- end }}
+  boundary-config.hcl: |
+    disable_mlock = true
+    log_format    = "standard"
+    controller {
+      name        = "kubernetes-controller"
+      description = "Boundary controller"
+      database {
+      {{- if .Values.vault.enabled }}
+        url = "file:///vault/secrets/database-creds.txt"
+      {{- else }}
+        url = "postgresql://{{.Values.database.username}}:{{.Values.database.password}}@{{ .Values.database.url }}:{{ .Values.database.port}}/{{.Values.database.dbName}}{{- if ne .Values.database.ssl true }}?sslmode=disable{{- end }}"
+      {{- end }}
+      }
+      public_cluster_addr = "localhost"
+    }
+    worker {
+      name        = "kubernetes-worker"
+      description = "Boundary worker"
+      address     = "localhost"
+      controllers = ["localhost"]
+      public_addr = "{{ .Values.publicAddress }}:{{ .Values.publicPort }}"
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "api"
+      tls_disable = true
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "cluster"
+      tls_disable = true
+    }
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "proxy"
+      tls_disable = true
+    }
+    {{- if .Values.metrics.enabled }}
+    listener "tcp" {
+      address     = "0.0.0.0"
+      purpose     = "ops"
+      tls_disable = true
+    }
+    {{- end }}
+    {{- if .Values.vault.enabled }}
+    {{- $fqdn := .Values.vault.fqdn }}
+    {{- $mountPath := .Values.vault.mountPath }}
+    {{- $tlsSkip := .Values.vault.tlsSkipVerify }}
+    {{- range $i, $purpose := list "root" "recovery" "worker-auth" }}
+    kms "transit" {
+      purpose         = "{{ $purpose }}"
+      address         = "{{ $fqdn }}"
+      disable_renewal = false
+
+      key_name   = "{{ $purpose }}"
+      mount_path = "{{ $mountPath }}"
+      {{- if $tlsSkip }}
+      tls_skip_verify = true
+      {{- end }}
+    }
+    {{- end }}
+    {{- else }}
+    {{- range $purpose, $key := .Values.aead.keys }}
+    kms "aead" {
+      purpose = "{{ $purpose }}"
+      key_id = "global_{{ $purpose }}"
+      aead_type = "aes-gcm"
+      key = "{{ $key }}"
+    }
+    {{- end }}
+    {{- end }}