feat: add values for maas plugin

chart/validator/README.md

@@ -51,6 +51,7 @@ The following table lists the configurable parameters of the Validator chart and
 | `pluginSecrets.vSphere` | Don't forget to delete these curly braces if you're specifying credentials here! | `{}` |
 | `pluginSecrets.oci.auth` | Don't forget to delete these square brackets if you're specifying credentials here! | `[]` |
 | `pluginSecrets.oci.pubKeys` | Don't forget to delete these square brackets if you're specifying public keys here! | `[]` |
+| `pluginSecrets.maas` | Don't forget to delete these curly braces if you're specifying credentials here! | `{}` |
 | `helmConfig.registry` |  | `"https://validator-labs.github.io"` |
 | `plugins` |  | `[{"chart": {"name": "validator-plugin-azure", "repository": "validator-plugin-azure", "version": "v0.0.14"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-azure\n      tag: v0.0.14\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n    # Optionally specify a volumeMount to mount a volume containing a private key\n    # to leverage Azure Service principal with certificate authentication.\n    volumeMounts: []\n  replicas: 1\n  serviceAccount:\n    annotations: {}\n  # Optionally specify a volume containing a private key to leverage Azure Service\n  # principal with certificate authentication.\n  volumes: []\n  # Optionally specify additional labels to use for the controller-manager Pods.\n  podLabels: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP\nauth:\n  # Leave secret undefined for implicit auth (e.g., WorkloadIdentity credentials)\n  secret: {}\n  # Specify the name of a secret in your cluster that contains Azure credentials.\n  # E.g.: https://github.com/validator-labs/validator/blob/main/chart/validator/templates/plugin-secret-azure.yaml\n  # secretName: azure-creds\n\n  # Override the service account used by Azure validator (optional, could be used for WorkloadIdentityCredentials on AKS)\n  # WARNING: the chosen service account must include all RBAC privileges found in templates/manager-rbac.yaml\n  serviceAccountName: \"\""}, {"chart": {"name": "validator-plugin-oci", "repository": "validator-plugin-oci", "version": "v0.0.12"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-oci\n      tag: v0.0.12\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n  replicas: 1\n  serviceAccount:\n    annotations: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP"}, {"chart": {"name": "validator-plugin-kubescape", "repository": "validator-plugin-kubescape", "version": "v0.0.4"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-kubescape\n      tag: v0.0.4\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n    # Optionally specify a volumeMount to mount a volume containing a private key\n    # to leverage Azure Service principal with certificate authentication.\n    volumeMounts: []\n  replicas: 1\n  serviceAccount:\n    annotations: {}\n  # Optionally specify a volume containing a private key to leverage Azure Service\n  # principal with certificate authentication.\n  volumes: []\n  # Optionally specify additional labels to use for the controller-manager Pods.\n  podLabels: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP"}, {"chart": {"name": "validator-plugin-aws", "repository": "validator-plugin-aws", "version": "v0.1.2"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-aws\n      tag: v0.1.2\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n  replicas: 1\n  serviceAccount:\n    annotations: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP\nauth:\n  # Leave secret undefined for implicit auth (node instance IAM role, IAM roles for Service Accounts, etc.)\n  secret: {}\n  # Specify the name of a secret in your cluster that contains AWS credentials.\n  # E.g.: https://github.com/validator-labs/validator/blob/main/chart/validator/templates/plugin-secret-aws.yaml\n  # secretName: aws-creds\n\n  # Override the service account used by AWS validator (optional, could be used for IAM roles for Service Accounts)\n  # WARNING: the chosen service account must have the same RBAC privileges as seen in templates/manager-rbac.yaml\n  serviceAccountName: \"\""}, {"chart": {"name": "validator-plugin-network", "repository": "validator-plugin-network", "version": "v0.0.21"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: true\n      capabilities:\n        add:\n          - NET_RAW\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-network\n      tag: v0.0.21\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n  replicas: 1\n  serviceAccount:\n    annotations: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP"}, {"chart": {"name": "validator-plugin-maas", "repository": "validator-plugin-maas", "version": "v0.0.6"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-maas\n      tag: v0.0.6\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n  replicas: 1\n  serviceAccount:\n    annotations: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP"}, {"chart": {"name": "validator-plugin-vsphere", "repository": "validator-plugin-vsphere", "version": "v0.0.28"}, "values": "controllerManager:\n  kubeRbacProxy:\n    args:\n      - --secure-listen-address=0.0.0.0:8443\n      - --upstream=http://127.0.0.1:8080/\n      - --logtostderr=true\n      - --v=0\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: gcr.io/kubebuilder/kube-rbac-proxy\n      tag: v0.16.0\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 5m\n        memory: 64Mi\n  manager:\n    args:\n      - --health-probe-bind-address=:8081\n      - --metrics-bind-address=127.0.0.1:8080\n      - --leader-elect\n    containerSecurityContext:\n      allowPrivilegeEscalation: false\n      capabilities:\n        drop:\n          - ALL\n    image:\n      repository: quay.io/validator-labs/validator-plugin-vsphere\n      tag: v0.0.28\n    resources:\n      limits:\n        cpu: 500m\n        memory: 128Mi\n      requests:\n        cpu: 10m\n        memory: 64Mi\n  replicas: 1\n  serviceAccount:\n    annotations: {}\nkubernetesClusterDomain: cluster.local\nmetricsService:\n  ports:\n    - name: https\n      port: 8443\n      protocol: TCP\n      targetPort: https\n  type: ClusterIP\nauth:\n  # Specify the name of a secret in your cluster that contains vSphere credentials.\n  # E.g.: https://github.com/validator-labs/validator/blob/main/chart/validator/templates/plugin-secret-vsphere.yaml\n  secretName: vsphere-credentials"}]` |
 

chart/validator/templates/plugin-secret-maas.yaml

@@ -0,0 +1,8 @@
+{{- if .Values.pluginSecrets.maas }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ required ".Values.pluginSecrets.maas.secretName is required!" .Values.pluginSecrets.maas.secretName }}
+stringData:
+  MAAS_API_KEY: {{ required ".Values.pluginSecrets.maas.MAAS_API_KEY is required!" .Values.pluginSecrets.maas.MAAS_API_KEY | quote }}
+{{- end }}

chart/validator/values.yaml

@@ -184,6 +184,16 @@ pluginSecrets:
       #    -----BEGIN PUBLIC KEY-----
       #    <your public key content here>
       #    -----END PUBLIC KEY-----
+
+  # If installing the MAAS plugin, the below config is required unless the following applies:
+  # - The target cluster already contains a secret with the correct format and you've specified its name above.
+  #   If specifying your own secret, refer to chart/validator/templates/plugin-secret-maas.yaml for
+  #   an example of the expected format and ensure that it exists in the same namespace as the Helm release.
+  #
+  maas: {}  # Don't forget to delete these curly braces if you're specifying credentials here!
+    # secretName: maas-creds  # ensure this matches the MAAS plugin values above
+    # MAAS_API_KEY: ""
+
 
 helmConfig:
   registry: "https://validator-labs.github.io"

hack/chart/values-base.yaml

@@ -184,6 +184,16 @@ pluginSecrets:
       #    -----BEGIN PUBLIC KEY-----
       #    <your public key content here>
       #    -----END PUBLIC KEY-----
+
+  # If installing the MAAS plugin, the below config is required unless the following applies:
+  # - The target cluster already contains a secret with the correct format and you've specified its name above.
+  #   If specifying your own secret, refer to chart/validator/templates/plugin-secret-maas.yaml for
+  #   an example of the expected format and ensure that it exists in the same namespace as the Helm release.
+  #
+  maas: {}  # Don't forget to delete these curly braces if you're specifying credentials here!
+    # secretName: maas-creds  # ensure this matches the MAAS plugin values above
+    # MAAS_API_KEY: ""
+
 
 helmConfig:
   registry: "https://validator-labs.github.io"