[VC-28877] Publish venafi kubernetes agent chart #471

wallrj · 2023-11-22T15:37:01Z

Fixes: https://venafi.atlassian.net/browse/VC-28877

Documented the current release process and explained why and how all the artifacts end up where they do.
Modified the venafi-kubernetes-agent Helm README file to bring it up to date with the desired installation process
Fixed some of the post install NOTES instructions
Manually built and pushed the Helm chart according to the documented release process

$ export VERSION=0.1.43-alpha.2
helm package deploy/charts/venafi-kubernetes-agent --version "${VERSION}"
helm push venafi-kubernetes-agent-${VERSION}.tgz oci://eu.gcr.io/jetstack-secure-enterprise/charts
Successfully packaged chart and saved it to: /home/richard/projects/jetstack/jetstack-secure/venafi-kubernetes-agent-0.1.43-alpha.2.tgz
Pushed: eu.gcr.io/jetstack-secure-enterprise/charts/venafi-kubernetes-agent:0.1.43-alpha.2
Digest: sha256:291f26609de4796fdd6f1824e3da740a91ace5ed2dc6a229481814bdb36b8256

@dbarranco made some changes to Harbour to mirror the chart to the documented Venafi registries.

You can examine the Helm chart yourself, as follows:

$ crane ls registry.venafi.cloud/charts/venafi-kubernetes-agent
0.1.43-alpha.0
0.1.43-alpha.1
0.1.43-alpha.2
sha256-291f26609de4796fdd6f1824e3da740a91ace5ed2dc6a229481814bdb36b8256.sig
sha256-d5b2b09773f068495cddd3a1f56147032741baa36e43cac16b5dac058bfad33a.sig
sha256-ff8162f3d68612ff922261a0dd7a661ed3abbfd9dc1e3c30a09aa5b9b9bf9ba0.sig

Testing

I installed the chart in a Kind cluster on my laptop and was able to see the agent running and connecting to the Venafi Control Plane.

$ helm upgrade venafi-kubernetes-agent oci://registry.venafi.cloud/charts/venafi-kubernetes-agent   --install   --namespace ${VENAFI_NAMESPACE}   --set config.clientId="${VENAFI_CLIENT_ID}" --devel
Pulled: registry.venafi.cloud/charts/venafi-kubernetes-agent:0.1.43-alpha.2
Digest: sha256:291f26609de4796fdd6f1824e3da740a91ace5ed2dc6a229481814bdb36b8256
Release "venafi-kubernetes-agent" has been upgraded. Happy Helming!
NAME: venafi-kubernetes-agent
LAST DEPLOYED: Fri Nov 24 13:09:53 2023
NAMESPACE: venafi
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
1. Check the credentials Secret exists: "agent-credentials"
> kubectl get secret -n venafi agent-credentials

2. Check the application is running:
> kubectl get pods -n venafi -l app.kubernetes.io/instance=venafi-kubernetes-agent

3. Check the application logs for successful connection to the platform:
> kubectl logs -n venafi -l app.kubernetes.io/instance=venafi-kubernetes-agent

$ helm list  -n venafi
NAME                    NAMESPACE       REVISION        UPDATED                                 STATUS          CHART                                   APP VERSION
venafi-kubernetes-agent venafi          2               2023-11-24 13:09:53.195739589 +0000 UTC deployed        venafi-kubernetes-agent-0.1.43-alpha.2  v0.1.43

$ kubectl logs -n ${VENAFI_NAMESPACE} -l app.kubernetes.io/instance=venafi-kubernetes-agent --tail -1 | head
2023/11/23 14:58:36 Preflight agent version: v0.1.43 (a1b618ca89aad69f71095e97724d62e3d0b113c7)
2023/11/23 14:58:36 Loaded config:
schedule: ""
period: 0s
endpoint:
    protocol: ""
    host: ""
    path: ""
server: https://api.venafi.cloud/
organization_id: ""

Signed-off-by: Richard Wall <richard.wall@venafi.com>

hawksight

Really good changes, thank you for refactoring this to include the right registry links etc.
Also repo instruction are good 👍

Couple of minor things and slight rant, but nothing to stop this merging.

hawksight · 2023-11-24T11:27:41Z

deploy/charts/venafi-kubernetes-agent/README.md.gotmpl


-### 1) Setup registry credentials
+> Learn [how to access the private Venafi OCI registries](https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/).


This is completely the right link, but what it links to is completely useless IMO.
Why would you have to enable this by talking to a human. Shouldn't this just be a feature enabled by default?

Surely being a Venafi Customer is enough to get access to a private revision of the venafi-kubernetes-agent?

No action needed, just ranting.

I raised an issue with the documentation team:

https://venafi.atlassian.net/browse/VC-28984

This was added to the docs by PM in advance of the preview. The page will updated for the GA.

hawksight · 2023-11-24T11:30:07Z

deploy/charts/venafi-kubernetes-agent/README.md.gotmpl

  --namespace ${VENAFI_NAMESPACE} \
  --set config.clientId="${VENAFI_CLIENT_ID}"
 ```

-Optionally if you need to change the backend to the EU Venafi Control Plane you can use:
+> To change the backend to the EU Venafi Control Plane, use the following Helm value:
+> `--set config.server="${VENAFI_SERVER_URL}"`


We haven't exported this variable previously, so maybe we include it, or just add this into the instructions if this might change often? Not sure what's best, but also happy to leave how it is and assume people know who to export the env var and what it should be exported to.

I've hard coded the EU URL here instead.

hawksight · 2023-11-24T11:42:30Z

deploy/charts/venafi-kubernetes-agent/README.md


-1) A registry credential to allow helm to pull the chart from our private OCI registry.
-2) A service account key pair used by the agent to authenticate to the Venafi Control Plane.
+- `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` (public)


Is it worth a quick note to say that for this readme, we assume you are using the public registry?

hawksight · 2023-11-24T11:45:40Z

README.md

+It starts with the following manual steps:
+
+1. Choose the next semver version number.
+   This project has only ever incremented the "patch" number (never the "minor" number) regardless of the scope of the changes.


Seems a bit counter intuitive to the preceding sentence, but is entirely accurate.

I considered just changing the version number to 1.0.0 and telling releasers to increment the minor version,
but decided that would require a wider discussion.

Yes, no need for action, I'm just arguing semantics 😂

Signed-off-by: Richard Wall <richard.wall@venafi.com>

wallrj · 2023-11-24T14:34:15Z

deploy/charts/venafi-kubernetes-agent/values.yaml

@@ -7,7 +7,7 @@ replicaCount: 1

 image:
  # -- Default to Open Source image repository
-  repository: quay.io/jetstack/preflight
+  repository: quay.io/jetstack/venafi-agent


This is a more appropriate image, but later we should set up mirroring to registry.venafi.cloud

hawksight

Thanks you for constructively taking on board my comments. Changes are good 👍

hawksight · 2023-11-24T14:54:31Z

README.md

+It starts with the following manual steps:
+
+1. Choose the next semver version number.
+   This project has only ever incremented the "patch" number (never the "minor" number) regardless of the scope of the changes.


Yes, no need for action, I'm just arguing semantics 😂

wallrj added 11 commits November 16, 2023 13:20

Update venafi-kubernetes-agent chart version to 0.1.43-alpha.0

e9b95c2

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Make the two charts more consistent

944563a

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Documenting the release process

d8534bf

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Revert changes to Helm chart sources

0b72247

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Update version to 0.1.43 to match appVersion

b0890c0

Signed-off-by: Richard Wall <richard.wall@venafi.com>

More documentation

ee159f1

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Update chart README

82aafb9

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Remove unresolved variable

0c73db4

Signed-off-by: Richard Wall <richard.wall@venafi.com>

make update-helm-docs

d6a478b

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Further README tweaks

dc1efc4

Signed-off-by: Richard Wall <richard.wall@venafi.com>

0.1.43-alpha.1

e2b05e9

Signed-off-by: Richard Wall <richard.wall@venafi.com>

wallrj requested a review from hawksight November 23, 2023 17:54

wallrj changed the title ~~WIP: Publish venafi kubernetes agent chart~~ WIP: [VC-28348] Publish venafi kubernetes agent chart Nov 23, 2023

hawksight approved these changes Nov 24, 2023

View reviewed changes

wallrj added 6 commits November 24, 2023 12:25

Address code review comments

d3cefdb

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Use quay.io/jetstack/venafi-agent

e938365

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Explain how to do a pre-release

f7a64fd

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Explain that the chart gets mirrored to venafi registries

a7c8f62

Signed-off-by: Richard Wall <richard.wall@venafi.com>

make update-helm-docs

e15eebf

Signed-off-by: Richard Wall <richard.wall@venafi.com>

Update the Helm test to allow for venafi-agent image

077953b

Signed-off-by: Richard Wall <richard.wall@venafi.com>

wallrj changed the title ~~WIP: [VC-28348] Publish venafi kubernetes agent chart~~ [VC-28348] Publish venafi kubernetes agent chart Nov 24, 2023

wallrj requested a review from hawksight November 24, 2023 13:01

wallrj commented Nov 24, 2023

View reviewed changes

wallrj changed the title ~~[VC-28348] Publish venafi kubernetes agent chart~~ [VC-28877] Publish venafi kubernetes agent chart Nov 24, 2023

hawksight approved these changes Nov 24, 2023

View reviewed changes

wallrj merged commit afdb47c into jetstack:master Nov 24, 2023
4 checks passed

wallrj deleted the publish-venafi-kubernetes-agent-chart branch November 24, 2023 15:00

wallrj mentioned this pull request Nov 24, 2023

Failing build: release-master: ERROR: Unable to validate cosign version: 'v1.13.1' #472

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[VC-28877] Publish venafi kubernetes agent chart #471

[VC-28877] Publish venafi kubernetes agent chart #471

wallrj commented Nov 22, 2023 •

edited

Loading

hawksight left a comment

hawksight Nov 24, 2023

wallrj Nov 24, 2023

ditatechwriter Nov 24, 2023

hawksight Nov 24, 2023

wallrj Nov 24, 2023

hawksight Nov 24, 2023

wallrj Nov 24, 2023

hawksight Nov 24, 2023

wallrj Nov 24, 2023

hawksight Nov 24, 2023

wallrj Nov 24, 2023

hawksight left a comment

hawksight Nov 24, 2023


		### 1) Setup registry credentials
		> Learn [how to access the private Venafi OCI registries](https://docs.venafi.cloud/vaas/k8s-components/th-guide-confg-access-to-tlspk-enterprise-components/).

[VC-28877] Publish venafi kubernetes agent chart #471

[VC-28877] Publish venafi kubernetes agent chart #471

Conversation

wallrj commented Nov 22, 2023 • edited Loading

Testing

hawksight left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hawksight left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

wallrj commented Nov 22, 2023 •

edited

Loading