Skip to content

Commit 70ded6c

Browse files
author
Engin Diri
authored
Feat: Add PAT handling with secrets, initContainers, extraVolumeMounts, extraVolumes and additionalEnv (#18)
Signed-off-by: Engin Diri <[email protected]>
1 parent 92d6211 commit 70ded6c

File tree

4 files changed

+137
-35
lines changed

4 files changed

+137
-35
lines changed

‎README.md

Lines changed: 24 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -38,24 +38,29 @@ $ helm upgrade --install azure-pipelines-agent emberstack/azure-pipelines-agent
3838

3939
You can customize the values of the helm deployment by using the following Values:
4040

41-
| Parameter | Description | Default |
42-
| ------------------------------------ | ----------------------------------------------------------- | ------------------------------------------------------- |
43-
| `nameOverride` | Overrides release name | `""` |
44-
| `fullnameOverride` | Overrides release fullname | `""` |
45-
| `image.repository` | Container image repository | `emberstack/azure-pipelines-agent` |
46-
| `image.tag` | Container image tag | `""` (same version as the chart) |
47-
| `image.pullPolicy` | Container image pull policy | `Always` if `image.tag` is `latest`, else `IfNotPresent`|
48-
| `pipelines.url` | The Azure base URL for your organization | `""` |
49-
| `pipelines.pat` | Personal Access Token (PAT) used by the agent to connect. | `""` |
50-
| `pipelines.pool` | Agent pool to which the Agent should register. | `""` |
51-
| `pipelines.agent.mountDocker` | Enable to mount the host `docker.sock` | `false` |
52-
| `pipelines.agent.workDir` | The work directory the agent should use | `_work` |
53-
| `serviceAccount.create` | Create ServiceAccount | `true` |
54-
| `serviceAccount.name` | ServiceAccount name | _release name_ |
55-
| `serviceAccount.clusterAdmin` | Sets the service account as a cluster admin | _release name_ |
56-
| `resources` | Resource limits | `{}` |
57-
| `nodeSelector` | Node labels for pod assignment | `{}` |
58-
| `tolerations` | Toleration labels for pod assignment | `[]` |
59-
| `affinity` | Node affinity for pod assignment | `{}` |
41+
| Parameter | Description | Default |
42+
|-------------------------------|---------------------------------------------------------------------------------------------------|----------------------------------------------------------|
43+
| `nameOverride` | Overrides release name | `""` |
44+
| `fullnameOverride` | Overrides release fullname | `""` |
45+
| `image.repository` | Container image repository | `emberstack/azure-pipelines-agent` |
46+
| `image.tag` | Container image tag | `""` (same version as the chart) |
47+
| `image.pullPolicy` | Container image pull policy | `Always` if `image.tag` is `latest`, else `IfNotPresent` |
48+
| `pipelines.url` | The Azure base URL for your organization | `""` |
49+
| `pipelines.pat.value` | Personal Access Token (PAT) used by the agent to connect. | `""` |
50+
| `pipelines.pat.secretRef` | The reference to the secret storing the Personal Access Token (PAT) used by the agent to connect. | `""` |
51+
| `pipelines.pool` | Agent pool to which the Agent should register. | `""` |
52+
| `pipelines.agent.mountDocker` | Enable to mount the host `docker.sock` | `false` |
53+
| `pipelines.agent.workDir` | The work directory the agent should use | `_work` |
54+
| `serviceAccount.create` | Create ServiceAccount | `true` |
55+
| `serviceAccount.name` | ServiceAccount name | _release name_ |
56+
| `serviceAccount.clusterAdmin` | Sets the service account as a cluster admin | _release name_ |
57+
| `resources` | Resource limits | `{}` |
58+
| `nodeSelector` | Node labels for pod assignment | `{}` |
59+
| `tolerations` | Toleration labels for pod assignment | `[]` |
60+
| `affinity` | Node affinity for pod assignment | `{}` |
61+
| `additionalEnv` | Additional environment variables for the agent container. | `[]` |
62+
| `extraVolumes` | Additional volumes for the agent pod. | `[]` |
63+
| `extraVolumeMounts` | Additional volume mounts for the agent container. | `[]` |
64+
| `initContainers` | InitContainers for the agent pod. | `[]` |
6065

6166
> Find us on [Artifact Hub](https://artifacthub.io/packages/helm/emberstack/azure-pipelines-agent)

‎src/helm/azure-pipelines-agent/templates/_helpers.tpl

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,3 +60,41 @@ Create the name of the service account to use
6060
{{- default "default" .Values.serviceAccount.name }}
6161
{{- end }}
6262
{{- end }}
63+
64+
{{/*
65+
Add volumes to the agent pod.
66+
*/}}
67+
{{- define "azure-pipelines-agent.volumes" -}}
68+
{{- if or .Values.pipelines.agent.mountDocker .Values.extraVolumes -}}
69+
volumes:
70+
{{- if .Values.extraVolumes }}
71+
{{- with .Values.extraVolumes }}
72+
{{ toYaml . }}
73+
{{- end }}
74+
{{- end }}
75+
{{- if .Values.pipelines.agent.mountDocker }}
76+
- name: dockersock
77+
hostPath:
78+
path: /var/run/docker.sock
79+
{{- end }}
80+
{{- end }}
81+
{{- end }}
82+
83+
84+
{{/*
85+
Add volume mounts to the agent container.
86+
*/}}
87+
{{- define "azure-pipelines-agent.volumeMounts" -}}
88+
{{- if or .Values.pipelines.agent.mountDocker .Values.extraVolumeMounts -}}
89+
volumeMounts:
90+
{{- if .Values.pipelines.agent.mountDocker }}
91+
- name: dockersock
92+
mountPath: /var/run/docker.sock
93+
{{- end }}
94+
{{- if .Values.extraVolumeMounts }}
95+
{{- with .Values.extraVolumeMounts }}
96+
{{ toYaml . }}
97+
{{- end }}
98+
{{- end }}
99+
{{- end }}
100+
{{- end }}

‎src/helm/azure-pipelines-agent/templates/statefulset.yaml

Lines changed: 18 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ spec:
2727
serviceAccountName: {{ include "azure-pipelines-agent.serviceAccountName" . }}
2828
securityContext:
2929
{{- toYaml .Values.podSecurityContext | nindent 8 }}
30+
{{- with .Values.initContainers }}
31+
initContainers:
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
3034
containers:
3135
- name: {{ .Chart.Name }}
3236
{{- if .Values.pipelines.agent.mountDocker }}
@@ -58,20 +62,22 @@ spec:
5862
- name: AZP_WORK
5963
value: {{ .Values.pipelines.agent.workDir | quote }}
6064
- name: AZP_TOKEN
61-
value: {{ .Values.pipelines.pat | quote }}
62-
{{- if .Values.pipelines.agent.mountDocker }}
63-
volumeMounts:
64-
- name: dockersock
65-
mountPath: "/var/run/docker.sock"
66-
{{- end }}
65+
{{- if .Values.pipelines.pat.secretRef }}
66+
{{- with .Values.pipelines.pat.secretRef }}
67+
valueFrom:
68+
secretKeyRef:
69+
{{- toYaml . | nindent 18 }}
70+
{{- end }}
71+
{{- else }}
72+
value: {{ .Values.pipelines.pat.value | quote }}
73+
{{- end }}
74+
{{- with .Values.additionalEnv }}
75+
{{- toYaml . | nindent 12 }}
76+
{{- end }}
6777
resources:
6878
{{- toYaml .Values.resources | nindent 12 }}
69-
{{- if .Values.pipelines.agent.mountDocker }}
70-
volumes:
71-
- name: dockersock
72-
hostPath:
73-
path: /var/run/docker.sock
74-
{{- end }}
79+
{{- include "azure-pipelines-agent.volumeMounts" . | nindent 10 -}}
80+
{{- include "azure-pipelines-agent.volumes" . | nindent 6 }}
7581
{{- with .Values.nodeSelector }}
7682
nodeSelector:
7783
{{- toYaml . | nindent 8 }}

‎src/helm/azure-pipelines-agent/values.yaml

Lines changed: 57 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,21 @@ imagePullSecrets: []
1414
nameOverride: ""
1515
fullnameOverride: ""
1616

17+
18+
# Pat: Can be either a string or a reference to a secret.
19+
# If it is a string, it is used as the value of the secret:
20+
#
21+
# value: "my-secret"
22+
#
23+
# If it is a reference to a secret:
24+
# secretRef:
25+
# name: my-secret
26+
# key: my-key
1727
pipelines:
1828
url: ""
19-
pat: ""
29+
pat:
30+
value: ""
31+
#secretRef: {}
2032
pool: "Default"
2133
agent:
2234
name: ""
@@ -33,15 +45,15 @@ serviceAccount:
3345
name: ""
3446

3547
podSecurityContext: {}
36-
# fsGroup: 2000
48+
# fsGroup: 2000
3749

3850
securityContext: {}
3951
# capabilities:
4052
# drop:
4153
# - ALL
4254
# readOnlyRootFilesystem: true
4355
# runAsNonRoot: true
44-
# runAsUser: 1000
56+
# runAsUser: 1000
4557

4658

4759
resources: {}
@@ -54,10 +66,51 @@ resources: {}
5466
# memory: 128Mi
5567
# requests:
5668
# cpu: 100m
57-
# memory: 128Mi
69+
# memory: 128Mi
5870

5971
nodeSelector: {}
6072

6173
tolerations: []
6274

6375
affinity: {}
76+
77+
# Additional environment variables for the agent container.
78+
# Like:
79+
# - name: XXX
80+
# value: "YYY"
81+
#
82+
# or reference to a secret or configmap:
83+
# - name: SPECIAL_LEVEL_KEY
84+
# valueFrom:
85+
# configMapKeyRef:
86+
# name: special-config
87+
# key: special.how
88+
#
89+
# - name: SECRET_KEY
90+
# valueFrom:
91+
# secretKeyRef:
92+
# name: secret-name
93+
# key: secret.key
94+
additionalEnv: []
95+
96+
# Additional volumes for the agent pod.
97+
# extraVolumes:
98+
# - name: config-volume
99+
# configMap:
100+
# name: special-config
101+
extraVolumes: []
102+
103+
# Additional volume mounts for the agent container.
104+
# extraVolumeMounts:
105+
# - name: config-volume
106+
# mountPath: /etc/special
107+
# readOnly: true
108+
extraVolumeMounts: []
109+
110+
# InitContainers for the agent pod.
111+
#
112+
# initContainers:
113+
# - name: init-container
114+
# image: busybox
115+
# command: ["/bin/sh", "-c", "echo Hello World"]
116+
initContainers: []

0 commit comments

Comments
 (0)