feat(charts): add hostAliases support (#5866)

Signed-off-by: Jan Lauber <jan.lauber@protonmail.ch>
Co-authored-by: Gergely Bräutigam <skarlso777@gmail.com>

deploy/charts/external-secrets/README.md

@@ -45,6 +45,7 @@ The command removes all the Kubernetes components associated with the chart and
 | certController.extraInitContainers | list | `[]` |  |
 | certController.extraVolumeMounts | list | `[]` |  |
 | certController.extraVolumes | list | `[]` |  |
+| certController.hostAliases | list | `[]` | Specifies `hostAliases` to cert-controller deployment |
 | certController.hostNetwork | bool | `false` | Run the certController on the host network |
 | certController.hostUsers | bool | `nil` | Specifies if certController pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33. @schema type: [boolean, null] |
 | certController.image.flavour | string | `""` |  |
@@ -119,6 +120,7 @@ The command removes all the Kubernetes components associated with the chart and
 | genericTargets.resources | list | `[]` | List of additional resource types to grant permissions for. Each entry should specify apiGroup, resources, and verbs. Example: resources:   - apiGroup: "argoproj.io"     resources: ["applications"]     verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] |
 | global.affinity | object | `{}` |  |
 | global.compatibility.openshift.adaptSecurityContext | string | `"auto"` | Manages the securityContext properties to make them compatible with OpenShift. Possible values: auto - Apply configurations if it is detected that OpenShift is the target platform. force - Always apply configurations. disabled - No modification applied. |
+| global.hostAliases | list | `[]` | Global hostAliases to be applied to all deployments |
 | global.imagePullSecrets | list | `[]` | Global imagePullSecrets to be applied to all deployments |
 | global.nodeSelector | object | `{}` |  |
 | global.podAnnotations | object | `{}` | Global pod annotations to be applied to all deployments |
@@ -131,6 +133,7 @@ The command removes all the Kubernetes components associated with the chart and
 | grafanaDashboard.extraLabels | object | `{}` | Extra labels to add to the Grafana dashboard ConfigMap. |
 | grafanaDashboard.sidecarLabel | string | `"grafana_dashboard"` | Label that ConfigMaps should have to be loaded as dashboards. |
 | grafanaDashboard.sidecarLabelValue | string | `"1"` | Label value that ConfigMaps should have to be loaded as dashboards. |
+| hostAliases | list | `[]` | Specifies `hostAliases` to deployment |
 | hostNetwork | bool | `false` | Run the controller on the host network |
 | hostUsers | bool | `nil` | Specifies if controller pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33. @schema type: [boolean, null] |
 | image.flavour | string | `""` | The flavour of tag you want to use There are different image flavours available, like distroless and ubi. Please see GitHub release notes for image tags for these flavors. By default, the distroless image is used. |
@@ -235,6 +238,7 @@ The command removes all the Kubernetes components associated with the chart and
 | webhook.extraVolumeMounts | list | `[]` |  |
 | webhook.extraVolumes | list | `[]` |  |
 | webhook.failurePolicy | string | `"Fail"` | Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore |
+| webhook.hostAliases | list | `[]` | Specifies `hostAliases` to webhook deployment |
 | webhook.hostNetwork | bool | `false` | Specifies if webhook pod should use hostNetwork or not. |
 | webhook.hostUsers | bool | `nil` | Specifies if webhook pod should use hostUsers or not. If hostNetwork is true, hostUsers should be too. Only available in Kubernetes ≥ 1.33. @schema type: [boolean, null] |
 | webhook.image.flavour | string | `""` | The flavour of tag you want to use |

deploy/charts/external-secrets/templates/cert-controller-deployment.yaml

@@ -146,6 +146,10 @@ spec:
       volumes:
       {{- toYaml .Values.certController.extraVolumes | nindent 8 }}
       {{- end }}
+      {{- with .Values.certController.hostAliases | default .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.certController.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deploy/charts/external-secrets/templates/deployment.yaml

@@ -178,6 +178,10 @@ spec:
       dnsConfig:
           {{- toYaml .Values.dnsConfig | nindent 8 }}
       {{- end }}
+      {{- with .Values.hostAliases | default .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.extraVolumes }}
       volumes:
       {{- toYaml .Values.extraVolumes | nindent 8 }}

deploy/charts/external-secrets/templates/webhook-deployment.yaml

@@ -133,6 +133,10 @@ spec:
       {{- if .Values.webhook.extraVolumes }}
       {{- toYaml .Values.webhook.extraVolumes | nindent 8 }}
       {{- end }}
+      {{- with .Values.webhook.hostAliases | default .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.webhook.nodeSelector | default .Values.global.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

deploy/charts/external-secrets/tests/cert_controller_test.yaml

@@ -314,3 +314,62 @@ tests:
     asserts:
       - notExists:
           path: spec.template.spec.hostUsers
+  - it: should not have hostAliases by default
+    templates:
+      - cert-controller-deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.hostAliases
+  - it: should add hostAliases when configured
+    set:
+      certController.hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "cert.example.local"
+            - "cert"
+    templates:
+      - cert-controller-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "cert.example.local"
+                - "cert"
+  - it: should use global hostAliases when certController level not set
+    set:
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    templates:
+      - cert-controller-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.200"
+              hostnames:
+                - "global.example.com"
+  - it: should prefer certController hostAliases over global
+    set:
+      certController.hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "cert.example.com"
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    templates:
+      - cert-controller-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "cert.example.com"

deploy/charts/external-secrets/tests/controller_test.yaml

@@ -251,3 +251,60 @@ tests:
     asserts:
       - notExists:
           path: spec.template.spec.hostUsers
+  - it: should not have hostAliases by default
+    asserts:
+      - notExists:
+          path: spec.template.spec.hostAliases
+  - it: should add hostAliases when configured
+    set:
+      hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "example.local"
+            - "example"
+        - ip: "10.0.0.1"
+          hostnames:
+            - "internal.example.com"
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "example.local"
+                - "example"
+            - ip: "10.0.0.1"
+              hostnames:
+                - "internal.example.com"
+  - it: should use global hostAliases when root level not set
+    set:
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.200"
+              hostnames:
+                - "global.example.com"
+  - it: should prefer root level hostAliases over global
+    set:
+      hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "root.example.com"
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "root.example.com"

deploy/charts/external-secrets/tests/webhook_test.yaml

@@ -501,3 +501,62 @@ tests:
     asserts:
       - notExists:
           path: spec.template.spec.hostUsers
+  - it: should not have hostAliases by default
+    templates:
+      - webhook-deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.hostAliases
+  - it: should add hostAliases when configured
+    set:
+      webhook.hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "webhook.example.local"
+            - "webhook"
+    templates:
+      - webhook-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "webhook.example.local"
+                - "webhook"
+  - it: should use global hostAliases when webhook level not set
+    set:
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    templates:
+      - webhook-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.200"
+              hostnames:
+                - "global.example.com"
+  - it: should prefer webhook hostAliases over global
+    set:
+      webhook.hostAliases:
+        - ip: "192.168.1.100"
+          hostnames:
+            - "webhook.example.com"
+      global:
+        hostAliases:
+          - ip: "192.168.1.200"
+            hostnames:
+              - "global.example.com"
+    templates:
+      - webhook-deployment.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.hostAliases
+          value:
+            - ip: "192.168.1.100"
+              hostnames:
+                - "webhook.example.com"

deploy/charts/external-secrets/values.schema.json

@@ -43,6 +43,9 @@
                 "extraVolumes": {
                     "type": "array"
                 },
+                "hostAliases": {
+                    "type": "array"
+                },
                 "hostNetwork": {
                     "type": "boolean"
                 },
@@ -380,6 +383,9 @@
                         }
                     }
                 },
+                "hostAliases": {
+                    "type": "array"
+                },
                 "imagePullSecrets": {
                     "type": "array"
                 },
@@ -423,6 +429,9 @@
                 }
             }
         },
+        "hostAliases": {
+            "type": "array"
+        },
         "hostNetwork": {
             "type": "boolean"
         },
@@ -874,6 +883,9 @@
                 "failurePolicy": {
                     "type": "string"
                 },
+                "hostAliases": {
+                    "type": "array"
+                },
                 "hostNetwork": {
                     "type": "boolean"
                 },

deploy/charts/external-secrets/values.yaml

@@ -14,6 +14,8 @@ global:
   #    matchLabelKeys:
   #      - pod-template-hash
   affinity: {}
+  # -- Global hostAliases to be applied to all deployments
+  hostAliases: []
   # -- Global pod labels to be applied to all deployments
   podLabels: {}
   # -- Global pod annotations to be applied to all deployments
@@ -440,6 +442,9 @@ webhook:
     name: ""
   nodeSelector: {}
 
+  # -- Specifies `hostAliases` to webhook deployment
+  hostAliases: []
+
   certManager:
     # -- Enabling cert-manager support will disable the built in secret and
     # switch to using cert-manager (installed separately) to automatically issue
@@ -625,6 +630,9 @@ certController:
     name: ""
   nodeSelector: {}
 
+  # -- Specifies `hostAliases` to cert-controller deployment
+  hostAliases: []
+
   tolerations: []
 
   topologySpreadConstraints: []
@@ -729,5 +737,8 @@ dnsPolicy: ClusterFirst
 # -- Specifies `dnsOptions` to deployment
 dnsConfig: {}
 
+# -- Specifies `hostAliases` to deployment
+hostAliases: []
+
 # -- Any extra pod spec on the deployment
 podSpecExtra: {}