add helm values for cluster controller primary access from secondary

[cliffcolvin]

Signed-off-by: Cliff Colvin [email protected]

What does this PR change?

Adds the ability to set primary cluster aggregator url, and define a service token/api key for access.

Does this PR rely on any other PRs?

NA

How does this PR impact users? (This is the kind of thing that goes in release notes!)

Adds ability to define url and api key for cluster-controller primary access

Links to Issues or tickets this PR addresses or fixes

What risks are associated with merging this PR? What is required to fully test this PR?

NA

How was this PR tested?

qa-eks3 for last few months

helm template from values:

clusterController:
  enabled: true
  primaryKubecostURL: "https://kubecost.myorg.com"
  kubecostAPIKey: "123"

give us:

# Source: cost-analyzer/templates/kubecost-cluster-controller-template.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: cost-analyzer-cluster-controller
  namespace: default
  ...
spec:
  ...
      containers:
      - name: cost-analyzer-cluster-controller
        image: gcr.io/kubecost1/cluster-controller:v0.16.12
        imagePullPolicy: IfNotPresent
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
        volumeMounts:
        - name: cluster-controller-keys
          mountPath: /var/keys
        env:
         ...
        - name: CC_LOG_LEVEL
          value: info
        - name: CC_KUBESCALER_COST_MODEL_PATH
          value: https://kubecost.myorg.com/model
        - name: CC_CCL_COST_MODEL_PATH
          value: https://kubecost.myorg.com/model
        - name: KUBECOST_API_KEY
          valueFrom:
            secretKeyRef:
              name: controller-secrets
              key: kubecostAPIKey
        ...
      volumes:
      - name: cluster-controller-keys
        secret:
          secretName: controller-secrets
          # The secret is optional because not all of cluster controller's
          # functionality requires this secret. Cluster controller will
          # partially or fully initialize based on the presence of these keys
          # and their validity.
          optional: true
---
# Source: cost-analyzer/templates/controller-secrets.yaml
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: controller-secrets
  namespace: default
  labels:
    app.kubernetes.io/name: cost-analyzer
    helm.sh/chart: cost-analyzer-2.3.3
    app.kubernetes.io/instance: cost-analyzer
    app.kubernetes.io/managed-by: Helm
    app: cost-analyzer
data:
  kubecostAPIKey: MTIz #base64 of api key 123

Have you made an update to documentation? If so, please provide the corresponding PR.

v2.6

[thomasvn]

@mittal-ishaan I've made some modifications. I removed the net new controller-secret.yaml and instead created the secret within the kubecost-cluster-controller-template.yaml.

[thomasvn]

@mittal-ishaan I am seeing similar results when running the following test:

clusterController:
  enabled: true
  primaryKubecostURL: "https://kubecost.myorganization.com"
  kubecostAPIKey: "1234"

helm template . -f values-thomas.yaml --show-only templates/kubecost-cluster-controller-template.yaml

Additionally, I've validated that the secret is only created when primaryKubecostURL exists:

# primaryKubecostURL is set
$ helm template . -f values-thomas.yaml --show-only templates/kubecost-cluster-controller-template.yaml | grep "kind"
kind: ServiceAccount
kind: Secret
kind: ClusterRole
kind: ClusterRoleBinding
  kind: ClusterRole
  - kind: ServiceAccount
kind: Service
kind: Deployment

# primaryKubecostURL="" and kubecostAPIKey=""
helm template . -f values-thomas.yaml --show-only templates/kubecost-cluster-controller-template.yaml | grep "kind"
kind: ServiceAccount
kind: ClusterRole
kind: ClusterRoleBinding
  kind: ClusterRole
  - kind: ServiceAccount
kind: Service
kind: Deployment

[thomasvn]

I'm approving. @mittal-ishaan Please merge if my changes look good here.

[mittal-ishaan]

/cherry-pick v2.6