AB#2490: Add KMS helm chart

* Also run helm-lint in CI now

.github/workflows/test-helm-lint.yaml

@@ -0,0 +1,40 @@
+name: Lint Helm Charts
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "cli/internal/helm/charts/**"
+  pull_request:
+    paths:
+      - "cli/internal/helm/charts/**"
+
+# Abort runs of *this* workflow, if a new commit with the same ref is pushed.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+
+jobs:
+  helm-lint:
+    runs-on: ubuntu-latest
+    env:
+      CTEST_OUTPUT_ON_FAILURE: True
+    steps:
+      - name: Checkout
+        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v3
+        with:
+          version: 'v3.9.0' # default is latest (stable)
+
+      - name: Create and populate build folder
+        run: mkdir build && cd build && cmake ..
+
+      - name: Unit Tests
+        run: ctest -R helm-lint
+        working-directory: build

CMakeLists.txt

@@ -63,3 +63,4 @@ add_test(NAME integration-node-operator COMMAND make test WORKING_DIRECTORY ${CM
 add_test(NAME integration-csi COMMAND bash -c "go test -tags integration -c ./test/ && sudo ./test.test -test.v" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/csi)
 add_test(NAME integration-dm COMMAND bash -c "go test -tags integration -c ./test/ && sudo ./test.test -test.v" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/disk-mapper/internal)
 add_test(NAME integration-license COMMAND bash -c "go test -tags integration" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/internal/license)
+add_test(NAME helm-lint COMMAND bash -c "helm lint --strict *" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/cli/internal/helm/charts/edgeless/)

cli/internal/helm/charts/edgeless/kms/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

cli/internal/helm/charts/edgeless/kms/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: kms
+description: A Helm chart to deploy the Constellation Key Management Service
+type: application
+version: 0.1.0
+appVersion: "2.1.0"

cli/internal/helm/charts/edgeless/kms/templates/clusterrole.yaml

@@ -0,0 +1,13 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    k8s-app: kms
+  name: kms
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get

cli/internal/helm/charts/edgeless/kms/templates/clusterrolebinding.yaml

@@ -0,0 +1,12 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kms
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kms
+subjects:
+- kind: ServiceAccount
+  name: kms
+  namespace: {{ .Values.namespace }}

cli/internal/helm/charts/edgeless/kms/templates/daemonset.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    component: kms
+    k8s-app: kms
+    kubernetes.io/cluster-service: "true"
+  name: kms
+  namespace: {{ .Values.namespace }}
+spec:
+  selector:
+    matchLabels:
+      k8s-app: kms
+  template:
+    metadata:
+      labels:
+        k8s-app: kms
+    spec:
+      containers:
+      - args:
+        - --port={{ .Values.kmsPort }}
+        image: {{ .Values.kmsImage }}
+        name: kms
+        resources: {}
+        volumeMounts:
+        - mountPath: {{ .Values.serviceBasePath }}
+          name: config
+          readOnly: true
+      nodeSelector:
+        node-role.kubernetes.io/control-plane: ""
+      priorityClassName: system-cluster-critical
+      serviceAccountName: kms
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+        operator: Equal
+        value: "true"
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+        operator: Exists
+      - effect: NoExecute
+        operator: Exists
+      - effect: NoSchedule
+        operator: Exists
+      volumes:
+      - name: config
+        projected:
+          sources:
+          - configMap:
+              items:
+              - key: {{ .Values.measurementsFilename }}
+                path: {{ .Values.measurementsFilename }}
+              name: {{ .Values.joinConfigCMName }}
+          - secret:
+              items:
+              - key: {{ .Values.masterSecretKeyName }}
+                path: {{ .Values.masterSecretKeyName }}
+              - key: {{ .Values.saltKeyName }}
+                path: {{ .Values.saltKeyName }}
+              name: {{ .Values.masterSecretName }}
+  updateStrategy: {}

cli/internal/helm/charts/edgeless/kms/templates/mastersecret.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: {{ .Values.masterSecretName }}
+  namespace: {{ .Values.namespace }}
+data:
+  mastersecret: {{ .Values.masterSecret }}
+  salt: {{ .Values.salt }}

cli/internal/helm/charts/edgeless/kms/templates/service.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kms
+  namespace: {{ .Values.namespace }}
+spec:
+  ports:
+  - name: grpc
+    port: {{ .Values.kmsPort }}
+    protocol: TCP
+    targetPort: {{ .Values.kmsPort }}
+  selector:
+    k8s-app: kms
+  type: ClusterIP
+status:
+  loadBalancer: {}

cli/internal/helm/charts/edgeless/kms/templates/serviceaccount.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kms
+  namespace: {{ .Values.namespace }}

cli/internal/helm/charts/edgeless/kms/values.yaml

@@ -0,0 +1,22 @@
+# Namespace to which KMS will be deployed.
+namespace: "kube-system"
+# Port on which the service will listen.
+kmsPort: 9000
+# Name of the ConfigMap that holds measurements and other info.
+joinConfigCMName: join-config
+# Path to which secrets/CMs are mounted.
+serviceBasePath: /var/config
+# Container image.
+kmsImage: setFullImagePathHere
+# Salt for key derivation.
+salt: ""
+# Name of the key within the respective secret that holds the salt.
+saltKeyName: salt
+# MasterSecret for the cluster.
+masterSecret: ""
+# Name of the secret that contains the master secret.
+masterSecretName: constellation-mastersecret
+# Name of the key within the respective secret that holds the master secret.
+masterSecretKeyName: mastersecret
+# Name of the ConfigMap that holds the measurements.
+measurementsFilename: measurements