Skip to content

Commit 2e208be

Browse files
authored
Readability changes for VSO CSI Helm docs (#1176)
* Readability changes for docs * Add EnterpriseAlert html
1 parent 3fcb114 commit 2e208be

File tree

1 file changed

+105
-71
lines changed
  • content/vault/v1.21.x/content/docs/deploy/kubernetes/vso

1 file changed

+105
-71
lines changed

content/vault/v1.21.x/content/docs/deploy/kubernetes/vso/helm.mdx

Lines changed: 105 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -92,27 +92,30 @@ Use these links to navigate to a particular top-level stanza.
9292
- antarctica-east1
9393
- antarctica-west1
9494

95-
- `topologySpreadConstraints` ((#v-controller-topologyspreadconstraints)) (`array: []`) - TopologySpreadConstraints settings for vault-secrets-operator pod.
96-
The value is an array of PodSpec TopologySpreadConstraint maps.
97-
A labelSelector for the pods will be added automatically to the template in case it is not set.
95+
- `topologySpreadConstraints` ((#v-controller-topologyspreadconstraints)) (`array: []`) - Topology spread constraint settings for the `vault-secrets-operator` pod
96+
as an array of PodSpec `topologySpreadConstraints` maps.
97+
VSO automatically adds a `labelSelector` entry to the templates if you do not provide a value.
9898
ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
9999
Example:
100+
101+
```yaml
100102
topologySpreadConstraints:
101103
- maxSkew: 1
102104
topologyKey: zone
103105
whenUnsatisfiable: DoNotSchedule
106+
```
104107

105-
- `podDisruptionBudget` ((#v-controller-poddisruptionbudget)) - Configure the PodDisruptionBudget for the controller deployment.
108+
- `podDisruptionBudget` ((#v-controller-poddisruptionbudget)) - Configures the PodDisruptionBudget for the controller deployment.
106109

107-
- `enabled` ((#v-controller-poddisruptionbudget-enabled)) (`boolean: false`) - toggles the deployment of the PodDisruptionBudget for the controller.
110+
- `enabled` ((#v-controller-poddisruptionbudget-enabled)) (`boolean: false`) - Toggles the deployment of the PodDisruptionBudget for the controller.
108111

109-
- `maxUnavailable` ((#v-controller-poddisruptionbudget-maxunavailable)) (`string: 0`) - Sets the maximum number of pods that can be unavailable during the eviction.
110-
This field cannot be set if minAvailable is set.
111-
Can be set as an integer (e.g. "2") or a percentage (e.g. "50%").
112+
- `maxUnavailable` ((#v-controller-poddisruptionbudget-maxunavailable)) (`string: 0`) - Sets the maximum number of unavailable pods during eviction.
113+
You cannot set both `maxUnavailable` and `minAvailable`.
114+
You can specify `maxUnavailable` as an integer ("2") or a percentage ("50%").
112115

113-
- `minAvailable` ((#v-controller-poddisruptionbudget-minavailable)) (`string: 0`) - Sets the number of pods that must be available during the eviction.
114-
This field cannot be set if maxUnavailable is set.
115-
Can be set as an integer (e.g. "2") or a percentage (e.g. "50%").
116+
- `minAvailable` ((#v-controller-poddisruptionbudget-minavailable)) (`string: 0`) - Sets the minimum number of available pods allowed during eviction.
117+
You cannot set both `minAvailable` and `maxUnavailable`.
118+
You can specify `minAvailable` as an integer ("2") or a percentage ("50%").
116119

117120
- `rbac` ((#v-controller-rbac))
118121

@@ -204,7 +207,7 @@ Use these links to navigate to a particular top-level stanza.
204207

205208
- `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`)
206209

207-
- `tag` ((#v-controller-manager-image-tag)) (`string: 0.10.0`)
210+
- `tag` ((#v-controller-manager-image-tag)) (`string: 1.0.1`)
208211

209212
- `logging` ((#v-controller-manager-logging)) - logging
210213

@@ -213,7 +216,13 @@ Use these links to navigate to a particular top-level stanza.
213216
Default: info
214217

215218
- `timeEncoding` ((#v-controller-manager-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the operator.
216-
Options are: epoch, millis, nano, iso8601, rfc3339, rfc3339nano
219+
Options are:
220+
- `epoch` - Unix timestamp in seconds (e.g. 1695382800)
221+
- `millis` - Unix timestamp in milliseconds (e.g. 1695382800000)
222+
- `nano` - Unix timestamp in nanoseconds (e.g. 1695382800000000000)
223+
- `iso8601` - ISO 8601 format (e.g. 2023-09-22T10:00:00Z)
224+
- `rfc3339` - RFC 3339 format (e.g. 2023-09-22T10:00:00Z)
225+
- `rfc3339nano` - RFC 3339 format with nanosecond precision (e.g. 2023-09-22T10:00:00.123456789Z)
217226
Default: rfc3339
218227

219228
- `stacktraceLevel` ((#v-controller-manager-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the operator.
@@ -753,41 +762,53 @@ Use these links to navigate to a particular top-level stanza.
753762

754763
### csi ((#h-csi))
755764

765+
<EnterpriseAlert inline="true" />
766+
756767
- `csi` ((#v-csi))
757768

758769
- `enabled` ((#v-csi-enabled)) (`boolean: false`) - Only supports Vault Enterprise servers.
759-
Toggles the deployment of the Vault Secrets Operator CSI driver. This will deploy the driver and the necessary
760-
resources to the cluster.
770+
Toggles the deployment of the Vault Secrets Operator CSI driver. Setting `enabled` to `true`
771+
deploys the CSI driver and the necessary resources to the cluster.
761772

762-
- `hostAliases` ((#v-csi-hostaliases)) (`array<map>`) - Host Aliases settings for the vault-secrets-operator-csi pods.
763-
The value is an array of PodSpec HostAlias maps.
773+
- `hostAliases` ((#v-csi-hostaliases)) (`array<map>`) - Host Aliases settings for the `vault-secrets-operator-csi` pods as
774+
an array of PodSpec HostAlias maps.
764775
ref: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
765776
Example:
777+
778+
```yaml
766779
hostAliases:
767780
- ip: 192.168.1.100
768781
hostnames:
769782
- vault.example.com
770783

771-
- `nodeSelector` ((#v-csi-nodeselector)) (`map`) - nodeSelector labels for vault-secrets-operator-csi pod assignment.
784+
- `nodeSelector` ((#v-csi-nodeselector)) (`map`) - Node selector labels for `vault-secrets-operator-csi` pod assignment.
772785
ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
773786
Example:
787+
788+
```yaml
774789
nodeSelector:
775790
beta.kubernetes.io/arch: amd64
791+
```
776792

777-
- `tolerations` ((#v-csi-tolerations)) (`array<map>`) - Toleration Settings for vault-secrets-operator-csi pods.
778-
The value is an array of PodSpec Toleration maps.
793+
- `tolerations` ((#v-csi-tolerations)) (`array<map>`) - Toleration settings for `vault-secrets-operator-csi` pods
794+
as an array of PodSpec Toleration maps.
779795
ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
780796
Example:
797+
798+
```yaml
781799
tolerations:
782800
- key: "key1"
783801
operator: "Equal"
784802
value: "value1"
785803
effect: "NoSchedule"
804+
```
786805

787-
- `affinity` ((#v-csi-affinity)) - Affinity settings for vault-secrets-operator-csi pods.
788-
The value is a map of PodSpec Affinity maps.
806+
- `affinity` ((#v-csi-affinity)) - Affinity settings for `vault-secrets-operator-csi` pods
807+
as a map of PodSpec Affinity maps.
789808
ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
790809
Example:
810+
811+
```yaml
791812
affinity:
792813
nodeAffinity:
793814
requiredDuringSchedulingIgnoredDuringExecution:
@@ -798,112 +819,125 @@ Use these links to navigate to a particular top-level stanza.
798819
values:
799820
- antarctica-east1
800821
- antarctica-west1
822+
```
801823

802-
- `imagePullSecrets` ((#v-csi-imagepullsecrets)) (`array<map>`) - Image pull secret to use for private container registry authentication which will be applied to the controllers
803-
service account. Alternatively, the value may be specified as an array of strings.
824+
- `imagePullSecrets` ((#v-csi-imagepullsecrets)) (`array<map>`) - Image pull secrets as an array of maps or strings for private container registry authentication for the controller
825+
service account.
826+
Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
804827
Example:
828+
805829
```yaml
806830
imagePullSecrets:
807831
- name: pull-secret-name-1
808832
- name: pull-secret-name-2
809833
```
810-
Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
811834

812-
- `extraLabels` ((#v-csi-extralabels)) - Extra labels to attach to the deployment. This should be formatted as a YAML object (map)
835+
- `extraLabels` ((#v-csi-extralabels)) - Additional deployment labels as a YAML object (map).
813836

814-
- `annotations` ((#v-csi-annotations)) - This value defines additional annotations for the deployment. This should be formatted as a YAML object (map)
837+
- `annotations` ((#v-csi-annotations)) - Additional deployment annotations as a YAML object (map).
815838

816839
- `driver` ((#v-csi-driver))
817840

818-
- `image` ((#v-csi-driver-image)) - Image sets the repo and tag of the vault-secrets-operator-csi image to use for the driver.
841+
- `image` ((#v-csi-driver-image)) - Image information for the CSI driver.
842+
ref: https://kubernetes.io/docs/concepts/containers/images/
819843

820-
- `pullPolicy` ((#v-csi-driver-image-pullpolicy)) (`string: IfNotPresent`)
844+
- `pullPolicy` ((#v-csi-driver-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
821845

822-
- `repository` ((#v-csi-driver-image-repository)) (`string: hashicorp/vault-secrets-operator-csi`)
846+
- `repository` ((#v-csi-driver-image-repository)) (`string: hashicorp/vault-secrets-operator-csi`) - The Docker repository of the CSI driver image.
823847

824-
- `tag` ((#v-csi-driver-image-tag)) (`string: 0.0.0-dev`)
848+
- `tag` ((#v-csi-driver-image-tag)) (`string: 1.0.0`) - The version of the CSI driver image to download.
825849

826-
- `extraEnv` ((#v-csi-driver-extraenv)) (`array<map>`) - Defines additional environment variables to be added to the
850+
- `extraEnv` ((#v-csi-driver-extraenv)) (`array<map>`) - Additional environment variables for the
827851
CSI driver container.
828852

829-
- `extraArgs` ((#v-csi-driver-extraargs)) (`array: []`) - Extra arguments to pass to the driver.
853+
- `extraArgs` ((#v-csi-driver-extraargs)) (`array: []`) - Additional arguments to pass to the CSI driver.
830854

831-
- `logging` ((#v-csi-driver-logging)) - logging
855+
- `logging` ((#v-csi-driver-logging)) - Configures logging output settings for the CSI driver.
832856

833-
- `level` ((#v-csi-driver-logging-level)) (`string: info`) - Sets the log level for the driver.
834-
Builtin levels are: info, error, debug, debug-extended, trace
857+
- `level` ((#v-csi-driver-logging-level)) (`string: info`) - Sets the log level for the CSI driver.
858+
Must be one of: info, error, debug, debug-extended, trace.
835859
Default: info
836860

837-
- `timeEncoding` ((#v-csi-driver-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the driver.
838-
Options are: epoch, millis, nano, iso8601, rfc3339, rfc3339nano
861+
- `timeEncoding` ((#v-csi-driver-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the CSI driver.
862+
Must be one of:
863+
- epoch - Unix timestamp in seconds (e.g. 1695382800)
864+
- millis - Unix timestamp in milliseconds (e.g. 1695382800000)
865+
- nano - Unix timestamp in nanoseconds (e.g. 1695382800000000000)
866+
- iso8601 - ISO 8601 format (e.g. 2023-09-22T10:00:00Z)
867+
- rfc3339 - RFC 3339 format (e.g. 2023-09-22T10:00:00Z)
868+
- rfc3339nano - RFC 3339 format with nanosecond precision (e.g. 2023-09-22T10:00:00.123456789Z)
839869
Default: rfc3339
840870

841-
- `stacktraceLevel` ((#v-csi-driver-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the driver.
842-
Options are: info, error, panic
871+
- `stacktraceLevel` ((#v-csi-driver-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the CSI driver.
872+
Must be one of: info, error, panic.
843873
Default: panic
844874

845-
- `backoffOnSecretSourceError` ((#v-csi-driver-backoffonsecretsourceerror)) (`object: ""`) - Backoff settings for the CSI driver. These settings control the backoff behavior
846-
when the driver encounters an error while fetching secrets from the SecretSource.
847-
For example given the following settings:
875+
- `backoffOnSecretSourceError` ((#v-csi-driver-backoffonsecretsourceerror)) (`object: ""`) - Describes backoff behavior for the CSI driver when the driver encounters
876+
an error fetching secrets from `SecretSource`.
877+
For example, the following configuration creates a backoff retry sequence like
878+
5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s, etc.:
879+
880+
```yaml
848881
initialInterval: 5s
849882
maxInterval: 60s
850883
randomizationFactor: 0.5
851884
multiplier: 1.5
852-
853-
The backoff retry sequence might be something like:
854-
5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s...
885+
```
855886

856887
- `initialInterval` ((#v-csi-driver-backoffonsecretsourceerror-initialinterval)) (`duration: 5s`) - Initial interval between retries.
857888

858889
- `maxInterval` ((#v-csi-driver-backoffonsecretsourceerror-maxinterval)) (`duration: 60s`) - Maximum interval between retries.
859890

860-
- `maxElapsedTime` ((#v-csi-driver-backoffonsecretsourceerror-maxelapsedtime)) (`duration: 0s`) - Maximum elapsed time without a successful sync from the secret's source.
861-
It's important to note that setting this option to anything other than
862-
its default will result in the secret sync no longer being retried after
863-
reaching the max elapsed time.
891+
- `maxElapsedTime` ((#v-csi-driver-backoffonsecretsourceerror-maxelapsedtime)) (`duration: 0s`) - Maximum elapsed time without a successful sync from the secret source.
892+
Setting an explicit `maxElapsedTime` tells VSO not to
893+
retry the secret sync once it reaches the max elapsed time.
864894

865-
- `randomizationFactor` ((#v-csi-driver-backoffonsecretsourceerror-randomizationfactor)) (`float: 0.5`) - Randomization factor randomizes the backoff interval between retries.
866-
This helps to spread out the retries to avoid a thundering herd.
867-
If the value is 0, then the backoff interval will not be randomized.
868-
It is recommended to set this to a value that is greater than 0.
895+
- `randomizationFactor` ((#v-csi-driver-backoffonsecretsourceerror-randomizationfactor)) (`float: 0.5`) - Custom factor used to randomize the backoff interval between retries
896+
to spread out the retries and avoid a thundering herd.
897+
We strongly recommend using a randomization factor, but you can set
898+
`randomizationFactor` to 0 to disable randomization.
869899

870-
- `multiplier` ((#v-csi-driver-backoffonsecretsourceerror-multiplier)) (`float: 1.5`) - Sets the multiplier that is used to increase the backoff interval between retries.
871-
This value should always be set to a value greater than 0.
872-
The value must be greater than zero.
900+
- `multiplier` ((#v-csi-driver-backoffonsecretsourceerror-multiplier)) (`float: 1.5`) - Sets a multiplier used to increase the backoff interval between retries.
901+
You cannot set `multiplier` to a value less than or equal to 0.
873902

874-
- `livenessProbe` ((#v-csi-livenessprobe))
903+
- `livenessProbe` ((#v-csi-livenessprobe)) - The liveness probe checks the health of the CSI driver container.
875904

876-
- `image` ((#v-csi-livenessprobe-image)) - Image sets the repo and tag of the image to use for the liveness probe.
905+
- `image` ((#v-csi-livenessprobe-image)) - Image information for the CSI driver liveness probe.
906+
ref: https://kubernetes.io/docs/concepts/containers/images/
877907

878-
- `pullPolicy` ((#v-csi-livenessprobe-image-pullpolicy)) (`string: IfNotPresent`)
908+
- `pullPolicy` ((#v-csi-livenessprobe-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
879909

880-
- `repository` ((#v-csi-livenessprobe-image-repository)) (`string: registry.k8s.io/sig-storage/livenessprobe`)
910+
- `repository` ((#v-csi-livenessprobe-image-repository)) (`string: registry.k8s.io/sig-storage/livenessprobe`) - The Docker repository of the liveness probe image.
881911

882-
- `tag` ((#v-csi-livenessprobe-image-tag)) (`string: v2.10.0`)
912+
- `tag` ((#v-csi-livenessprobe-image-tag)) (`string: v2.16.0`) - The version of the liveness probe image to download.
883913

884-
- `extraArgs` ((#v-csi-livenessprobe-extraargs)) (`array: []`) - Extra arguments to pass to the liveness probe container.
914+
- `extraArgs` ((#v-csi-livenessprobe-extraargs)) (`array: []`) - Additional arguments to pass to the liveness probe container.
885915

886-
- `nodeDriverRegistrar` ((#v-csi-nodedriverregistrar))
916+
- `nodeDriverRegistrar` ((#v-csi-nodedriverregistrar)) - The node driver registrar sidecar container handles registration with the kubelet.
887917

888-
- `image` ((#v-csi-nodedriverregistrar-image)) - Image sets the repo and tag of the image to use for the node driver registrar.
918+
- `image` ((#v-csi-nodedriverregistrar-image)) - Image information for the CSI driver node driver registrar.
919+
ref: https://kubernetes.io/docs/concepts/containers/images/
889920

890-
- `pullPolicy` ((#v-csi-nodedriverregistrar-image-pullpolicy)) (`string: IfNotPresent`)
921+
- `pullPolicy` ((#v-csi-nodedriverregistrar-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
891922

892-
- `repository` ((#v-csi-nodedriverregistrar-image-repository)) (`string: registry.k8s.io/sig-storage/csi-node-driver-registrar`)
923+
- `repository` ((#v-csi-nodedriverregistrar-image-repository)) (`string: registry.k8s.io/sig-storage/csi-node-driver-registrar`) - The Docker repository of the node driver registrar image.
893924

894-
- `tag` ((#v-csi-nodedriverregistrar-image-tag)) (`string: v2.8.0`)
925+
- `tag` ((#v-csi-nodedriverregistrar-image-tag)) (`string: v2.14.0`) - The version of the node driver registrar image to download.
895926

896-
- `extraArgs` ((#v-csi-nodedriverregistrar-extraargs)) (`array: []`) - Extra arguments to pass to the node driver registrar container.
927+
- `extraArgs` ((#v-csi-nodedriverregistrar-extraargs)) (`array: []`) - Additional arguments to pass to the node driver registrar container.
897928

898-
- `updateStrategy` ((#v-csi-updatestrategy)) (`object: ""`) - Configure update strategy for the DaemonSet
899-
Kubernetes supports types Recreate, and RollingUpdate
929+
- `updateStrategy` ((#v-csi-updatestrategy)) (`object: ""`) - Configures the update strategy for the CSI driver DaemonSet.
930+
Must be one of: Recreate, RollingUpdate.
900931
ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
901932
Example:
933+
934+
```yaml
902935
strategy: {}
903936
rollingUpdate:
904937
maxSurge: 1
905938
maxUnavailable: 0
906939
type: RollingUpdate
940+
```
907941

908942
### tests ((#h-tests))
909943

0 commit comments

Comments
 (0)