To default helm-vault installation to vault enterprise when license is provided - #1202
Open
harshit-nema wants to merge 16 commits into
Open
harshit-nema wants to merge 16 commits into
harshit-nema wants to merge 16 commits into
Conversation
harshit-nema
changed the title
harshit-nema
marked this pull request as ready for review
August 10, 2026 17:35
vijayavelsekar
requested changes
Aug 18, 2026
| Otherwise return the tag as-is. | ||
| */}} | ||
| {{- define "vault.imageTag" -}} | ||
| {{- $tag := .Values.server.image.tag | default "latest" -}} |
Contributor
There was a problem hiding this comment.
tag will never be nil as it have a default value from the values.yaml file.
Also having default as latest seems contradicting to the default value in the vaules.yaml file.
Or we can have | default $.Chart.AppVersion and remove all the tag attributes from the values file so we can centrally control the vault version in one place(Chart.yaml)
We can discuss this with the team about this.
Suggested change
| {{- $tag := .Values.server.image.tag | default "latest" -}} | |
| {{- $tag := .Values.server.image.tag -}} |
| If the tag already carries the suffix it is left unchanged (idempotent). | ||
| */}} | ||
| {{- define "vault.agentImageTag" -}} | ||
| {{- $tag := .Values.injector.agentImage.tag | default "latest" -}} |
Contributor
There was a problem hiding this comment.
Suggested change
| {{- $tag := .Values.injector.agentImage.tag | default "latest" -}} | |
| {{- $tag := .Values.injector.agentImage.tag -}} |
| If the tag already carries the "-ent" suffix it is left unchanged (idempotent). | ||
| */}} | ||
| {{- define "vault.csiAgentImageTag" -}} | ||
| {{- $tag := .Values.csi.agent.image.tag | default "latest" -}} |
Contributor
There was a problem hiding this comment.
Suggested change
| {{- $tag := .Values.csi.agent.image.tag | default "latest" -}} | |
| {{- $tag := .Values.csi.agent.image.tag -}} |
siyer-corp
reviewed
Sep 6, 2026
| */}} | ||
| {{- define "vault.imageTag" -}} | ||
| {{- $tag := .Values.server.image.tag | default .Chart.AppVersion -}} | ||
| {{- if and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey -}} |
There was a problem hiding this comment.
This check is repeated many times. Could we extract this into another template and re-use that?
| --ref main \ | ||
| -f SOURCE_TAG="${{ github.ref_name }}" \ | ||
| -f SOURCE_REPO="${{ github.repository }}" | ||
| - uses: hashicorp/actions-slack-status@v2 |
Contributor
There was a problem hiding this comment.
These changes are already there in the main. Why is this showing up in this PR ?
Author
There was a problem hiding this comment.
rebased the branch. This change is gone now.
…hen license is provided
…rprise when license secret is configured
…nt.Test files are updated with new test cases
…hen license is provided
… be appended. Test cases also added on similar note
harshit-nema
force-pushed
the
VAULT-45655-vault-helm-default-to-vaultEnt
branch
from
September 9, 2026 07:11
43adb45 to
eeb59d5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ISSUE :
The chart already wired the licence volume, mount, and VAULT_LICENSE_PATH env var when
server.enterpriseLicense.secretNamewas set — but still served the Community Edition image, forcing Enterprise customers to manually overrideserver.image.repositoryandserver.image.tag.SOLUTION :
Added
vault.isEnterpriseas a single source of truth for the license check, and two generic helpers —vault.resolveImageRepositoryandvault.resolveImageTag— containing the shared resolution logic. Six thin wrapper helpers delegate to these for the server, injector agent, and CSI agent respectively.Resolution rules:
hashicorp/vault(the default) → auto-selecthashicorp/vault-enterprise(license) orhashicorp/vault(no license). Any other explicit repo is returned verbatim.AppVersion-ent(license) orAppVersion(no license). Any explicit tag is always returned verbatim — never mutated.Image render sites in
server-statefulset.yaml,injector-deployment.yaml, andcsi-daemonset.yamlwere updated to use these helpers. Empty tags now fall back toChart.AppVersioninstead oflatest, making CE installs reproducible by default.server.enterpriseLicense.secretNameis the only configuration needed — no manual image overrides required for any component.IMPLEMENTATION VERIFICATION :
helm install vault . --set server.enterpriseLicense.secretName=vault-ent-licensehelm install vault .PCI review checklist
I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.