panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Cleanup documentation

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-11-08 13:11:58 +01:00
parent 37cd9f25e2
commit 0320c3f755
25 changed files with 130 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FAQ.md
+9 -3
View File
@@ -36,7 +36,8 @@ helm repo add spiffe https://spiffe.github.io/helm-charts-hardened
If you uninstall the SPIRE chart before all users of the CSI driver are removed, Pods will get stuck in a terminating state waiting for the driver, that no longer is installed, to unmount the volumes for the Pod. In order to fix this, reinstall the chart and remove all affected workloads that are not part of the SPIRE helm chart itself, before attempting to remove SPIRE again.
You can discover Pods that use the driver with the following command:
```
```shell
kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := printf "%s %s" .metadata.namespace .metadata.name}}{{range .spec.volumes}}{{if .csi.driver}}{{if eq .csi.driver "csi.spiffe.io"}}{{printf "%s\n" $nn}}{{end}}{{end}}{{end}}{{end}}'
```
@@ -44,17 +45,20 @@ kubectl get pods --all-namespaces -o go-template='{{range .items}}{{$nn := print
If you uninstall the SPIFFE CSI driver manually before removing the chart, Pods can still be using the driver and are unable to unmount the CSI volume.
To resolve, reinstall the chart before trying to remove it again.
To resolve, reinstall the chart before trying to remove it again.
## The PSAT plugin is not working
The chart requires `Projected Service Account Tokens` which has to be enabled on your Kubernetes API server. In most cases this is already done for you.
> **Note**: This is enabled by default with newer versions as shown by the existence of:
> [!Note]
> This is enabled by default with newer versions as shown by the existence of:
>
> ```yaml
> - --service-account-issuer
> - --service-account-key-file
> - --service-account-signing-key-file
> ```
See [Service Account Token Volume Projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) in the Kubernetes docs for more details.
@@ -64,7 +68,9 @@ command to SSH into the Docker Desktop K8s VM.
```bash
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
```
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
```yaml
spec:
containers: