diff --git a/.github/tests/lockdown/.env b/.github/tests/lockdown/.env new file mode 100644 index 0000000..7b6e741 --- /dev/null +++ b/.github/tests/lockdown/.env @@ -0,0 +1 @@ +export EXTRA_HELM_ARGS="--values=examples/production/values.yaml" diff --git a/.github/tests/lockdown/post-install.sh b/.github/tests/lockdown/post-install.sh new file mode 100755 index 0000000..d93ebd9 --- /dev/null +++ b/.github/tests/lockdown/post-install.sh @@ -0,0 +1,48 @@ +#!/usr/bin/env bash + +set -x + +SCRIPT=$(readlink -f "$0") +SCRIPTPATH=$(dirname "$SCRIPT") + +k_wait=(kubectl wait --for condition=available --timeout 30s --namespace) +k_rollout_status=(kubectl rollout status --watch --timeout 30s --namespace) + +cat <>"$GITHUB_STEP_SUMMARY" +### spire +| workload | Status | +| -------- | ------ | +| spire-server | $("${k_rollout_status[@]}" spire-server statefulset spire-server) | +| spire-spiffe-csi-driver | $("${k_rollout_status[@]}" spire-system daemonset spire-spiffe-csi-driver) | +| spire-agent | $("${k_rollout_status[@]}" spire-system daemonset spire-agent) | +| spire-spiffe-oidc-discovery-provider | $("${k_wait[@]}" spire-server deployments.apps spire-spiffe-oidc-discovery-provider) | +EOF + +if [ $1 -ne 0 ]; then + echo + echo '```' + echo '==> Events of namespace spire-server' + echo '........................................................................................................................' + echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-server' + kubectl --request-timeout=30s get events --output wide --namespace spire-server + echo '........................................................................................................................' + echo '<== Events of namespace spire-server' + echo '........................................................................................................................' + echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-server' + kubectl --request-timeout=30s describe pods --namespace spire-server + echo '========================================================================================================================' + echo '==> Events of namespace spire-system' + echo '........................................................................................................................' + echo '>>> kubectl --request-timeout=30s get events --output wide --namespace spire-system' + kubectl --request-timeout=30s get events --output wide --namespace spire-system + echo '........................................................................................................................' + echo '<== Events of namespace spire-system' + echo '........................................................................................................................' + echo '>>> kubectl --request-timeout=30s describe pods --namespace spire-system' + kubectl --request-timeout=30s describe pods --namespace spire-system + echo '========================================================================================================================' + kubectl get pods -o name -n spire-server | while read line; do echo logs for $line; kubectl logs -n spire-server $line --all-containers=true --ignore-errors=true; done + kubectl get pods -o name -n spire-system | while read line; do echo logs for $line; kubectl logs -n spire-system $line --all-containers=true --ignore-errors=true; done + echo '========================================================================================================================' + echo '```' +fi | cat >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/tests/lockdown/pre-install.sh b/.github/tests/lockdown/pre-install.sh index 62bfeae..8336be0 100755 --- a/.github/tests/lockdown/pre-install.sh +++ b/.github/tests/lockdown/pre-install.sh @@ -1,5 +1,5 @@ #!/bin/bash -kubectl label namespace "$scenario" pod-security.kubernetes.io/enforce=privileged -kubectl create namespace "${scenario}-deps" -kubectl label namespace "${scenario}-deps" pod-security.kubernetes.io/enforce=restricted -helm install -n "${scenario}-deps" spire charts/spire -f "${TEST_DIR}"/deps-values.yaml +kubectl create namespace "spire-system" +kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged +kubectl create namespace "spire-server" +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted diff --git a/.github/tests/lockdown/values.yaml b/.github/tests/lockdown/values.yaml index 182e582..3260fb5 100644 --- a/.github/tests/lockdown/values.yaml +++ b/.github/tests/lockdown/values.yaml @@ -1,20 +1,5 @@ -global: - telemetry: - prometheus: - enabled: true - -spiffe-csi-driver: - enabled: true - -spire-agent: - enabled: true - serviceAccount: - name: spire-agent - server: - address: spire-server.lockdown-deps - spiffe-oidc-discovery-provider: - enabled: false + namespaceOverride: spire-server spire-server: - enabled: false + namespaceOverride: spire-server diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 1504901..0aba8c9 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -2,7 +2,7 @@ apiVersion: apps/v1 kind: DaemonSet metadata: name: {{ include "spiffe-csi-driver.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spiffe-csi-driver.namespace" . }} labels: {{- include "spiffe-csi-driver.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index ddcbc83..0f785c6 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -41,6 +41,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | | insecureScheme.nginx.resources | object | `{}` | | | nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | | nodeSelector | object | `{}` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index aea5274..7236c91 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name. {{- end }} {{- end }} +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spiffe-oidc-discovery-provider.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 49453d8..cd188a1 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -3,15 +3,15 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} data: oidc-discovery-provider.conf: | log_level = "{{ .Values.config.logLevel }}" domains = [ "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local", {{- if gt (len .Values.config.domains) 0 }} "{{- join "\",\n \"" .Values.config.domains }}" {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index c316e79..39f192f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -3,6 +3,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml index 937d80c..fcacb3f 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml @@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml index 3d1bd9e..e398216 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} {{- with .Values.service.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml index 31cdf7b..da64d7d 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index 7c2389e..7c222c5 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Pod metadata: name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection" + namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }} labels: {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} annotations: @@ -19,13 +20,13 @@ spec: - name: wget-service-name-namespace image: busybox command: ['wget'] - args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} - name: wget-service-name-namespace-svc-cluster-local image: busybox command: ['wget'] - args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] + args: ['-O', '/dev/null', '{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] securityContext: {{- toYaml .Values.securityContext | nindent 8 }} restartPolicy: Never diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index cb9f7aa..ed7489e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -6,6 +6,8 @@ agentSocket: spire-agent.sock replicaCount: 1 +namespaceOverride: "" + image: # registry: gcr.io # repository: spiffe-io/oidc-discovery-provider diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index fb0f9f7..b6bd83b 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -30,6 +30,7 @@ A Helm chart to install the SPIRE agent. | initContainers | list | `[]` | | | logLevel | string | `"info"` | | | nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | | nodeSelector | object | `{}` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | @@ -37,6 +38,7 @@ A Helm chart to install the SPIRE agent. | resources | object | `{}` | | | securityContext | object | `{}` | | | server.address | string | `""` | | +| server.namespaceOverride | string | `""` | | | server.port | int | `8081` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 7fc6508..5fa7b3a 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -23,6 +23,25 @@ If release name contains chart name it will be used as a full name. {{- end }} {{- end }} +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spire-agent.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{- define "spire-agent.server.namespace" -}} + {{- if .Values.server.namespaceOverride -}} + {{- .Values.server.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} @@ -77,7 +96,7 @@ Create the name of the service account to use {{- if .Values.server.address }} {{- .Values.server.address }} {{- else }} -{{ .Release.Name }}-server +{{ .Release.Name }}-server.{{ include "spire-agent.server.namespace" . }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index f6b81a4..5b9557f 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "spire-agent.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-agent.namespace" . }} data: agent.conf: | agent { diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 84c3359..47b276c 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -3,7 +3,7 @@ apiVersion: apps/v1 kind: DaemonSet metadata: name: {{ include "spire-agent.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-agent.namespace" . }} labels: {{- include "spire-agent.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spire-agent/templates/roles.yaml b/charts/spire/charts/spire-agent/templates/roles.yaml index 8aa1c7e..e6878a2 100644 --- a/charts/spire/charts/spire-agent/templates/roles.yaml +++ b/charts/spire/charts/spire-agent/templates/roles.yaml @@ -16,11 +16,10 @@ kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-agent.fullname" . }} - namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire-agent.fullname" . }} - namespace: {{ .Release.Namespace }} + name: {{ include "spire-agent.serviceAccountName" . }} + namespace: {{ include "spire-agent.namespace" . }} roleRef: kind: ClusterRole name: {{ include "spire-agent.fullname" . }} diff --git a/charts/spire/charts/spire-agent/templates/serviceaccount.yaml b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml index 8bbb3bb..03e447e 100644 --- a/charts/spire/charts/spire-agent/templates/serviceaccount.yaml +++ b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "spire-agent.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-agent.namespace" . }} labels: {{- include "spire-agent.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 109ec67..c1536f0 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -13,6 +13,7 @@ image: imagePullSecrets: [] nameOverride: "" +namespaceOverride: "" fullnameOverride: "" serviceAccount: @@ -60,6 +61,7 @@ bundleConfigMap: spire-bundle server: address: "" port: 8081 + namespaceOverride: "" healthChecks: # -- override the host port used for health checking diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6e810ef..e20ae64 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -66,6 +66,7 @@ A Helm chart to install the SPIRE server. | jwtIssuer | string | `"oidc-discovery.example.org"` | | | logLevel | string | `"info"` | | | nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | | nodeAttestor.k8sPsat.enabled | bool | `true` | | | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | | | nodeSelector | object | `{}` | | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 39f367c..7e7c45c 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -23,6 +23,17 @@ If release name contains chart name it will be used as a full name. {{- end }} {{- end }} +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spire-server.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + {{/* Create chart name and version as used by the chart label. */}} diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml index 00443fc..948c120 100644 --- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -1,5 +1,6 @@ +{{- $namespace := include "spire-server.namespace" . }} apiVersion: v1 kind: ConfigMap metadata: name: {{ .Values.bundleConfigMap }} - namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} + namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 8b2a628..03f148a 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,9 +1,10 @@ -{{ $root := . }} +{{- $root := . }} +{{- $namespace := include "spire-server.namespace" . }} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "spire-server.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} data: server.conf: | server { @@ -60,7 +61,7 @@ data: Notifier "k8sbundle" { plugin_data { - namespace = {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace | quote }} + namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }} config_map = {{ .Values.bundleConfigMap | quote }} } } diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 6bac89f..5967d31 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -5,6 +5,7 @@ apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterSPIFFEID metadata: name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based + namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} {{- with .identities.podSelector }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 1c198db..ebf9ee8 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -3,14 +3,14 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ include "spire-controller-manager.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} data: controller-manager-config.yaml: | apiVersion: spire.spiffe.io/v1alpha1 kind: ControllerManagerConfig metadata: name: {{ include "spire-controller-manager.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 8 }} metrics: @@ -20,7 +20,7 @@ data: leaderElection: leaderElect: true resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io - resourceNamespace: {{ .Release.Namespace }} + resourceNamespace: {{ include "spire-server.namespace" . }} validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook clusterName: {{ .Values.clusterName }} trustDomain: {{ .Values.trustDomain }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index 795a06f..f5a85a7 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ include "spire-controller-manager.fullname" . }}-leader-election - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} rules: - apiGroups: [""] resources: ["configmaps"] @@ -19,7 +19,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ include "spire-controller-manager.fullname" . }}-leader-election - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -27,7 +27,7 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -76,5 +76,5 @@ roleRef: subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml index c7a33a0..5d3b0a7 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "spire-controller-manager.fullname" . }}-webhook - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} {{- with .Values.controllerManager.service.annotations }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 3a9dcf6..6f963fc 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -8,7 +8,7 @@ webhooks: clientConfig: service: name: {{ include "spire-controller-manager.fullname" . }}-webhook - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain failurePolicy: Fail name: vclusterfederatedtrustdomain.kb.io @@ -22,7 +22,7 @@ webhooks: clientConfig: service: name: {{ include "spire-controller-manager.fullname" . }}-webhook - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid failurePolicy: Fail name: vclusterspiffeid.kb.io diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml index 5121749..b68f878 100644 --- a/charts/spire/charts/spire-server/templates/hpa.yaml +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -3,6 +3,7 @@ apiVersion: autoscaling/v2beta1 kind: HorizontalPodAutoscaler metadata: name: {{ include "spire-server.fullname" . }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 57de993..3382d67 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,9 +1,10 @@ +{{- $namespace := include "spire-server.namespace" . }} # Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-server.fullname" . }}-bundle - namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} + namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} rules: - apiGroups: [""] resources: [configmaps] @@ -18,7 +19,7 @@ kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-server.fullname" . }}-cm - namespace: {{ .Release.Namespace }} + namespace: {{ $namespace }} rules: - apiGroups: ["cert-manager.io"] resources: @@ -35,11 +36,11 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-server.fullname" . }}-cm - namespace: {{ .Release.Namespace }} + namespace: {{ $namespace }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ $namespace }} roleRef: kind: Role name: {{ include "spire-server.fullname" . }}-cm @@ -50,11 +51,11 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-server.fullname" . }}-bundle - namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} + namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ $namespace }} roleRef: kind: Role name: {{ include "spire-server.fullname" . }}-bundle @@ -89,7 +90,7 @@ metadata: subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ $namespace }} roleRef: kind: ClusterRole name: {{ .Release.Namespace}}-{{ include "spire-server.fullname" . }} diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml index ba42c07..a0cb1c2 100644 --- a/charts/spire/charts/spire-server/templates/service.yaml +++ b/charts/spire/charts/spire-server/templates/service.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: Service metadata: name: {{ include "spire-server.fullname" . }} - namespace: {{ .Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} {{- with .Values.service.annotations }} annotations: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/charts/spire-server/templates/serviceaccount.yaml b/charts/spire/charts/spire-server/templates/serviceaccount.yaml index 48d513b..cd717b5 100644 --- a/charts/spire/charts/spire-server/templates/serviceaccount.yaml +++ b/charts/spire/charts/spire-server/templates/serviceaccount.yaml @@ -3,6 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 38215b8..cd18025 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -5,6 +5,7 @@ apiVersion: apps/v1 kind: StatefulSet metadata: name: {{ include "spire-server.fullname" . }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} spec: diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml index f277706..432a583 100644 --- a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -2,6 +2,7 @@ apiVersion: v1 kind: Pod metadata: name: "{{ include "spire-server.fullname" . }}-test-connection" + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" . | nindent 4 }} annotations: diff --git a/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml index 3d62360..2adc109 100644 --- a/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml +++ b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml @@ -5,7 +5,7 @@ apiVersion: v1 kind: Secret metadata: name: {{ include "spire-server.upstream-ca-secret" $root }} - namespace: {{ $root.Release.Namespace }} + namespace: {{ include "spire-server.namespace" . }} labels: {{- include "spire-server.labels" $root | nindent 4 }} data: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 92ca35a..4ebfc9b 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -16,6 +16,7 @@ image: imagePullSecrets: [] nameOverride: "" +namespaceOverride: "" fullnameOverride: "" serviceAccount: diff --git a/examples/production/README.md b/examples/production/README.md new file mode 100644 index 0000000..77f3b78 --- /dev/null +++ b/examples/production/README.md @@ -0,0 +1,8 @@ +Install with something similar to: + +kubectl create namespace "spire-system" +kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged +kubectl create namespace "spire-server" +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted + +helm upgrade --install --namespace spire-server spire charts/spire -f values.yaml diff --git a/examples/production/values.yaml b/examples/production/values.yaml new file mode 100644 index 0000000..feb473f --- /dev/null +++ b/examples/production/values.yaml @@ -0,0 +1,60 @@ +global: + telemetry: + prometheus: + enabled: true + +spiffe-oidc-discovery-provider: + enabled: true + insecureScheme: + enabled: true + podSecurityContext: + runAsUser: 1000 + runAsGroup: 1000 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault + +spire-server: + nodeAttestor: + k8sPsat: + serviceAccountAllowList: ["spire-system:spire-agent"] + notifier: + k8sbundle: + namespace: spire-system + podSecurityContext: + runAsUser: 1000 + runAsGroup: 1000 + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault + controllerManager: + securityContext: + allowPrivilegeEscalation: false + runAsNonRoot: true + readOnlyRootFilesystem: true + capabilities: + drop: [ALL] + seccompProfile: + type: RuntimeDefault + +spiffe-csi-driver: + enabled: true + namespaceOverride: spire-system + +spire-agent: + enabled: true + namespaceOverride: spire-system + serviceAccount: + name: spire-agent + server: + namespaceOverride: spire-server