From 08f699bdb08c51919d2b277b331db22a1f809072 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 18 Apr 2024 08:21:31 -0700 Subject: [PATCH] Add spire-lib chart (#289) * Add spire-lib chart Make spire-lib bits into its own library chart. Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Marco Franssen Signed-off-by: kfox1111 * Move notes back Signed-off-by: Kevin Fox * Fix NOTES Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Marco Franssen --- charts/spire/Chart.yaml | 3 +++ charts/spire/charts/spire-lib/.helmignore | 23 ++++++++++++++++++ charts/spire/charts/spire-lib/Chart.yaml | 24 +++++++++++++++++++ charts/spire/charts/spire-lib/README.md | 14 +++++++++++ .../spire-lib/templates/_helpers.tpl} | 0 .../spire-lib/templates/_namespaces.yaml | 5 ++++ .../templates/_spire-server-namespace.yaml} | 6 +++-- .../templates/_spire-system-namespace.yaml} | 6 +++-- charts/spire/charts/spire-lib/values.yaml | 8 +++++++ charts/spire/templates/namespaces.yaml | 1 + 10 files changed, 86 insertions(+), 4 deletions(-) create mode 100644 charts/spire/charts/spire-lib/.helmignore create mode 100644 charts/spire/charts/spire-lib/Chart.yaml create mode 100644 charts/spire/charts/spire-lib/README.md rename charts/spire/{templates/_spire-lib.tpl => charts/spire-lib/templates/_helpers.tpl} (100%) create mode 100644 charts/spire/charts/spire-lib/templates/_namespaces.yaml rename charts/spire/{templates/spire-server-namespace.yaml => charts/spire-lib/templates/_spire-server-namespace.yaml} (83%) rename charts/spire/{templates/spire-system-namespace.yaml => charts/spire-lib/templates/_spire-system-namespace.yaml} (81%) create mode 100644 charts/spire/charts/spire-lib/values.yaml create mode 100644 charts/spire/templates/namespaces.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 3be046f..3839ce2 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -22,6 +22,9 @@ maintainers: email: edwbuck@gmail.com kubeVersion: ">=1.21.0-0" dependencies: + - name: spire-lib + repository: file://./charts/spire-lib + version: 0.1.0 - name: spire-server condition: spire-server.enabled repository: file://./charts/spire-server diff --git a/charts/spire/charts/spire-lib/.helmignore b/charts/spire/charts/spire-lib/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-lib/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-lib/Chart.yaml b/charts/spire/charts/spire-lib/Chart.yaml new file mode 100644 index 0000000..4f7bda2 --- /dev/null +++ b/charts/spire/charts/spire-lib/Chart.yaml @@ -0,0 +1,24 @@ +apiVersion: v2 +name: spire-lib +description: A Helm chart for Kubernetes + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: library + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "" diff --git a/charts/spire/charts/spire-lib/README.md b/charts/spire/charts/spire-lib/README.md new file mode 100644 index 0000000..0fd47f0 --- /dev/null +++ b/charts/spire/charts/spire-lib/README.md @@ -0,0 +1,14 @@ +# SPIRE Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between SPIRE charts. + +## TL;DR + +```yaml +dependencies: + - name: spire-lib + version: 0.1.0 + repository: https://spiffe.github.io/helm-charts-hardened/ +``` + +## Parameters diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/charts/spire-lib/templates/_helpers.tpl similarity index 100% rename from charts/spire/templates/_spire-lib.tpl rename to charts/spire/charts/spire-lib/templates/_helpers.tpl diff --git a/charts/spire/charts/spire-lib/templates/_namespaces.yaml b/charts/spire/charts/spire-lib/templates/_namespaces.yaml new file mode 100644 index 0000000..4071e28 --- /dev/null +++ b/charts/spire/charts/spire-lib/templates/_namespaces.yaml @@ -0,0 +1,5 @@ +{{- define "spire-lib.namespaces" }} +{{- include "spire-lib.namespace.system" . }} +--- +{{- include "spire-lib.namespace.server" . }} +{{- end }} diff --git a/charts/spire/templates/spire-server-namespace.yaml b/charts/spire/charts/spire-lib/templates/_spire-server-namespace.yaml similarity index 83% rename from charts/spire/templates/spire-server-namespace.yaml rename to charts/spire/charts/spire-lib/templates/_spire-server-namespace.yaml index a0ac41b..37a959b 100644 --- a/charts/spire/templates/spire-server-namespace.yaml +++ b/charts/spire/charts/spire-lib/templates/_spire-server-namespace.yaml @@ -1,12 +1,13 @@ -{{- define "spire.namespace.default_server_labels" }} +{{- define "spire-lib.namespace.default_server_labels" }} "pod-security.kubernetes.io/warn": restricted "pod-security.kubernetes.io/audit": restricted "pod-security.kubernetes.io/enforce": restricted {{- end }} +{{- define "spire-lib.namespace.server" }} {{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.server.create }} {{- $labels := dict }} {{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }} -{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_server_labels" . | fromYaml) }} +{{- $labels = mergeOverwrite $labels (include "spire-lib.namespace.default_server_labels" . | fromYaml) }} {{- if (dig "openshift" false .Values.global) }} {{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }} {{- if (index .Values "spiffe-oidc-discovery-provider").enabled }} @@ -28,3 +29,4 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/templates/spire-system-namespace.yaml b/charts/spire/charts/spire-lib/templates/_spire-system-namespace.yaml similarity index 81% rename from charts/spire/templates/spire-system-namespace.yaml rename to charts/spire/charts/spire-lib/templates/_spire-system-namespace.yaml index 3ddf3c1..2e0c5c2 100644 --- a/charts/spire/templates/spire-system-namespace.yaml +++ b/charts/spire/charts/spire-lib/templates/_spire-system-namespace.yaml @@ -1,12 +1,13 @@ -{{- define "spire.namespace.default_system_labels" }} +{{- define "spire-lib.namespace.default_system_labels" }} "pod-security.kubernetes.io/warn": privileged "pod-security.kubernetes.io/audit": privileged "pod-security.kubernetes.io/enforce": privileged {{- end }} +{{- define "spire-lib.namespace.system" }} {{- if or .Values.global.spire.namespaces.create .Values.global.spire.namespaces.system.create }} {{- $labels := dict }} {{- if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespacePSS" true .Values.global) }} -{{- $labels = mergeOverwrite $labels (include "spire.namespace.default_system_labels" . | fromYaml) }} +{{- $labels = mergeOverwrite $labels (include "spire-lib.namespace.default_system_labels" . | fromYaml) }} {{- if (dig "openshift" false .Values.global) }} {{- $_ := set $labels "security.openshift.io/scc.podSecurityLabelSync" "false" }} {{- end }} @@ -25,3 +26,4 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-lib/values.yaml b/charts/spire/charts/spire-lib/values.yaml new file mode 100644 index 0000000..ff0e175 --- /dev/null +++ b/charts/spire/charts/spire-lib/values.yaml @@ -0,0 +1,8 @@ +# Default values for spire-lib. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: spire-lib diff --git a/charts/spire/templates/namespaces.yaml b/charts/spire/templates/namespaces.yaml new file mode 100644 index 0000000..62d1a49 --- /dev/null +++ b/charts/spire/templates/namespaces.yaml @@ -0,0 +1 @@ +{{- include "spire-lib.namespaces" . }}