Move the k8s-workload-registrar back into same pod as spire-server

The k8s-workload-registrar needs access to the spire-server socket and
therefore has to run in the same pod to be able to mount the socket
into the container.

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml

@@ -0,0 +1,16 @@
+{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+  namespace: {{ .Release.Namespace }}
+data:
+  workload-registrar.conf: |
+    log_level       = "{{ .Values.k8sWorkloadRegistrar.logLevel }}"
+    mode            = "reconcile"
+    trust_domain    = {{ .Values.trustDomain | quote }}
+    cluster         = {{ .Values.clusterName | quote }}
+    server_address  = "unix://{{ .Values.socketPath }}"
+    leader_election = true
+    metrics_addr    = "0.0.0.0:18080"
+{{- end }}

charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml

@@ -0,0 +1,56 @@
+{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
+# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree.
+# These roles are needed for the k8s registrar to work properly in reconciling mode.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "nodes", "endpoints"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["create"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["controller-leader-election-helper"]
+    verbs: ["update", "get"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire-server.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -46,11 +46,14 @@ rules:
     resources: [tokenreviews]
     verbs:
       - get
+      - watch
+      - list
       - create
   - apiGroups: [""]
-    resources: [nodes]
+    resources: [nodes, pods]
     verbs:
       - get
+      - list
 ---
 # Binds above cluster role to spire-server service account
 kind: ClusterRoleBinding

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -76,6 +76,25 @@ spec:
               mountPath: /run/spire/upstream_ca
               readOnly: false
             {{ end }}
+        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
+        - name: spire-k8s-workload-registrar
+          securityContext:
+            {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }}
+          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - -config
+            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
+          resources:
+            {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: /run/spire/server-sockets
+              readOnly: true
+            - name: k8s-workload-registrar-config
+              mountPath: /run/spire/k8s-workload-registrar/config
+              readOnly: true
+        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -105,6 +124,11 @@ spec:
           secret:
             secretName: {{ include "spire-server.upstream-ca-secret" . }}
         {{- end }}
+        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
+        - name: k8s-workload-registrar-config
+          configMap:
+            name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar
+        {{- end }}
   volumeClaimTemplates:
     {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
     - metadata: