From 199bb6f998ff15d5e6fb10b693d52afc9fb681d9 Mon Sep 17 00:00:00 2001 From: tuxotron Date: Thu, 11 Jul 2024 15:47:57 -0400 Subject: [PATCH] Add connect by hostname to agent cofigmap (#392) When setting the kubeletConnectByHostname to "true", the charts update the agent daemonset to define the MY_NODE_NAME environment variable, but it doesn't set the "node_name_env" setting in the WorkloadAttestor:k8s plugin, therefore the agent continues trying to connect to the kubelet using the localhost interface Signed-off-by: tuxotron Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/templates/configmap.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 6da9069..18c68c9 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -116,6 +116,9 @@ plugins: disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }} use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }} verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }} + {{- if eq (include "spire-agent.connect-by-hostname" .) "true" }} + node_name_env: "MY_NODE_NAME" + {{- end }} {{- end }} {{- if .Values.workloadAttestors.unix.enabled }}