From 24b3a1730e1bd7d30cb0b9100e47c2f94f466d69 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Tue, 3 Mar 2026 13:56:48 -0800 Subject: [PATCH] Change hostNetwork to auto (#758) --- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 5 +++-- charts/spire/charts/spire-agent/values.yaml | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 9a50493..9e7d4d2 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -118,7 +118,7 @@ A Helm chart to install the SPIRE agent. | `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | | `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | -| `hostNetwork` | Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | +| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | | `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 5257606..83a194b 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -30,8 +30,9 @@ {{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }} {{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }} {{- $hostNetwork := not $cbh }} -{{- if ne (.Values.hostNetwork | toString) "" }} -{{- $hostNetwork = eq (.Values.hostNetwork | toString) "true" }} +{{- $hostNetworkValue := .Values.hostNetwork | toString }} +{{- if and (ne $hostNetworkValue "") (ne $hostNetworkValue "auto") }} +{{- $hostNetwork = eq $hostNetworkValue "true" }} {{- end }} {{- $dnsPolicy := .Values.dnsPolicy }} {{- if (and (eq $dnsPolicy "") $hostNetwork) }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index d5dbc2c..75a93a2 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -294,8 +294,8 @@ kubeletAddress: ## provided at runtime or SPIRE agent will fail to start. mode: auto -## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. -hostNetwork: "" +## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. +hostNetwork: auto ## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy dnsPolicy: "" ## @param socketPath The unix socket path to the spire-agent