panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Change hostNetwork to auto (#758)

Browse Source
This commit is contained in:
Faisal Memon
2026-03-03 21:56:48 +00:00
committed by GitHub
parent 0133d4a5a7
commit 24b3a1730e
3 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+1 -1
View File
@@ -118,7 +118,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+3 -2
View File
@@ -30,8 +30,9 @@
{{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }}
{{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }}
{{- $hostNetwork := not $cbh }}
{{- if ne (.Values.hostNetwork | toString) "" }}
{{- $hostNetwork = eq (.Values.hostNetwork | toString) "true" }}
{{- $hostNetworkValue := .Values.hostNetwork | toString }}
{{- if and (ne $hostNetworkValue "") (ne $hostNetworkValue "auto") }}
{{- $hostNetwork = eq $hostNetworkValue "true" }}
{{- end }}
{{- $dnsPolicy := .Values.dnsPolicy }}
{{- if (and (eq $dnsPolicy "") $hostNetwork) }}
charts/spire/charts/spire-agent/values.yaml
+2 -2
View File
@@ -294,8 +294,8 @@ kubeletAddress:
## provided at runtime or SPIRE agent will fail to start.
mode: auto
## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override.
hostNetwork: ""
## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override.
hostNetwork: auto
## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
dnsPolicy: ""
## @param socketPath The unix socket path to the spire-agent