From 2c360a50fd6641633dd7ced7f9f20d97b9482d05 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 20 Apr 2023 11:08:14 -0700 Subject: [PATCH] Add global for image registry (#201) This patch enables a user to override all image registry settings all at once to point to their own registry to enable easy custom mirrors. partially implements: https://github.com/spiffe/helm-charts/issues/139 --------- Signed-off-by: Kevin Fox Co-authored-by: Marco Franssen --- charts/spire/README.md | 1 + .../spiffe-csi-driver/templates/daemonset.yaml | 4 ++-- .../templates/deployment.yaml | 6 +++--- .../charts/spire-agent/templates/daemonset.yaml | 4 ++-- .../templates/post-install-hook.yaml | 2 +- .../templates/post-upgrade-hook.yaml | 2 +- .../templates/pre-upgrade-hook.yaml | 2 +- .../spire-server/templates/statefulset.yaml | 4 ++-- charts/spire/templates/_spire-lib.tpl | 17 +++++++++++++---- charts/spire/values.yaml | 4 ++++ 10 files changed, 30 insertions(+), 16 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c8c24ca..8c7cddf 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -111,6 +111,7 @@ Kubernetes: `>=1.21.0-0` | global.k8s.clusterDomain | string | `"cluster.local"` | | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | +| global.spire.image.registry | string | `""` | Override all Spire image registries at once | | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | | spiffe-csi-driver.enabled | bool | `true` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index caa219f..c926a0e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -31,7 +31,7 @@ spec: containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: [ "-workload-api-socket-dir", "/spire-agent-socket", @@ -71,7 +71,7 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }} + image: {{ template "spire-lib.image" (dict "image" .Values.nodeDriverRegistrar.image "global" .Values.global) }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index f1af485..d180466 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -34,7 +34,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -75,7 +75,7 @@ spec: - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }} + image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} ports: - containerPort: 8080 @@ -97,7 +97,7 @@ spec: - name: nginx-exporter securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }} + image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} args: - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 5f76bee..19e9437 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -38,7 +38,7 @@ spec: # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire-lib.image" .Values.waitForIt }} + image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] resources: @@ -48,7 +48,7 @@ spec: {{- end }} containers: - name: {{ .Chart.Name }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] ports: diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index 53d2e3f..37fd2a8 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index b28bdc2..f73e9f2 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-upgrade-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index 2639632..d2445bc 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -63,7 +63,7 @@ spec: - name: post-install-job securityContext: {{- toYaml .Values.securityContext | nindent 10 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }} command: - /bin/sh - -c diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 114307c..2ca1676 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -43,7 +43,7 @@ spec: - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config @@ -108,7 +108,7 @@ spec: - name: spire-controller-manager securityContext: {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} - image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} args: - --config=controller-manager-config.yaml diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 379aed5..4c0c492 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -30,14 +30,23 @@ {{- end }} {{- end }} +{{- define "spire-lib.registry" }} +{{- if ne (len (dig "spire" "image" "registry" "" .global)) 0 }} +{{- .global.spire.image.registry }} +{{- else }} +{{- .image.registry }} +{{- end }} +{{- end }} + {{- define "spire-lib.image" -}} +{{- $registry := include "spire-lib.registry" . }} {{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- printf "%s/%s@%s" $registry .image.repository .image.version -}} {{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}} {{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- printf "%s/%s:%s" $registry .image.repository .image.version -}} {{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} +{{- printf "%s/%s" $registry .image.repository -}} {{- end -}} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 7c028d7..d1978d0 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -11,6 +11,10 @@ global: # -- Override all instances of bundleConfigMap bundleConfigMap: "" + image: + # -- Override all Spire image registries at once + registry: "" + # telemetry: # prometheus: # enabled: true