panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add global for image registry (#201)

Browse Source 
This patch enables a user to override all image registry settings all at
once to point to their own registry to enable easy custom mirrors.

partially implements: https://github.com/spiffe/helm-charts/issues/139

---------

Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-04-20 20:08:14 +02:00
committed by GitHub
co-authored by Marco Franssen
parent 3cc8955429
commit 2c360a50fd
10 changed files with 30 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1
View File
@@ -111,6 +111,7 @@ Kubernetes: `>=1.21.0-0`
| global.k8s.clusterDomain | string | `"cluster.local"` | | | global.k8s.clusterDomain | string | `"cluster.local"` | |
| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | | global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | | global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
| global.spire.image.registry | string | `""` | Override all Spire image registries at once |
| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | | global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
| spiffe-csi-driver.enabled | bool | `true` | | | spiffe-csi-driver.enabled | bool | `true` | |
| spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+2 -2
View File
@@ -31,7 +31,7 @@ spec:
containers: containers:
# This is the container which runs the SPIFFE CSI driver. # This is the container which runs the SPIFFE CSI driver.
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: [ args: [
"-workload-api-socket-dir", "/spire-agent-socket", "-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
# of all the little details required to register a CSI driver with # of all the little details required to register a CSI driver with
# the kubelet. # the kubelet.
- name: node-driver-registrar - name: node-driver-registrar
image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }} image: {{ template "spire-lib.image" (dict "image" .Values.nodeDriverRegistrar.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
args: [ args: [
"-csi-address", "/spiffe-csi/csi.sock", "-csi-address", "/spiffe-csi/csi.sock",
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+3 -3
View File
@@ -34,7 +34,7 @@ spec:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: args:
- -config - -config
@@ -75,7 +75,7 @@ spec:
- name: nginx - name: nginx
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }} image: {{ template "spire-lib.image" (dict "image" .Values.insecureScheme.nginx.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
ports: ports:
- containerPort: 8080 - containerPort: 8080
@@ -97,7 +97,7 @@ spec:
- name: nginx-exporter - name: nginx-exporter
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }} image: {{ template "spire-lib.image" (dict "image" .Values.telemetry.prometheus.nginxExporter.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }} imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
args: args:
- -nginx.scrape-uri=http://127.0.0.1:8080/stub_status - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
charts/spire/charts/spire-agent/templates/daemonset.yaml
+2 -2
View File
@@ -38,7 +38,7 @@ spec:
# This is a small image with wait-for-it, choose whatever image # This is a small image with wait-for-it, choose whatever image
# you prefer that waits for a service to be up. This image is built # you prefer that waits for a service to be up. This image is built
# from https://github.com/vishnubob/wait-for-it # from https://github.com/vishnubob/wait-for-it
image: {{ template "spire-lib.image" .Values.waitForIt }} image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
resources: resources:
@@ -48,7 +48,7 @@ spec:
{{- end }} {{- end }}
containers: containers:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"] args: ["-config", "/run/spire/config/agent.conf"]
ports: ports:
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job - name: post-install-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command: command:
- /bin/sh - /bin/sh
- -c - -c
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-upgrade-job - name: post-upgrade-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command: command:
- /bin/sh - /bin/sh
- -c - -c
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job - name: post-install-job
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 10 }} {{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global) }}
command: command:
- /bin/sh - /bin/sh
- -c - -c
charts/spire/charts/spire-server/templates/statefulset.yaml
+2 -2
View File
@@ -43,7 +43,7 @@ spec:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: args:
- -config - -config
@@ -108,7 +108,7 @@ spec:
- name: spire-controller-manager - name: spire-controller-manager
securityContext: securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }} {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
args: args:
- --config=controller-manager-config.yaml - --config=controller-manager-config.yaml
charts/spire/templates/_spire-lib.tpl
+13 -4
View File
@@ -30,14 +30,23 @@
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- define "spire-lib.registry" }}
{{- if ne (len (dig "spire" "image" "registry" "" .global)) 0 }}
{{- .global.spire.image.registry }}
{{- else }}
{{- .image.registry }}
{{- end }}
{{- end }}
{{- define "spire-lib.image" -}} {{- define "spire-lib.image" -}}
{{- $registry := include "spire-lib.registry" . }}
{{- if eq (substr 0 7 .image.version) "sha256:" -}} {{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} {{- printf "%s/%s@%s" $registry .image.repository .image.version -}}
{{- else if .appVersion -}} {{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} {{- printf "%s/%s:%s" $registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}} {{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} {{- printf "%s/%s:%s" $registry .image.repository .image.version -}}
{{- else -}} {{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}} {{- printf "%s/%s" $registry .image.repository -}}
{{- end -}} {{- end -}}
{{- end }} {{- end }}
charts/spire/values.yaml
+4
View File
@@ -11,6 +11,10 @@ global:
# -- Override all instances of bundleConfigMap # -- Override all instances of bundleConfigMap
bundleConfigMap: "" bundleConfigMap: ""
image:
# -- Override all Spire image registries at once
registry: ""
# telemetry: # telemetry:
# prometheus: # prometheus:
# enabled: true # enabled: true