diff --git a/charts/spire/README.md b/charts/spire/README.md index 61b985a..c7ce935 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -162,6 +162,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | | `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` | +| `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` | | `global.spire.image.registry` | Override all Spire image registries at once | `""` | | `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` | | `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index b5db413..62ef2a4 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -95,7 +95,7 @@ spec: readOnly: false resources: {{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }} - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} + {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} - name: nginx-exporter securityContext: {{- include "spire-lib.securitycontext" . | nindent 12 }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 0bfd9d9..f0e1d87 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -86,7 +86,7 @@ health_checks: live_path: "/live" ready_path: "/ready" -{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} +{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} telemetry: - Prometheus: - host: "0.0.0.0" diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 5ab152c..0ee60cd 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -86,7 +86,7 @@ spec: ports: - containerPort: {{ .Values.healthChecks.port }} name: healthz - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} + {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} - containerPort: {{ .Values.telemetry.prometheus.port }} name: prom {{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index a677810..9b172ef 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -242,7 +242,7 @@ health_checks: live_path: "/live" ready_path: "/ready" -{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} +{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} telemetry: - Prometheus: - host: "0.0.0.0" diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 69201d8..713201a 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -125,7 +125,7 @@ spec: protocol: TCP {{- end }} {{- end }} - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} + {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} - containerPort: 9988 name: prom {{- end }} @@ -198,7 +198,7 @@ spec: protocol: TCP - containerPort: 8083 name: healthz - {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }} + {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} - containerPort: 8082 name: prom2 {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 52d8dea..81b2371 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -25,11 +25,13 @@ global: ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts + ## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring recommendations: enabled: false priorityClassName: true strictMode: true securityContexts: true + prometheus: true image: ## @param global.spire.image.registry Override all Spire image registries at once diff --git a/examples/production/values.yaml b/examples/production/values.yaml index a62e661..aed7471 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -1,7 +1,4 @@ global: - telemetry: - prometheus: - enabled: true spire: recommendations: enabled: true