diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index dda28fa..7bbf39f 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -38,3 +38,7 @@ maintainers: email: marco.franssen@gmail.com url: https://marcofranssen.nl kubeVersion: ">=1.21.0-0" +dependencies: + - name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index 82f5030..c6ab41e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -44,6 +44,10 @@ spec: Kubernetes: `>=1.21.0-0` +| Repository | Name | Version | +|------------|------|---------| +| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | + ## Values | Key | Type | Default | Description | @@ -57,19 +61,9 @@ Kubernetes: `>=1.21.0-0` | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | | agent.service.annotations | object | `{}` | | -| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | -| csiDriver.image.registry | string | `"ghcr.io"` | | -| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | -| csiDriver.image.version | string | `"0.2.1"` | | -| csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | -| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | -| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | -| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | -| nodeDriverRegistrar.resources | object | `{}` | | | oidc.affinity | object | `{}` | | | oidc.config.acme.cacheDir | string | `"/run/spire"` | | | oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | diff --git a/charts/spire/charts/spiffe-csi-driver/.helmignore b/charts/spire/charts/spiffe-csi-driver/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spiffe-csi-driver/Chart.yaml b/charts/spire/charts/spiffe-csi-driver/Chart.yaml new file mode 100644 index 0000000..be915ee --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spiffe-csi-driver +description: A Helm chart to install the SPIFFE CSI driver. +type: application +version: 0.1.0 +appVersion: "0.2.1" diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md new file mode 100644 index 0000000..d3514b5 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -0,0 +1,35 @@ +# spiffe-csi-driver + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square) + +A Helm chart to install the SPIFFE CSI driver. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spiffe-csi-driver"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | +| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | +| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | +| nodeDriverRegistrar.resources | object | `{}` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext.privileged | bool | `true` | | +| securityContext.readOnlyRootFilesystem | bool | `true` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt new file mode 100644 index 0000000..3d27b51 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt @@ -0,0 +1 @@ +SPIFFE CSI Driver installed… diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl new file mode 100644 index 0000000..7154e44 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -0,0 +1,86 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spiffe-csi-driver.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spiffe-csi-driver.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spiffe-csi-driver.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spiffe-csi-driver.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spiffe-csi-driver.labels" -}} +helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }} +{{ include "spiffe-csi-driver.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spiffe-csi-driver.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spiffe-csi-driver.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + + +{{- define "spiffe-csi-driver.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml new file mode 100644 index 0000000..09b7a9a --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -0,0 +1,116 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }} + updateStrategy: + type: RollingUpdate + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + # This is the container which runs the SPIFFE CSI driver. + - name: {{ .Chart.Name }} + image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: [ + "-workload-api-socket-dir", "/spire-agent-socket", + "-csi-socket-path", "/spiffe-csi/csi.sock", + ] + env: + # The CSI driver needs a unique node ID. The node name can be + # used for this purpose. + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + # The volume containing the SPIRE agent socket. The SPIFFE CSI + # driver will mount this directory into containers. + - mountPath: /spire-agent-socket + name: spire-agent-socket-dir + readOnly: true + # The volume that will contain the CSI driver socket shared + # with the kubelet and the driver registrar. + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The volume containing mount points for containers. + - mountPath: /var/lib/kubelet/pods + mountPropagation: Bidirectional + name: mountpoint-dir + securityContext: + privileged: true + resources: + {{- toYaml .Values.resources | nindent 12 }} + # This container runs the CSI Node Driver Registrar which takes care + # of all the little details required to register a CSI driver with + # the kubelet. + - name: node-driver-registrar + image: {{ template "spire.image" .Values.nodeDriverRegistrar }} + imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} + args: [ + "-csi-address", "/spiffe-csi/csi.sock", + "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + "-health-port", "9809" + ] + volumeMounts: + # The registrar needs access to the SPIFFE CSI driver socket + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The registrar needs access to the Kubelet plugin registration + # directory + - name: kubelet-plugin-registration-dir + mountPath: /registration + ports: + - containerPort: 9809 + name: healthz + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 5 + timeoutSeconds: 5 + resources: + {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} + volumes: + - name: spire-agent-sockets + hostPath: + path: {{ dir .Values.agentSocketPath }} + type: DirectoryOrCreate + - name: spire-agent-socket-dir + hostPath: + path: {{ dir .Values.agentSocketPath }} + type: DirectoryOrCreate + # This volume is where the socket for kubelet->driver communication lives + - name: spiffe-csi-socket-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.spiffe.io + type: DirectoryOrCreate + # This volume is where the SPIFFE CSI driver mounts volumes + - name: mountpoint-dir + hostPath: + path: /var/lib/kubelet/pods + type: Directory + # This volume is where the node-driver-registrar registers the plugin + # with kubelet + - name: kubelet-plugin-registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry + type: Directory diff --git a/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml new file mode 100644 index 0000000..2577265 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spiffe-csi-driver.serviceAccountName" . }} + namespace: {{ include "spiffe-csi-driver.namespace" . }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml similarity index 100% rename from charts/spire/templates/spiffe-csi-driver.yaml rename to charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml new file mode 100644 index 0000000..bf3760b --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -0,0 +1,67 @@ +image: + registry: ghcr.io + repository: spiffe/spiffe-csi-driver + pullPolicy: IfNotPresent + version: "" +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +imagePullSecrets: [] +nameOverride: "" +namespaceOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: + readOnlyRootFilesystem: true + privileged: true + # runAsNonRoot: true + # runAsUser: 1000 + # capabilities: + # drop: + # - ALL + +nodeSelector: + kubernetes.io/arch: amd64 + +nodeDriverRegistrar: + image: + registry: registry.k8s.io + repository: sig-storage/csi-node-driver-registrar + pullPolicy: IfNotPresent + version: v2.6.2 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +agentSocketPath: /run/spire/agent-sockets/spire-agent.sock diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 8e8e6bf..176e910 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -69,69 +69,6 @@ spec: periodSeconds: 60 resources: {{- toYaml .Values.agent.resources | nindent 12 }} - # This is the container which runs the SPIFFE CSI driver. - - name: spiffe-csi-driver - image: {{ template "spire.image" .Values.csiDriver }} - imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }} - args: [ - "-workload-api-socket-dir", "/spire-agent-socket", - "-csi-socket-path", "/spiffe-csi/csi.sock", - ] - env: - # The CSI driver needs a unique node ID. The node name can be - # used for this purpose. - - name: MY_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - volumeMounts: - # The volume containing the SPIRE agent socket. The SPIFFE CSI - # driver will mount this directory into containers. - - mountPath: /spire-agent-socket - name: spire-agent-socket-dir - readOnly: true - # The volume that will contain the CSI driver socket shared - # with the kubelet and the driver registrar. - - mountPath: /spiffe-csi - name: spiffe-csi-socket-dir - # The volume containing mount points for containers. - - mountPath: /var/lib/kubelet/pods - mountPropagation: Bidirectional - name: mountpoint-dir - securityContext: - privileged: true - resources: - {{- toYaml .Values.csiDriver.resources | nindent 12 }} - # This container runs the CSI Node Driver Registrar which takes care - # of all the little details required to register a CSI driver with - # the kubelet. - - name: node-driver-registrar - image: {{ template "spire.image" .Values.nodeDriverRegistrar }} - imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} - args: [ - "-csi-address", "/spiffe-csi/csi.sock", - "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", - "-health-port", "9809" - ] - volumeMounts: - # The registrar needs access to the SPIFFE CSI driver socket - - mountPath: /spiffe-csi - name: spiffe-csi-socket-dir - # The registrar needs access to the Kubelet plugin registration - # directory - - name: kubelet-plugin-registration-dir - mountPath: /registration - ports: - - containerPort: 9809 - name: healthz - livenessProbe: - httpGet: - path: /healthz - port: healthz - initialDelaySeconds: 5 - timeoutSeconds: 5 - resources: - {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} volumes: - name: spire-config configMap: @@ -154,19 +91,3 @@ spec: hostPath: path: {{ dir .Values.agent.config.socketPath }} type: DirectoryOrCreate - # This volume is where the socket for kubelet->driver communication lives - - name: spiffe-csi-socket-dir - hostPath: - path: /var/lib/kubelet/plugins/csi.spiffe.io - type: DirectoryOrCreate - # This volume is where the SPIFFE CSI driver mounts volumes - - name: mountpoint-dir - hostPath: - path: /var/lib/kubelet/pods - type: Directory - # This volume is where the node-driver-registrar registers the plugin - # with kubelet - - name: kubelet-plugin-registration-dir - hostPath: - path: /var/lib/kubelet/plugins_registry - type: Directory diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 9ec6372..a24af64 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -140,42 +140,6 @@ agent: logLevel: info socketPath: /run/spire/agent-sockets/spire-agent.sock -csiDriver: - image: - registry: ghcr.io - repository: spiffe/spiffe-csi-driver - pullPolicy: IfNotPresent - version: 0.2.1 - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - -nodeDriverRegistrar: - image: - registry: registry.k8s.io - repository: sig-storage/csi-node-driver-registrar - pullPolicy: IfNotPresent - version: v2.6.2 - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - oidc: enabled: false replicaCount: 1