Move the spiffe-csi-driver into a sub chart
Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
@@ -0,0 +1 @@
|
||||
SPIFFE CSI Driver installed…
|
||||
@@ -0,0 +1,86 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }}
|
||||
{{ include "spiffe-csi-driver.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- define "spiffe-csi-driver.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,116 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spiffe-csi-driver.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
# This is the container which runs the SPIFFE CSI driver.
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: [
|
||||
"-workload-api-socket-dir", "/spire-agent-socket",
|
||||
"-csi-socket-path", "/spiffe-csi/csi.sock",
|
||||
]
|
||||
env:
|
||||
# The CSI driver needs a unique node ID. The node name can be
|
||||
# used for this purpose.
|
||||
- name: MY_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
volumeMounts:
|
||||
# The volume containing the SPIRE agent socket. The SPIFFE CSI
|
||||
# driver will mount this directory into containers.
|
||||
- mountPath: /spire-agent-socket
|
||||
name: spire-agent-socket-dir
|
||||
readOnly: true
|
||||
# The volume that will contain the CSI driver socket shared
|
||||
# with the kubelet and the driver registrar.
|
||||
- mountPath: /spiffe-csi
|
||||
name: spiffe-csi-socket-dir
|
||||
# The volume containing mount points for containers.
|
||||
- mountPath: /var/lib/kubelet/pods
|
||||
mountPropagation: Bidirectional
|
||||
name: mountpoint-dir
|
||||
securityContext:
|
||||
privileged: true
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
# This container runs the CSI Node Driver Registrar which takes care
|
||||
# of all the little details required to register a CSI driver with
|
||||
# the kubelet.
|
||||
- name: node-driver-registrar
|
||||
image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
|
||||
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
|
||||
args: [
|
||||
"-csi-address", "/spiffe-csi/csi.sock",
|
||||
"-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
|
||||
"-health-port", "9809"
|
||||
]
|
||||
volumeMounts:
|
||||
# The registrar needs access to the SPIFFE CSI driver socket
|
||||
- mountPath: /spiffe-csi
|
||||
name: spiffe-csi-socket-dir
|
||||
# The registrar needs access to the Kubelet plugin registration
|
||||
# directory
|
||||
- name: kubelet-plugin-registration-dir
|
||||
mountPath: /registration
|
||||
ports:
|
||||
- containerPort: 9809
|
||||
name: healthz
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: spire-agent-sockets
|
||||
hostPath:
|
||||
path: {{ dir .Values.agentSocketPath }}
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ dir .Values.agentSocketPath }}
|
||||
type: DirectoryOrCreate
|
||||
# This volume is where the socket for kubelet->driver communication lives
|
||||
- name: spiffe-csi-socket-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins/csi.spiffe.io
|
||||
type: DirectoryOrCreate
|
||||
# This volume is where the SPIFFE CSI driver mounts volumes
|
||||
- name: mountpoint-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/pods
|
||||
type: Directory
|
||||
# This volume is where the node-driver-registrar registers the plugin
|
||||
# with kubelet
|
||||
- name: kubelet-plugin-registration-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins_registry
|
||||
type: Directory
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||
namespace: {{ include "spiffe-csi-driver.namespace" . }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: "csi.spiffe.io"
|
||||
spec:
|
||||
# Only ephemeral, inline volumes are supported. There is no need for a
|
||||
# controller to provision and attach volumes.
|
||||
attachRequired: false
|
||||
|
||||
# Request the pod information which the CSI driver uses to verify that an
|
||||
# ephemeral mount was requested.
|
||||
podInfoOnMount: true
|
||||
|
||||
# Don't change ownership on the contents of the mount since the Workload API
|
||||
# Unix Domain Socket is typically open to all (i.e. 0777).
|
||||
fsGroupPolicy: None
|
||||
|
||||
# Declare support for ephemeral volumes only.
|
||||
volumeLifecycleModes:
|
||||
- Ephemeral
|
||||
Reference in New Issue
Block a user