Move the spiffe-csi-driver into a sub chart

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/Chart.yaml

@@ -38,3 +38,7 @@ maintainers:
     email: [email protected]
     url: https://marcofranssen.nl
 kubeVersion: ">=1.21.0-0"
+dependencies:
+  - name: spiffe-csi-driver
+    repository: file://./charts/spiffe-csi-driver
+    version: 0.1.0

charts/spire/README.md

@@ -44,6 +44,10 @@ spec:
 
 Kubernetes: `>=1.21.0-0`
 
+| Repository | Name | Version |
+|------------|------|---------|
+| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
+
 ## Values
 
 | Key | Type | Default | Description |
@@ -57,19 +61,9 @@ Kubernetes: `>=1.21.0-0`
 | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | agent.resources | object | `{}` |  |
 | agent.service.annotations | object | `{}` |  |
-| csiDriver.image.pullPolicy | string | `"IfNotPresent"` |  |
-| csiDriver.image.registry | string | `"ghcr.io"` |  |
-| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` |  |
-| csiDriver.image.version | string | `"0.2.1"` |  |
-| csiDriver.resources | object | `{}` |  |
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
-| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` |  |
-| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` |  |
-| nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
-| nodeDriverRegistrar.resources | object | `{}` |  |
 | oidc.affinity | object | `{}` |  |
 | oidc.config.acme.cacheDir | string | `"/run/spire"` |  |
 | oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |

charts/spire/charts/spiffe-csi-driver/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spire/charts/spiffe-csi-driver/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: spiffe-csi-driver
+description: A Helm chart to install the SPIFFE CSI driver.
+type: application
+version: 0.1.0
+appVersion: "0.2.1"

charts/spire/charts/spiffe-csi-driver/README.md

@@ -0,0 +1,35 @@
+# spiffe-csi-driver
+
+<!-- This README.md is generated. -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square)
+
+A Helm chart to install the SPIFFE CSI driver.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/spiffe-csi-driver"` |  |
+| image.version | string | `""` |  |
+| imagePullSecrets | list | `[]` |  |
+| nameOverride | string | `""` |  |
+| namespaceOverride | string | `""` |  |
+| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
+| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` |  |
+| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` |  |
+| nodeDriverRegistrar.image.version | string | `"v2.6.2"` |  |
+| nodeDriverRegistrar.resources | object | `{}` |  |
+| nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| resources | object | `{}` |  |
+| securityContext.privileged | bool | `true` |  |
+| securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |

charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt

@@ -0,0 +1 @@
+SPIFFE CSI Driver installed…

charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl

@@ -0,0 +1,86 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "spiffe-csi-driver.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "spiffe-csi-driver.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Allow the release namespace to be overridden for multi-namespace deployments in combined charts
+*/}}
+{{- define "spiffe-csi-driver.namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "spiffe-csi-driver.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "spiffe-csi-driver.labels" -}}
+helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }}
+{{ include "spiffe-csi-driver.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "spiffe-csi-driver.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "spiffe-csi-driver.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+
+{{- define "spiffe-csi-driver.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}

charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml

@@ -0,0 +1,116 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ include "spiffe-csi-driver.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "spiffe-csi-driver.labels" . | nindent 4 }}
+spec:
+  selector:
+    matchLabels:
+      {{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }}
+    spec:
+      serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        # This is the container which runs the SPIFFE CSI driver.
+        - name: {{ .Chart.Name }}
+          image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args: [
+            "-workload-api-socket-dir", "/spire-agent-socket",
+            "-csi-socket-path", "/spiffe-csi/csi.sock",
+          ]
+          env:
+            # The CSI driver needs a unique node ID. The node name can be
+            # used for this purpose.
+            - name: MY_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          volumeMounts:
+            # The volume containing the SPIRE agent socket. The SPIFFE CSI
+            # driver will mount this directory into containers.
+            - mountPath: /spire-agent-socket
+              name: spire-agent-socket-dir
+              readOnly: true
+            # The volume that will contain the CSI driver socket shared
+            # with the kubelet and the driver registrar.
+            - mountPath: /spiffe-csi
+              name: spiffe-csi-socket-dir
+            # The volume containing mount points for containers.
+            - mountPath: /var/lib/kubelet/pods
+              mountPropagation: Bidirectional
+              name: mountpoint-dir
+          securityContext:
+            privileged: true
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+        # This container runs the CSI Node Driver Registrar which takes care
+        # of all the little details required to register a CSI driver with
+        # the kubelet.
+        - name: node-driver-registrar
+          image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
+          imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
+          args: [
+            "-csi-address", "/spiffe-csi/csi.sock",
+            "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
+            "-health-port", "9809"
+          ]
+          volumeMounts:
+            # The registrar needs access to the SPIFFE CSI driver socket
+            - mountPath: /spiffe-csi
+              name: spiffe-csi-socket-dir
+            # The registrar needs access to the Kubelet plugin registration
+            # directory
+            - name: kubelet-plugin-registration-dir
+              mountPath: /registration
+          ports:
+            - containerPort: 9809
+              name: healthz
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: healthz
+            initialDelaySeconds: 5
+            timeoutSeconds: 5
+          resources:
+            {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
+      volumes:
+        - name: spire-agent-sockets
+          hostPath:
+            path: {{ dir .Values.agentSocketPath }}
+            type: DirectoryOrCreate
+        - name: spire-agent-socket-dir
+          hostPath:
+            path: {{ dir .Values.agentSocketPath }}
+            type: DirectoryOrCreate
+        # This volume is where the socket for kubelet->driver communication lives
+        - name: spiffe-csi-socket-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins/csi.spiffe.io
+            type: DirectoryOrCreate
+        # This volume is where the SPIFFE CSI driver mounts volumes
+        - name: mountpoint-dir
+          hostPath:
+            path: /var/lib/kubelet/pods
+            type: Directory
+        # This volume is where the node-driver-registrar registers the plugin
+        # with kubelet
+        - name: kubelet-plugin-registration-dir
+          hostPath:
+            path: /var/lib/kubelet/plugins_registry
+            type: Directory

charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "spiffe-csi-driver.serviceAccountName" . }}
+  namespace: {{ include "spiffe-csi-driver.namespace" . }}
+  labels:
+    {{- include "spiffe-csi-driver.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/charts/spiffe-csi-driver/values.yaml

@@ -0,0 +1,67 @@
+image:
+  registry: ghcr.io
+  repository: spiffe/spiffe-csi-driver
+  pullPolicy: IfNotPresent
+  version: ""
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # requests:
+  #   cpu: 50m
+  #   memory: 32Mi
+  # limits:
+  #   cpu: 100m
+  #   memory: 64Mi
+
+imagePullSecrets: []
+nameOverride: ""
+namespaceOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext:
+  readOnlyRootFilesystem: true
+  privileged: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+  # capabilities:
+  #   drop:
+  #   - ALL
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+nodeDriverRegistrar:
+  image:
+    registry: registry.k8s.io
+    repository: sig-storage/csi-node-driver-registrar
+    pullPolicy: IfNotPresent
+    version: v2.6.2
+  resources: {}
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    # requests:
+    #   cpu: 50m
+    #   memory: 32Mi
+    # limits:
+    #   cpu: 100m
+    #   memory: 64Mi
+
+agentSocketPath: /run/spire/agent-sockets/spire-agent.sock

charts/spire/templates/agent-daemonset.yaml

@@ -69,69 +69,6 @@ spec:
             periodSeconds: 60
           resources:
             {{- toYaml .Values.agent.resources | nindent 12 }}
-        # This is the container which runs the SPIFFE CSI driver.
-        - name: spiffe-csi-driver
-          image: {{ template "spire.image" .Values.csiDriver }}
-          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
-          args: [
-            "-workload-api-socket-dir", "/spire-agent-socket",
-            "-csi-socket-path", "/spiffe-csi/csi.sock",
-          ]
-          env:
-            # The CSI driver needs a unique node ID. The node name can be
-            # used for this purpose.
-            - name: MY_NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-          volumeMounts:
-            # The volume containing the SPIRE agent socket. The SPIFFE CSI
-            # driver will mount this directory into containers.
-            - mountPath: /spire-agent-socket
-              name: spire-agent-socket-dir
-              readOnly: true
-            # The volume that will contain the CSI driver socket shared
-            # with the kubelet and the driver registrar.
-            - mountPath: /spiffe-csi
-              name: spiffe-csi-socket-dir
-            # The volume containing mount points for containers.
-            - mountPath: /var/lib/kubelet/pods
-              mountPropagation: Bidirectional
-              name: mountpoint-dir
-          securityContext:
-            privileged: true
-          resources:
-            {{- toYaml .Values.csiDriver.resources | nindent 12 }}
-        # This container runs the CSI Node Driver Registrar which takes care
-        # of all the little details required to register a CSI driver with
-        # the kubelet.
-        - name: node-driver-registrar
-          image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
-          imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
-          args: [
-            "-csi-address", "/spiffe-csi/csi.sock",
-            "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
-            "-health-port", "9809"
-          ]
-          volumeMounts:
-            # The registrar needs access to the SPIFFE CSI driver socket
-            - mountPath: /spiffe-csi
-              name: spiffe-csi-socket-dir
-            # The registrar needs access to the Kubelet plugin registration
-            # directory
-            - name: kubelet-plugin-registration-dir
-              mountPath: /registration
-          ports:
-            - containerPort: 9809
-              name: healthz
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: healthz
-            initialDelaySeconds: 5
-            timeoutSeconds: 5
-          resources:
-            {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
       volumes:
         - name: spire-config
           configMap:
@@ -154,19 +91,3 @@ spec:
           hostPath:
             path: {{ dir .Values.agent.config.socketPath }}
             type: DirectoryOrCreate
-        # This volume is where the socket for kubelet->driver communication lives
-        - name: spiffe-csi-socket-dir
-          hostPath:
-            path: /var/lib/kubelet/plugins/csi.spiffe.io
-            type: DirectoryOrCreate
-        # This volume is where the SPIFFE CSI driver mounts volumes
-        - name: mountpoint-dir
-          hostPath:
-            path: /var/lib/kubelet/pods
-            type: Directory
-        # This volume is where the node-driver-registrar registers the plugin
-        # with kubelet
-        - name: kubelet-plugin-registration-dir
-          hostPath:
-            path: /var/lib/kubelet/plugins_registry
-            type: Directory

charts/spire/values.yaml

@@ -140,42 +140,6 @@ agent:
     logLevel: info
     socketPath: /run/spire/agent-sockets/spire-agent.sock
 
-csiDriver:
-  image:
-    registry: ghcr.io
-    repository: spiffe/spiffe-csi-driver
-    pullPolicy: IfNotPresent
-    version: 0.2.1
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # requests:
-    #   cpu: 50m
-    #   memory: 32Mi
-    # limits:
-    #   cpu: 100m
-    #   memory: 64Mi
-
-nodeDriverRegistrar:
-  image:
-    registry: registry.k8s.io
-    repository: sig-storage/csi-node-driver-registrar
-    pullPolicy: IfNotPresent
-    version: v2.6.2
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # requests:
-    #   cpu: 50m
-    #   memory: 32Mi
-    # limits:
-    #   cpu: 100m
-    #   memory: 64Mi
-
 oidc:
   enabled: false
   replicaCount: 1