Basic Prometheus support (#28)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-agent/README.md

@@ -30,6 +30,8 @@ A Helm chart to install the SPIRE agent.
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
+| telemetry.prometheus.enabled | bool | `false` |  |
+| telemetry.prometheus.port | int | `9988` |  |
 | trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
 | waitForIt.image.registry | string | `"cgr.dev"` |  |

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -51,3 +51,12 @@ data:
       live_path = "/live"
       ready_path = "/ready"
     }
+
+    {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+    telemetry {
+      Prometheus {
+        host = "0.0.0.0"
+        port = {{ .Values.telemetry.prometheus.port }}
+      }
+    }
+    {{- end }}

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -1,3 +1,4 @@
+{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -11,10 +12,11 @@ spec:
       {{- include "spire-agent.selectorLabels" . | nindent 6 }}
   template:
     metadata:
-      {{- with .Values.podAnnotations }}
       annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        checksum/config: {{ $configSum }}
+        {{- with .Values.podAnnotations }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
       labels:
         {{- include "spire-agent.selectorLabels" . | nindent 8 }}
     spec:
@@ -46,6 +48,10 @@ spec:
           ports:
             - containerPort: {{ .Values.healthChecks.port }}
               name: healthz
+            {{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
+            - containerPort: {{ .Values.telemetry.prometheus.port }}
+              name: prom
+            {{- end }}
           volumeMounts:
             - name: spire-config
               mountPath: /run/spire/config

charts/spire/charts/spire-agent/values.yaml

@@ -79,3 +79,8 @@ workloadAttestors:
   unix:
     # -- enables the Unix workload attestor
     enabled: false
+
+telemetry:
+  prometheus:
+    enabled: false
+    port: 9988