Support Openshift deployment (#13)

* Add support for SPIRE deployment on OpenShift 4.13 Signed-off-by: Mariusz Sabath <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> * Render README Signed-off-by: Mariusz Sabath <[email protected]> * Fix tornjak HTTP/HTTPS port values Signed-off-by: Mariusz Sabath <[email protected]> * Update Frontend README Signed-off-by: Mariusz Sabath <[email protected]> * Add env. variable to Agent to inject node name Signed-off-by: Mariusz Sabath <[email protected]> * Implement Marco's suggestion on CSI CSS version Signed-off-by: Mariusz Sabath <[email protected]> * Add MY_NODE_NAME env. variable to agent for openshift example Signed-off-by: Mariusz Sabath <[email protected]> * Move Openshift examples to dedicated directory Signed-off-by: Mariusz Sabath <[email protected]> * Simplified the install instructions Signed-off-by: Mariusz Sabath <[email protected]> * Suggested changes Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Andrew Block <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs, fix default for backwards compat Signed-off-by: Kevin Fox <[email protected]> * Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features Signed-off-by: Kevin Fox <[email protected]> * Add notes about openshift to the project for other reviewers. Signed-off-by: Kevin Fox <[email protected]> * Fix incorrectly reverted change Signed-off-by: Kevin Fox <[email protected]> * Correct notes Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix issue created from bad merge conflict resolution Signed-off-by: kfox1111 <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> * Update examples/openshift/openshift-values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Mariusz Sabath <[email protected]> --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Trilok Geer <[email protected]> Co-authored-by: Andrew Block <[email protected]> Co-authored-by: Kevin Fox <[email protected]>
2023-10-31 16:27:23 +00:00
parent ed23d8b714
commit 3b016841da
18 changed files with 432 additions and 40 deletions
@@ -36,6 +36,10 @@ spec:
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName }}
      {{- end }}
+      {{- with .Values.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
      containers:
        # This is the container which runs the SPIFFE CSI driver.
        - name: {{ .Chart.Name }}
@@ -0,0 +1,61 @@
+{{- if and .Values.global.openshift .Values.restrictedScc.enabled }}
+{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}}
+{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+allowHostPorts: false
+priority: null
+requiredDropCapabilities:
+{{- if eq (.Values.restrictedScc.version | toString) "2" }}
+  - ALL
+{{- else }}
+  - KILL
+  - MKNOD
+  - SETUID
+  - SETGID
+{{- end }}
+allowPrivilegedContainer: false
+runAsUser:
+  type: MustRunAsRange
+users: []
+allowHostDirVolumePlugin: false
+{{- if eq (.Values.restrictedScc.version | toString) "2" }}
+seccompProfiles:
+  - runtime/default
+{{- end }}
+allowHostIPC: false
+seLinuxContext:
+  type: MustRunAs
+readOnlyRootFilesystem: false
+metadata:
+  name: {{ $name }}
+  annotations:
+    kubernetes.io/description: >-
+      {{ $name }} denies access to all host features and requires pods to be
+      run with a UID, and SELinux context that are allocated to the namespace.
+      {{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }}
+fsGroup:
+  type: MustRunAs
+groups: []
+defaultAddCapabilities: null
+supplementalGroups:
+  type: RunAsAny
+volumes:
+  - configMap
+  - csi
+  - downwardAPI
+  - emptyDir
+  - ephemeral
+  - persistentVolumeClaim
+  - projected
+  - secret
+allowHostPID: false
+allowHostNetwork: false
+allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
+{{- if eq (.Values.restrictedScc.version | toString) "2" }}
+allowedCapabilities:
+  - NET_BIND_SERVICE
+{{ else}}
+allowedCapabilities: null
+{{- end }}
+{{- end }}
@@ -0,0 +1,30 @@
+{{- if eq (.Values.global.openshift | toString) "true" }}
+apiVersion: security.openshift.io/v1
+kind: SecurityContextConstraints
+metadata:
+  name: {{ include "spiffe-csi-driver.fullname" . }}
+readOnlyRootFilesystem: true
+runAsUser:
+  type: RunAsAny
+seLinuxContext:
+  type: RunAsAny
+supplementalGroups:
+  type: RunAsAny
+users:
+  - system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }}
+volumes:
+  - configmap
+  - hostPath
+  - secret
+allowHostDirVolumePlugin: true
+allowHostIPC: false
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowPrivilegeEscalation: true
+allowPrivilegedContainer: true
+fsGroup:
+  type: RunAsAny
+groups: []
+
+{{ end }}
@@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1
 kind: CSIDriver
 metadata:
  name: {{ .Values.pluginName | quote }}
+  {{- with .Values.csiDriverLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+
 spec:
  # Only ephemeral, inline volumes are supported. There is no need for a
  # controller to provision and attach volumes.