Move reusable macros to root chart (#218)

This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>

charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl

@@ -72,19 +72,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-
-{{- define "spiffe-csi-driver.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-csi-driver.agent-socket-path" -}}
 {{- print .Values.agentSocketPath }}
 {{- end }}

charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml

@@ -31,7 +31,7 @@ spec:
       containers:
         # This is the container which runs the SPIFFE CSI driver.
         - name: {{ .Chart.Name }}
-          image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: [
             "-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
         # of all the little details required to register a CSI driver with
         # the kubelet.
         - name: node-driver-registrar
-          image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
+          image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }}
           imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
           args: [
             "-csi-address", "/spiffe-csi/csi.sock",

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -82,42 +82,7 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
 {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
 {{- end }}
 
-{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
-{{- end }}
-{{- end }}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml

@@ -7,7 +7,7 @@ log_level: {{ .Values.config.logLevel | quote }}
 domains:
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
   - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
-  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}"
+  - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
   {{- if gt (len .Values.config.domains) 0 }}
   {{- .Values.config.domains | toYaml | nindent 2 }}
   {{- end }}
@@ -25,7 +25,7 @@ acme:
 
 workload_api:
   socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
-  trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
 
 health_checks:
   bind_port: "8008"

charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml

@@ -34,7 +34,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - -config
@@ -75,7 +75,7 @@ spec:
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
+          image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }}
           imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
           ports:
             - containerPort: 8080
@@ -97,7 +97,7 @@ spec:
         - name: nginx-exporter
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
+          image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }}
           imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
           args:
           - -nginx.scrape-uri=http://127.0.0.1:8080/stub_status

charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml

@@ -26,7 +26,7 @@ spec:
     - name: curl-service-name-namespace-svc-cluster-local
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
+      args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- if .Values.ingress.enabled }}

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -90,18 +90,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-agent.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-agent.server-address" }}
 {{- if .Values.server.address }}
 {{- .Values.server.address }}
@@ -114,26 +102,3 @@ Create the name of the service account to use
 {{- print .Values.socketPath }}
 {{- end }}
 
-{{- define "spire-agent.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-agent.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
-{{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -6,13 +6,13 @@ agent:
   server_port: {{ .Values.server.port | quote }}
   socket_path: {{ include "spire-agent.socket-path" . | quote }}
   trust_bundle_path: "/run/spire/bundle/bundle.crt"
-  trust_domain: {{ include "spire-agent.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
 
 plugins:
   NodeAttestor:
     - k8s_psat:
         plugin_data:
-          cluster: {{ include "spire-agent.cluster-name" . | quote }}
+          cluster: {{ include "spire-lib.cluster-name" . | quote }}
 
   KeyManager:
     - memory:

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -38,7 +38,7 @@ spec:
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/vishnubob/wait-for-it
-          image: {{ template "spire-agent.image" .Values.waitForIt }}
+          image: {{ template "spire-lib.image" .Values.waitForIt }}
           imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
           args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
           resources:
@@ -48,7 +48,7 @@ spec:
         {{- end }}
       containers:
         - name: {{ .Chart.Name }}
-          image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           ports:
@@ -100,7 +100,7 @@ spec:
             name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: {{ include "spire-agent.bundle-configmap" . }}
+            name: {{ include "spire-lib.bundle-configmap" . }}
         - name: spire-token
           projected:
             sources:

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -82,18 +82,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.image" -}}
-{{- if eq (substr 0 7 .image.version) "sha256:" -}}
-{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
-{{- else if .appVersion -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
-{{- else if .image.version -}}
-{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
-{{- else -}}
-{{- printf "%s/%s" .image.registry .image.repository -}}
-{{- end -}}
-{{- end }}
-
 {{- define "spire-server.upstream-ca-secret" -}}
 {{- $root := . }}
 {{- with .Values.upstreamAuthority.disk -}}
@@ -117,34 +105,3 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{- define "spire-server.cluster-name" }}
-{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
-{{- .Values.global.spire.clusterName }}
-{{- else }}
-{{- .Values.clusterName }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.trust-domain" }}
-{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
-{{- .Values.global.spire.trustDomain }}
-{{- else }}
-{{- .Values.trustDomain }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.bundle-configmap" }}
-{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
-{{- .Values.global.spire.bundleConfigMap }}
-{{- else }}
-{{- .Values.bundleConfigMap }}
-{{- end }}
-{{- end }}
-
-{{- define "spire-server.cluster-domain" -}}
-{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
-{{- .Values.global.k8s.clusterDomain }}
-{{- else }}
-{{- .Values.clusterDomain }}
-{{- end }}
-{{- end }}

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -2,5 +2,5 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "spire-server.bundle-configmap" . }}
+  name: {{ include "spire-lib.bundle-configmap" . }}
   namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -3,7 +3,7 @@
 server:
   bind_address: "0.0.0.0"
   bind_port: "8081"
-  trust_domain: {{ include "spire-server.trust-domain" . | quote }}
+  trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
   data_dir: "/run/spire/data"
   log_level: {{ .Values.logLevel | quote }}
   jwt_issuer: {{ .Values.jwtIssuer | quote }}
@@ -42,7 +42,7 @@ plugins:
     - k8s_psat:
         plugin_data:
           clusters:
-            {{ include "spire-server.cluster-name" $root }}:
+            {{ include "spire-lib.cluster-name" $root }}:
               service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
   {{- end }}
   {{- end }}
@@ -56,7 +56,7 @@ plugins:
     - k8sbundle:
         plugin_data:
           namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
-          config_map: {{ include "spire-server.bundle-configmap" . | quote }}
+          config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
 
   {{- with .Values.upstreamAuthority.disk }}
   {{- if eq (.enabled | toString) "true" }}

charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml

@@ -22,8 +22,8 @@ data:
       resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
       resourceNamespace: {{ include "spire-server.namespace" . }}
     validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
-    clusterName: {{ include "spire-server.cluster-name" . }}
+    clusterName: {{ include "spire-lib.cluster-name" . }}
-    trustDomain: {{ include "spire-server.trust-domain" . }}
+    trustDomain: {{ include "spire-lib.trust-domain" . }}
     ignoreNamespaces:
       {{- with .Values.controllerManager.ignoreNamespaces }}
       {{- toYaml . | nindent 6 }}

charts/spire/charts/spire-server/templates/post-install-hook.yaml

@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c

charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml

@@ -63,7 +63,7 @@ spec:
       - name: post-upgrade-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c

charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml

@@ -63,7 +63,7 @@ spec:
       - name: post-install-job
         securityContext:
           {{- toYaml .Values.securityContext | nindent 10 }}
-        image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
+        image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
         command:
         - /bin/sh
         - -c

charts/spire/charts/spire-server/templates/roles.yaml

@@ -8,7 +8,7 @@ metadata:
 rules:
   - apiGroups: [""]
     resources: [configmaps]
-    resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
+    resourceNames: [{{ include "spire-lib.bundle-configmap" . }}]
     verbs:
       - get
       - patch

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -43,7 +43,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           args:
             - -config
@@ -108,7 +108,7 @@ spec:
         - name: spire-controller-manager
           securityContext:
             {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
           imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
           args:
             - --config=controller-manager-config.yaml

charts/spire/charts/spire-server/templates/tests/test-connection.yaml

@@ -33,7 +33,7 @@ spec:
     - name: curl-federation-bundle-endpoint
       image: cgr.dev/chainguard/bash:latest
       command: ['curl']
-      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
+      args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     {{- end }}

charts/spire/templates/_spire-lib.tpl

@@ -0,0 +1,43 @@
+{{- define "spire-lib.cluster-name" }}
+{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
+{{- .Values.global.spire.clusterName }}
+{{- else }}
+{{- .Values.clusterName }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.trust-domain" }}
+{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
+{{- .Values.global.spire.trustDomain }}
+{{- else }}
+{{- .Values.trustDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.bundle-configmap" }}
+{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
+{{- .Values.global.spire.bundleConfigMap }}
+{{- else }}
+{{- .Values.bundleConfigMap }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.cluster-domain" -}}
+{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
+{{- .Values.global.k8s.clusterDomain }}
+{{- else }}
+{{- .Values.clusterDomain }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-lib.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}