panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move reusable macros to root chart (#218)

Browse Source 
This patch adds the start of a library to help reduce code duplication.
It will be split out to its own library chart at the same time the other
charts are split out.

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2023-04-18 08:54:46 +02:00
committed by GitHub
parent 3fc81780d9
commit 3cc8955429
20 changed files with 69 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl
-13
View File
@@ -72,19 +72,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spiffe-csi-driver.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spiffe-csi-driver.agent-socket-path" -}}
{{- print .Values.agentSocketPath }}
{{- end }}
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+2 -2
View File
@@ -31,7 +31,7 @@ spec:
containers:
# This is the container which runs the SPIFFE CSI driver.
- name: {{ .Chart.Name }}
image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: [
"-workload-api-socket-dir", "/spire-agent-socket",
@@ -71,7 +71,7 @@ spec:
# of all the little details required to register a CSI driver with
# the kubelet.
- name: node-driver-registrar
image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
image: {{ template "spire-lib.image" .Values.nodeDriverRegistrar }}
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
args: [
"-csi-address", "/spiffe-csi/csi.sock",
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
-35
View File
@@ -82,42 +82,7 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.cluster-domain" }}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- end }}
{{- end }}
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+2 -2
View File
@@ -7,7 +7,7 @@ log_level: {{ .Values.config.logLevel | quote }}
domains:
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}"
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}"
{{- if gt (len .Values.config.domains) 0 }}
{{- .Values.config.domains | toYaml | nindent 2 }}
{{- end }}
@@ -25,7 +25,7 @@ acme:
workload_api:
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
health_checks:
bind_port: "8008"
charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml
+3 -3
View File
@@ -34,7 +34,7 @@ spec:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- -config
@@ -75,7 +75,7 @@ spec:
- name: nginx
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
image: {{ template "spire-lib.image" .Values.insecureScheme.nginx }}
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
ports:
- containerPort: 8080
@@ -97,7 +97,7 @@ spec:
- name: nginx-exporter
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.telemetry.prometheus.nginxExporter }}
image: {{ template "spire-lib.image" .Values.telemetry.prometheus.nginxExporter }}
imagePullPolicy: {{ .Values.telemetry.prometheus.nginxExporter.image.pullPolicy }}
args:
- -nginx.scrape-uri=http://127.0.0.1:8080/stub_status
charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml
+1 -1
View File
@@ -26,7 +26,7 @@ spec:
- name: curl-service-name-namespace-svc-cluster-local
image: cgr.dev/chainguard/bash:latest
command: ['curl']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- if .Values.ingress.enabled }}
charts/spire/charts/spire-agent/templates/_helpers.tpl
-35
View File
@@ -90,18 +90,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-agent.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-agent.server-address" }}
{{- if .Values.server.address }}
{{- .Values.server.address }}
@@ -114,26 +102,3 @@ Create the name of the service account to use
{{- print .Values.socketPath }}
{{- end }}
{{- define "spire-agent.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-agent.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-agent.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+2 -2
View File
@@ -6,13 +6,13 @@ agent:
server_port: {{ .Values.server.port | quote }}
socket_path: {{ include "spire-agent.socket-path" . | quote }}
trust_bundle_path: "/run/spire/bundle/bundle.crt"
trust_domain: {{ include "spire-agent.trust-domain" . | quote }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
plugins:
NodeAttestor:
- k8s_psat:
plugin_data:
cluster: {{ include "spire-agent.cluster-name" . | quote }}
cluster: {{ include "spire-lib.cluster-name" . | quote }}
KeyManager:
- memory:
charts/spire/charts/spire-agent/templates/daemonset.yaml
+3 -3
View File
@@ -38,7 +38,7 @@ spec:
# This is a small image with wait-for-it, choose whatever image
# you prefer that waits for a service to be up. This image is built
# from https://github.com/vishnubob/wait-for-it
image: {{ template "spire-agent.image" .Values.waitForIt }}
image: {{ template "spire-lib.image" .Values.waitForIt }}
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
resources:
@@ -48,7 +48,7 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"]
ports:
@@ -100,7 +100,7 @@ spec:
name: {{ include "spire-agent.fullname" . }}
- name: spire-bundle
configMap:
name: {{ include "spire-agent.bundle-configmap" . }}
name: {{ include "spire-lib.bundle-configmap" . }}
- name: spire-token
projected:
sources:
charts/spire/charts/spire-server/templates/_helpers.tpl
-43
View File
@@ -82,18 +82,6 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-server.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-server.upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk -}}
@@ -117,34 +105,3 @@ Create the name of the service account to use
{{- end }}
{{- end }}
{{- define "spire-server.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-server.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-server.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
{{- define "spire-server.cluster-domain" -}}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+1 -1
View File
@@ -2,5 +2,5 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-server.bundle-configmap" . }}
name: {{ include "spire-lib.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
charts/spire/charts/spire-server/templates/configmap.yaml
+3 -3
View File
@@ -3,7 +3,7 @@
server:
bind_address: "0.0.0.0"
bind_port: "8081"
trust_domain: {{ include "spire-server.trust-domain" . | quote }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
data_dir: "/run/spire/data"
log_level: {{ .Values.logLevel | quote }}
jwt_issuer: {{ .Values.jwtIssuer | quote }}
@@ -42,7 +42,7 @@ plugins:
- k8s_psat:
plugin_data:
clusters:
{{ include "spire-server.cluster-name" $root }}:
{{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
{{- end }}
{{- end }}
@@ -56,7 +56,7 @@ plugins:
- k8sbundle:
plugin_data:
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
config_map: {{ include "spire-server.bundle-configmap" . | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+2 -2
View File
@@ -22,8 +22,8 @@ data:
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ include "spire-server.cluster-name" . }}
trustDomain: {{ include "spire-server.trust-domain" . }}
clusterName: {{ include "spire-lib.cluster-name" . }}
trustDomain: {{ include "spire-lib.trust-domain" . }}
ignoreNamespaces:
{{- with .Values.controllerManager.ignoreNamespaces }}
{{- toYaml . | nindent 6 }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image) }}
command:
- /bin/sh
- -c
charts/spire/charts/spire-server/templates/roles.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
rules:
- apiGroups: [""]
resources: [configmaps]
resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
resourceNames: [{{ include "spire-lib.bundle-configmap" . }}]
verbs:
- get
- patch
charts/spire/charts/spire-server/templates/statefulset.yaml
+2 -2
View File
@@ -43,7 +43,7 @@ spec:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- -config
@@ -108,7 +108,7 @@ spec:
- name: spire-controller-manager
securityContext:
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
args:
- --config=controller-manager-config.yaml
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+1 -1
View File
@@ -33,7 +33,7 @@ spec:
- name: curl-federation-bundle-endpoint
image: cgr.dev/chainguard/bash:latest
command: ['curl']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-server.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
args: ['-k', '-s', '-f', 'https://{{ include "spire-server.fullname" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.federation.bundleEndpoint.port }}']
securityContext:
{{- toYaml .Values.securityContext | nindent 8 }}
{{- end }}
charts/spire/templates/_spire-lib.tpl
+43
View File
@@ -0,0 +1,43 @@
{{- define "spire-lib.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-lib.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-lib.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
{{- define "spire-lib.cluster-domain" -}}
{{- if ne (len (dig "k8s" "clusterDomain" "" .Values.global)) 0 }}
{{- .Values.global.k8s.clusterDomain }}
{{- else }}
{{- .Values.clusterDomain }}
{{- end }}
{{- end }}
{{- define "spire-lib.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}