From 49beb64584ee0f530833c399354d675591c4e9b1 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 19 Dec 2023 07:02:57 -0800 Subject: [PATCH] Add recommendation for namespaceLayout (#127) Co-authored-by: Marco Franssen --- charts/spire/README.md | 1 + .../spiffe-csi-driver/templates/_helpers.tpl | 6 +++ .../templates/_helpers.tpl | 6 +++ .../charts/spire-agent/templates/_helpers.tpl | 18 ++++++--- .../spire-server/templates/_helpers.tpl | 38 ++++++++++++++++++- .../templates/bundle-configmap.yaml | 4 +- .../spire-server/templates/configmap.yaml | 2 +- .../charts/spire-server/templates/roles.yaml | 5 ++- .../tornjak-frontend/templates/_helpers.tpl | 6 +++ charts/spire/values.yaml | 2 + examples/production/values.yaml | 18 --------- 11 files changed, 77 insertions(+), 29 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c7ce935..301f7c3 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -159,6 +159,7 @@ Now you can interact with the Spire agent socket from your own application. The | `global.spire.trustDomain` | The trust domain for Spire install | `example.org` | | `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` | | `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` | +| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` | | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` | | `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` | | `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl index 3df9f55..4fd5fcd 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "spiffe-csi-driver.namespace" -}} {{- if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.system.name }} + {{- else }} + {{- printf "spire-system" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index 70d6de2..3ac006e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "spiffe-oidc-discovery-provider.namespace" -}} {{- if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 6964205..89d5624 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "spire-agent.namespace" -}} {{- if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.system.name }} + {{- else }} + {{- printf "spire-system" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} @@ -37,6 +43,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "spire-agent.server.namespace" -}} {{- if .Values.server.namespaceOverride -}} {{- .Values.server.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} @@ -83,11 +95,7 @@ app.kubernetes.io/instance: {{ .Release.Name }} Create the name of the service account to use */}} {{- define "spire-agent.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} +{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }} {{- end }} {{- define "spire-agent.server-address" }} diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 3652f54..75050af 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -29,6 +29,42 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "spire-server.namespace" -}} {{- if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{- define "spire-server.agent-namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.system.name }} + {{- else }} + {{- printf "spire-system" }} + {{- end }} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{- define "spire-server.bundle-namespace" -}} + {{- if .Values.notifier.k8sbundle.namespace }} + {{- .Values.notifier.k8sbundle.namespace }} + {{- else if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.system.name }} + {{- else }} + {{- printf "spire-system" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} @@ -101,7 +137,7 @@ Create the name of the service account to use {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} {{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }} {{- else }} -[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}] +[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}] {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml index 95b7dd2..4217322 100644 --- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -1,9 +1,9 @@ -{{- $namespace := include "spire-server.namespace" . }} +{{- $namespace := include "spire-server.bundle-namespace" . }} apiVersion: v1 kind: ConfigMap metadata: name: {{ include "spire-lib.bundle-configmap" . }} - namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} + namespace: {{ $namespace }} {{- with .Values.configMap.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 9b172ef..d631806 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -131,7 +131,7 @@ plugins: Notifier: k8sbundle: plugin_data: - namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }} + namespace: {{ include "spire-server.bundle-namespace" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }} {{- with .Values.upstreamAuthority.disk }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 6c667e7..c09bede 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,10 +1,11 @@ {{- $namespace := include "spire-server.namespace" . }} +{{- $bundleNamespace := include "spire-server.bundle-namespace" . }} # Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-lib.bundle-configmap" . }} - namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} + namespace: {{ $bundleNamespace }} rules: - apiGroups: [""] resources: [configmaps] @@ -52,7 +53,7 @@ kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-lib.bundle-configmap" . }} - namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} + namespace: {{ $bundleNamespace }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} diff --git a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl index 535df2b..c810f0f 100644 --- a/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl +++ b/charts/spire/charts/tornjak-frontend/templates/_helpers.tpl @@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in {{- define "tornjak-frontend.namespace" -}} {{- if .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}} + {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} + {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }} + {{- .Values.global.spire.namespaces.server.name }} + {{- else }} + {{- printf "spire-server" }} + {{- end }} {{- else -}} {{- .Release.Namespace -}} {{- end -}} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 81b2371..c52ebe2 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -22,12 +22,14 @@ global: upstreamServerAddress: "" ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off. + ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production. ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts ## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring recommendations: enabled: false + namespaceLayout: true priorityClassName: true strictMode: true securityContexts: true diff --git a/examples/production/values.yaml b/examples/production/values.yaml index aed7471..de8c821 100644 --- a/examples/production/values.yaml +++ b/examples/production/values.yaml @@ -4,28 +4,10 @@ global: enabled: true spire-server: - nodeAttestor: - k8sPsat: - serviceAccountAllowList: ["spire-system:spire-agent"] - notifier: - k8sbundle: - namespace: spire-system - -spiffe-csi-driver: - namespaceOverride: spire-system - -upstream-spiffe-csi-driver: - namespaceOverride: spire-system spire-agent: - namespaceOverride: spire-system - serviceAccount: - name: spire-agent - server: - namespaceOverride: spire-server upstream-spire-agent: - namespaceOverride: spire-system spiffe-oidc-discovery-provider: enabled: true