Add recommendation for namespaceLayout (#127)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -159,6 +159,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `global.spire.trustDomain`                       | The trust domain for Spire install                                                                                                                                                                                                     | `example.org`     |
 | `global.spire.upstreamServerAddress`             | Set what address to use for the upstream server when using nested spire                                                                                                                                                                | `""`              |
 | `global.spire.recommendations.enabled`           | Use recommended settings for production deployments. Default is off.                                                                                                                                                                   | `false`           |
+| `global.spire.recommendations.namespaceLayout`   | Set to true to use recommended values for installing across namespaces                                                                                                                                                                 | `true`            |
 | `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names                                                                                                                                                                     | `true`            |
 | `global.spire.recommendations.strictMode`        | Check values, such as trustDomain, are overridden with a suitable value for production.                                                                                                                                                | `true`            |
 | `global.spire.recommendations.securityContexts`  | Set to true to use recommended values for Pod and Container Security Contexts                                                                                                                                                          | `true`            |

charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl

@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spiffe-csi-driver.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}

charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl

@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spiffe-oidc-discovery-provider.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.server.name }}
+    {{- else }}
+      {{- printf "spire-server" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spire-agent.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}
@@ -37,6 +43,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spire-agent.server.namespace" -}}
   {{- if .Values.server.namespaceOverride -}}
     {{- .Values.server.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.server.name }}
+    {{- else }}
+      {{- printf "spire-server" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}
@@ -83,11 +95,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 Create the name of the service account to use
 */}}
 {{- define "spire-agent.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create }}
+{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }}
-{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
-{{- else }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- end }}
 {{- end }}
 
 {{- define "spire-agent.server-address" }}

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -29,6 +29,42 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "spire-server.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.server.name }}
+    {{- else }}
+      {{- printf "spire-server" }}
+    {{- end }}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-server.agent-namespace" -}}
+  {{- if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
+  {{- else -}}
+    {{- .Release.Namespace -}}
+  {{- end -}}
+{{- end -}}
+
+{{- define "spire-server.bundle-namespace" -}}
+  {{- if .Values.notifier.k8sbundle.namespace }}
+    {{- .Values.notifier.k8sbundle.namespace }}
+  {{- else if .Values.namespaceOverride -}}
+    {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.system.name }}
+    {{- else }}
+      {{- printf "spire-system" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}
@@ -101,7 +137,7 @@ Create the name of the service account to use
 {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
 {{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }}
 {{- else }}
-[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
+[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}]
 {{- end }}
 {{- end }}
 

charts/spire/charts/spire-server/templates/bundle-configmap.yaml

@@ -1,9 +1,9 @@
-{{- $namespace := include "spire-server.namespace" . }}
+{{- $namespace := include "spire-server.bundle-namespace" . }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $namespace }}
   {{- with .Values.configMap.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -131,7 +131,7 @@ plugins:
   Notifier:
     k8sbundle:
       plugin_data:
-        namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
+        namespace: {{ include "spire-server.bundle-namespace" . | quote }}
         config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
 
   {{- with .Values.upstreamAuthority.disk }}

charts/spire/charts/spire-server/templates/roles.yaml

@@ -1,10 +1,11 @@
 {{- $namespace := include "spire-server.namespace" . }}
+{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
 # Role to be able to push certificate bundles to a configmap
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $bundleNamespace }}
 rules:
   - apiGroups: [""]
     resources: [configmaps]
@@ -52,7 +53,7 @@ kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: {{ include "spire-lib.bundle-configmap" . }}
-  namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
+  namespace: {{ $bundleNamespace }}
 subjects:
   - kind: ServiceAccount
     name: {{ include "spire-server.serviceAccountName" . }}

charts/spire/charts/tornjak-frontend/templates/_helpers.tpl

@@ -29,6 +29,12 @@ Allow the release namespace to be overridden for multi-namespace deployments in
 {{- define "tornjak-frontend.namespace" -}}
   {{- if .Values.namespaceOverride -}}
     {{- .Values.namespaceOverride -}}
+  {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
+    {{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
+      {{- .Values.global.spire.namespaces.server.name }}
+    {{- else }}
+      {{- printf "spire-server" }}
+    {{- end }}
   {{- else -}}
     {{- .Release.Namespace -}}
   {{- end -}}

charts/spire/values.yaml

@@ -22,12 +22,14 @@ global:
     upstreamServerAddress: ""
 
     ## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
+    ## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
     ## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
     ## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
     ## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
     ## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
     recommendations:
       enabled: false
+      namespaceLayout: true
       priorityClassName: true
       strictMode: true
       securityContexts: true

examples/production/values.yaml

@@ -4,28 +4,10 @@ global:
       enabled: true
 
 spire-server:
-  nodeAttestor:
-    k8sPsat:
-      serviceAccountAllowList: ["spire-system:spire-agent"]
-  notifier:
-    k8sbundle:
-      namespace: spire-system
-
-spiffe-csi-driver:
-  namespaceOverride: spire-system
-
-upstream-spiffe-csi-driver:
-  namespaceOverride: spire-system
 
 spire-agent:
-  namespaceOverride: spire-system
-  serviceAccount:
-    name: spire-agent
-  server:
-    namespaceOverride: spire-server
 
 upstream-spire-agent:
-  namespaceOverride: spire-system
 
 spiffe-oidc-discovery-provider:
   enabled: true