Change socket mounts for more control (readonly)

pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/NOTES.txt

@@ -1,4 +1,4 @@
 1. Get the currently registered SPIFFE entries from the server:
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
-    bin/spire-server entry show -socketPath {{ include "spire.sockets" . }}/registration.sock
+    bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock

charts/spire/templates/_helpers.tpl

@@ -120,7 +120,3 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
-
-{{- define "spire.sockets" -}}
-{{- "/run/spire/sockets" -}}
-{{- end -}}

charts/spire/templates/agent-configmap.yaml

@@ -10,7 +10,7 @@ data:
       log_level = "{{ .Values.spire.agent.logLevel }}"
       server_address = "{{ include "spire.fullname" . }}-server"
       server_port = "{{ .Values.server.service.port }}"
-      socket_path = "/run/spire/sockets/agent.sock"
+      socket_path = "/run/spire/agent-sockets/agent.sock"
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
     }

charts/spire/templates/agent-daemonset.yaml

@@ -38,8 +38,8 @@ spec:
             - name: spire-bundle
               mountPath: /run/spire/bundle
               readOnly: true
-            - name: spire-agent-socket
-              mountPath: /run/spire/sockets
+            - name: spire-agent-sockets
+              mountPath: /run/spire/agent-sockets
               readOnly: false
             - name: spire-token
               mountPath: /var/run/secrets/tokens
@@ -62,9 +62,9 @@ spec:
         - name: spire-bundle
           configMap:
             name: {{ include "spire.fullname" . }}-bundle
-        - name: spire-agent-socket
+        - name: spire-agent-sockets
           hostPath:
-            path: /run/spire/sockets
+            path: /run/spire/agent-sockets
             type: DirectoryOrCreate
         - name: spire-token
           projected:

charts/spire/templates/oidc-deployment.yaml

@@ -46,9 +46,9 @@ spec:
             - containerPort: 443
               name: https
           volumeMounts:
-            - name: spire-agent-socket
-              mountPath: {{ include "spire.sockets" . }}
-              readOnly: true
+            - name: spire-oidc-sockets
+              mountPath: /run/spire/oidc-sockets
+              readOnly: false
             - name: spire-oidc-config
               mountPath: /run/spire/oidc/config/
               readOnly: true
@@ -64,9 +64,9 @@ spec:
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
       volumes:
-        - name: spire-agent-socket
+        - name: spire-oidc-sockets
           hostPath:
-            path: /run/spire/sockets
+            path: /run/spire/oidc-sockets
             type: DirectoryOrCreate
         - name: spire-oidc-config
           configMap:

charts/spire/templates/oidc-dp-configmap.yaml

@@ -18,7 +18,7 @@ data:
         email = "{{ .Values.oidc.acme.emailAddress }}"
     }
     workload_api {
-        socket_path = "{{ include "spire.sockets" . }}/agent.sock"
+        socket_path = "/run/spire/agent-sockets/agent.sock"
         trust_domain = "{{ .Values.spire.trustDomain }}"
     }
 {{ end }}

charts/spire/templates/server-configmap.yaml

@@ -8,7 +8,7 @@ data:
     server {
       bind_address = "0.0.0.0"
       bind_port = "8081"
-      socket_path = "{{ include "spire.sockets" . }}/registration.sock"
+      socket_path = "/run/spire/server-sockets/registration.sock"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
       data_dir = "/run/spire/data"
       log_level = "{{ .Values.spire.server.logLevel }}"

charts/spire/templates/server-statefulset.yaml

@@ -47,7 +47,7 @@ spec:
               protocol: TCP
           volumeMounts:
             - name: spire-server-socket
-              mountPath: {{ include "spire.sockets" . }}
+              mountPath: /run/spire/server-sockets
               readOnly: false
             - name: spire-config
               mountPath: /run/spire/config
@@ -86,7 +86,7 @@ spec:
               name: registrar-port
           volumeMounts:
             - name: spire-server-socket
-              mountPath: {{ include "spire.sockets" . }}
+              mountPath: /run/spire/server-sockets
               readOnly: true
             - name: spire-workload-registrar-config
               mountPath: /run/spire/k8s-workload-registrar/config

charts/spire/templates/workload-registrar-configmap.yaml

@@ -9,6 +9,6 @@ data:
     mode            = "reconcile"
     trust_domain    = {{ .Values.spire.trustDomain | quote }}
     cluster         = {{ .Values.spire.clusterName | quote }}
-    server_address  = "unix://{{ include "spire.sockets" . }}/registration.sock"
+    server_address  = "unix:///run/spire/server-sockets/registration.sock"
     leader_election = true
     metrics_addr    = "0.0.0.0:18080"