From 56445c4f947900abe13daf73cd94d43024371da7 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 17 Oct 2023 12:54:12 -0700 Subject: [PATCH] Spire controller manager upgrade (#8) Co-authored-by: Faisal Memon Co-authored-by: Marco Franssen --- .github/workflows/helm-chart-ci.yaml | 8 +- charts/spire-crds/.helmignore | 23 +++++ charts/spire-crds/Chart.yaml | 22 +++++ charts/spire-crds/README.md | 23 +++++ ...iffe.io_clusterfederatedtrustdomains.yaml} | 9 +- .../spire.spiffe.io_clusterspiffeids.yaml} | 27 +++--- .../spire.spiffe.io_clusterstaticentries.yaml | 92 +++++++++++++++++++ ...e.spiffe.io_controllermanagerconfigs.yaml} | 1 + charts/spire-crds/values.yaml | 3 + charts/spire/README.md | 33 +++++++ charts/spire/charts/spire-server/README.md | 2 +- .../templates/controller-manager-roles.yaml | 9 ++ charts/spire/charts/spire-server/values.yaml | 2 +- examples/production/run-tests.sh | 12 +++ 14 files changed, 244 insertions(+), 22 deletions(-) create mode 100644 charts/spire-crds/.helmignore create mode 100644 charts/spire-crds/Chart.yaml create mode 100644 charts/spire-crds/README.md rename charts/{spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml => spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml} (96%) rename charts/{spire/charts/spire-server/crds/clusterspiffeids.yaml => spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml} (93%) create mode 100644 charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml rename charts/{spire/charts/spire-server/crds/controllermanagerconfigs.yaml => spire-crds/templates/spire.spiffe.io_controllermanagerconfigs.yaml} (97%) create mode 100644 charts/spire-crds/values.yaml diff --git a/.github/workflows/helm-chart-ci.yaml b/.github/workflows/helm-chart-ci.yaml index c9c8a91..32ae4fb 100644 --- a/.github/workflows/helm-chart-ci.yaml +++ b/.github/workflows/helm-chart-ci.yaml @@ -170,7 +170,8 @@ jobs: - name: Run chart-testing (install) run: | - ct install --config ct.yaml \ + helm install -n spire-server spire-crds charts/spire-crds + ct install --config ct.yaml --excluded-charts spire-crds \ --target-branch ${{ github.base_ref }} - name: Test summary @@ -238,7 +239,10 @@ jobs: verbosity: 1 - name: Install and test example - run: ${{ matrix.example }}/run-tests.sh + run: | + kubectl create namespace spire-server + helm install -n spire-server spire-crds charts/spire-crds + ${{ matrix.example }}/run-tests.sh upgrade-test: runs-on: ubuntu-22.04 diff --git a/charts/spire-crds/.helmignore b/charts/spire-crds/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire-crds/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire-crds/Chart.yaml b/charts/spire-crds/Chart.yaml new file mode 100644 index 0000000..34be7d8 --- /dev/null +++ b/charts/spire-crds/Chart.yaml @@ -0,0 +1,22 @@ +apiVersion: v2 +name: spire-crds +description: > + A Helm chart for deploying the Spire CRDS +type: application +version: 0.0.1 +appVersion: "0.0.1" +keywords: ["spire-crds"] +home: https://github.com/spiffe/helm-charts/tree/main/charts/spire +sources: + - https://github.com/spiffe/helm-charts/tree/main/charts/spire +icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png +maintainers: + - name: marcofranssen + email: marco.franssen@gmail.com + url: https://marcofranssen.nl + - name: kfox1111 + email: Kevin.Fox@pnnl.gov + - name: faisal-memon + email: fymemon@yahoo.com + - name: edwbuck + email: edwbuck@gmail.com diff --git a/charts/spire-crds/README.md b/charts/spire-crds/README.md new file mode 100644 index 0000000..7eb21c2 --- /dev/null +++ b/charts/spire-crds/README.md @@ -0,0 +1,23 @@ +# spire-crds + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square) + +A Helm chart to install the SPIRE CRDS. + +**Homepage:** + +## Maintainers +| Name | Email | Url | +| ---- | ------ | --- | +| marcofranssen | | | +| kfox1111 | | | +| faisal-memon | | | +| edwbuck | | | + +## Source Code + +* + + + +## Parameters diff --git a/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml similarity index 96% rename from charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml rename to charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml index 91aae17..6380ac4 100644 --- a/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml @@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.8.0 + controller-gen.kubebuilder.io/version: v0.11.1 + {{- .Values.annotations | toYaml | nindent 4 }} creationTimestamp: null name: clusterfederatedtrustdomains.spire.spiffe.io spec: @@ -88,9 +89,3 @@ spec: storage: true subresources: status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml similarity index 93% rename from charts/spire/charts/spire-server/crds/clusterspiffeids.yaml rename to charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index 74758a5..d630c73 100644 --- a/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: - controller-gen.kubebuilder.io/version: v0.8.0 + controller-gen.kubebuilder.io/version: v0.11.1 + {{- .Values.annotations | toYaml | nindent 4 }} creationTimestamp: null name: clusterspiffeids.spire.spiffe.io spec: @@ -48,14 +49,22 @@ spec: items: type: string type: array + downstream: + description: Downstream indicates that the entry describes a downstream + SPIRE server. + type: boolean federatesWith: description: FederatesWith is a list of trust domain names that workloads that obtain this SPIFFE ID will federate with. items: type: string type: array + jwtTtl: + description: JWTTTL indicates an upper-bound time-to-live for JWT + SVIDs minted for this ClusterSPIFFEID. + type: string namespaceSelector: - description: NamespaceSelector selects the namespaces that are targetted + description: NamespaceSelector selects the namespaces that are targeted by this CRD. properties: matchExpressions: @@ -99,8 +108,9 @@ spec: are ANDed. type: object type: object + x-kubernetes-map-type: atomic podSelector: - description: PodSelector selects the pods that are targetted by this + description: PodSelector selects the pods that are targeted by this CRD. properties: matchExpressions: @@ -144,14 +154,15 @@ spec: are ANDed. type: object type: object + x-kubernetes-map-type: atomic spiffeIDTemplate: description: SPIFFEID is the SPIFFE ID template. The node and pod spec are made available to the template under .NodeSpec, .PodSpec respectively. type: string ttl: - description: TTL indicates an upper-bound time-to-live for SVIDs minted - for this ClusterSPIFFEID. If unset, a default will be chosen. + description: TTL indicates an upper-bound time-to-live for X509 SVIDs + minted for this ClusterSPIFFEID. If unset, a default will be chosen. type: string workloadSelectorTemplates: description: WorkloadSelectorTemplates are templates to produce arbitrary @@ -213,9 +224,3 @@ spec: storage: true subresources: status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml new file mode 100644 index 0000000..3e2e35c --- /dev/null +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -0,0 +1,92 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.11.1 + {{- .Values.annotations | toYaml | nindent 4 }} + creationTimestamp: null + name: clusterstaticentries.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ClusterStaticEntry + listKind: ClusterStaticEntryList + plural: clusterstaticentries + singular: clusterstaticentry + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterStaticEntry is the Schema for the clusterstaticentries + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterStaticEntrySpec defines the desired state of ClusterStaticEntry + properties: + admin: + type: boolean + dnsNames: + items: + type: string + type: array + downstream: + type: boolean + federatesWith: + items: + type: string + type: array + hint: + type: string + jwtSVIDTTL: + type: string + parentID: + type: string + selectors: + items: + type: string + type: array + spiffeID: + type: string + x509SVIDTTL: + type: string + required: + - parentID + - selectors + - spiffeID + type: object + status: + description: ClusterStaticEntryStatus defines the observed state of ClusterStaticEntry + properties: + masked: + description: If the static entry was masked by another entry. + type: boolean + rendered: + description: If the static entry rendered properly. + type: boolean + set: + description: If the static entry was successfully created/updated. + type: boolean + required: + - masked + - rendered + - set + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml b/charts/spire-crds/templates/spire.spiffe.io_controllermanagerconfigs.yaml similarity index 97% rename from charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml rename to charts/spire-crds/templates/spire.spiffe.io_controllermanagerconfigs.yaml index 7845a10..137616a 100644 --- a/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_controllermanagerconfigs.yaml @@ -4,6 +4,7 @@ kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.8.0 + {{- .Values.annotations | toYaml | nindent 4 }} creationTimestamp: null name: controllermanagerconfigs.spire.spiffe.io spec: diff --git a/charts/spire-crds/values.yaml b/charts/spire-crds/values.yaml new file mode 100644 index 0000000..1e1e994 --- /dev/null +++ b/charts/spire-crds/values.yaml @@ -0,0 +1,3 @@ +annotations: + ## @param annotations.helm.sh/resource-policy keep the crds after chart deletion + helm.sh/resource-policy: keep diff --git a/charts/spire/README.md b/charts/spire/README.md index cb784b9..8c8d576 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -83,6 +83,39 @@ Now you can interact with the Spire agent socket from your own application. The | file://./charts/spire-server | spire-server | 0.1.0 | | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 | +## Install notes + +To do a quick non production install: + +```shell +kubectl create namespace spire-system +helm install -n spire-system spire-crds charts/spire-crds +helm install -n spire-system spire charts/spire + +For production installs, please see [the production example](examples/production/). + +## Upgrade notes + +0.14.X: + +If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart +run the following: + +```shell +# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in. + +kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" +kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" +helm install -n spire-server spire-crds charts/spire-crds +``` + ## Parameters diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 5fdf4f3..2b09965 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -218,7 +218,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.2.3` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index f5a85a7..e9cbc5d 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -64,6 +64,15 @@ rules: - apiGroups: ["spire.spiffe.io"] resources: ["clusterspiffeids/status"] verbs: ["get", "patch", "update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterstaticentries"] + verbs: ["create", "delete", "get", "list", "patch", "update", "watch"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterstaticentries/finalizers"] + verbs: ["update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterstaticentries/status"] + verbs: ["get", "patch", "update"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index ff8dd60..5dfd1bf 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -386,7 +386,7 @@ controllerManager: repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent version: "" - tag: "0.2.3" + tag: "0.3.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 05102f7..6e840e9 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -105,7 +105,19 @@ install_and_test() { if [[ -n "$UPGRADE_ARGS" ]]; then install_and_test spire "$UPGRADE_ARGS" + # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) + kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" + kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" + kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" + kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" + kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" + kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" + kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm" + kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds" + kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server" + + helm upgrade --install -n spire-server spire-crds charts/spire-crds fi install_and_test charts/spire ""