Spire controller manager upgrade (#8)

Co-authored-by: Faisal Memon <[email protected]>
Co-authored-by: Marco Franssen <[email protected]>

.github/workflows/helm-chart-ci.yaml

@@ -170,7 +170,8 @@ jobs:
 
       - name: Run chart-testing (install)
         run: |
-          ct install --config ct.yaml \
+          helm install -n spire-server spire-crds charts/spire-crds
+          ct install --config ct.yaml --excluded-charts spire-crds \
             --target-branch ${{ github.base_ref }}
 
       - name: Test summary
@@ -238,7 +239,10 @@ jobs:
           verbosity: 1
 
       - name: Install and test example
-        run: ${{ matrix.example }}/run-tests.sh
+        run: |
+          kubectl create namespace spire-server
+          helm install -n spire-server spire-crds charts/spire-crds
+          ${{ matrix.example }}/run-tests.sh
 
   upgrade-test:
     runs-on: ubuntu-22.04

charts/spire-crds/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spire-crds/Chart.yaml

@@ -0,0 +1,22 @@
+apiVersion: v2
+name: spire-crds
+description: >
+  A Helm chart for deploying the Spire CRDS
+type: application
+version: 0.0.1
+appVersion: "0.0.1"
+keywords: ["spire-crds"]
+home: https://github.com/spiffe/helm-charts/tree/main/charts/spire
+sources:
+  - https://github.com/spiffe/helm-charts/tree/main/charts/spire
+icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
+maintainers:
+  - name: marcofranssen
+    email: [email protected]
+    url: https://marcofranssen.nl
+  - name: kfox1111
+    email: [email protected]
+  - name: faisal-memon
+    email: [email protected]
+  - name: edwbuck
+    email: [email protected]

charts/spire-crds/README.md

@@ -0,0 +1,23 @@
+# spire-crds
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.2](https://img.shields.io/badge/AppVersion-1.7.2-informational?style=flat-square)
+
+A Helm chart to install the SPIRE CRDS.
+
+**Homepage:** <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
+## Maintainers
+| Name | Email | Url |
+| ---- | ------ | --- |
+| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
+| kfox1111 | <Kevin.Fox@pnnl.gov> |  |
+| faisal-memon | <fymemon@yahoo.com> |  |
+| edwbuck | <edwbuck@gmail.com> |  |
+
+## Source Code
+
+* <https://github.com/spiffe/helm-charts/tree/main/charts/spire>
+
+<!-- The Parameters section is generated using helm-docs.sh -->
+
+## Parameters

charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml

@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.8.0
+    controller-gen.kubebuilder.io/version: v0.11.1
+    {{- .Values.annotations | toYaml | nindent 4 }}
   creationTimestamp: null
   name: clusterfederatedtrustdomains.spire.spiffe.io
 spec:
@@ -88,9 +89,3 @@ spec:
     storage: true
     subresources:
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml

@@ -3,7 +3,8 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.8.0
+    controller-gen.kubebuilder.io/version: v0.11.1
+    {{- .Values.annotations | toYaml | nindent 4 }}
   creationTimestamp: null
   name: clusterspiffeids.spire.spiffe.io
 spec:
@@ -48,14 +49,22 @@ spec:
                 items:
                   type: string
                 type: array
+              downstream:
+                description: Downstream indicates that the entry describes a downstream
+                  SPIRE server.
+                type: boolean
               federatesWith:
                 description: FederatesWith is a list of trust domain names that workloads
                   that obtain this SPIFFE ID will federate with.
                 items:
                   type: string
                 type: array
+              jwtTtl:
+                description: JWTTTL indicates an upper-bound time-to-live for JWT
+                  SVIDs minted for this ClusterSPIFFEID.
+                type: string
               namespaceSelector:
-                description: NamespaceSelector selects the namespaces that are targetted
+                description: NamespaceSelector selects the namespaces that are targeted
                   by this CRD.
                 properties:
                   matchExpressions:
@@ -99,8 +108,9 @@ spec:
                       are ANDed.
                     type: object
                 type: object
+                x-kubernetes-map-type: atomic
               podSelector:
-                description: PodSelector selects the pods that are targetted by this
+                description: PodSelector selects the pods that are targeted by this
                   CRD.
                 properties:
                   matchExpressions:
@@ -144,14 +154,15 @@ spec:
                       are ANDed.
                     type: object
                 type: object
+                x-kubernetes-map-type: atomic
               spiffeIDTemplate:
                 description: SPIFFEID is the SPIFFE ID template. The node and pod
                   spec are made available to the template under .NodeSpec, .PodSpec
                   respectively.
                 type: string
               ttl:
-                description: TTL indicates an upper-bound time-to-live for SVIDs minted
+                description: TTL indicates an upper-bound time-to-live for X509 SVIDs
-                  for this ClusterSPIFFEID. If unset, a default will be chosen.
+                  minted for this ClusterSPIFFEID. If unset, a default will be chosen.
                 type: string
               workloadSelectorTemplates:
                 description: WorkloadSelectorTemplates are templates to produce arbitrary
@@ -213,9 +224,3 @@ spec:
     storage: true
     subresources:
       status: {}
-status:
-  acceptedNames:
-    kind: ""
-    plural: ""
-  conditions: []
-  storedVersions: []

charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml

@@ -0,0 +1,92 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.11.1
+    {{- .Values.annotations | toYaml | nindent 4 }}
+  creationTimestamp: null
+  name: clusterstaticentries.spire.spiffe.io
+spec:
+  group: spire.spiffe.io
+  names:
+    kind: ClusterStaticEntry
+    listKind: ClusterStaticEntryList
+    plural: clusterstaticentries
+    singular: clusterstaticentry
+  scope: Cluster
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: ClusterStaticEntry is the Schema for the clusterstaticentries
+          API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: ClusterStaticEntrySpec defines the desired state of ClusterStaticEntry
+            properties:
+              admin:
+                type: boolean
+              dnsNames:
+                items:
+                  type: string
+                type: array
+              downstream:
+                type: boolean
+              federatesWith:
+                items:
+                  type: string
+                type: array
+              hint:
+                type: string
+              jwtSVIDTTL:
+                type: string
+              parentID:
+                type: string
+              selectors:
+                items:
+                  type: string
+                type: array
+              spiffeID:
+                type: string
+              x509SVIDTTL:
+                type: string
+            required:
+            - parentID
+            - selectors
+            - spiffeID
+            type: object
+          status:
+            description: ClusterStaticEntryStatus defines the observed state of ClusterStaticEntry
+            properties:
+              masked:
+                description: If the static entry was masked by another entry.
+                type: boolean
+              rendered:
+                description: If the static entry rendered properly.
+                type: boolean
+              set:
+                description: If the static entry was successfully created/updated.
+                type: boolean
+            required:
+            - masked
+            - rendered
+            - set
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

charts/spire-crds/templates/spire.spiffe.io_controllermanagerconfigs.yaml

@@ -4,6 +4,7 @@ kind: CustomResourceDefinition
 metadata:
   annotations:
     controller-gen.kubebuilder.io/version: v0.8.0
+    {{- .Values.annotations | toYaml | nindent 4 }}
   creationTimestamp: null
   name: controllermanagerconfigs.spire.spiffe.io
 spec:

charts/spire-crds/values.yaml

@@ -0,0 +1,3 @@
+annotations:
+  ## @param annotations.helm.sh/resource-policy keep the crds after chart deletion
+  helm.sh/resource-policy: keep

charts/spire/README.md

@@ -83,6 +83,39 @@ Now you can interact with the Spire agent socket from your own application. The
 | file://./charts/spire-server | spire-server | 0.1.0 |
 | file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
 
+## Install notes
+
+To do a quick non production install:
+
+```shell
+kubectl create namespace spire-system
+helm install -n spire-system spire-crds charts/spire-crds
+helm install -n spire-system spire charts/spire
+
+For production installs, please see [the production example](examples/production/).
+
+## Upgrade notes
+
+0.14.X:
+
+If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
+run the following:
+
+```shell
+# Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
+
+kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+helm install -n spire-server spire-crds charts/spire-crds
+```
+
 <!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
 
 ## Parameters

charts/spire/charts/spire-server/README.md

@@ -218,7 +218,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `controllerManager.image.repository`                             | The repository within the registry                                                                                                                                                                                                                                                                                                                                   | `spiffe/spire-controller-manager`                                                              |
 | `controllerManager.image.pullPolicy`                             | The image pull policy                                                                                                                                                                                                                                                                                                                                                | `IfNotPresent`                                                                                 |
 | `controllerManager.image.version`                                | This value is deprecated in favor of tag. (Will be removed in a future release)                                                                                                                                                                                                                                                                                      | `""`                                                                                           |
-| `controllerManager.image.tag`                                    | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                        | `0.2.3`                                                                                        |
+| `controllerManager.image.tag`                                    | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                        | `0.3.0`                                                                                        |
 | `controllerManager.resources`                                    | Resource requests and limits for controller manager                                                                                                                                                                                                                                                                                                                  | `{}`                                                                                           |
 | `controllerManager.securityContext`                              | Security context                                                                                                                                                                                                                                                                                                                                                     | `{}`                                                                                           |
 | `controllerManager.service.type`                                 | Service type for controller manager                                                                                                                                                                                                                                                                                                                                  | `ClusterIP`                                                                                    |

charts/spire/charts/spire-server/templates/controller-manager-roles.yaml

@@ -64,6 +64,15 @@ rules:
   - apiGroups: ["spire.spiffe.io"]
     resources: ["clusterspiffeids/status"]
     verbs: ["get", "patch", "update"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterstaticentries"]
+    verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterstaticentries/finalizers"]
+    verbs: ["update"]
+  - apiGroups: ["spire.spiffe.io"]
+    resources: ["clusterstaticentries/status"]
+    verbs: ["get", "patch", "update"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/spire/charts/spire-server/values.yaml

@@ -386,7 +386,7 @@ controllerManager:
     repository: spiffe/spire-controller-manager
     pullPolicy: IfNotPresent
     version: ""
-    tag: "0.2.3"
+    tag: "0.3.0"
 
   ## @param controllerManager.resources [object] Resource requests and limits for controller manager
   resources: {}

examples/production/run-tests.sh

@@ -105,7 +105,19 @@ install_and_test() {
 
 if [[ -n "$UPGRADE_ARGS" ]]; then
   install_and_test spire "$UPGRADE_ARGS"
+
   # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.)
+  kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+  kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+  kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+  kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+  kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+  kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+  kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
+  kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
+  kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
+
+  helm upgrade --install -n spire-server spire-crds charts/spire-crds
 fi
 
 install_and_test charts/spire ""