From 5cb6ebe95e7abfb9d8f8e993eb5d2a6324035d73 Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@philips.com>
Date: Mon, 31 Oct 2022 09:00:12 +0100
Subject: [PATCH] Enforce to amd64 nodes using nodeSelector

Signed-off-by: Marco Franssen <marco.franssen@philips.com>
Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/README.md                         |  4 +++-
 charts/spire/templates/agent-daemonset.yaml    |  4 ++++
 charts/spire/templates/server-statefulset.yaml |  4 ++++
 charts/spire/values.yaml                       | 11 +++++++++--
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index 84bd0a7..03df42d 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -52,6 +52,7 @@ Kubernetes: `>=1.19.0-0`
 | agent.image.pullPolicy | string | `"IfNotPresent"` |  |
 | agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` |  |
 | agent.image.tag | string | `""` |  |
+| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | autoscaling.enabled | bool | `false` |  |
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
@@ -59,7 +60,6 @@ Kubernetes: `>=1.19.0-0`
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
-| nodeSelector | object | `{}` |  |
 | oidc.acme.cacheDir | string | `"/run/spire"` |  |
 | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
 | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` |  |
@@ -78,6 +78,7 @@ Kubernetes: `>=1.19.0-0`
 | oidc.insecureScheme.nginx.tag | string | `"alpine"` |  |
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
+| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | oidc.service.annotations | object | `{}` |  |
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
@@ -93,6 +94,7 @@ Kubernetes: `>=1.19.0-0`
 | server.image.pullPolicy | string | `"IfNotPresent"` |  |
 | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` |  |
 | server.image.tag | string | `""` |  |
+| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | server.service.port | int | `8081` |  |
 | server.service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |
diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml
index ee3a443..e7d73d3 100644
--- a/charts/spire/templates/agent-daemonset.yaml
+++ b/charts/spire/templates/agent-daemonset.yaml
@@ -27,6 +27,10 @@ spec:
           # from https://github.com/lqhl/wait-for-it
           image: gcr.io/spiffe-io/wait-for-it:latest
           args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-agent
           image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml
index 58bcb18..ed97871 100644
--- a/charts/spire/templates/server-statefulset.yaml
+++ b/charts/spire/templates/server-statefulset.yaml
@@ -32,6 +32,10 @@ spec:
       shareProcessNamespace: true
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.server.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-server
           securityContext:
diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml
index f77c7b1..e3d24d0 100644
--- a/charts/spire/values.yaml
+++ b/charts/spire/values.yaml
@@ -18,6 +18,9 @@ server:
     # Overrides the image tag whose default is the chart appVersion.
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
   dataStorage:
     enabled: true
     size: 1Gi
@@ -36,6 +39,9 @@ oidc:
     pullPolicy: IfNotPresent
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
   logLevel: INFO
 
   service:
@@ -73,6 +79,9 @@ agent:
     # Overrides the image tag whose default is the chart appVersion.
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
 imagePullSecrets: []
   # - name: my-docker-registry
   #   username: my-docker-user
@@ -123,8 +132,6 @@ autoscaling:
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
-nodeSelector: {}
-
 tolerations: []
 
 affinity: {}