Enforce to amd64 nodes using nodeSelector

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -52,6 +52,7 @@ Kubernetes: `>=1.19.0-0`
 | agent.image.pullPolicy | string | `"IfNotPresent"` |  |
 | agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` |  |
 | agent.image.tag | string | `""` |  |
+| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | autoscaling.enabled | bool | `false` |  |
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
@@ -59,7 +60,6 @@ Kubernetes: `>=1.19.0-0`
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | nameOverride | string | `""` |  |
-| nodeSelector | object | `{}` |  |
 | oidc.acme.cacheDir | string | `"/run/spire"` |  |
 | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` |  |
 | oidc.acme.emailAddress | string | `"[email protected]"` |  |
@@ -78,6 +78,7 @@ Kubernetes: `>=1.19.0-0`
 | oidc.insecureScheme.nginx.tag | string | `"alpine"` |  |
 | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | oidc.logLevel | string | `"INFO"` |  |
+| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | oidc.service.annotations | object | `{}` |  |
 | oidc.service.port | int | `80` |  |
 | oidc.service.type | string | `"NodePort"` |  |
@@ -93,6 +94,7 @@ Kubernetes: `>=1.19.0-0`
 | server.image.pullPolicy | string | `"IfNotPresent"` |  |
 | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` |  |
 | server.image.tag | string | `""` |  |
+| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
 | server.service.port | int | `8081` |  |
 | server.service.type | string | `"ClusterIP"` |  |
 | serviceAccount.annotations | object | `{}` |  |

charts/spire/templates/agent-daemonset.yaml

@@ -27,6 +27,10 @@ spec:
           # from https://github.com/lqhl/wait-for-it
           image: gcr.io/spiffe-io/wait-for-it:latest
           args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
+      {{- with .Values.agent.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-agent
           image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"

charts/spire/templates/server-statefulset.yaml

@@ -32,6 +32,10 @@ spec:
       shareProcessNamespace: true
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      {{- with .Values.server.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-server
           securityContext:

charts/spire/values.yaml

@@ -18,6 +18,9 @@ server:
     # Overrides the image tag whose default is the chart appVersion.
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
   dataStorage:
     enabled: true
     size: 1Gi
@@ -36,6 +39,9 @@ oidc:
     pullPolicy: IfNotPresent
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
   logLevel: INFO
 
   service:
@@ -73,6 +79,9 @@ agent:
     # Overrides the image tag whose default is the chart appVersion.
     tag: ""
 
+  nodeSelector:
+    kubernetes.io/arch: amd64
+
 imagePullSecrets: []
   # - name: my-docker-registry
   #   username: my-docker-user
@@ -123,8 +132,6 @@ autoscaling:
   targetCPUUtilizationPercentage: 80
   # targetMemoryUtilizationPercentage: 80
 
-nodeSelector: {}
-
 tolerations: []
 
 affinity: {}