From 661000a29af4c8c8ffda847c831a2e0ec4c1a009 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 13 Mar 2023 12:35:27 -0700 Subject: [PATCH] Make the agent socket configurable (#114) --- charts/spire/charts/spiffe-csi-driver/README.md | 1 + charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl | 4 ++++ .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 2 +- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 ++ charts/spire/charts/spiffe-oidc-discovery-provider/README.md | 1 + .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 2 +- .../spire/charts/spiffe-oidc-discovery-provider/values.yaml | 2 ++ charts/spire/charts/spire-agent/README.md | 1 + charts/spire/charts/spire-agent/templates/_helpers.tpl | 4 ++++ charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 2 ++ charts/spire/templates/_helpers.tpl | 4 ---- 13 files changed, 22 insertions(+), 9 deletions(-) diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 833800a..ad6e736 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -13,6 +13,7 @@ A Helm chart to install the SPIFFE CSI driver. | Key | Type | Default | Description | |-----|------|---------|-------------| +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | fullnameOverride | string | `""` | | | healthChecks.port | int | `9809` | | | image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl index 7154e44..0680b9e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -84,3 +84,7 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} + +{{- define "spiffe-csi-driver.agent-socket-path" -}} +{{- print .Values.agentSocketPath }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index daad453..1504901 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -100,7 +100,7 @@ spec: volumes: - name: spire-agent-socket-dir hostPath: - path: {{ include "spire.agent-socket-path" . | dir }} + path: {{ include "spiffe-csi-driver.agent-socket-path" . | dir }} type: DirectoryOrCreate # This volume is where the socket for kubelet->driver communication lives - name: spiffe-csi-socket-dir diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 3011595..62bf062 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -69,5 +69,7 @@ nodeDriverRegistrar: # cpu: 100m # memory: 64Mi +agentSocketPath: /run/spire/agent-sockets/spire-agent.sock + # -- Priority class assigned to daemonset pods priorityClassName: "" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index a20470f..ddcbc83 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -15,6 +15,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | Key | Type | Default | Description | |-----|------|---------|-------------| | affinity | object | `{}` | | +| agentSocket | string | `"spire-agent.sock"` | | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 88dd47c..49453d8 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -30,7 +30,7 @@ data: {{- end }} workload_api { - socket_path = "/spiffe-workload-api/{{ include "spire.agent-socket-path" . | splitList "/" | last }}" + socket_path = "/spiffe-workload-api/{{ .Values.agentSocket }}" trust_domain = "{{ .Values.trustDomain }}" } diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 682d4c5..cb9f7aa 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -2,6 +2,8 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. +agentSocket: spire-agent.sock + replicaCount: 1 image: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 8e70932..fb0f9f7 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -14,6 +14,7 @@ A Helm chart to install the SPIRE agent. | Key | Type | Default | Description | |-----|------|---------|-------------| +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | bundleConfigMap | string | `"spire-bundle"` | | | clusterName | string | `"example-cluster"` | | | extraContainers | list | `[]` | | diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index cc7b1e0..7fc6508 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -80,3 +80,7 @@ Create the name of the service account to use {{ .Release.Name }}-server {{- end }} {{- end }} + +{{- define "spire-agent.agent-socket-path" -}} +{{- print .Values.agentSocketPath }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 230ad6c..f6b81a4 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -10,7 +10,7 @@ data: log_level = {{ .Values.logLevel | quote }} server_address = {{ include "spire-agent.server-address" . | trim | quote }} server_port = {{ .Values.server.port | quote }} - socket_path = {{ include "spire.agent-socket-path" . | quote }} + socket_path = {{ include "spire-agent.agent-socket-path" . | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.trustDomain | quote }} } diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index ce9f6f1..84c3359 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -66,7 +66,7 @@ spec: mountPath: /run/spire/bundle readOnly: true - name: spire-agent-socket-dir - mountPath: {{ include "spire.agent-socket-path" . | dir }} + mountPath: {{ include "spire-agent.agent-socket-path" . | dir }} readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -110,7 +110,7 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: {{ include "spire.agent-socket-path" . | dir }} + path: {{ include "spire-agent.agent-socket-path" . | dir }} type: DirectoryOrCreate {{- if gt (len .Values.extraVolumes) 0 }} {{- toYaml .Values.extraVolumes | nindent 8 }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 96657d7..109ec67 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -85,6 +85,8 @@ telemetry: enabled: false port: 9988 +agentSocketPath: /run/spire/agent-sockets/spire-agent.sock + # -- Priority class assigned to daemonset pods priorityClassName: "" diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index e052bfc..50fe6eb 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -30,10 +30,6 @@ Create chart name and version as used by the chart label. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} -{{- define "spire.agent-socket-path" -}} -{{- print "/run/spire/agent-sockets/spire-agent.sock" }} -{{- end }} - {{- define "spire.server-socket-path" -}} {{- print "/run/spire/server-sockets/spire-server.sock" }} {{- end }}