From 6d4d52604a70e3ae0d74c0a669aac3f368127691 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 8 Aug 2024 20:06:06 -0700 Subject: [PATCH] Allow configuring persistence in the spire-agent (#414) * Allow configuring persistence in the spire-agent Signed-off-by: Kevin Fox * Better wording. Leave space for other services if needed some day. Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox --- charts/spire/charts/spire-agent/README.md | 2 ++ .../charts/spire-agent/templates/daemonset.yaml | 17 ++++++++++++++++- charts/spire/charts/spire-agent/values.yaml | 7 +++++++ 3 files changed, 25 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index f860889..25b10c1 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -131,3 +131,5 @@ A Helm chart to install the SPIRE agent. | `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | +| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | +| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 577d153..73b75f4 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -146,12 +146,16 @@ spec: imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} command: ["bash", "-c"] args: - - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private" + - | + chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private + chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} /var/lib/spire resources: {{- toYaml .Values.fsGroupFix.resources | nindent 12 }} volumeMounts: - name: spire-agent-socket-dir mountPath: {{ $socketPath | dir }} + - name: spire-agent-persistence + mountPath: /var/lib/spire - name: spire-agent-admin-socket-dir mountPath: /tmp/spire-agent/private securityContext: @@ -191,6 +195,8 @@ spec: - name: spire-config mountPath: /opt/spire/conf/agent readOnly: true + - name: spire-agent-persistence + mountPath: /var/lib/spire {{- if .Values.sockets.admin.enabled }} - name: spire-agent-admin-socket-dir mountPath: /tmp/spire-agent/private @@ -257,6 +263,15 @@ spec: - name: spire-agent-admin-socket-dir emptyDir: {} {{- end }} + {{- if eq .Values.persistence.type "hostPath" }} + - name: spire-agent-persistence + hostPath: + path: {{ .Values.persistence.hostPath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }} + type: DirectoryOrCreate + {{- else }} + - name: spire-agent-persistence + emptyDir: {} + {{- end }} {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle configMap: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 03cd01c..51ea31a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -351,3 +351,10 @@ sockets: admin: enabled: false mountOnHost: false + +## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) +## @param persistence.hostPath Which path to use on the host when type = hostPath +## +persistence: + type: emptyDir + hostPath: /var/lib/spire/k8s/agent