panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow configuring persistence in the spire-agent (#414)

Browse Source 
* Allow configuring persistence in the spire-agent

Signed-off-by: Kevin Fox <[email protected]>

* Better wording. Leave space for other services if needed some day.

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-08-08 20:06:06 -07:00
committed by GitHub
parent 84f4f45e35
commit 6d4d52604a
3 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+2
View File
@@ -131,3 +131,5 @@ A Helm chart to install the SPIRE agent.
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+16 -1
View File
@@ -146,12 +146,16 @@ spec:
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
command: ["bash", "-c"] command: ["bash", "-c"]
args: args:
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private" - |
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} /var/lib/spire
resources: resources:
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }} {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: {{ $socketPath | dir }} mountPath: {{ $socketPath | dir }}
- name: spire-agent-persistence
mountPath: /var/lib/spire
- name: spire-agent-admin-socket-dir - name: spire-agent-admin-socket-dir
mountPath: /tmp/spire-agent/private mountPath: /tmp/spire-agent/private
securityContext: securityContext:
@@ -191,6 +195,8 @@ spec:
- name: spire-config - name: spire-config
mountPath: /opt/spire/conf/agent mountPath: /opt/spire/conf/agent
readOnly: true readOnly: true
- name: spire-agent-persistence
mountPath: /var/lib/spire
{{- if .Values.sockets.admin.enabled }} {{- if .Values.sockets.admin.enabled }}
- name: spire-agent-admin-socket-dir - name: spire-agent-admin-socket-dir
mountPath: /tmp/spire-agent/private mountPath: /tmp/spire-agent/private
@@ -257,6 +263,15 @@ spec:
- name: spire-agent-admin-socket-dir - name: spire-agent-admin-socket-dir
emptyDir: {} emptyDir: {}
{{- end }} {{- end }}
{{- if eq .Values.persistence.type "hostPath" }}
- name: spire-agent-persistence
hostPath:
path: {{ .Values.persistence.hostPath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }}
type: DirectoryOrCreate
{{- else }}
- name: spire-agent-persistence
emptyDir: {}
{{- end }}
{{- if eq (len .Values.trustBundleURL) 0 }} {{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle - name: spire-bundle
configMap: configMap:
charts/spire/charts/spire-agent/values.yaml
+7
View File
@@ -351,3 +351,10 @@ sockets:
admin: admin:
enabled: false enabled: false
mountOnHost: false mountOnHost: false
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
## @param persistence.hostPath Which path to use on the host when type = hostPath
##
persistence:
type: emptyDir
hostPath: /var/lib/spire/k8s/agent