Allow configuring persistence in the spire-agent (#414)

* Allow configuring persistence in the spire-agent Signed-off-by: Kevin Fox <[email protected]> * Better wording. Leave space for other services if needed some day. Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2024-08-08 20:06:06 -07:00
parent 84f4f45e35
commit 6d4d52604a
3 changed files with 25 additions and 1 deletions
@@ -131,3 +131,5 @@ A Helm chart to install the SPIRE agent.
 | `sockets.hostBasePath`                              | Path on which the agent socket is made available when admin.mountOnHost is true                                                                                                                   | `/run/spire/agent/sockets`                                                       |
 | `sockets.admin.enabled`                             | Enable the admin socket. Useful for admin tasks or the Delegated Identity API.                                                                                                                    | `false`                                                                          |
 | `sockets.admin.mountOnHost`                         | Enable the admin socket to be visible on the host.                                                                                                                                                | `false`                                                                          |
+| `persistence.type`                                  | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)                                                   | `emptyDir`                                                                       |
+| `persistence.hostPath`                              | Which path to use on the host when type = hostPath                                                                                                                                                | `/var/lib/spire/k8s/agent`                                                       |
@@ -146,12 +146,16 @@ spec:
          imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
          command: ["bash", "-c"]
          args:
-            - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private"
+            - |
+              chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private
+              chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} /var/lib/spire
          resources:
            {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
          volumeMounts:
            - name: spire-agent-socket-dir
              mountPath: {{ $socketPath | dir }}
+            - name: spire-agent-persistence
+              mountPath: /var/lib/spire
            - name: spire-agent-admin-socket-dir
              mountPath: /tmp/spire-agent/private
          securityContext:
@@ -191,6 +195,8 @@ spec:
            - name: spire-config
              mountPath: /opt/spire/conf/agent
              readOnly: true
+            - name: spire-agent-persistence
+              mountPath: /var/lib/spire
            {{- if .Values.sockets.admin.enabled }}
            - name: spire-agent-admin-socket-dir
              mountPath: /tmp/spire-agent/private
@@ -257,6 +263,15 @@ spec:
        - name: spire-agent-admin-socket-dir
          emptyDir: {}
        {{- end }}
+        {{- if eq .Values.persistence.type "hostPath" }}
+        - name: spire-agent-persistence
+          hostPath:
+            path: {{ .Values.persistence.hostPath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }}
+            type: DirectoryOrCreate
+        {{- else }}
+        - name: spire-agent-persistence
+          emptyDir: {}
+        {{- end }}
        {{- if eq (len .Values.trustBundleURL) 0 }}
        - name: spire-bundle
          configMap:
@@ -351,3 +351,10 @@ sockets:
  admin:
    enabled: false
    mountOnHost: false
+
+## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
+## @param persistence.hostPath Which path to use on the host when type = hostPath
+##
+persistence:
+  type: emptyDir
+  hostPath: /var/lib/spire/k8s/agent