From 7155d71c38461fafb8b5a210eb1d6626f680eb7a Mon Sep 17 00:00:00 2001
From: Marco Franssen <marco.franssen@gmail.com>
Date: Tue, 14 Mar 2023 12:15:28 +0100
Subject: [PATCH] Add documentation how to use Spire in own workloads

Signed-off-by: Marco Franssen <marco.franssen@gmail.com>
---
 charts/spire/README.md        | 34 ++++++++++++++++++++++++++++++++++
 charts/spire/README.md.gotmpl | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 68 insertions(+)

diff --git a/charts/spire/README.md b/charts/spire/README.md
index d7e30b1..cb63ec8 100644
--- a/charts/spire/README.md
+++ b/charts/spire/README.md
@@ -32,6 +32,40 @@ spec:
         - --service-account-signing-key-file=/run/config/pki/sa.key
 ```
 
+## Usage
+
+To utilize Spire in your own workloads you should add the following to your workload:
+
+```diff
+ apiVersion: v1
+ kind: Pod
+ metadata:
+   name: my-app
+ spec:
+   containers:
+     - name: my-app
+       image: "my-app:latest"
+       imagePullPolicy: Always
++      volumeMounts:
++        - name: spiffe-workload-api
++          mountPath: /spiffe-workload-api
++          readOnly: true
+       resources:
+         requests:
+           cpu: 200m
+           memory: 32Mi
+         limits:
+           cpu: 500m
+           memory: 64Mi
++  volumes:
++    - name: spiffe-workload-api
++      csi:
++        driver: "csi.spiffe.io"
++        readOnly: true
+```
+
+Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
+
 ## Maintainers
 
 | Name | Email | Url |
diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl
index 677a8f4..9c640b7 100644
--- a/charts/spire/README.md.gotmpl
+++ b/charts/spire/README.md.gotmpl
@@ -34,6 +34,40 @@ spec:
         - --service-account-signing-key-file=/run/config/pki/sa.key
 ```
 
+## Usage
+
+To utilize Spire in your own workloads you should add the following to your workload:
+
+```diff
+ apiVersion: v1
+ kind: Pod
+ metadata:
+   name: my-app
+ spec:
+   containers:
+     - name: my-app
+       image: "my-app:latest"
+       imagePullPolicy: Always
++      volumeMounts:
++        - name: spiffe-workload-api
++          mountPath: /spiffe-workload-api
++          readOnly: true
+       resources:
+         requests:
+           cpu: 200m
+           memory: 32Mi
+         limits:
+           cpu: 500m
+           memory: 64Mi
++  volumes:
++    - name: spiffe-workload-api
++      csi:
++        driver: "csi.spiffe.io"
++        readOnly: true
+```
+
+Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
+
 {{ template "chart.maintainersSection" . }}
 
 {{ template "chart.sourcesSection" . }}