From 805d8696d01231738758a01bfba37aee3cc2bf3b Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 8 Nov 2023 02:43:19 -0800 Subject: [PATCH] spire-controller-manager 0.4.0 support (#60) Co-authored-by: Marco Franssen Co-authored-by: Faisal Memon --- .github/tests/common.sh | 2 ++ .../dependencies/spire-root-server-values.yaml | 9 ++++++++- ...pire.spiffe.io_clusterfederatedtrustdomains.yaml | 9 +++++++++ .../templates/spire.spiffe.io_clusterspiffeids.yaml | 13 +++++++++++++ .../spire.spiffe.io_clusterstaticentries.yaml | 9 +++++++++ charts/spire/README.md | 8 ++++++++ charts/spire/charts/spire-server/README.md | 5 ++++- .../charts/spire-server/templates/_helpers.tpl | 8 ++++++++ .../templates/controller-manager-cluster-ids.yaml | 4 +++- .../templates/controller-manager-configmap.yaml | 4 +++- .../templates/controller-manager-roles.yaml | 9 ++++++--- .../templates/controller-manager-webhook.yaml | 2 +- .../spire-server/templates/post-install-hook.yaml | 4 ++-- .../spire-server/templates/post-upgrade-hook.yaml | 4 ++-- .../spire-server/templates/pre-upgrade-hook.yaml | 9 +++++++-- charts/spire/charts/spire-server/values.yaml | 10 +++++++++- charts/spire/templates/NOTES.txt | 10 ++++++++++ examples/nested/run-tests.sh | 4 ---- examples/production/run-tests.sh | 1 + 19 files changed, 105 insertions(+), 19 deletions(-) diff --git a/.github/tests/common.sh b/.github/tests/common.sh index c550721..3fa18df 100755 --- a/.github/tests/common.sh +++ b/.github/tests/common.sh @@ -1,5 +1,7 @@ #!/usr/bin/env bash +GITHUB_STEP_SUMMARY="${GITHUB_STEP_SUMMARY:-/tmp/summary}" + get_namespace_details () { cat <>"$GITHUB_STEP_SUMMARY" ### Namespace $1 diff --git a/.github/tests/dependencies/spire-root-server-values.yaml b/.github/tests/dependencies/spire-root-server-values.yaml index f588366..43c97d0 100644 --- a/.github/tests/dependencies/spire-root-server-values.yaml +++ b/.github/tests/dependencies/spire-root-server-values.yaml @@ -6,7 +6,14 @@ global: spire-server: controllerManager: - enabled: false + identities: + namespaceSelector: + kubernetes.io/metadata.name: spire-server + podSelector: + app.kubernetes.io/component: server + app.kubernetes.io/instance: spire + app.kubernetes.io/name: server + downstream: true nodeAttestor: k8sPsat: serviceAccountAllowList: diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml index 6380ac4..112249f 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterfederatedtrustdomains.yaml @@ -65,6 +65,9 @@ spec: description: BundleEndpointURL is the URL of the bundle endpoint. It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). type: string + className: + description: Set the class of controller to handle this object. + type: string trustDomain: description: TrustDomain is the name of the trust domain to federate with (e.g. example.org) @@ -89,3 +92,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml index d630c73..951fa0e 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterspiffeids.yaml @@ -41,6 +41,10 @@ spec: access the SPIRE administrative APIs. Extra care should be taken to only apply this SPIFFE ID to admin workloads. type: boolean + autoPopulateDNSNames: + description: AutoPopulateDNSNames indicates whether or not to auto + populate service DNS names. + type: boolean dnsNameTemplates: description: DNSNameTemplate represents templates for extra DNS names that are applicable to SVIDs minted for this ClusterSPIFFEID. The @@ -53,6 +57,9 @@ spec: description: Downstream indicates that the entry describes a downstream SPIRE server. type: boolean + className: + description: Set the class of controller to handle this object. + type: string federatesWith: description: FederatesWith is a list of trust domain names that workloads that obtain this SPIFFE ID will federate with. @@ -224,3 +231,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml index 3e2e35c..bfdde50 100644 --- a/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml +++ b/charts/spire-crds/templates/spire.spiffe.io_clusterstaticentries.yaml @@ -39,6 +39,9 @@ spec: properties: admin: type: boolean + className: + description: Set the class of controller to handle this object. + type: string dnsNames: items: type: string @@ -90,3 +93,9 @@ spec: storage: true subresources: status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/README.md b/charts/spire/README.md index 82d0589..2f203e2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -32,6 +32,14 @@ For production installs, please see [the production example](https://github.com/ ## Upgrade notes +### 0.15.X + +The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart. + +The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`. + +If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified. + ### 0.14.X If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 3b130a1..726bcb5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -215,13 +215,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `controllerManager.enabled` | Flag to enable controller manager | `false` | +| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` | +| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` | | `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` | | `controllerManager.deleteHook.enabled` | Enable Helm hook to autofix common delete issues (should be disabled when using `helm template`) | `true` | | `controllerManager.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `controllerManager.image.repository` | The repository within the registry | `spiffe/spire-controller-manager` | | `controllerManager.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `controllerManager.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.3.0` | +| `controllerManager.image.tag` | Overrides the image tag whose default is the chart appVersion | `0.4.0` | | `controllerManager.resources` | Resource requests and limits for controller manager | `{}` | | `controllerManager.securityContext` | Security context | `{}` | | `controllerManager.service.type` | Service type for controller manager | `ClusterIP` | @@ -240,6 +242,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.jwtTTL` | Indicates an upper-bound time-to-live for JWT SVIDs. If unset, the cluster default will be chosen. | `""` | | `controllerManager.identities.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` | | `controllerManager.identities.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` | +| `controllerManager.identities.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` | | `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` | | `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 0f0521b..3652f54 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -220,3 +220,11 @@ The code below determines what connection type should be used. {{- end }} {{ $args | toYaml }} {{- end -}} + +{{- define "spire-server.controller-manager-class-name" -}} +{{- if .Values.controllerManager.className }} +{{- .Values.controllerManager.className }} +{{- else }} +{{- .Release.Namespace }}-{{ .Release.Name }} +{{- end -}} +{{- end -}} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 0535f52..77cca5e 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -4,7 +4,7 @@ apiVersion: spire.spiffe.io/v1alpha1 kind: ClusterSPIFFEID metadata: - name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based + name: {{ $root.Release.Namespace }}-{{ include "spire-controller-manager.fullname" $root }}-service-account-based namespace: {{ include "spire-server.namespace" $root }} spec: spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} @@ -36,5 +36,7 @@ spec: {{- end }} admin: {{ .identities.admin }} downstream: {{ .identities.downstream }} + autoPopulateDNSNames: {{ .identities.autoPopulateDNSNames }} + className: {{ include "spire-server.controller-manager-class-name" $root | quote}} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 7184ff0..60f728a 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -25,7 +25,7 @@ data: leaderElect: true resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} - validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook + validatingWebhookConfigurationName: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook clusterName: {{ include "spire-lib.cluster-name" . }} trustDomain: {{ include "spire-lib.trust-domain" . }} ignoreNamespaces: @@ -33,4 +33,6 @@ data: {{- toYaml . | nindent 6 }} {{- end }} spireServerSocketPath: "/tmp/spire-server/private/api.sock" + className: {{ include "spire-server.controller-manager-class-name" . | quote}} + watchClassless: {{ .Values.controllerManager.watchClassless | toYaml }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml index e9cbc5d..551b680 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -32,7 +32,7 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} rules: - apiGroups: [""] resources: ["namespaces"] @@ -43,6 +43,9 @@ rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"] @@ -77,11 +80,11 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "spire-controller-manager.fullname" . }} + name: {{ .Release.Namespace}}-{{ include "spire-controller-manager.fullname" . }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml index 0622736..40e9493 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -2,7 +2,7 @@ apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: - name: {{ include "spire-controller-manager.fullname" . }}-webhook + name: {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook webhooks: - admissionReviewVersions: ["v1"] clientConfig: diff --git a/charts/spire/charts/spire-server/templates/post-install-hook.yaml b/charts/spire/charts/spire-server/templates/post-install-hook.yaml index dbbb7bd..77b6470 100644 --- a/charts/spire/charts/spire-server/templates/post-install-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-install-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml index ff2883b..d1b255f 100644 --- a/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml @@ -22,7 +22,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +68,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ .Release.Namespace }}-{{ include "spire-controller-manager.fullname" . }}-webhook - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml index db53b27..a72e043 100644 --- a/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml @@ -1,4 +1,9 @@ {{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.controllerManager.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +{{- $webhookname := printf "%s-%s-webhook" .Release.Namespace (include "spire-controller-manager.fullname" .) }} +{{- $oldwebhookname := printf "%s-webhook" (include "spire-controller-manager.fullname" .) }} +{{- if not (lookup "admissionregistration.k8s.io/v1" "ValidatingWebhookConfiguration" "" $webhookname) }} +{{- $webhookname = $oldwebhookname }} +{{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} {{- if eq .Values.controllerManager.validatingWebhookConfiguration.failurePolicy "Fail" }} apiVersion: v1 @@ -22,7 +27,7 @@ metadata: rules: - apiGroups: ["admissionregistration.k8s.io"] resources: ["validatingwebhookconfigurations"] - resourceNames: [{{ printf "%s-webhook" (include "spire-controller-manager.fullname" .) | quote }}] + resourceNames: [{{ $webhookname | quote }}] verbs: ["get", "patch"] --- kind: ClusterRoleBinding @@ -68,7 +73,7 @@ spec: args: - patch - validatingwebhookconfiguration - - {{ include "spire-controller-manager.fullname" . }}-webhook + - {{ $webhookname }} - --type=strategic - -p - | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5a557ad..63c6647 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -377,6 +377,12 @@ notifier: controllerManager: ## @param controllerManager.enabled Flag to enable controller manager enabled: false + + ## @param controllerManager.className specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. + className: "" + ## @param controllerManager.watchClassless specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. + watchClassless: false + installAndUpgradeHook: ## @param controllerManager.installAndUpgradeHook.enabled Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) enabled: true @@ -395,7 +401,7 @@ controllerManager: repository: spiffe/spire-controller-manager pullPolicy: IfNotPresent version: "" - tag: "0.3.0" + tag: "0.4.0" ## @param controllerManager.resources [object] Resource requests and limits for controller manager resources: {} @@ -469,6 +475,8 @@ controllerManager: admin: false ## @param controllerManager.identities.downstream Set if this spire instance is a root server and the workloads are downstream servers. downstream: false + ## @param controllerManager.identities.autoPopulateDNSNames Auto populate DNS names from services attached to pods + autoPopulateDNSNames: false validatingWebhookConfiguration: ## @param controllerManager.validatingWebhookConfiguration.failurePolicy Action when identity is not issued diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 5da926b..6da2681 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -21,3 +21,13 @@ Warning: You're using an unsupported plugin. Functionality of this release and f Warning: You're using an experimental config. Functionality of this release and future upgrades aren't guaranteed to work smoothly. {{- end }} +{{- $className := include "spire-server.controller-manager-class-name" (dict "Values" (index .Values "spire-server") "Release" .Release) }} +{{- if (index .Values "spire-server").controllerManager.enabled }} +{{- if (index .Values "spire-server").controllerManager.watchClassless }} + +Spire CR's will be handled if no className is specified or if className is set to "{{ $className }}" +{{- else }} + +Spire CR's will be handled only if className is set to "{{ $className }}" +{{- end }} +{{- end }} diff --git a/examples/nested/run-tests.sh b/examples/nested/run-tests.sh index c394c56..407715e 100755 --- a/examples/nested/run-tests.sh +++ b/examples/nested/run-tests.sh @@ -46,10 +46,6 @@ helm upgrade --install --create-namespace spire charts/spire \ --values "${DEPS}/spire-root-server-values.yaml" \ --wait -kubectl get nodes -o go-template='{{range .items}}{{printf "%s\n" .metadata.uid}}{{end}}' | while read -r line; do - kubectl exec -t spire-server-0 -n "spire-root-server" -- spire-server entry create -spiffeID spiffe://production.other/production/nested-spire -parentID "spiffe://production.other/spire/agent/k8s_psat/production/$line" -selector k8s:pod-label:app.kubernetes.io/name:server -downstream -done - helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../production/values.yaml,${SCRIPTPATH}/../production/values-node-pod-antiaffinity.yaml,${SCRIPTPATH}/../production/example-your-values.yaml" \ --wait spire charts/spire helm test --namespace spire-server spire diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index e48a127..5ad1764 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -58,6 +58,7 @@ if [[ -n "$UPGRADE_ARGS" ]]; then popd popd # Any other upgrade steps go here. (Upgrade crds, delete statefulsets without cascade, etc.) + helm upgrade -n spire-system spire-crds charts/spire-crds --wait else kubectl create namespace spire-system 2>/dev/null || true