From 83c3e45e93807cbd0faecab3614b4c3f5ddae127 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 15 Nov 2022 11:14:57 +0100 Subject: [PATCH] Make socketPaths configurable Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 ++ charts/spire/templates/NOTES.txt | 2 +- charts/spire/templates/agent-configmap.yaml | 6 +++--- charts/spire/templates/oidc-dp-configmap.yaml | 2 +- charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/templates/workload-registrar-configmap.yaml | 2 +- charts/spire/values.yaml | 2 ++ 7 files changed, 11 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index ec4dd73..7c08dae 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -49,6 +49,7 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | agent.config.logLevel | string | `"info"` | | +| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.registry | string | `"ghcr.io"` | | | agent.image.repository | string | `"spiffe/spire-agent"` | | @@ -101,6 +102,7 @@ Kubernetes: `>=1.21.0-0` | server.config.ca_subject.organization | string | `"Example"` | | | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | | server.config.logLevel | string | `"info"` | | +| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 21242d9..65e935f 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1,4 +1,4 @@ 1. Get the currently registered SPIFFE entries from the server: kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ - bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock + bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }} diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index 4530f6b..7b348bb 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -7,10 +7,10 @@ data: agent.conf: | agent { data_dir = "/run/spire" - log_level = "{{ .Values.agent.config.logLevel }}" + log_level = {{ .Values.agent.config.logLevel | quote }} server_address = "{{ include "spire.fullname" . }}-server" - server_port = "{{ .Values.server.service.port }}" - socket_path = "/run/spire/agent-sockets/spire-agent.sock" + server_port = {{ .Values.server.service.port | quote }} + socket_path = {{ .Values.agent.config.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.spire.trustDomain | quote }} } diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index ee5a317..951cc5a 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -29,7 +29,7 @@ data: {{- end }} workload_api { - socket_path = "/spiffe-workload-api/spire-agent.sock" + socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}" trust_domain = "{{ .Values.spire.trustDomain }}" } diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 800f33e..78bd729 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -8,7 +8,7 @@ data: server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = "/run/spire/server-sockets/spire-server.sock" + socket_path = {{ .Values.server.config.socketPath | quote }} trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" log_level = "{{ .Values.server.config.logLevel }}" diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml index 22cf8d3..72f0ed5 100644 --- a/charts/spire/templates/workload-registrar-configmap.yaml +++ b/charts/spire/templates/workload-registrar-configmap.yaml @@ -9,6 +9,6 @@ data: mode = "reconcile" trust_domain = {{ .Values.spire.trustDomain | quote }} cluster = {{ .Values.spire.clusterName | quote }} - server_address = "unix:///run/spire/server-sockets/spire-server.sock" + server_address = "unix://{{ .Values.server.config.socketPath }}" leader_election = true metrics_addr = "0.0.0.0:18080" diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 9cbc664..4158201 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -77,6 +77,7 @@ server: config: logLevel: info + socketPath: /run/spire/server-sockets/spire-server.sock jwtIssuer: oidc-discovery.example.org ca_subject: @@ -111,6 +112,7 @@ agent: config: logLevel: info + socketPath: /run/spire/agent-sockets/spire-agent.sock csiDriver: image: