Make socketPaths configurable

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -49,6 +49,7 @@ Kubernetes: `>=1.21.0-0`
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
 | agent.config.logLevel | string | `"info"` |  |
+| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
 | agent.image.pullPolicy | string | `"IfNotPresent"` |  |
 | agent.image.registry | string | `"ghcr.io"` |  |
 | agent.image.repository | string | `"spiffe/spire-agent"` |  |
@@ -101,6 +102,7 @@ Kubernetes: `>=1.21.0-0`
 | server.config.ca_subject.organization | string | `"Example"` |  |
 | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` |  |
 | server.config.logLevel | string | `"info"` |  |
+| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` |  |
 | server.dataStorage.accessMode | string | `"ReadWriteOnce"` |  |
 | server.dataStorage.enabled | bool | `true` |  |
 | server.dataStorage.size | string | `"1Gi"` |  |

charts/spire/templates/NOTES.txt

@@ -1,4 +1,4 @@
 1. Get the currently registered SPIFFE entries from the server:
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
-    bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock
+    bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }}

charts/spire/templates/agent-configmap.yaml

@@ -7,10 +7,10 @@ data:
   agent.conf: |
     agent {
       data_dir = "/run/spire"
-      log_level = "{{ .Values.agent.config.logLevel }}"
+      log_level = {{ .Values.agent.config.logLevel | quote }}
       server_address = "{{ include "spire.fullname" . }}-server"
-      server_port = "{{ .Values.server.service.port }}"
+      server_port = {{ .Values.server.service.port | quote }}
-      socket_path = "/run/spire/agent-sockets/spire-agent.sock"
+      socket_path = {{ .Values.agent.config.socketPath | quote }}
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
       trust_domain = {{ .Values.spire.trustDomain | quote }}
     }

charts/spire/templates/oidc-dp-configmap.yaml

@@ -29,7 +29,7 @@ data:
     {{- end }}
 
     workload_api {
-      socket_path = "/spiffe-workload-api/spire-agent.sock"
+      socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}"
       trust_domain = "{{ .Values.spire.trustDomain }}"
     }
 

charts/spire/templates/server-configmap.yaml

@@ -8,7 +8,7 @@ data:
     server {
       bind_address = "0.0.0.0"
       bind_port = "8081"
-      socket_path = "/run/spire/server-sockets/spire-server.sock"
+      socket_path = {{ .Values.server.config.socketPath | quote }}
       trust_domain = {{ .Values.spire.trustDomain | quote }}
       data_dir = "/run/spire/data"
       log_level = "{{ .Values.server.config.logLevel }}"

charts/spire/templates/workload-registrar-configmap.yaml

@@ -9,6 +9,6 @@ data:
     mode            = "reconcile"
     trust_domain    = {{ .Values.spire.trustDomain | quote }}
     cluster         = {{ .Values.spire.clusterName | quote }}
-    server_address  = "unix:///run/spire/server-sockets/spire-server.sock"
+    server_address  = "unix://{{ .Values.server.config.socketPath }}"
     leader_election = true
     metrics_addr    = "0.0.0.0:18080"

charts/spire/values.yaml

@@ -77,6 +77,7 @@ server:
 
   config:
     logLevel: info
+    socketPath: /run/spire/server-sockets/spire-server.sock
     jwtIssuer: oidc-discovery.example.org
 
     ca_subject:
@@ -111,6 +112,7 @@ agent:
 
   config:
     logLevel: info
+    socketPath: /run/spire/agent-sockets/spire-agent.sock
 
 csiDriver:
   image: