panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add initial spire-ha-agent support to the spire-nested chart (#790)

Browse Source 
* Add initial spire-ha-agent support to the spire-nested chart

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix lint issue

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2026-04-10 08:46:28 +00:00
committed by GitHub
parent c71ffc3c4e
commit 86787b5912
3 changed files with 59 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-nested/Chart.yaml
+13
View File
@@ -105,12 +105,25 @@ dependencies:
- nestedRoot - nestedRoot
- nestedChildFull - nestedChildFull
- nestedChildSecurity - nestedChildSecurity
- haAgentCommon
repository: file://../spire/charts/spiffe-oidc-discovery-provider repository: file://../spire/charts/spiffe-oidc-discovery-provider
version: 0.1.0 version: 0.1.0
- name: tornjak-frontend - name: tornjak-frontend
condition: tornjak-frontend.enabled condition: tornjak-frontend.enabled
repository: file://../spire/charts/tornjak-frontend repository: file://../spire/charts/tornjak-frontend
version: 0.1.0 version: 0.1.0
- name: spiffe-csi-driver
repository: file://../spire/charts/spiffe-csi-driver
version: 0.1.0
condition: spiffe-csi-driver.enabled
tags:
- haAgentCommon
- name: spire-ha-agent
repository: file://../spire-ha-agent
version: 0.1.0
condition: spire-ha-agent.enabled
tags:
- haAgentCommon
annotations: annotations:
artifacthub.io/category: security artifacthub.io/category: security
artifacthub.io/license: Apache-2.0 artifacthub.io/license: Apache-2.0
charts/spire-nested/README.md
+29 -25
View File
@@ -233,6 +233,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` | | `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` | | `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` | | `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
| `tags.haAgentCommon` | Set the chart mode to deploy the common portion of a spire-ha-agent setup | `false` |
### Spire agent parameters ### Spire agent parameters
@@ -328,28 +329,31 @@ Now you can interact with the Spire agent socket from your own application. The
### Spire server parameters ### Spire server parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- | | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ----------------------------------------------- |
| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` | | `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | | `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` | | `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | | `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | | `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | | `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | | `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` | | `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` |
| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` | | `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` |
| `external-spire-server.crNameOverride` | Custom Resource name override | `external` | | `external-spire-server.crNameOverride` | Custom Resource name override | `external` |
| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | | `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | | `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | | `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` | | `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` |
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` | | `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` |
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | | `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | | `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | | `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | | `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | | `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
| `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` | | `external-spire-server.bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `false` |
| `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` | | `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` |
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | | `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
| `spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/var/run/spire/agent-sockets/spire-agent.sock` |
| `spiffe-csi-driver.healthChecks.port` | Health check port number for upstream Spire agent | `9814` |
| `spire-ha-agent` | The configuration overrides for a spire-ha-agent | `{}` |
charts/spire-nested/values.yaml
+17 -1
View File
@@ -101,6 +101,8 @@ tags:
nestedChildFull: false nestedChildFull: false
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster ## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
nestedChildSecurity: false nestedChildSecurity: false
## @param tags.haAgentCommon Set the chart mode to deploy the common portion of a spire-ha-agent setup
haAgentCommon: false
## subcharts ## subcharts
@@ -197,7 +199,7 @@ upstream-spiffe-csi-driver:
## @section SPIFFE oidc discovery provider parameters ## @section SPIFFE oidc discovery provider parameters
## Parameter values for spiffe-oidc-discovery-provider ## Parameter values for spiffe-oidc-discovery-provider
## ##
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity] # Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity, haAgentCommon]
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
# enabled: true # enabled: true
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override ## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
@@ -395,3 +397,17 @@ external-spire-server:
joinToken: joinToken:
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: true enabled: true
# Used with tags [haAgentCommon]
spiffe-csi-driver:
# enabled: true
## @param spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
agentSocketPath: /var/run/spire/agent-sockets/spire-agent.sock
healthChecks:
## @param spiffe-csi-driver.healthChecks.port Health check port number for upstream Spire agent
port: 9814
## @param spire-ha-agent The configuration overrides for a spire-ha-agent
# Used with tags [haAgentCommon]
spire-ha-agent: {}
# enabled: true