From 8adbb89890865d55bb3880562bb43890cfcd522f Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 5 Feb 2024 11:40:19 -0800 Subject: [PATCH] Add alternate name support for the socket (#181) * Add alternate name support for the socket Signed-off-by: Kevin Fox * Fix missing image reference Signed-off-by: Kevin Fox * Make user changing socket work smoothly. Signed-off-by: Kevin Fox * Apply suggestions from code review Signed-off-by: kfox1111 * Update charts/spire/charts/spire-agent/values.yaml Signed-off-by: kfox1111 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- .github/tests/images.json | 5 +++ charts/spire/charts/spire-agent/README.md | 6 +++ .../charts/spire-agent/templates/_helpers.tpl | 8 ++++ .../spire-agent/templates/configmap.yaml | 2 +- .../spire-agent/templates/daemonset.yaml | 39 ++++++++++++++++--- charts/spire/charts/spire-agent/values.yaml | 21 ++++++++++ 6 files changed, 74 insertions(+), 7 deletions(-) diff --git a/.github/tests/images.json b/.github/tests/images.json index 271dca1..12863b5 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -12,6 +12,11 @@ "filter": "LATESTSHA", "sort-flags": [] }, + { + "query": "socketAlternate.image", + "filter": "LATESTSHA", + "sort-flags": [] + }, { "query": "fsGroupFix.image", "filter": "LATESTSHA", diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 2db9ee2..22c11c4 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -88,6 +88,12 @@ A Helm chart to install the SPIRE agent. | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | +| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | +| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | +| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea` | +| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 89d5624..fd83a3f 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -125,3 +125,11 @@ Create the name of the service account to use {{- printf "false" }} {{- end }} {{- end }} + +{{- define "spire-agent.socket-alternate-names" -}} +{{- $sockName := .Values.socketPath | base }} +{{- $l := deepCopy .Values.socketAlternate.names }} +{{- $l = without $l $sockName }} +names: +{{ $l | toYaml }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 34a0d7e..1270be6 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -24,7 +24,7 @@ agent: log_level: {{ .Values.logLevel | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_port: {{ .Values.server.port | quote }} - socket_path: {{ include "spire-agent.socket-path" . | quote }} + socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }} {{- if ne (len .Values.trustBundleURL) 0 }} trust_bundle_url: {{ .Values.trustBundleURL | quote }} trust_bundle_format: {{ .Values.trustBundleFormat | quote }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4d6c7c5..7dfe8d0 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,6 +1,8 @@ {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }} {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }} +{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }} +{{- $socketPath := include "spire-agent.socket-path" . }} apiVersion: apps/v1 kind: DaemonSet metadata: @@ -50,18 +52,43 @@ spec: {{- toYaml .Values.waitForIt.resources | nindent 12 }} securityContext: {{ toYaml .Values.securityContext | nindent 12 }} + {{- if gt (len $socketAlternateNames) 0 }} + - name: ensure-alternate-names + image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }} + imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }} + command: ["bash", "-xc"] + {{/* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}} + args: + - | + cd {{ $socketPath | dir }} + {{- range $socketAlternateNames }} + L=`readlink {{ . }}` + [ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }} + [ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }} + {{- end }} + [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }} + exit 0 + resources: + {{- toYaml .Values.socketAlternate.resources | nindent 12 }} + volumeMounts: + - name: spire-agent-socket-dir + mountPath: {{ $socketPath | dir }} + securityContext: + runAsUser: 0 + runAsGroup: 0 + {{- end }} {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }} - name: fsgroupfix image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }} imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }} command: ["bash", "-c"] args: - - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}" + - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}" resources: {{- toYaml .Values.fsGroupFix.resources | nindent 12 }} volumeMounts: - name: spire-agent-socket-dir - mountPath: {{ include "spire-agent.socket-path" . | dir }} + mountPath: {{ $socketPath | dir }} securityContext: runAsUser: 0 runAsGroup: 0 @@ -73,7 +100,7 @@ spec: - name: {{ .Chart.Name }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} imagePullPolicy: {{ .Values.image.pullPolicy }} - args: ["-config", "/run/spire/config/agent.conf"] + args: ["-config", "/opt/spire/conf/agent/agent.conf"] securityContext: {{ toYaml .Values.securityContext | nindent 12 }} env: @@ -97,7 +124,7 @@ spec: {{- end }} volumeMounts: - name: spire-config - mountPath: /run/spire/config + mountPath: /opt/spire/conf/agent readOnly: true {{- if eq (len .Values.trustBundleURL) 0 }} - name: spire-bundle @@ -105,7 +132,7 @@ spec: readOnly: true {{- end }} - name: spire-agent-socket-dir - mountPath: {{ include "spire-agent.socket-path" . | dir }} + mountPath: /tmp/spire-agent/public readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -153,7 +180,7 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: {{ include "spire-agent.socket-path" . | dir }} + path: {{ $socketPath | dir }} type: DirectoryOrCreate {{- if gt (len .Values.extraVolumes) 0 }} {{- toYaml .Values.extraVolumes | nindent 8 }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 5c907ef..f072b52 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -210,6 +210,27 @@ kubeletConnectByHostname: "" ## @param socketPath The unix socket path to the spire-agent socketPath: /run/spire/agent-sockets/spire-agent.sock +socketAlternate: + ## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount. + names: + - socket + - spire-agent.sock + - api.sock + + ## @param socketAlternate.image.registry The OCI registry to pull the image from + ## @param socketAlternate.image.repository The repository within the registry + ## @param socketAlternate.image.pullPolicy The image pull policy + ## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion + ## + image: + registry: cgr.dev + repository: chainguard/bash + pullPolicy: Always + tag: latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea + + ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: ""