Add alternate name support for the socket (#181)

* Add alternate name support for the socket

Signed-off-by: Kevin Fox <[email protected]>

* Fix missing image reference

Signed-off-by: Kevin Fox <[email protected]>

* Make user changing socket work smoothly.

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

.github/tests/images.json

@@ -12,6 +12,11 @@
       "filter": "LATESTSHA",
       "sort-flags": []
     },
+    {
+      "query": "socketAlternate.image",
+      "filter": "LATESTSHA",
+      "sort-flags": []
+    },
     {
       "query": "fsGroupFix.image",
       "filter": "LATESTSHA",

charts/spire/charts/spire-agent/README.md

@@ -88,6 +88,12 @@ A Helm chart to install the SPIRE agent.
 | `telemetry.prometheus.podMonitor.labels`          | Pod labels to filter for prometheus monitoring                                                                                                                                                    | `{}`                                                                             |
 | `kubeletConnectByHostname`                        | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.                                                      | `""`                                                                             |
 | `socketPath`                                      | The unix socket path to the spire-agent                                                                                                                                                           | `/run/spire/agent-sockets/spire-agent.sock`                                      |
+| `socketAlternate.names`                           | List of alternate names for the socket that workloads might expect to be able to access in the driver mount.                                                                                      | `["socket","spire-agent.sock","api.sock"]`                                       |
+| `socketAlternate.image.registry`                  | The OCI registry to pull the image from                                                                                                                                                           | `cgr.dev`                                                                        |
+| `socketAlternate.image.repository`                | The repository within the registry                                                                                                                                                                | `chainguard/bash`                                                                |
+| `socketAlternate.image.pullPolicy`                | The image pull policy                                                                                                                                                                             | `Always`                                                                         |
+| `socketAlternate.image.tag`                       | Overrides the image tag whose default is the chart appVersion                                                                                                                                     | `latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea` |
+| `socketAlternate.resources`                       | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/                                                                                      | `{}`                                                                             |
 | `priorityClassName`                               | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.                                                                                         | `""`                                                                             |
 | `extraEnvVars`                                    | Extra environment variables to be added to the Spire Agent container                                                                                                                              | `[]`                                                                             |
 | `extraVolumes`                                    | Extra volumes to be mounted on Spire Agent pods                                                                                                                                                   | `[]`                                                                             |

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -125,3 +125,11 @@ Create the name of the service account to use
 {{-     printf "false" }}
 {{-   end }}
 {{- end }}
+
+{{- define "spire-agent.socket-alternate-names" -}}
+{{-   $sockName := .Values.socketPath | base }}
+{{-   $l := deepCopy .Values.socketAlternate.names }}
+{{-   $l = without $l $sockName }}
+names:
+{{ $l | toYaml }}
+{{- end }}

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -24,7 +24,7 @@ agent:
   log_level: {{ .Values.logLevel | quote }}
   server_address: {{ include "spire-agent.server-address" . | trim | quote }}
   server_port: {{ .Values.server.port | quote }}
-  socket_path: {{ include "spire-agent.socket-path" . | quote }}
+  socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
   {{- if ne (len .Values.trustBundleURL) 0 }}
   trust_bundle_url: {{ .Values.trustBundleURL | quote }}
   trust_bundle_format: {{ .Values.trustBundleFormat | quote }}

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -1,6 +1,8 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
 {{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
+{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
+{{- $socketPath := include "spire-agent.socket-path" . }}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -50,18 +52,43 @@ spec:
             {{- toYaml .Values.waitForIt.resources | nindent 12 }}
           securityContext:
             {{ toYaml .Values.securityContext | nindent 12 }}
+        {{- if gt (len $socketAlternateNames) 0 }}
+        - name: ensure-alternate-names
+          image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
+          imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }}
+          command: ["bash", "-xc"]
+          {{/* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
+          args:
+            - |
+              cd {{ $socketPath | dir }}
+              {{- range $socketAlternateNames }}
+              L=`readlink {{ . }}`
+              [ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }}
+              [ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
+              {{- end }}
+              [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
+              exit 0
+          resources:
+            {{- toYaml .Values.socketAlternate.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-agent-socket-dir
+              mountPath: {{ $socketPath | dir }}
+          securityContext:
+            runAsUser: 0
+            runAsGroup: 0
+        {{- end }}
         {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
         - name: fsgroupfix
           image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
           command: ["bash", "-c"]
           args:
-            - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}"
+            - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}"
           resources:
             {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
           volumeMounts:
             - name: spire-agent-socket-dir
-              mountPath: {{ include "spire-agent.socket-path" . | dir }}
+              mountPath: {{ $socketPath | dir }}
           securityContext:
             runAsUser: 0
             runAsGroup: 0
@@ -73,7 +100,7 @@ spec:
         - name: {{ .Chart.Name }}
           image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          args: ["-config", "/run/spire/config/agent.conf"]
+          args: ["-config", "/opt/spire/conf/agent/agent.conf"]
           securityContext:
             {{ toYaml .Values.securityContext | nindent 12 }}
           env:
@@ -97,7 +124,7 @@ spec:
             {{- end }}
           volumeMounts:
             - name: spire-config
-              mountPath: /run/spire/config
+              mountPath: /opt/spire/conf/agent
               readOnly: true
             {{- if eq (len .Values.trustBundleURL) 0 }}
             - name: spire-bundle
@@ -105,7 +132,7 @@ spec:
               readOnly: true
             {{- end }}
             - name: spire-agent-socket-dir
-              mountPath: {{ include "spire-agent.socket-path" . | dir }}
+              mountPath: /tmp/spire-agent/public
               readOnly: false
             - name: spire-token
               mountPath: /var/run/secrets/tokens
@@ -153,7 +180,7 @@ spec:
                 audience: spire-server
         - name: spire-agent-socket-dir
           hostPath:
-            path: {{ include "spire-agent.socket-path" . | dir }}
+            path: {{ $socketPath | dir }}
             type: DirectoryOrCreate
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}

charts/spire/charts/spire-agent/values.yaml

@@ -210,6 +210,27 @@ kubeletConnectByHostname: ""
 ## @param socketPath The unix socket path to the spire-agent
 socketPath: /run/spire/agent-sockets/spire-agent.sock
 
+socketAlternate:
+  ## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
+  names:
+    - socket
+    - spire-agent.sock
+    - api.sock
+
+  ## @param socketAlternate.image.registry The OCI registry to pull the image from
+  ## @param socketAlternate.image.repository The repository within the registry
+  ## @param socketAlternate.image.pullPolicy The image pull policy
+  ## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
+  ##
+  image:
+    registry: cgr.dev
+    repository: chainguard/bash
+    pullPolicy: Always
+    tag: latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea
+
+  ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+  resources: {}
+
 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
 priorityClassName: ""