Add alternate name support for the socket (#181)
* Add alternate name support for the socket Signed-off-by: Kevin Fox <[email protected]> * Fix missing image reference Signed-off-by: Kevin Fox <[email protected]> * Make user changing socket work smoothly. Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Update charts/spire/charts/spire-agent/values.yaml Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -12,6 +12,11 @@
|
||||
"filter": "LATESTSHA",
|
||||
"sort-flags": []
|
||||
},
|
||||
{
|
||||
"query": "socketAlternate.image",
|
||||
"filter": "LATESTSHA",
|
||||
"sort-flags": []
|
||||
},
|
||||
{
|
||||
"query": "fsGroupFix.image",
|
||||
"filter": "LATESTSHA",
|
||||
|
||||
@@ -88,6 +88,12 @@ A Helm chart to install the SPIRE agent.
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
|
||||
@@ -125,3 +125,11 @@ Create the name of the service account to use
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-agent.socket-alternate-names" -}}
|
||||
{{- $sockName := .Values.socketPath | base }}
|
||||
{{- $l := deepCopy .Values.socketAlternate.names }}
|
||||
{{- $l = without $l $sockName }}
|
||||
names:
|
||||
{{ $l | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
@@ -24,7 +24,7 @@ agent:
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
server_port: {{ .Values.server.port | quote }}
|
||||
socket_path: {{ include "spire-agent.socket-path" . | quote }}
|
||||
socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
|
||||
{{- if ne (len .Values.trustBundleURL) 0 }}
|
||||
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
|
||||
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
|
||||
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
|
||||
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||
{{- $socketPath := include "spire-agent.socket-path" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
@@ -50,18 +52,43 @@ spec:
|
||||
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | nindent 12 }}
|
||||
{{- if gt (len $socketAlternateNames) 0 }}
|
||||
- name: ensure-alternate-names
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }}
|
||||
command: ["bash", "-xc"]
|
||||
{{/* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
|
||||
args:
|
||||
- |
|
||||
cd {{ $socketPath | dir }}
|
||||
{{- range $socketAlternateNames }}
|
||||
L=`readlink {{ . }}`
|
||||
[ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }}
|
||||
[ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
|
||||
{{- end }}
|
||||
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
|
||||
exit 0
|
||||
resources:
|
||||
{{- toYaml .Values.socketAlternate.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
|
||||
- name: fsgroupfix
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
|
||||
command: ["bash", "-c"]
|
||||
args:
|
||||
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ include "spire-agent.socket-path" . | dir }}"
|
||||
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}"
|
||||
resources:
|
||||
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ include "spire-agent.socket-path" . | dir }}
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
@@ -73,7 +100,7 @@ spec:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["-config", "/run/spire/config/agent.conf"]
|
||||
args: ["-config", "/opt/spire/conf/agent/agent.conf"]
|
||||
securityContext:
|
||||
{{ toYaml .Values.securityContext | nindent 12 }}
|
||||
env:
|
||||
@@ -97,7 +124,7 @@ spec:
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
mountPath: /opt/spire/conf/agent
|
||||
readOnly: true
|
||||
{{- if eq (len .Values.trustBundleURL) 0 }}
|
||||
- name: spire-bundle
|
||||
@@ -105,7 +132,7 @@ spec:
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ include "spire-agent.socket-path" . | dir }}
|
||||
mountPath: /tmp/spire-agent/public
|
||||
readOnly: false
|
||||
- name: spire-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
@@ -153,7 +180,7 @@ spec:
|
||||
audience: spire-server
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ include "spire-agent.socket-path" . | dir }}
|
||||
path: {{ $socketPath | dir }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if gt (len .Values.extraVolumes) 0 }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
|
||||
@@ -210,6 +210,27 @@ kubeletConnectByHostname: ""
|
||||
## @param socketPath The unix socket path to the spire-agent
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
socketAlternate:
|
||||
## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
|
||||
names:
|
||||
- socket
|
||||
- spire-agent.sock
|
||||
- api.sock
|
||||
|
||||
## @param socketAlternate.image.registry The OCI registry to pull the image from
|
||||
## @param socketAlternate.image.repository The repository within the registry
|
||||
## @param socketAlternate.image.pullPolicy The image pull policy
|
||||
## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:07d2662ef699e9ceafab3f39624083193dfcb7b768ee86860dbdd5cb4473dcea
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
|
||||
Reference in New Issue
Block a user