use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691)
* use spire-agent.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources Signed-off-by: Daniel Schlatter <[email protected]> * set resources for spire-agent init containers fingerprint-tpm and init-tpm-direct Signed-off-by: Daniel Schlatter <[email protected]> * use spiffe-csi-driver.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources Signed-off-by: Daniel Schlatter <[email protected]> * set resources for spiffe-csi-driver init container set-context Signed-off-by: Daniel Schlatter <[email protected]> --------- Signed-off-by: Daniel Schlatter <[email protected]>
This commit is contained in:
Daniel Schlatter
@@ -32,7 +32,7 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
|
||||
| `resources` | Resource requests and limits for spiffe-csi-driver and its initContainers | `{}` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the spiffe-csi-driver container | `[]` |
|
||||
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
@@ -61,7 +61,6 @@ A Helm chart to install the SPIFFE CSI driver.
|
||||
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
|
||||
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` |
|
||||
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
|
||||
| `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` |
|
||||
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
|
||||
|
||||
@@ -68,6 +68,8 @@ spec:
|
||||
mountPath: /spire-agent-socket
|
||||
terminationMessagePolicy: File
|
||||
terminationMessagePath: /dev/termination-log
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.initContainers) 0 }}
|
||||
{{- toYaml .Values.initContainers | nindent 8 }}
|
||||
@@ -147,7 +149,7 @@ spec:
|
||||
port: healthz
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
|
||||
@@ -20,7 +20,7 @@ image:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param resources [object] Resource requests and limits for spiffe-csi-driver
|
||||
## @param resources [object] Resource requests and limits for spiffe-csi-driver and its initContainers
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
@@ -127,18 +127,6 @@ nodeDriverRegistrar:
|
||||
repository: sig-storage/csi-node-driver-registrar
|
||||
pullPolicy: IfNotPresent
|
||||
tag: v2.9.4
|
||||
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container
|
||||
extraEnvVars: []
|
||||
|
||||
|
||||
@@ -43,7 +43,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
@@ -74,7 +74,6 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
@@ -123,12 +122,10 @@ A Helm chart to install the SPIRE agent.
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` |
|
||||
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095` |
|
||||
| `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
|
||||
@@ -124,6 +124,8 @@ spec:
|
||||
echo Mode detected as hostCert.
|
||||
{{- end }}
|
||||
chmod 644 /hostCert/kubelet.crt
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
env:
|
||||
{{- if $cbh }}
|
||||
- name: NODE_NAME
|
||||
@@ -156,6 +158,8 @@ spec:
|
||||
else
|
||||
/app/get_tpm_pubhash
|
||||
fi
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: tpm
|
||||
mountPath: /dev/tpmrm0
|
||||
@@ -174,6 +178,8 @@ spec:
|
||||
- |
|
||||
# SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it.
|
||||
cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: tpm-direct
|
||||
mountPath: /tpm
|
||||
@@ -196,7 +202,7 @@ spec:
|
||||
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
|
||||
exit 0
|
||||
resources:
|
||||
{{- toYaml .Values.socketAlternate.resources | nindent 12 }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
@@ -214,7 +220,7 @@ spec:
|
||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
|
||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
|
||||
resources:
|
||||
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
|
||||
@@ -61,7 +61,7 @@ securityContext: {}
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param resources [object] Resource requests and limits
|
||||
## @param resources [object] Resource requests and limits for the spire-agent container and all its initContainers
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
@@ -161,9 +161,6 @@ fsGroupFix:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
keyManager:
|
||||
memory:
|
||||
## @param keyManager.memory.enabled Enable the memory based Key Manager
|
||||
@@ -301,9 +298,6 @@ socketAlternate:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
hostCert:
|
||||
## @param hostCert.image.registry The OCI registry to pull the image from
|
||||
## @param hostCert.image.repository The repository within the registry
|
||||
@@ -316,9 +310,6 @@ hostCert:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095
|
||||
|
||||
## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
|
||||
Reference in New Issue
Block a user