panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

use spire-agent.hostCert.resources to set resources for corresponding spire-agent init container (#691)

Browse Source 
* use spire-agent.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spire-agent init containers fingerprint-tpm and init-tpm-direct

Signed-off-by: Daniel Schlatter <[email protected]>

* use spiffe-csi-driver.resources to set resources for associated initContainers, remove specific keys for those initContainers corresponding resources

Signed-off-by: Daniel Schlatter <[email protected]>

* set resources for spiffe-csi-driver init container set-context

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
This commit is contained in:
Daniel Schlatter
2025-11-20 21:47:59 -08:00
committed by GitHub
parent e75e095e1e
commit 8dffc8eda1
6 changed files with 15 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+1 -2
View File
@@ -32,7 +32,7 @@ A Helm chart to install the SPIFFE CSI driver.
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | | `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | | `resources` | Resource requests and limits for spiffe-csi-driver and its initContainers | `{}` |
| `extraEnvVars` | Extra environment variables to be added to the spiffe-csi-driver container | `[]` | | `extraEnvVars` | Extra environment variables to be added to the spiffe-csi-driver container | `[]` |
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | | `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
@@ -61,7 +61,6 @@ A Helm chart to install the SPIFFE CSI driver.
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` | | `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` |
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
| `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` | | `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` |
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | | `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+3 -1
View File
@@ -68,6 +68,8 @@ spec:
mountPath: /spire-agent-socket mountPath: /spire-agent-socket
terminationMessagePolicy: File terminationMessagePolicy: File
terminationMessagePath: /dev/termination-log terminationMessagePath: /dev/termination-log
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- end }} {{- end }}
{{- if gt (len .Values.initContainers) 0 }} {{- if gt (len .Values.initContainers) 0 }}
{{- toYaml .Values.initContainers | nindent 8 }} {{- toYaml .Values.initContainers | nindent 8 }}
@@ -147,7 +149,7 @@ spec:
port: healthz port: healthz
{{- toYaml .Values.livenessProbe | nindent 12 }} {{- toYaml .Values.livenessProbe | nindent 12 }}
resources: resources:
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
volumes: volumes:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
hostPath: hostPath:
charts/spire/charts/spiffe-csi-driver/values.yaml
+1 -13
View File
@@ -20,7 +20,7 @@ image:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: "" tag: ""
## @param resources [object] Resource requests and limits for spiffe-csi-driver ## @param resources [object] Resource requests and limits for spiffe-csi-driver and its initContainers
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little # choice for the user. This also increases chances charts run on environments with little
@@ -127,18 +127,6 @@ nodeDriverRegistrar:
repository: sig-storage/csi-node-driver-registrar repository: sig-storage/csi-node-driver-registrar
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: v2.9.4 tag: v2.9.4
## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 32Mi
# limits:
# cpu: 100m
# memory: 64Mi
## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container ## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container
extraEnvVars: [] extraEnvVars: []
charts/spire/charts/spire-agent/README.md
+1 -4
View File
@@ -43,7 +43,7 @@ A Helm chart to install the SPIRE agent.
| `podLabels` | Labels to add to pods | `{}` | | `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `resources` | Resource requests and limits | `{}` | | `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
@@ -74,7 +74,6 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
@@ -123,12 +122,10 @@ A Helm chart to install the SPIRE agent.
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095` | | `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095` |
| `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+8 -2
View File
@@ -124,6 +124,8 @@ spec:
echo Mode detected as hostCert. echo Mode detected as hostCert.
{{- end }} {{- end }}
chmod 644 /hostCert/kubelet.crt chmod 644 /hostCert/kubelet.crt
resources:
{{- toYaml .Values.resources | nindent 12 }}
env: env:
{{- if $cbh }} {{- if $cbh }}
- name: NODE_NAME - name: NODE_NAME
@@ -156,6 +158,8 @@ spec:
else else
/app/get_tpm_pubhash /app/get_tpm_pubhash
fi fi
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: tpm - name: tpm
mountPath: /dev/tpmrm0 mountPath: /dev/tpmrm0
@@ -174,6 +178,8 @@ spec:
- | - |
# SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it. # SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it.
cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: tpm-direct - name: tpm-direct
mountPath: /tpm mountPath: /tpm
@@ -196,7 +202,7 @@ spec:
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }} [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
exit 0 exit 0
resources: resources:
{{- toYaml .Values.socketAlternate.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: {{ $socketPath | dir }} mountPath: {{ $socketPath | dir }}
@@ -214,7 +220,7 @@ spec:
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
resources: resources:
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
volumeMounts: volumeMounts:
- name: spire-agent-socket-dir - name: spire-agent-socket-dir
mountPath: {{ $socketPath | dir }} mountPath: {{ $socketPath | dir }}
charts/spire/charts/spire-agent/values.yaml
+1 -10
View File
@@ -61,7 +61,7 @@ securityContext: {}
# runAsNonRoot: true # runAsNonRoot: true
# runAsUser: 1000 # runAsUser: 1000
## @param resources [object] Resource requests and limits ## @param resources [object] Resource requests and limits for the spire-agent container and all its initContainers
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little # choice for the user. This also increases chances charts run on environments with little
@@ -161,9 +161,6 @@ fsGroupFix:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670 tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
keyManager: keyManager:
memory: memory:
## @param keyManager.memory.enabled Enable the memory based Key Manager ## @param keyManager.memory.enabled Enable the memory based Key Manager
@@ -301,9 +298,6 @@ socketAlternate:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670 tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
hostCert: hostCert:
## @param hostCert.image.registry The OCI registry to pull the image from ## @param hostCert.image.registry The OCI registry to pull the image from
## @param hostCert.image.repository The repository within the registry ## @param hostCert.image.repository The repository within the registry
@@ -316,9 +310,6 @@ hostCert:
pullPolicy: IfNotPresent pullPolicy: IfNotPresent
tag: latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095 tag: latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095
## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {}
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
priorityClassName: "" priorityClassName: ""