diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index cad27b1..92baa12 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -32,7 +32,7 @@ A Helm chart to install the SPIFFE CSI driver. | `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `resources` | Resource requests and limits for spiffe-csi-driver and its initContainers | `{}` | | `extraEnvVars` | Extra environment variables to be added to the spiffe-csi-driver container | `[]` | | `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | @@ -61,7 +61,6 @@ A Helm chart to install the SPIFFE CSI driver. | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.4` | -| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | | `nodeDriverRegistrar.extraEnvVars` | Extra environment variables to be added to the nodeDriverRegistrar container | `[]` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 5c4528d..83892b9 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -68,6 +68,8 @@ spec: mountPath: /spire-agent-socket terminationMessagePolicy: File terminationMessagePath: /dev/termination-log + resources: + {{- toYaml .Values.resources | nindent 12 }} {{- end }} {{- if gt (len .Values.initContainers) 0 }} {{- toYaml .Values.initContainers | nindent 8 }} @@ -147,7 +149,7 @@ spec: port: healthz {{- toYaml .Values.livenessProbe | nindent 12 }} resources: - {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} volumes: - name: spire-agent-socket-dir hostPath: diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 844a4de..f21cf4d 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -20,7 +20,7 @@ image: pullPolicy: IfNotPresent tag: "" -## @param resources [object] Resource requests and limits for spiffe-csi-driver +## @param resources [object] Resource requests and limits for spiffe-csi-driver and its initContainers resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -127,18 +127,6 @@ nodeDriverRegistrar: repository: sig-storage/csi-node-driver-registrar pullPolicy: IfNotPresent tag: v2.9.4 - ## @param nodeDriverRegistrar.resources Resource requests and limits for CSI driver pods - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi ## @param nodeDriverRegistrar.extraEnvVars [array] Extra environment variables to be added to the nodeDriverRegistrar container extraEnvVars: [] diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 715f448..8cf2079 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -43,7 +43,7 @@ A Helm chart to install the SPIRE agent. | `podLabels` | Labels to add to pods | `{}` | | `podSecurityContext` | Pod security context | `{}` | | `securityContext` | Security context | `{}` | -| `resources` | Resource requests and limits | `{}` | +| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | | `nodeSelector` | Node selector | `{}` | | `tolerations` | List of tolerations | `[]` | | `affinity` | Node affinity | `{}` | @@ -74,7 +74,6 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` | -| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | @@ -123,12 +122,10 @@ A Helm chart to install the SPIRE agent. | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670` | -| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095` | -| `hostCert.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index bbf5ccc..9f70999 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -124,6 +124,8 @@ spec: echo Mode detected as hostCert. {{- end }} chmod 644 /hostCert/kubelet.crt + resources: + {{- toYaml .Values.resources | nindent 12 }} env: {{- if $cbh }} - name: NODE_NAME @@ -156,6 +158,8 @@ spec: else /app/get_tpm_pubhash fi + resources: + {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: tpm mountPath: /dev/tpmrm0 @@ -174,6 +178,8 @@ spec: - | # SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it. cp -a {{ .Values.nodeAttestor.tpmDirect.plugin.path | quote }} /tpm/tpm_attestor_agent + resources: + {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: tpm-direct mountPath: /tpm @@ -196,7 +202,7 @@ spec: [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }} exit 0 resources: - {{- toYaml .Values.socketAlternate.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: spire-agent-socket-dir mountPath: {{ $socketPath | dir }} @@ -214,7 +220,7 @@ spec: chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire resources: - {{- toYaml .Values.fsGroupFix.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} volumeMounts: - name: spire-agent-socket-dir mountPath: {{ $socketPath | dir }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 6c0fe91..38908a7 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -61,7 +61,7 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 -## @param resources [object] Resource requests and limits +## @param resources [object] Resource requests and limits for the spire-agent container and all its initContainers resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -161,9 +161,6 @@ fsGroupFix: pullPolicy: IfNotPresent tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670 - ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - resources: {} - keyManager: memory: ## @param keyManager.memory.enabled Enable the memory based Key Manager @@ -301,9 +298,6 @@ socketAlternate: pullPolicy: IfNotPresent tag: latest@sha256:b8210a1e571844b4839347864086a50a12bdf6b160636d9d5b4d349d06c9b670 - ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - resources: {} - hostCert: ## @param hostCert.image.registry The OCI registry to pull the image from ## @param hostCert.image.repository The repository within the registry @@ -316,9 +310,6 @@ hostCert: pullPolicy: IfNotPresent tag: latest@sha256:d943db395689eda73af1bb16943de9ab7658a916a0792d2c93901e7fd252e095 - ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ - resources: {} - ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. priorityClassName: ""