Update spire-ha-agent (#936)
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -110,6 +110,15 @@ Create the name of the service account to use
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Whether prometheus metrics are on.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.prometheus-enabled" -}}
|
||||
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
|
||||
{{- printf "true" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.socket-path" -}}
|
||||
{{- print .Values.socketPath }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
{{- define "spire-ha-agent.check-config-values" -}}
|
||||
{{- if not (has .Values.mode (list "delegated" "broker")) }}
|
||||
{{- fail (printf "mode must be one of [delegated, broker], got: %s" .Values.mode) }}
|
||||
{{- end }}
|
||||
{{- if .Values.brokerAPI.enabled }}
|
||||
{{- if ne .Values.mode "broker" }}
|
||||
{{- fail "brokerAPI.enabled is true but mode is not broker. The served broker api is only available in broker mode." }}
|
||||
{{- end }}
|
||||
{{- if and (not .Values.brokerAPI.socket.enabled) (not .Values.brokerAPI.tcp.enabled) }}
|
||||
{{- fail "brokerAPI.enabled is true but neither brokerAPI.socket.enabled nor brokerAPI.tcp.enabled is set. At least one listener is required." }}
|
||||
{{- end }}
|
||||
{{- $enabledBrokers := 0 }}
|
||||
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||
{{- $enabledBrokers = add1 $enabledBrokers }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq $enabledBrokers 0 }}
|
||||
{{- fail "brokerAPI.enabled is true but no entry in brokerAPI.brokers is enabled. Only listed brokers may connect, so at least one is required." }}
|
||||
{{- end }}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set when brokerAPI is enabled, as broker ids are derived from it" (eq (include "spire-lib.trust-domain" .) "example.org")) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
The agent reads this config as YAML, so it is emitted directly rather than
|
||||
going through spire-lib.reformat-and-yaml2json. That helper exists to hand
|
||||
spire an HCL-compatible JSON document and to reshape its plugins dict into
|
||||
lists; neither applies here.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.yaml-config" -}}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" . | trim -}}
|
||||
single: {{ eq .Values.singleSocket true }}
|
||||
{{- if .Values.vsock }}
|
||||
vsock:
|
||||
enabled: true
|
||||
port: {{ .Values.port }}
|
||||
{{- else }}
|
||||
socket: /tmp/spire-ha-agent/public/spire-agent.sock
|
||||
{{- end }}
|
||||
upstream_a:
|
||||
broker_address: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
workload_socket: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- if not .Values.singleSocket }}
|
||||
upstream_b:
|
||||
broker_address: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
||||
workload_socket: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
upstream_keepalive:
|
||||
time: {{ .Values.upstreamKeepalive.time | quote }}
|
||||
timeout: {{ .Values.upstreamKeepalive.timeout | quote }}
|
||||
{{- if include "spire-ha-agent.prometheus-enabled" . }}
|
||||
metrics:
|
||||
bind_address: {{ printf "%s:%v" .Values.telemetry.prometheus.host .Values.telemetry.prometheus.port | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.brokerAPI.enabled }}
|
||||
broker_endpoint:
|
||||
{{- /* Deliberately not under the workload api socket directory: the agent
|
||||
rejects a socket_path that shares a directory with it. */}}
|
||||
{{- if .Values.brokerAPI.socket.enabled }}
|
||||
socket_path: /tmp/spire-ha-agent/broker/broker.sock
|
||||
{{- end }}
|
||||
{{- if .Values.brokerAPI.tcp.enabled }}
|
||||
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
||||
{{- end }}
|
||||
brokers:
|
||||
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||
- id: {{ tpl $value.idTemplate (dict "TrustDomain" $trustDomain) | quote }}
|
||||
allowed_reference_types:
|
||||
{{- range $value.allowedReferenceTypes }}
|
||||
- type_url: {{ .typeURL | quote }}
|
||||
allow_over_tcp: {{ eq .allowOverTCP true }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- /* Validation runs for every mode: two of its checks exist precisely to
|
||||
catch a mode that is not broker. */}}
|
||||
{{- include "spire-ha-agent.check-config-values" . }}
|
||||
{{- if eq .Values.mode "broker" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
data:
|
||||
config.yaml: |
|
||||
{{- include "spire-ha-agent.yaml-config" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -2,6 +2,7 @@
|
||||
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
|
||||
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||
{{- $socketPath := include "spire-ha-agent.socket-path" . }}
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
@@ -30,6 +31,12 @@ spec:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: spire-ha-agent
|
||||
{{- if eq .Values.mode "broker" }}
|
||||
checksum/config: {{ $configSum | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
@@ -122,53 +129,51 @@ spec:
|
||||
args:
|
||||
- "-mode"
|
||||
- {{ .Values.mode | quote }}
|
||||
{{- if eq .Values.mode "broker" }}
|
||||
- "-config"
|
||||
- "/opt/spire-ha-agent/conf/config.yaml"
|
||||
{{- end }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
#FIXME read permission to api socket
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
#{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||
{{- /* Broker mode is configured entirely by the rendered config
|
||||
file, so it has nothing to put here unless the user supplied
|
||||
extraEnvVars. Emitting a bare env: would render env: null. */}}
|
||||
{{- if or (eq .Values.mode "delegated") (gt (len .Values.extraEnvVars) 0) }}
|
||||
env:
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCK
|
||||
value: /tmp/spire-ha-agent/public/spire-agent.sock
|
||||
{{- if .Values.singleSocket }}
|
||||
{{- if .Values.singleSocket }}
|
||||
- name: SPIRE_HA_AGENT_SINGLE
|
||||
value: enabled
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
- name: SPIRE_HA_AGENT_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_BROKER_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
- name: SPIRE_HA_AGENT_VSOCK
|
||||
value: enabled
|
||||
- name: SPIRE_HA_AGENT_PORT
|
||||
value: {{ .Values.port | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if include "spire-ha-agent.prometheus-enabled" . }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.telemetry.prometheus.port }}
|
||||
name: prom
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# - name: spire-ha-agent-persistence
|
||||
# mountPath: /var/lib/spire
|
||||
@@ -201,6 +206,18 @@ spec:
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "broker" }}
|
||||
- name: spire-ha-agent-config
|
||||
mountPath: /opt/spire-ha-agent/conf
|
||||
readOnly: true
|
||||
{{- if .Values.brokerAPI.enabled }}
|
||||
{{- if .Values.brokerAPI.socket.enabled }}
|
||||
- name: spire-ha-agent-broker-socket-dir
|
||||
mountPath: /tmp/spire-ha-agent/broker
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||
@@ -261,6 +278,22 @@ spec:
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "broker" }}
|
||||
- name: spire-ha-agent-config
|
||||
configMap:
|
||||
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||
{{- if and .Values.brokerAPI.enabled .Values.brokerAPI.socket.enabled }}
|
||||
{{- if .Values.brokerAPI.socket.mountOnHost }}
|
||||
- name: spire-ha-agent-broker-socket-dir
|
||||
hostPath:
|
||||
path: {{ .Values.brokerAPI.socket.hostPath | quote }}
|
||||
type: DirectoryOrCreate
|
||||
{{- else }}
|
||||
- name: spire-ha-agent-broker-socket-dir
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
path: /dev
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||
{{- $namespace := include "spire-ha-agent.podMonitor.namespace" . }}
|
||||
{{- $podNamespace := ( include "spire-ha-agent.namespace" . ) }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.fullname" . }}
|
||||
namespace: {{ $namespace | quote }}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
|
||||
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 6 }}
|
||||
podMetricsEndpoints:
|
||||
- port: prom
|
||||
{{- if ne $namespace $podNamespace }}
|
||||
namespaceSelector:
|
||||
kubernetes.io/metadata.name: {{ $podNamespace | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user