spire-ha-agent chart (#519)
* Initial swag at a spire-ha-agent chart Signed-off-by: Kevin Fox <[email protected]> * Fix default Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Use released cid2pid Signed-off-by: Kevin Fox <[email protected]> * Fix test and pdate chart Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,137 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.system.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-system" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-ha-agent.server.namespace" -}}
|
||||
{{- if .Values.server.namespaceOverride -}}
|
||||
{{- .Values.server.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-ha-agent.podMonitor.namespace" -}}
|
||||
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else }}
|
||||
{{- include "spire-ha-agent.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-ha-agent.chart" . | quote }}
|
||||
{{ include "spire-ha-agent.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-ha-agent.name" . | quote }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-ha-agent.serviceAccountName" -}}
|
||||
{{- default (printf "%s-agent" .Release.Name) .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.server-address" }}
|
||||
{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }}
|
||||
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||
{{- else if .Values.server.address }}
|
||||
{{- .Values.server.address }}
|
||||
{{- else if .Values.server.nameOverride }}
|
||||
{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-ha-agent.server.namespace" . }}
|
||||
{{- else }}
|
||||
{{ .Release.Name }}-server.{{ include "spire-ha-agent.server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.socket-path" -}}
|
||||
{{- print .Values.socketPath }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.connect-by-hostname" -}}
|
||||
{{- if ne .Values.kubeletConnectByHostname "" }}
|
||||
{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- else if (dig "openshift" false .Values.global) }}
|
||||
{{- printf "true" }}
|
||||
{{- else }}
|
||||
{{- printf "false" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-ha-agent.socket-alternate-names" -}}
|
||||
{{- $sockName := .Values.socketPath | base }}
|
||||
{{- $l := deepCopy .Values.socketAlternate.names }}
|
||||
{{- $l = without $l $sockName }}
|
||||
names:
|
||||
{{ $l | toYaml }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,207 @@
|
||||
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
|
||||
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
|
||||
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||
{{- $socketPath := include "spire-ha-agent.socket-path" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||
namespace: {{ include "spire-ha-agent.namespace" . | quote}}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
{{- with .Values.updateStrategy }}
|
||||
updateStrategy:
|
||||
{{- if not (has .type (list "RollingUpdate" "OnDelete")) }}
|
||||
{{- fail "updateStrategy.type can only be RollingUpdate or OnDelete"}}
|
||||
{{- end }}
|
||||
type: {{ .type }}
|
||||
{{- if eq .type "RollingUpdate" }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .rollingUpdate.maxUnavailable }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/default-container: spire-ha-agent
|
||||
labels:
|
||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: spire-ha-agent
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostPID: true
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
serviceAccountName: {{ include "spire-ha-agent.serviceAccountName" . | quote }}
|
||||
securityContext:
|
||||
{{- toYaml $podSecurityContext | nindent 8 }}
|
||||
{{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
|
||||
{{- if ne (len .Values.hostAliases) 0 }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if not .Values.vsock }}
|
||||
{{- if gt (len $socketAlternateNames) 0 }}
|
||||
- name: ensure-alternate-names
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy | quote }}
|
||||
command: ["bash", "-xc"]
|
||||
{{- /* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
|
||||
args:
|
||||
- |
|
||||
cd {{ $socketPath | dir }}
|
||||
{{- range $socketAlternateNames }}
|
||||
L=`readlink {{ . }}`
|
||||
[ "x$L" != "x{{ $socketPath | base }}" ] && rm -f {{ . }}
|
||||
[ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
|
||||
{{- end }}
|
||||
[ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
|
||||
exit 0
|
||||
resources:
|
||||
{{- toYaml .Values.socketAlternate.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-ha-agent-socket-dir
|
||||
mountPath: {{ $socketPath | dir }}
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: setup-shell
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.cid2PID.busybox.image.pullPolicy | quote }}
|
||||
command: ["sh", "-xc"]
|
||||
args:
|
||||
- |
|
||||
cp -a /bin/busybox /data
|
||||
resources:
|
||||
{{- toYaml .Values.cid2PID.busybox.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: cid2pid
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
- name: setup-cid2pid
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.cid2PID.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.cid2PID.image.pullPolicy | quote }}
|
||||
command: ["/data/busybox", "sh", "-xc"]
|
||||
args:
|
||||
- |
|
||||
/data/busybox cp -a /usr/bin/cid2pid /data
|
||||
/data/busybox rm -f /data/busybox
|
||||
resources:
|
||||
{{- toYaml .Values.cid2PID.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: cid2pid
|
||||
mountPath: /data
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.initContainers) 0 }}
|
||||
{{- toYaml .Values.initContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name | quote }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
#FIXME read permission to api socket
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
#{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||
env:
|
||||
{{- if .Values.singleSocket }}
|
||||
- name: SPIRE_HA_AGENT_SINGLE
|
||||
value: enabled
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
- name: SPIRE_HA_AGENT_VSOCK
|
||||
value: enabled
|
||||
- name: SPIRE_HA_AGENT_PORT
|
||||
value: {{ .Values.port | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.extraEnvVars }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
# - name: spire-ha-agent-persistence
|
||||
# mountPath: /var/lib/spire
|
||||
{{- if .Values.vsock }}
|
||||
- name: cid2pid
|
||||
mountPath: /usr/bin/cid2pid
|
||||
subPath: cid2pid
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: spire-ha-agent-socket-dir
|
||||
mountPath: /tmp/spire-ha-agent/public
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/private
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/private
|
||||
{{- end }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if gt (len .Values.extraContainers) 0 }}
|
||||
{{- toYaml .Values.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if not .Values.vsock }}
|
||||
- name: spire-ha-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ $socketPath | dir }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.admin.hostPath }}{{ else }}{{ .Values.sockets.a.admin.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.admin.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
path: /dev
|
||||
- name: cid2pid
|
||||
emtpyDir: {}
|
||||
{{- if gt (len .Values.extraVolumes) 0 }}
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-ha-agent.serviceAccountName" . | quote }}
|
||||
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
|
||||
labels:
|
||||
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user