spire-ha-agent chart (#519)
* Initial swag at a spire-ha-agent chart Signed-off-by: Kevin Fox <[email protected]> * Fix default Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Use released cid2pid Signed-off-by: Kevin Fox <[email protected]> * Fix test and pdate chart Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,198 @@
|
||||
# Default configuration for Spire Agent
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @skip global
|
||||
global: {}
|
||||
|
||||
## @section Chart parameters
|
||||
##
|
||||
## @param image.registry The OCI registry to pull the image from
|
||||
## @param image.repository The repository within the registry
|
||||
## @param image.pullPolicy The image pull policy
|
||||
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-ha-agent
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param singleSocket If in singleSocket mode, only one driver is used
|
||||
singleSocket: false
|
||||
|
||||
## @param sockets.single.admin.hostPath Where the sockets are on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.b.admin.hostPath Where the sockets are on disk
|
||||
sockets:
|
||||
single:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin
|
||||
a:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
b:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
|
||||
## @param vsock Use a vsockets to expose the service rather then a unix socket
|
||||
vsock: false
|
||||
|
||||
## @param port Port number to listen on
|
||||
port: 999
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
create: true
|
||||
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||
annotations: {}
|
||||
## @param serviceAccount.name The name of the service account to use.
|
||||
## If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
## @param podAnnotations [object] Annotations to add to pods
|
||||
podAnnotations: {}
|
||||
|
||||
## @param podLabels [object] Labels to add to pods
|
||||
podLabels: {}
|
||||
|
||||
## @param podSecurityContext [object] Pod security context
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Security context
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param nodeSelector [object] Node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param tolerations [array] List of tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param affinity [object] Node affinity
|
||||
affinity: {}
|
||||
|
||||
## @param updateStrategy.type The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete.
|
||||
## @param updateStrategy.rollingUpdate.maxUnavailable Max unavailable pods during update. Can be a number or a percentage.
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
|
||||
# When running as non root, needed to ensure the socket path has the correct permissions.
|
||||
# Set runAsUser to a non-zero value in podSecurityContext to run as non-root user.
|
||||
fsGroupFix:
|
||||
## @param fsGroupFix.image.registry The OCI registry to pull the image from
|
||||
## @param fsGroupFix.image.repository The repository within the registry
|
||||
## @param fsGroupFix.image.pullPolicy The image pull policy
|
||||
## @param fsGroupFix.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
||||
|
||||
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
cid2PID:
|
||||
## @param cid2PID.image.registry The OCI registry to pull the image from
|
||||
## @param cid2PID.image.repository The repository within the registry
|
||||
## @param cid2PID.image.pullPolicy The image pull policy
|
||||
## @param cid2PID.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: kfox1111/cid2pid
|
||||
pullPolicy: Always
|
||||
tag: v0.0.3
|
||||
|
||||
## @param cid2PID.busybox.image.registry The OCI registry to pull the image from
|
||||
## @param cid2PID.busybox.image.repository The repository within the registry
|
||||
## @param cid2PID.busybox.image.pullPolicy The image pull policy
|
||||
## @param cid2PID.busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
busybox:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: library/busybox
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.36.1-uclibc
|
||||
|
||||
## @param cid2PID.busybox.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param socketPath The unix socket path to the spire-agent
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
socketAlternate:
|
||||
## @param socketAlternate.names List of alternate names for the socket that workloads might expect to be able to access in the driver mount.
|
||||
names:
|
||||
- socket
|
||||
- spire-agent.sock
|
||||
- api.sock
|
||||
|
||||
## @param socketAlternate.image.registry The OCI registry to pull the image from
|
||||
## @param socketAlternate.image.repository The repository within the registry
|
||||
## @param socketAlternate.image.pullPolicy The image pull policy
|
||||
## @param socketAlternate.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1
|
||||
|
||||
## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
|
||||
priorityClassName: ""
|
||||
|
||||
## @param extraEnvVars [array] Extra environment variables to be added to the Spire Agent container
|
||||
extraEnvVars: []
|
||||
|
||||
## @param extraVolumes [array] Extra volumes to be mounted on Spire Agent pods
|
||||
extraVolumes: []
|
||||
|
||||
## @param extraVolumeMounts [array] Extra volume mounts for Spire Agent pods
|
||||
extraVolumeMounts: []
|
||||
|
||||
## @param extraContainers [array] Additional containers to create with Spire Agent pods
|
||||
extraContainers: []
|
||||
|
||||
## @param initContainers [array] Additional init containers to create with Spire Agent pods
|
||||
initContainers: []
|
||||
## @param hostAliases [array] Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
|
||||
hostAliases: []
|
||||
Reference in New Issue
Block a user