Move oidc-discovery-provider to sub chart
Signed-off-by: Marco Franssen <[email protected]> Co-authored-by: Gert Jan Kamstra <[email protected]> Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
co-authored by
Gert Jan Kamstra
Gert Jan Kamstra
parent
35b8ad3c00
commit
99da500c1c
@@ -1,116 +0,0 @@
|
||||
{{- if eq (.Values.oidc.enabled | toString) "true" }}
|
||||
{{- $fullname := include "spire.fullname" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ printf "%s-oidc" $fullname }}
|
||||
labels:
|
||||
{{- include "spire.oidc.labels" . | nindent 4 }}
|
||||
spec:
|
||||
replicas: {{ .Values.oidc.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire.oidc.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.oidc.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire.oidc.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range . }}
|
||||
- name: {{ printf "%s-%s" $fullname .name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
|
||||
securityContext:
|
||||
{{- toYaml .Values.oidc.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: spire-oidc
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }}
|
||||
imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
|
||||
args:
|
||||
- -config
|
||||
- /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
name: health
|
||||
{{- if not .Values.oidc.insecureScheme.enabled }}
|
||||
- containerPort: 443
|
||||
name: https
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: spire-oidc-sockets
|
||||
mountPath: /run/spire/oidc-sockets
|
||||
readOnly: false
|
||||
- name: spire-oidc-config
|
||||
mountPath: /run/spire/oidc/config/
|
||||
readOnly: true
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.oidc.resources | nindent 12 }}
|
||||
{{- if .Values.oidc.insecureScheme.enabled }}
|
||||
- name: nginx
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }}
|
||||
imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: spire-oidc-sockets
|
||||
mountPath: /run/spire/oidc-sockets
|
||||
readOnly: true
|
||||
- name: spire-oidc-config
|
||||
mountPath: /etc/nginx/templates/default.conf.template
|
||||
subPath: default.conf.template
|
||||
readOnly: true
|
||||
resources:
|
||||
{{- toYaml .Values.oidc.insecureScheme.nginx.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "csi.spiffe.io"
|
||||
readOnly: true
|
||||
- name: spire-oidc-sockets
|
||||
hostPath:
|
||||
path: /run/spire/oidc-sockets
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-oidc-config
|
||||
configMap:
|
||||
name: {{ include "spire.fullname" . }}-oidc-discovery-provider
|
||||
{{- with .Values.oidc.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.oidc.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.oidc.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -1,58 +0,0 @@
|
||||
{{- if eq (.Values.oidc.enabled | toString) "true" }}
|
||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-oidc-discovery-provider
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
oidc-discovery-provider.conf: |
|
||||
log_level = "{{ .Values.oidc.config.logLevel }}"
|
||||
|
||||
domains = [
|
||||
"spire-oidc.{{ .Release.Namespace }}",
|
||||
"spire-oidc.{{ .Release.Namespace }}.svc.cluster.local",
|
||||
{{- if gt (len .Values.oidc.config.domains) 0 }}
|
||||
"{{- join "\",\n \"" .Values.oidc.config.domains }}"
|
||||
{{- end }}
|
||||
]
|
||||
|
||||
{{- if .Values.oidc.insecureScheme.enabled }}
|
||||
allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
|
||||
listen_socket_path = {{ $oidcSocket | quote }}
|
||||
{{- else }}
|
||||
acme {
|
||||
directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
|
||||
cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}"
|
||||
tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }}
|
||||
email = "{{ .Values.oidc.config.acme.emailAddress }}"
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
workload_api {
|
||||
socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}"
|
||||
trust_domain = "{{ .Values.spire.trustDomain }}"
|
||||
}
|
||||
|
||||
health_checks {
|
||||
bind_port = "8008"
|
||||
ready_path = "/ready"
|
||||
live_path = "/live"
|
||||
}
|
||||
{{- if .Values.oidc.insecureScheme.enabled }}
|
||||
default.conf.template: |
|
||||
upstream oidc {
|
||||
server unix:{{ $oidcSocket }};
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
location / {
|
||||
proxy_pass http://oidc;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -1,25 +0,0 @@
|
||||
{{- if eq (.Values.oidc.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-oidc
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.oidc.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.oidc.service.type }}
|
||||
ports:
|
||||
{{- if .Values.oidc.insecureScheme.enabled }}
|
||||
- name: http
|
||||
port: {{ .Values.oidc.service.port }}
|
||||
targetPort: http
|
||||
{{- else }}
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: https
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "spire.oidc.selectorLabels" . | nindent 4 }}
|
||||
{{ end }}
|
||||
@@ -15,7 +15,7 @@ data:
|
||||
# AWS requires the use of RSA. EC cryptography is not supported
|
||||
ca_key_type = "rsa-2048"
|
||||
|
||||
{{- if eq (.Values.oidc.enabled | toString) "true" }}
|
||||
{{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }}
|
||||
jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
|
||||
{{ end }}
|
||||
default_x509_svid_ttl = "1h"
|
||||
|
||||
Reference in New Issue
Block a user