Fix permission issue with 1.10 and defaults when upgraded (#423)
* Fix permission issue with 1.10 and defaults when upgraded Signed-off-by: Kevin Fox <[email protected]> * Fix indenting Signed-off-by: Kevin Fox <[email protected]> * incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -393,6 +393,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` |
|
||||
| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` |
|
||||
| `chown.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `chown.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `chown.image.pullPolicy` | The image pull policy | `Always` |
|
||||
| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776` |
|
||||
| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` |
|
||||
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
|
||||
|
||||
@@ -318,3 +318,17 @@ subjects:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.podSecurityContext" -}}
|
||||
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
|
||||
{{- $openshift := ((.Values).global).openshift | default false }}
|
||||
{{- if not $openshift }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsUser") }}
|
||||
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
|
||||
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- toYaml $podSecurityContext }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
{{- $rawPodSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
|
||||
{{- $podSecurityContext := fromYaml (include "spire-server.podSecurityContext" .) }}
|
||||
{{- $needsChown := and (not (hasKey $rawPodSecurityContext "runAsUser")) (not (dig "openshift" false .Values.global)) }}
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
{{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
|
||||
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
|
||||
@@ -76,9 +79,9 @@ spec:
|
||||
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
{{- $podSecurityContext | toYaml | nindent 8 }}
|
||||
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled $needsChown }}
|
||||
initContainers:
|
||||
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
- name: init-tpm-direct
|
||||
@@ -100,6 +103,23 @@ spec:
|
||||
mountPath: /run/spire/data
|
||||
imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.image.pullPolicy }}
|
||||
{{- end }}
|
||||
{{- if $needsChown }}
|
||||
- name: chown
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.chown.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.chown.image.pullPolicy }}
|
||||
command: ["bash", "-c"]
|
||||
args:
|
||||
- |
|
||||
chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.runAsGroup }} /var/lib/spire
|
||||
resources:
|
||||
{{- toYaml .Values.chown.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-data
|
||||
mountPath: /var/lib/spire
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
{{- end }}
|
||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
|
||||
- name: wait
|
||||
securityContext:
|
||||
|
||||
@@ -990,6 +990,22 @@ customPlugins:
|
||||
upstreamAuthority: {}
|
||||
notifier: {}
|
||||
|
||||
# When upgrading from a previous version, sometimes we need to change the user and requires updating permissions.
|
||||
chown:
|
||||
## @param chown.image.registry The OCI registry to pull the image from
|
||||
## @param chown.image.repository The repository within the registry
|
||||
## @param chown.image.pullPolicy The image pull policy
|
||||
## @param chown.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/bash
|
||||
pullPolicy: Always
|
||||
tag: latest@sha256:27dc752a2ebacd10571c4045d3e1732f4bbb764446373ac85626602b69132776
|
||||
|
||||
## @param chown.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
resources: {}
|
||||
|
||||
experimental:
|
||||
## @param experimental.enabled Allow configuration of experimental features
|
||||
enabled: false
|
||||
|
||||
Reference in New Issue
Block a user