diff --git a/.gitignore b/.gitignore index 34ca862..6df9c8e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -.github/scripts/bin -.idea/ \ No newline at end of file +bin/ +.idea/ diff --git a/charts/spire/.helmignore b/charts/spire/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml new file mode 100644 index 0000000..e6c6696 --- /dev/null +++ b/charts/spire/Chart.yaml @@ -0,0 +1,31 @@ +apiVersion: v2 +name: spire +description: > + A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. +type: application +version: 0.1.0 +appVersion: "1.5.4" +keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] +home: https://github.com/philips-labs/helm-charts/tree/main/charts/spire +sources: + - https://github.com/philips-labs/helm-charts/tree/main/charts/spire +icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png +maintainers: + - name: marcofranssen + email: marco.franssen@gmail.com + url: https://marcofranssen.nl +kubeVersion: ">=1.21.0-0" +dependencies: + - name: spire-server + repository: file://./charts/spire-server + version: 0.1.0 + - name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 + - name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 + - name: spiffe-oidc-discovery-provider + condition: spiffe-oidc-discovery-provider.enabled + repository: file://./charts/spiffe-oidc-discovery-provider + version: 0.1.0 diff --git a/charts/spire/LICENSE b/charts/spire/LICENSE new file mode 100644 index 0000000..261eeb9 --- /dev/null +++ b/charts/spire/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/spire/README.md b/charts/spire/README.md new file mode 100644 index 0000000..8f23256 --- /dev/null +++ b/charts/spire/README.md @@ -0,0 +1,74 @@ +# spire + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) + +A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. + +**Homepage:** + +> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + +> **Note**: Minimum Spire version is `v1.5.3`. + +To enable Projected Service Account Tokens on Docker for Mac/Windows run the following +command to SSH into the Docker Desktop K8s VM. + +```bash +docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh +``` + +Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + +```yaml +spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key +``` + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| marcofranssen | | | + +## Source Code + +* + +## Requirements + +Kubernetes: `>=1.21.0-0` + +| Repository | Name | Version | +|------------|------|---------| +| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | +| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | +| file://./charts/spire-agent | spire-agent | 0.1.0 | +| file://./charts/spire-server | spire-server | 0.1.0 | + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| fullnameOverride | string | `""` | | +| nameOverride | string | `""` | | +| spiffe-csi-driver | object | `{}` | | +| spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | | +| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | +| spire-agent.clusterName | string | `"example-cluster"` | | +| spire-agent.nameOverride | string | `"agent"` | | +| spire-agent.trustDomain | string | `"example.org"` | | +| spire-server.bundleConfigMap | string | `"spire-bundle"` | | +| spire-server.clusterName | string | `"example-cluster"` | | +| spire-server.nameOverride | string | `"server"` | | +| spire-server.trustDomain | string | `"example.org"` | | + +---------------------------------------------- diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl new file mode 100644 index 0000000..677a8f4 --- /dev/null +++ b/charts/spire/README.md.gotmpl @@ -0,0 +1,45 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + +> **Note**: Minimum Spire version is `v1.5.3`. + +To enable Projected Service Account Tokens on Docker for Mac/Windows run the following +command to SSH into the Docker Desktop K8s VM. + +```bash +docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh +``` + +Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + +```yaml +spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key +``` + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/.helmignore b/charts/spire/charts/spiffe-csi-driver/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spiffe-csi-driver/Chart.yaml b/charts/spire/charts/spiffe-csi-driver/Chart.yaml new file mode 100644 index 0000000..be915ee --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spiffe-csi-driver +description: A Helm chart to install the SPIFFE CSI driver. +type: application +version: 0.1.0 +appVersion: "0.2.1" diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md new file mode 100644 index 0000000..03ee62c --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -0,0 +1,36 @@ +# spiffe-csi-driver + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square) + +A Helm chart to install the SPIFFE CSI driver. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spiffe-csi-driver"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | +| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | +| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | +| nodeDriverRegistrar.resources | object | `{}` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext.privileged | bool | `true` | | +| securityContext.readOnlyRootFilesystem | bool | `true` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt new file mode 100644 index 0000000..3d27b51 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt @@ -0,0 +1 @@ +SPIFFE CSI Driver installed… diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl new file mode 100644 index 0000000..7154e44 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -0,0 +1,86 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spiffe-csi-driver.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spiffe-csi-driver.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spiffe-csi-driver.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spiffe-csi-driver.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spiffe-csi-driver.labels" -}} +helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }} +{{ include "spiffe-csi-driver.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spiffe-csi-driver.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spiffe-csi-driver.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + + +{{- define "spiffe-csi-driver.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml new file mode 100644 index 0000000..6a681df --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -0,0 +1,116 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }} + updateStrategy: + type: RollingUpdate + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + # This is the container which runs the SPIFFE CSI driver. + - name: {{ .Chart.Name }} + image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: [ + "-workload-api-socket-dir", "/spire-agent-socket", + "-csi-socket-path", "/spiffe-csi/csi.sock", + ] + env: + # The CSI driver needs a unique node ID. The node name can be + # used for this purpose. + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + # The volume containing the SPIRE agent socket. The SPIFFE CSI + # driver will mount this directory into containers. + - mountPath: /spire-agent-socket + name: spire-agent-socket-dir + readOnly: true + # The volume that will contain the CSI driver socket shared + # with the kubelet and the driver registrar. + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The volume containing mount points for containers. + - mountPath: /var/lib/kubelet/pods + mountPropagation: Bidirectional + name: mountpoint-dir + securityContext: + readOnlyRootFilesystem: true + capabilities: + drop: + - all + privileged: true + resources: + {{- toYaml .Values.resources | nindent 12 }} + # This container runs the CSI Node Driver Registrar which takes care + # of all the little details required to register a CSI driver with + # the kubelet. + - name: node-driver-registrar + image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }} + imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} + args: [ + "-csi-address", "/spiffe-csi/csi.sock", + "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + "-health-port", "9809" + ] + volumeMounts: + # The registrar needs access to the SPIFFE CSI driver socket + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The registrar needs access to the Kubelet plugin registration + # directory + - name: kubelet-plugin-registration-dir + mountPath: /registration + ports: + - containerPort: 9809 + name: healthz + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 5 + timeoutSeconds: 5 + resources: + {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} + volumes: + - name: spire-agent-socket-dir + hostPath: + path: {{ include "spire.agent-socket-path" . | dir }} + type: DirectoryOrCreate + # This volume is where the socket for kubelet->driver communication lives + - name: spiffe-csi-socket-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.spiffe.io + type: DirectoryOrCreate + # This volume is where the SPIFFE CSI driver mounts volumes + - name: mountpoint-dir + hostPath: + path: /var/lib/kubelet/pods + type: Directory + # This volume is where the node-driver-registrar registers the plugin + # with kubelet + - name: kubelet-plugin-registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry + type: Directory diff --git a/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml new file mode 100644 index 0000000..2577265 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spiffe-csi-driver.serviceAccountName" . }} + namespace: {{ include "spiffe-csi-driver.namespace" . }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml new file mode 100644 index 0000000..e9d07bc --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml @@ -0,0 +1,20 @@ +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: "csi.spiffe.io" +spec: + # Only ephemeral, inline volumes are supported. There is no need for a + # controller to provision and attach volumes. + attachRequired: false + + # Request the pod information which the CSI driver uses to verify that an + # ephemeral mount was requested. + podInfoOnMount: true + + # Don't change ownership on the contents of the mount since the Workload API + # Unix Domain Socket is typically open to all (i.e. 0777). + fsGroupPolicy: None + + # Declare support for ephemeral volumes only. + volumeLifecycleModes: + - Ephemeral diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml new file mode 100644 index 0000000..b6be7ee --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -0,0 +1,65 @@ +image: + registry: ghcr.io + repository: spiffe/spiffe-csi-driver + pullPolicy: IfNotPresent + version: "" +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +imagePullSecrets: [] +nameOverride: "" +namespaceOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: + readOnlyRootFilesystem: true + privileged: true + # runAsNonRoot: true + # runAsUser: 1000 + # capabilities: + # drop: + # - ALL + +nodeSelector: + kubernetes.io/arch: amd64 + +nodeDriverRegistrar: + image: + registry: registry.k8s.io + repository: sig-storage/csi-node-driver-registrar + pullPolicy: IfNotPresent + version: v2.6.2 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore b/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml new file mode 100644 index 0000000..ee29699 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spiffe-oidc-discovery-provider +description: A Helm chart to install the SPIFFE OIDC discovery provider. +type: application +version: 0.1.0 +appVersion: "1.5.4" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md new file mode 100644 index 0000000..3499858 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -0,0 +1,54 @@ +# spiffe-oidc-discovery-provider + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) + +A Helm chart to install the SPIFFE OIDC discovery provider. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `5` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| autoscaling.targetMemoryUtilizationPercentage | int | `80` | | +| config.acme.cacheDir | string | `"/run/spire"` | | +| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| config.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| config.acme.tosAccepted | bool | `false` | | +| config.domains[0] | string | `"localhost"` | | +| config.domains[1] | string | `"oidc-discovery.example.org"` | | +| config.logLevel | string | `"info"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/oidc-discovery-provider"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| insecureScheme.enabled | bool | `false` | | +| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | +| insecureScheme.nginx.image.registry | string | `"docker.io"` | | +| insecureScheme.nginx.image.repository | string | `"nginx"` | | +| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | +| insecureScheme.nginx.resources | object | `{}` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.annotations | object | `{}` | | +| service.port | int | `80` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| tolerations | list | `[]` | | +| trustDomain | string | `"example.org"` | | + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt new file mode 100644 index 0000000..12c5222 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt @@ -0,0 +1 @@ +SPIFFE OIDC discovery provider installed… diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl new file mode 100644 index 0000000..aea5274 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spiffe-oidc-discovery-provider.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spiffe-oidc-discovery-provider.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spiffe-oidc-discovery-provider.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spiffe-oidc-discovery-provider.labels" -}} +helm.sh/chart: {{ include "spiffe-oidc-discovery-provider.chart" . }} +{{ include "spiffe-oidc-discovery-provider.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spiffe-oidc-discovery-provider.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spiffe-oidc-discovery-provider.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spiffe-oidc-discovery-provider.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spiffe-oidc-discovery-provider.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spiffe-oidc-discovery-provider.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml new file mode 100644 index 0000000..b44c456 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -0,0 +1,57 @@ +{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + oidc-discovery-provider.conf: | + log_level = "{{ .Values.config.logLevel }}" + + domains = [ + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local", + {{- if gt (len .Values.config.domains) 0 }} + "{{- join "\",\n \"" .Values.config.domains }}" + {{- end }} + ] + + {{- if .Values.insecureScheme.enabled }} + allow_insecure_scheme = {{ .Values.insecureScheme.enabled }} + listen_socket_path = {{ $oidcSocket | quote }} + {{- else }} + acme { + directory_url = "{{ .Values.config.acme.directoryUrl }}" + cache_dir = "{{ .Values.config.acme.cacheDir }}" + tos_accepted = {{ .Values.config.acme.tosAccepted }} + email = "{{ .Values.config.acme.emailAddress }}" + } + {{- end }} + + workload_api { + socket_path = "/spiffe-workload-api/{{ include "spire.agent-socket-path" . | splitList "/" | last }}" + trust_domain = "{{ .Values.trustDomain }}" + } + + health_checks { + bind_port = "8008" + ready_path = "/ready" + live_path = "/live" + } + {{- if .Values.insecureScheme.enabled }} + default.conf.template: | + upstream oidc { + server unix:{{ $oidcSocket }}; + } + + server { + listen 80; + listen [::]:80; + + location / { + proxy_pass http://oidc; + proxy_set_header Host $host; + } + } + {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml new file mode 100644 index 0000000..a3a7d6a --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -0,0 +1,114 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - -config + - /run/spire/oidc/config/oidc-discovery-provider.conf + ports: + - containerPort: 8008 + name: health + {{- if not .Values.insecureScheme.enabled }} + - containerPort: 443 + name: https + {{- end }} + volumeMounts: + - name: spiffe-workload-api + mountPath: /spiffe-workload-api + readOnly: true + - name: spire-oidc-sockets + mountPath: /run/spire/oidc-sockets + readOnly: false + - name: spire-oidc-config + mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf + subPath: oidc-discovery-provider.conf + readOnly: true + readinessProbe: + httpGet: + path: /ready + port: health + initialDelaySeconds: 5 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /live + port: health + initialDelaySeconds: 5 + periodSeconds: 5 + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.insecureScheme.enabled }} + - name: nginx + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }} + imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} + ports: + - containerPort: 80 + name: http + volumeMounts: + - name: spire-oidc-sockets + mountPath: /run/spire/oidc-sockets + readOnly: true + - name: spire-oidc-config + mountPath: /etc/nginx/templates/default.conf.template + subPath: default.conf.template + readOnly: true + resources: + {{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }} + {{- end }} + volumes: + - name: spiffe-workload-api + csi: + driver: "csi.spiffe.io" + readOnly: true + - name: spire-oidc-sockets + hostPath: + path: /run/spire/oidc-sockets + type: DirectoryOrCreate + - name: spire-oidc-config + configMap: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml new file mode 100644 index 0000000..937d80c --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml new file mode 100644 index 0000000..3d1bd9e --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + ports: + {{- if .Values.insecureScheme.enabled }} + - name: http + port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + {{- else }} + - name: https + port: 443 + targetPort: https + protocol: TCP + {{- end }} + selector: + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml new file mode 100644 index 0000000..31cdf7b --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml new file mode 100644 index 0000000..c71ad51 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection" + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget-service-name + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + - name: wget-service-name-namespace + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + - name: wget-service-name-namespace-svc-cluster-local + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] + restartPolicy: Never diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml new file mode 100644 index 0000000..a4b6827 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -0,0 +1,112 @@ +# Default values for spiffe-oidc-discovery-provider. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + # registry: gcr.io + # repository: spiffe-io/oidc-discovery-provider + registry: ghcr.io + repository: spiffe/oidc-discovery-provider + pullPolicy: IfNotPresent + version: "" + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +service: + type: ClusterIP + port: 80 + annotations: {} + # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +podAnnotations: {} + +insecureScheme: + enabled: false + + nginx: + image: + registry: docker.io + repository: nginx + pullPolicy: IfNotPresent + version: 1.23.2-alpine + # chainguard image does not support the templates feature + # https://github.com/chainguard-images/nginx/issues/43 + # registry: cgr.dev + # repository: chainguard/nginx + # pullPolicy: IfNotPresent + # version: "1.23.2" + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +config: + logLevel: info + domains: + - localhost + - oidc-discovery.example.org + + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory + emailAddress: letsencrypt@example.org + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +trustDomain: "example.org" diff --git a/charts/spire/charts/spire-agent/.helmignore b/charts/spire/charts/spire-agent/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-agent/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml new file mode 100644 index 0000000..ed2233f --- /dev/null +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-agent +description: A Helm chart to install the SPIRE agent. +type: application +version: 0.1.0 +appVersion: "1.5.4" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md new file mode 100644 index 0000000..3b90505 --- /dev/null +++ b/charts/spire/charts/spire-agent/README.md @@ -0,0 +1,39 @@ +# spire-agent + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) + +A Helm chart to install the SPIRE agent. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| bundleConfigMap | string | `"spire-bundle"` | | +| clusterName | string | `"example-cluster"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-agent"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| server.port | int | `8081` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| trustDomain | string | `"example.org"` | | +| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | +| waitForIt.image.registry | string | `"cgr.dev"` | | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| waitForIt.image.version | string | `"latest-20230113"` | | +| waitForIt.resources | object | `{}` | | + +---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/README.md.gotmpl b/charts/spire/charts/spire-agent/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spire-agent/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/templates/NOTES.txt b/charts/spire/charts/spire-agent/templates/NOTES.txt new file mode 100644 index 0000000..dfe3e24 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ .Chart.Name }}… diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl new file mode 100644 index 0000000..5bb2ffe --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-agent.labels" -}} +helm.sh/chart: {{ include "spire-agent.chart" . }} +{{ include "spire-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-agent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-agent.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-agent.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml new file mode 100644 index 0000000..55d4e78 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-agent.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + agent.conf: | + agent { + data_dir = "/run/spire" + log_level = {{ .Values.logLevel | quote }} + server_address = "{{ .Release.Name }}-server" + server_port = {{ .Values.server.port | quote }} + socket_path = {{ include "spire.agent-socket-path" . | quote }} + trust_bundle_path = "/run/spire/bundle/bundle.crt" + trust_domain = {{ .Values.trustDomain | quote }} + } + + plugins { + NodeAttestor "k8s_psat" { + plugin_data { + cluster = {{ .Values.clusterName | quote }} + } + } + + KeyManager "memory" { + plugin_data { + } + } + + WorkloadAttestor "k8s" { + plugin_data { + # Defaults to the secure kubelet port by default. + # Minikube does not have a cert in the cluster CA bundle that + # can authenticate the kubelet cert, so skip validation. + skip_kubelet_verification = true + } + } + + WorkloadAttestor "unix" { + plugin_data { + } + } + } + + health_checks { + listener_enabled = true + bind_address = "0.0.0.0" + bind_port = "8080" + live_path = "/live" + ready_path = "/ready" + } diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml new file mode 100644 index 0000000..acee537 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -0,0 +1,93 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spire-agent.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-agent.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "spire-agent.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-agent.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + hostPID: true + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + initContainers: + - name: init + # This is a small image with wait-for-it, choose whatever image + # you prefer that waits for a service to be up. This image is built + # from https://github.com/vishnubob/wait-for-it + image: {{ template "spire-agent.image" .Values.waitForIt }} + imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} + args: ["-t", "30", "-h", "{{ .Release.Name }}-server", "-p", {{ .Values.server.port | quote }}] + resources: + {{- toYaml .Values.waitForIt.resources | nindent 12 }} + containers: + - name: {{ .Chart.Name }} + image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: ["-config", "/run/spire/config/agent.conf"] + volumeMounts: + - name: spire-config + mountPath: /run/spire/config + readOnly: true + - name: spire-bundle + mountPath: /run/spire/bundle + readOnly: true + - name: spire-agent-socket-dir + mountPath: {{ include "spire.agent-socket-path" . | dir }} + readOnly: false + - name: spire-token + mountPath: /var/run/secrets/tokens + livenessProbe: + httpGet: + path: /live + port: 8080 + initialDelaySeconds: 15 + periodSeconds: 60 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 15 + periodSeconds: 60 + resources: + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: spire-config + configMap: + name: {{ include "spire-agent.fullname" . }} + - name: spire-bundle + configMap: + name: {{ .Values.bundleConfigMap }} + - name: spire-token + projected: + sources: + - serviceAccountToken: + path: spire-agent + expirationSeconds: 7200 + audience: spire-server + - name: spire-agent-socket-dir + hostPath: + path: {{ include "spire.agent-socket-path" . | dir }} + type: DirectoryOrCreate diff --git a/charts/spire/charts/spire-agent/templates/roles.yaml b/charts/spire/charts/spire-agent/templates/roles.yaml new file mode 100644 index 0000000..8aa1c7e --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/roles.yaml @@ -0,0 +1,27 @@ +# Required cluster role to allow spire-agent to query k8s API server +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-agent.fullname" . }} +rules: + - apiGroups: [""] + resources: + - pods + - nodes + - nodes/proxy + verbs: ["get"] +--- +# Binds above cluster role to spire-agent service account +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-agent.fullname" . }} + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire-agent.fullname" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire-agent.fullname" . }} + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/spire-agent/templates/serviceaccount.yaml b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml new file mode 100644 index 0000000..8bbb3bb --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire-agent.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-agent.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml new file mode 100644 index 0000000..607e04f --- /dev/null +++ b/charts/spire/charts/spire-agent/values.yaml @@ -0,0 +1,70 @@ +# Default values for spire-agent. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + # registry: gcr.io + # repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/arch: amd64 + +logLevel: info +clusterName: example-cluster +trustDomain: example.org + +bundleConfigMap: spire-bundle + +server: + port: 8081 + +waitForIt: + image: + registry: cgr.dev + repository: chainguard/wait-for-it + pullPolicy: IfNotPresent + version: latest-20230113 + resources: {} diff --git a/charts/spire/charts/spire-server/.helmignore b/charts/spire/charts/spire-server/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-server/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml new file mode 100644 index 0000000..b1b7be3 --- /dev/null +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-server +description: A Helm chart to install the SPIRE server. +type: application +version: 0.1.0 +appVersion: "1.5.4" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md new file mode 100644 index 0000000..d0571d6 --- /dev/null +++ b/charts/spire/charts/spire-server/README.md @@ -0,0 +1,75 @@ +# spire-server + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) + +A Helm chart to install the SPIRE server. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| bundleConfigMap | string | `"spire-server"` | | +| ca_subject.common_name | string | `"example.org"` | | +| ca_subject.country | string | `"NL"` | | +| ca_subject.organization | string | `"Example"` | | +| clusterName | string | `"example-cluster"` | | +| controllerManager.enabled | bool | `false` | | +| controllerManager.identities.dnsNameTemplates | list | `[]` | | +| controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.namespaceSelector | object | `{}` | | +| controllerManager.identities.podSelector | object | `{}` | | +| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | +| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | +| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | +| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | +| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | | +| controllerManager.image.registry | string | `"ghcr.io"` | | +| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | | +| controllerManager.image.version | string | `"0.2.1"` | | +| controllerManager.resources | object | `{}` | | +| controllerManager.securityContext | object | `{}` | | +| controllerManager.service.annotations | object | `{}` | | +| controllerManager.service.port | int | `443` | | +| controllerManager.service.type | string | `"ClusterIP"` | | +| dataStorage.accessMode | string | `"ReadWriteOnce"` | | +| dataStorage.enabled | bool | `true` | | +| dataStorage.size | string | `"1Gi"` | | +| dataStorage.storageClass | string | `nil` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-server"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| jwtIssuer | string | `"oidc-discovery.example.org"` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.annotations | object | `{}` | | +| service.port | int | `8081` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| tolerations | list | `[]` | | +| topologySpreadConstraints | list | `[]` | | +| trustDomain | string | `"example.org"` | | +| upstreamAuthority.disk.enabled | bool | `false` | | +| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | +| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | +| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | + +---------------------------------------------- diff --git a/charts/spire/charts/spire-server/README.md.gotmpl b/charts/spire/charts/spire-server/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spire-server/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml b/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml new file mode 100644 index 0000000..91aae17 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml @@ -0,0 +1,96 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: clusterfederatedtrustdomains.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ClusterFederatedTrustDomain + listKind: ClusterFederatedTrustDomainList + plural: clusterfederatedtrustdomains + singular: clusterfederatedtrustdomain + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.trustDomain + name: Trust Domain + type: string + - jsonPath: .spec.bundleEndpointURL + name: Endpoint URL + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterFederatedTrustDomainSpec defines the desired state + of ClusterFederatedTrustDomain + properties: + bundleEndpointProfile: + description: BundleEndpointProfile is the profile for the bundle endpoint. + properties: + endpointSPIFFEID: + description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint. + It is required for the "https_spiffe" profile. + type: string + type: + description: Type is the type of the bundle endpoint profile. + enum: + - https_spiffe + - https_web + type: string + required: + - type + type: object + bundleEndpointURL: + description: BundleEndpointURL is the URL of the bundle endpoint. + It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). + type: string + trustDomain: + description: TrustDomain is the name of the trust domain to federate + with (e.g. example.org) + pattern: '[a-z0-9._-]{1,255}' + type: string + trustDomainBundle: + description: TrustDomainBundle is the contents of the bundle for the + referenced trust domain. This field is optional when the resource + is created. + type: string + required: + - bundleEndpointProfile + - bundleEndpointURL + - trustDomain + type: object + status: + description: ClusterFederatedTrustDomainStatus defines the observed state + of ClusterFederatedTrustDomain + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml b/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml new file mode 100644 index 0000000..74758a5 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml @@ -0,0 +1,221 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: clusterspiffeids.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ClusterSPIFFEID + listKind: ClusterSPIFFEIDList + plural: clusterspiffeids + singular: clusterspiffeid + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterSPIFFEID is the Schema for the clusterspiffeids API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID + properties: + admin: + description: Admin indicates whether or not the SVID can be used to + access the SPIRE administrative APIs. Extra care should be taken + to only apply this SPIFFE ID to admin workloads. + type: boolean + dnsNameTemplates: + description: DNSNameTemplate represents templates for extra DNS names + that are applicable to SVIDs minted for this ClusterSPIFFEID. The + node and pod spec are made available to the template under .NodeSpec, + .PodSpec respectively. + items: + type: string + type: array + federatesWith: + description: FederatesWith is a list of trust domain names that workloads + that obtain this SPIFFE ID will federate with. + items: + type: string + type: array + namespaceSelector: + description: NamespaceSelector selects the namespaces that are targetted + by this CRD. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + podSelector: + description: PodSelector selects the pods that are targetted by this + CRD. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + spiffeIDTemplate: + description: SPIFFEID is the SPIFFE ID template. The node and pod + spec are made available to the template under .NodeSpec, .PodSpec + respectively. + type: string + ttl: + description: TTL indicates an upper-bound time-to-live for SVIDs minted + for this ClusterSPIFFEID. If unset, a default will be chosen. + type: string + workloadSelectorTemplates: + description: WorkloadSelectorTemplates are templates to produce arbitrary + workload selectors that apply to a given workload before it will + receive this SPIFFE ID. The rendered value is interpreted by SPIRE + and are of the form type:value, where the value may, and often does, + contain semicolons, .e.g., k8s:container-image:docker/hello-world + The node and pod spec are made available to the template under .NodeSpec, + .PodSpec respectively. + items: + type: string + type: array + required: + - spiffeIDTemplate + type: object + status: + description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID + properties: + stats: + description: Stats produced by the last entry reconciliation run + properties: + entriesMasked: + description: How many entries were masked by entries for other + ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs + produce an entry for the same pod with the same set of workload + selectors. + type: integer + entriesToSet: + description: How many entries are to be set for this ClusterSPIFFEID. + In nominal conditions, this should reflect the number of pods + selected, but not always if there were problems encountered + rendering an entry for the pod (RenderFailures) or entries are + masked (EntriesMasked). + type: integer + entryFailures: + description: How many entries were unable to be set due to failures + to create or update the entries via the SPIRE Server API. + type: integer + namespacesIgnored: + description: How many (selected) namespaces were ignored (based + on configuration). + type: integer + namespacesSelected: + description: How many namespaces were selected. + type: integer + podEntryRenderFailures: + description: How many failures were encountered rendering an entry + selected pods. This could be due to either a bad template in + the ClusterSPIFFEID or Pod metadata that when applied to the + template did not produce valid entry values. + type: integer + podsSelected: + description: How many pods were selected out of the namespaces. + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml b/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml new file mode 100644 index 0000000..7845a10 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml @@ -0,0 +1,59 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: controllermanagerconfigs.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ControllerManagerConfig + listKind: ControllerManagerConfigList + plural: controllermanagerconfigs + singular: controllermanagerconfig + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ControllerManagerConfig is the Schema for the controllermanagerconfigs + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ControllerManagerConfigSpec defines the desired state of + ControllerManagerConfig + properties: + foo: + description: Foo is an example field of ControllerManagerConfig. Edit + controllermanagerconfig_types.go to remove/update + type: string + type: object + status: + description: ControllerManagerConfigStatus defines the observed state + of ControllerManagerConfig + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt new file mode 100644 index 0000000..69e0da7 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/NOTES.txt @@ -0,0 +1,6 @@ +Installed {{ .Chart.Name }}… + +1. Get the currently registered SPIFFE entries from the server: + + kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \ + bin/spire-server entry show -socketPath {{ .Values.socketPath }} diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl new file mode 100644 index 0000000..9e68939 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -0,0 +1,94 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-server.labels" -}} +helm.sh/chart: {{ include "spire-server.chart" . }} +{{ include "spire-server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-server.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-server.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} + + +{{- define "spire-server.upstream-ca-secret" -}} +{{- $root := . }} +{{- with .Values.upstreamAuthority.disk -}} +{{- if eq (.secret.create | toString) "true" -}} +{{ include "spire-server.fullname" $root }}-upstream-ca +{{- else -}} +{{ default (include "spire-server.fullname" $root) .secret.name }} +{{- end -}} +{{- end -}} +{{- end }} + +{{- define "spire-controller-manager.fullname" -}} +{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager +{{- end }} + +{{- define "spire-k8s-workload-registrar.fullname" -}} +{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml new file mode 100644 index 0000000..ae55ad4 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Values.bundleConfigMap }} + namespace: {{ .Release.Namespace }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml new file mode 100644 index 0000000..52de751 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -0,0 +1,83 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + server.conf: | + server { + bind_address = "0.0.0.0" + bind_port = "8081" + socket_path = {{ .Values.socketPath | quote }} + trust_domain = {{ .Values.trustDomain | quote }} + data_dir = "/run/spire/data" + log_level = "{{ .Values.logLevel }}" + # AWS requires the use of RSA. EC cryptography is not supported + ca_key_type = "rsa-2048" + + jwt_issuer = "{{ .Values.jwtIssuer }}" + + default_x509_svid_ttl = "1h" + default_jwt_svid_ttl = "1h" + ca_subject = { + {{- with .Values.ca_subject }} + country = [{{ .country | quote }}], + organization = [{{ .organization | quote }}], + common_name = {{ .common_name | quote }}, + {{- end }} + } + } + + plugins { + DataStore "sql" { + plugin_data { + database_type = "sqlite3" + connection_string = "/run/spire/data/datastore.sqlite3" + } + } + + NodeAttestor "k8s_psat" { + plugin_data { + clusters = { + {{ .Values.clusterName | quote }} = { + service_account_allow_list = ["{{ .Release.Namespace }}:{{ .Release.Name }}-agent"] + } + } + } + } + + KeyManager "disk" { + plugin_data { + keys_path = "/run/spire/data/keys.json" + } + } + + Notifier "k8sbundle" { + plugin_data { + namespace = "{{ .Release.Namespace }}" + config_map = {{ .Values.bundleConfigMap | quote }} + } + } + + {{- with .Values.upstreamAuthority.disk }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority "disk" { + plugin_data { + cert_file_path = "/run/spire/upstream_ca/tls.crt" + key_file_path = "/run/spire/upstream_ca/tls.key" + {{- if ne .secret.data.bundle "" }} + bundle_file_path = "/run/spire/upstream_ca/bundle.crt" + {{- end }} + } + } + {{- end }} + {{- end }} + } + + health_checks { + listener_enabled = true + bind_address = "0.0.0.0" + bind_port = "8080" + live_path = "/live" + ready_path = "/ready" + } diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml new file mode 100644 index 0000000..6bac89f --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -0,0 +1,23 @@ +{{- $root := . }} +{{- with .Values.controllerManager }} +{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }} +apiVersion: spire.spiffe.io/v1alpha1 +kind: ClusterSPIFFEID +metadata: + name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based +spec: + spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} + {{- with .identities.podSelector }} + podSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.dnsNameTemplates }} + dnsNameTemplates: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml new file mode 100644 index 0000000..a447676 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -0,0 +1,32 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-controller-manager.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + controller-manager-config.yaml: | + apiVersion: spire.spiffe.io/v1alpha1 + kind: ControllerManagerConfig + metadata: + name: {{ include "spire-controller-manager.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-server.labels" . | nindent 8 }} + metrics: + bindAddress: 127.0.0.1:8082 + healthProbe: + bindAddress: 127.0.0.1:8083 + leaderElection: + leaderElect: true + resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io + resourceNamespace: {{ .Release.Namespace }} + validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook + clusterName: {{ .Values.clusterName }} + trustDomain: {{ .Values.trustDomain }} + ignoreNamespaces: + {{- with .Values.controllerManager.ignoreNamespaces }} + {{- toYaml . | nindent 6 }} + {{- end }} + spireServerSocketPath: {{ .Values.socketPath | quote }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml new file mode 100644 index 0000000..795a06f --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -0,0 +1,80 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-leader-election + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-leader-election + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "spire-controller-manager.fullname" . }}-leader-election +subjects: +- kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "spire-controller-manager.fullname" . }} +rules: + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["get", "list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["get", "list", "patch", "watch"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains/finalizers"] + verbs: ["update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains/status"] + verbs: ["get", "patch", "update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids/finalizers"] + verbs: ["update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids/status"] + verbs: ["get", "patch", "update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "spire-controller-manager.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "spire-controller-manager.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml new file mode 100644 index 0000000..c7a33a0 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml @@ -0,0 +1,22 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + {{- with .Values.controllerManager.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} +spec: + type: {{ .Values.controllerManager.service.type }} + ports: + - name: https + port: {{ .Values.controllerManager.service.port }} + targetPort: https + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml new file mode 100644 index 0000000..3a9dcf6 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -0,0 +1,35 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-webhook +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain + failurePolicy: Fail + name: vclusterfederatedtrustdomain.kb.io + rules: + - apiGroups: ["spire.spiffe.io"] + apiVersions: ["v1alpha1"] + operations: ["CREATE", "UPDATE"] + resources: ["clusterfederatedtrustdomains"] + sideEffects: None + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid + failurePolicy: Fail + name: vclusterspiffeid.kb.io + rules: + - apiGroups: ["spire.spiffe.io"] + apiVersions: ["v1alpha1"] + operations: ["CREATE", "UPDATE"] + resources: ["clusterspiffeids"] + sideEffects: None +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml new file mode 100644 index 0000000..5121749 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spire-server.fullname" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spire-server.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml new file mode 100644 index 0000000..439c1bc --- /dev/null +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -0,0 +1,71 @@ +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} +rules: + # allow "get" access to pods (to resolve selectors for PSAT attestation) + - apiGroups: [""] + resources: [pods] + verbs: [get] + # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE + # agent bootstrapping, see the spire-bundle ConfigMap below) + - apiGroups: [""] + resources: [configmaps] + resourceNames: [{{ .Values.bundleConfigMap }}] + verbs: + - get + - patch +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "spire-server.fullname" . }} + apiGroup: rbac.authorization.k8s.io +--- +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }} +rules: + # allow TokenReview requests (to verify service account tokens for PSAT + # attestation) + - apiGroups: [authentication.k8s.io] + resources: [tokenreviews] + verbs: + - get + - watch + - list + - create + - apiGroups: [""] + resources: [nodes, pods] + verbs: + - get + - list +--- +# Binds above cluster role to spire-server service account +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire-server.fullname" . }} + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml new file mode 100644 index 0000000..ba42c07 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: grpc + port: {{ .Values.service.port }} + targetPort: grpc + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/templates/serviceaccount.yaml b/charts/spire/charts/spire-server/templates/serviceaccount.yaml new file mode 100644 index 0000000..48d513b --- /dev/null +++ b/charts/spire/charts/spire-server/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire-server.serviceAccountName" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml new file mode 100644 index 0000000..3d71059 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -0,0 +1,158 @@ +{{- $fullname := include "spire-server.fullname" . }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "spire-server.fullname" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + serviceName: {{ include "spire-server.fullname" . }} + selector: + matchLabels: + {{- include "spire-server.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-server.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "spire-server.serviceAccountName" . }} + shareProcessNamespace: true + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - -config + - /run/spire/config/server.conf + ports: + - name: grpc + containerPort: 8081 + protocol: TCP + livenessProbe: + httpGet: + path: /live + port: 8080 + failureThreshold: 2 + initialDelaySeconds: 15 + periodSeconds: 60 + timeoutSeconds: 3 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 5 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: false + - name: spire-config + mountPath: /run/spire/config + readOnly: true + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} + - name: spire-data + mountPath: /run/spire/data + readOnly: false + {{- end }} + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca + mountPath: /run/spire/upstream_ca + readOnly: false + {{ end }} + {{- if eq (.Values.controllerManager.enabled | toString) "true" }} + - name: spire-controller-manager + securityContext: + {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} + imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} + args: + - --config=controller-manager-config.yaml + ports: + - name: https + containerPort: 9443 + protocol: TCP + # TODO: implement probes + # livenessProbe: + # httpGet: + # path: / + # port: https + # readinessProbe: + # httpGet: + # path: / + # port: https + resources: + {{- toYaml .Values.controllerManager.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: true + - name: controller-manager-config + mountPath: /controller-manager-config.yaml + subPath: controller-manager-config.yaml + readOnly: true + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: spire-config + configMap: + name: {{ include "spire-server.fullname" . }} + - name: spire-server-socket + hostPath: + path: /run/spire/server-sockets + type: DirectoryOrCreate + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca + secret: + secretName: {{ include "spire-server.upstream-ca-secret" . }} + {{- end }} + {{- if eq (.Values.controllerManager.enabled | toString) "true" }} + - name: controller-manager-config + configMap: + name: {{ include "spire-controller-manager.fullname" . }} + {{- end }} + volumeClaimTemplates: + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} + - metadata: + name: spire-data + spec: + accessModes: + - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }} + resources: + requests: + storage: {{ .Values.dataStorage.size }} + {{- if .Values.dataStorage.storageClass }} + storageClassName: {{ .Values.dataStorage.storageClass }} + {{- end }} + {{ end }} diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml new file mode 100644 index 0000000..60f83f3 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spire-server.fullname" . }}-test-connection" + labels: + {{- include "spire-server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['nc'] + args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml new file mode 100644 index 0000000..3d62360 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml @@ -0,0 +1,20 @@ +{{- $root := . }} +{{- with .Values.upstreamAuthority.disk }} +{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "spire-server.upstream-ca-secret" $root }} + namespace: {{ $root.Release.Namespace }} + labels: + {{- include "spire-server.labels" $root | nindent 4 }} +data: + {{- with .secret.data }} + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} + {{- if ne .bundle ""}} + bundle.crt: {{ .bundle | b64enc }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml new file mode 100644 index 0000000..9efa2c0 --- /dev/null +++ b/charts/spire/charts/spire-server/values.yaml @@ -0,0 +1,161 @@ +# Default values for spire-server. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. +replicaCount: 1 + +image: + # registry: gcr.io + # repository: spiffe-io/spire-server + registry: ghcr.io + repository: spiffe/spire-server + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8081 + annotations: {} + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 200m + # memory: 256Mi + # limits: + # cpu: 200m + # memory: 256Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +topologySpreadConstraints: [] + +dataStorage: + enabled: true + size: 1Gi + accessMode: ReadWriteOnce + storageClass: null + +logLevel: info +socketPath: /run/spire/server-sockets/spire-server.sock +jwtIssuer: oidc-discovery.example.org + +clusterName: example-cluster +trustDomain: example.org + +bundleConfigMap: spire-server + +ca_subject: + country: NL + organization: Example + common_name: example.org + +upstreamAuthority: + disk: + enabled: false + secret: + # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. + create: true + # -- If secret creation is disabled, the secret with this name will be used. + name: "spiffe-upstream-ca" + # -- If secret creation is enabled, will create a secret with following certificate info + data: + certificate: "" + key: "" + bundle: "" + +controllerManager: + enabled: false + + image: + registry: ghcr.io + repository: spiffe/spire-controller-manager + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "0.2.1" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + + service: + type: ClusterIP + port: 443 + annotations: {} + + ignoreNamespaces: + - kube-system + - kube-public + - local-path-storage + + identities: + enabled: true + + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} + podSelector: {} + # matchLabels: + # spiffe.io/spiffe-id: "true" + namespaceSelector: {} + # matchLabels: + # spiffe.io/spiffe-id: "true" + dnsNameTemplates: [] + # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt new file mode 100644 index 0000000..dfe3e24 --- /dev/null +++ b/charts/spire/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ .Chart.Name }}… diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl new file mode 100644 index 0000000..e052bfc --- /dev/null +++ b/charts/spire/templates/_helpers.tpl @@ -0,0 +1,39 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "spire.agent-socket-path" -}} +{{- print "/run/spire/agent-sockets/spire-agent.sock" }} +{{- end }} + +{{- define "spire.server-socket-path" -}} +{{- print "/run/spire/server-sockets/spire-server.sock" }} +{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml new file mode 100644 index 0000000..7e26097 --- /dev/null +++ b/charts/spire/values.yaml @@ -0,0 +1,23 @@ +nameOverride: "" +fullnameOverride: "" + +# subcharts +spire-server: + nameOverride: server + bundleConfigMap: &bundleConfigMap spire-bundle + + clusterName: &clusterName "example-cluster" + trustDomain: &trustDomain "example.org" + +spire-agent: + nameOverride: agent + bundleConfigMap: *bundleConfigMap + + clusterName: *clusterName + trustDomain: *trustDomain + +spiffe-csi-driver: {} + +spiffe-oidc-discovery-provider: + enabled: false + trustDomain: *trustDomain