From 007fa7b83dd50160c3375f0f7291b38fb4a478cc Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 10 Feb 2021 12:46:40 +0100 Subject: [PATCH 01/97] Initial spire chart setup Signed-off-by: Marco Franssen --- charts/spire/.helmignore | 23 +++ charts/spire/Chart.yaml | 38 ++++ charts/spire/LICENSE | 21 +++ charts/spire/README.md | 98 +++++++++++ charts/spire/templates/NOTES.txt | 4 + charts/spire/templates/_helpers.tpl | 106 ++++++++++++ .../spire/templates/agent-cluster-role.yaml | 25 +++ charts/spire/templates/agent-configmap.yaml | 51 ++++++ charts/spire/templates/agent-daemonset.yaml | 75 ++++++++ .../spire/templates/agent-serviceaccount.yaml | 13 ++ charts/spire/templates/hpa.yaml | 29 ++++ .../spire/templates/image-pull-secrets.yaml | 21 +++ charts/spire/templates/oidc-dp-configmap.yaml | 22 +++ charts/spire/templates/oidc-ingress.yaml | 30 ++++ charts/spire/templates/oidc-service.yaml | 15 ++ .../spire/templates/server-cluster-role.yaml | 31 ++++ charts/spire/templates/server-configmap.yaml | 67 ++++++++ charts/spire/templates/server-role.yaml | 43 +++++ charts/spire/templates/server-service.yaml | 16 ++ .../templates/server-serviceaccount.yaml | 13 ++ .../spire/templates/server-statefulset.yaml | 162 ++++++++++++++++++ .../templates/spire-bundle-configmap.yaml | 5 + .../tests/server-test-connection.yaml | 15 ++ .../workload-registrar-configmap.yaml | 14 ++ .../templates/workload-registrar-service.yaml | 16 ++ charts/spire/values.yaml | 123 +++++++++++++ 26 files changed, 1076 insertions(+) create mode 100644 charts/spire/.helmignore create mode 100644 charts/spire/Chart.yaml create mode 100644 charts/spire/LICENSE create mode 100644 charts/spire/README.md create mode 100644 charts/spire/templates/NOTES.txt create mode 100644 charts/spire/templates/_helpers.tpl create mode 100644 charts/spire/templates/agent-cluster-role.yaml create mode 100644 charts/spire/templates/agent-configmap.yaml create mode 100644 charts/spire/templates/agent-daemonset.yaml create mode 100644 charts/spire/templates/agent-serviceaccount.yaml create mode 100644 charts/spire/templates/hpa.yaml create mode 100644 charts/spire/templates/image-pull-secrets.yaml create mode 100644 charts/spire/templates/oidc-dp-configmap.yaml create mode 100644 charts/spire/templates/oidc-ingress.yaml create mode 100644 charts/spire/templates/oidc-service.yaml create mode 100644 charts/spire/templates/server-cluster-role.yaml create mode 100644 charts/spire/templates/server-configmap.yaml create mode 100644 charts/spire/templates/server-role.yaml create mode 100644 charts/spire/templates/server-service.yaml create mode 100644 charts/spire/templates/server-serviceaccount.yaml create mode 100644 charts/spire/templates/server-statefulset.yaml create mode 100644 charts/spire/templates/spire-bundle-configmap.yaml create mode 100644 charts/spire/templates/tests/server-test-connection.yaml create mode 100644 charts/spire/templates/workload-registrar-configmap.yaml create mode 100644 charts/spire/templates/workload-registrar-service.yaml create mode 100644 charts/spire/values.yaml diff --git a/charts/spire/.helmignore b/charts/spire/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml new file mode 100644 index 0000000..0bb99c5 --- /dev/null +++ b/charts/spire/Chart.yaml @@ -0,0 +1,38 @@ +apiVersion: v2 +name: spire +description: | + A Helm chart for deploying spire-server and spire-agent. + + > :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + + To enable Projected Service Account Tokens on Docker for Mac/Windows run the following + command to SSH into the Docker Desktop K8s VM. + + ```bash + docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh + ``` + + Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + + ```yaml + spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key + ``` +type: application +version: 0.1.0 +appVersion: "1.0.0" +keywords: ["spiffe", "spire", "spire-server", "spire-agent"] +home: https://github.com/philips-labs/helm-charts/charts/spire +sources: + - https://github.com/philips-labs/helm-charts/charts/spire +maintainers: + - name: marcofranssen + email: marco.franssen@gmail.com + url: https://marcofranssen.nl +kubeVersion: ">=1.19.0-0" diff --git a/charts/spire/LICENSE b/charts/spire/LICENSE new file mode 100644 index 0000000..fff6bbb --- /dev/null +++ b/charts/spire/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2020 Koninklijke Philips N.V, https://www.philips.com + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/charts/spire/README.md b/charts/spire/README.md new file mode 100644 index 0000000..775c3ce --- /dev/null +++ b/charts/spire/README.md @@ -0,0 +1,98 @@ +# spire + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) + +A Helm chart for deploying spire-server and spire-agent. + +> :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + +To enable Projected Service Account Tokens on Docker for Mac/Windows run the following +command to SSH into the Docker Desktop K8s VM. + +```bash +docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh +``` + +Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + +```yaml +spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key +``` + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| marcofranssen | | | + +## Source Code + +* + +## Requirements + +Kubernetes: `>=1.19.0-0` + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| agent.image.pullPolicy | string | `"IfNotPresent"` | | +| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | | +| agent.image.tag | string | `""` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| fullnameOverride | string | `""` | | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| nodeSelector | object | `{}` | | +| oidc.enabled | bool | `false` | | +| oidc.image.pullPolicy | string | `"IfNotPresent"` | | +| oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | +| oidc.image.tag | string | `""` | | +| oidc.ingress.domain | string | `"oidc-discovery.example.org"` | | +| oidc.ingress.enabled | bool | `false` | | +| oidc.letsEncrypt.emailAddress | string | `"letsencrypt@example.org"` | | +| oidc.logLevel | string | `"INFO"` | | +| oidc.service.port | int | `80` | | +| oidc.service.type | string | `"NodePort"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | +| server.dataStorage.enabled | bool | `true` | | +| server.dataStorage.size | string | `"1Gi"` | | +| server.dataStorage.storageClass | string | `nil` | | +| server.image.pullPolicy | string | `"IfNotPresent"` | | +| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | +| server.image.tag | string | `""` | | +| server.service.port | int | `8081` | | +| server.service.type | string | `"NodePort"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| spire.agent.logLevel | string | `"INFO"` | | +| spire.clusterName | string | `"example-cluster"` | | +| spire.server.logLevel | string | `"INFO"` | | +| spire.trustDomain | string | `"example.org"` | | +| tolerations | list | `[]` | | +| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | | +| workloadRegistrar.image.tag | string | `""` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt new file mode 100644 index 0000000..2356615 --- /dev/null +++ b/charts/spire/templates/NOTES.txt @@ -0,0 +1,4 @@ +1. Get the currently registered SPIFFE entries from the server: + + kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ + bin/spire-server entry show -socketPath {{ include "spire.sockets" . }}/registration.sock diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl new file mode 100644 index 0000000..c80282a --- /dev/null +++ b/charts/spire/templates/_helpers.tpl @@ -0,0 +1,106 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire.labels" -}} +helm.sh/chart: {{ include "spire.chart" . }} +{{ include "spire.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Common server labels +*/}} +{{- define "spire.server.labels" -}} +helm.sh/chart: {{ include "spire.chart" . }} +{{ include "spire.server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector server labels +*/}} +{{- define "spire.server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire.name" . }}-server +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Common agent labels +*/}} +{{- define "spire.agent.labels" -}} +helm.sh/chart: {{ include "spire.chart" . }} +{{ include "spire.agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector agent labels +*/}} +{{- define "spire.agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire.name" . }}-agent +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire.sockets" -}} +{{- "/run/spire/sockets" -}} +{{- end -}} diff --git a/charts/spire/templates/agent-cluster-role.yaml b/charts/spire/templates/agent-cluster-role.yaml new file mode 100644 index 0000000..298a655 --- /dev/null +++ b/charts/spire/templates/agent-cluster-role.yaml @@ -0,0 +1,25 @@ +# Required cluster role to allow spire-agent to query k8s API server +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-agent-cluster-role +rules: + - apiGroups: [""] + resources: ["pods", "nodes", "nodes/proxy"] + verbs: ["get"] + +--- +# Binds above cluster role to spire-agent service account +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-agent-cluster-role-binding + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.fullname" . }}-agent + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire.fullname" . }}-agent-cluster-role + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml new file mode 100644 index 0000000..577b5c6 --- /dev/null +++ b/charts/spire/templates/agent-configmap.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }}-agent + namespace: {{ .Release.Namespace }} +data: + agent.conf: | + agent { + data_dir = "/run/spire" + log_level = "{{ .Values.spire.agent.logLevel }}" + server_address = "{{ include "spire.fullname" . }}-server" + server_port = "{{ .Values.server.service.port }}" + socket_path = "/run/spire/sockets/agent.sock" + trust_bundle_path = "/run/spire/bundle/bundle.crt" + trust_domain = {{ .Values.spire.trustDomain | quote }} + } + + plugins { + NodeAttestor "k8s_psat" { + plugin_data { + cluster = {{ .Values.spire.clusterName | quote }} + } + } + + KeyManager "memory" { + plugin_data { + } + } + + WorkloadAttestor "k8s" { + plugin_data { + # Defaults to the secure kubelet port by default. + # Minikube does not have a cert in the cluster CA bundle that + # can authenticate the kubelet cert, so skip validation. + skip_kubelet_verification = true + } + } + + WorkloadAttestor "unix" { + plugin_data { + } + } + } + + health_checks { + listener_enabled = true + bind_address = "0.0.0.0" + bind_port = "8080" + live_path = "/live" + ready_path = "/ready" + } diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml new file mode 100644 index 0000000..17d57a1 --- /dev/null +++ b/charts/spire/templates/agent-daemonset.yaml @@ -0,0 +1,75 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spire.fullname" . }}-agent + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.agent.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "spire.agent.selectorLabels" . | nindent 6 }} + updateStrategy: + type: RollingUpdate + template: + metadata: + labels: + {{- include "spire.agent.selectorLabels" . | nindent 8 }} + spec: + hostPID: true + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + initContainers: + - name: init + # This is a small image with wait-for-it, choose whatever image + # you prefer that waits for a service to be up. This image is built + # from https://github.com/lqhl/wait-for-it + image: gcr.io/spiffe-io/wait-for-it:latest + args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] + containers: + - name: {{ .Chart.Name }}-agent + image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}" + args: ["-config", "/run/spire/config/agent.conf"] + volumeMounts: + - name: spire-config + mountPath: /run/spire/config + readOnly: true + - name: spire-bundle + mountPath: /run/spire/bundle + readOnly: true + - name: spire-agent-socket + mountPath: /run/spire/sockets + readOnly: false + - name: spire-token + mountPath: /var/run/secrets/tokens + livenessProbe: + httpGet: + path: /live + port: 8080 + initialDelaySeconds: 15 + periodSeconds: 60 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 15 + periodSeconds: 60 + volumes: + - name: spire-config + configMap: + name: {{ include "spire.fullname" . }}-agent + - name: spire-bundle + configMap: + name: {{ include "spire.fullname" . }}-bundle + - name: spire-agent-socket + hostPath: + path: /run/spire/sockets + type: DirectoryOrCreate + - name: spire-token + projected: + sources: + - serviceAccountToken: + path: spire-agent + expirationSeconds: 7200 + audience: spire-server diff --git a/charts/spire/templates/agent-serviceaccount.yaml b/charts/spire/templates/agent-serviceaccount.yaml new file mode 100644 index 0000000..750f1da --- /dev/null +++ b/charts/spire/templates/agent-serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire.serviceAccountName" . }}-agent + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.agent.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/hpa.yaml b/charts/spire/templates/hpa.yaml new file mode 100644 index 0000000..000dc45 --- /dev/null +++ b/charts/spire/templates/hpa.yaml @@ -0,0 +1,29 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spire.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spire.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/image-pull-secrets.yaml b/charts/spire/templates/image-pull-secrets.yaml new file mode 100644 index 0000000..71b675f --- /dev/null +++ b/charts/spire/templates/image-pull-secrets.yaml @@ -0,0 +1,21 @@ +{{- $fullname := include "spire.fullname" . }} +{{- $ns := .Release.Namespace }} +{{- $labels := include "spire.labels" . }} +{{- range .Values.imagePullSecrets }} +{{- $registryAuthDocument := dict -}} +{{- $authMessage := printf "%s:%s" .username .password | b64enc }} +{{- $_ := set $registryAuthDocument "auth" $authMessage }} +{{- $dockerAuthDocument := dict .registryURL $registryAuthDocument }} +{{- $dockerConfigJSONDocument := dict "auths" $dockerAuthDocument -}} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ (printf "%s-%s" $fullname .name) }} + namespace: {{ $ns }} + labels: + {{- $labels | nindent 4 }} +data: + .dockerconfigjson: {{ $dockerConfigJSONDocument | toJson | b64enc | quote }} +type: kubernetes.io/dockerconfigjson +{{- end }} diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml new file mode 100644 index 0000000..4500ca0 --- /dev/null +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -0,0 +1,22 @@ +{{- if eq (.Values.oidc.enabled | toString) "true" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }}-oidc-discovery-provider + namespace: {{ .Release.Namespace }} +data: + oidc-discovery-provider.conf: | + log_level = "{{ .Values.oidc.logLevel }}" + + domain = "{{ .Values.oidc.ingress.domain }}" + insecure_addr = ":{{ .Values.oidc.service.port }}" + # acme { + # directory_url = "https://acme-v02.api.letsencrypt.org/directory" + # cache_dir = "/run/spire" + # tos_accepted = true + # email = "{{ .Values.oidc.letsEncrypt.emailAddress }}" + # } + server_api { + address = "unix://{{ include "spire.sockets" . }}/registration.sock" + } +{{ end }} diff --git a/charts/spire/templates/oidc-ingress.yaml b/charts/spire/templates/oidc-ingress.yaml new file mode 100644 index 0000000..c6063de --- /dev/null +++ b/charts/spire/templates/oidc-ingress.yaml @@ -0,0 +1,30 @@ +{{- if and (eq (.Values.oidc.enabled | toString) "true") (eq (.Values.oidc.ingress.enabled | toString) "true") }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "spire.fullname" . }}-oidc-ingress + namespace: spire +spec: + tls: + - hosts: + - {{ .Values.oidc.ingress.domain }} + secretName: oidc-secret + rules: + - host: {{ .Values.oidc.ingress.domain }} + http: + paths: + - path: /.well-known/openid-configuration + pathType: ImplementationSpecific + backend: + service: + name: {{ include "spire.fullname" . }}-oidc + port: + name: http + - path: /keys + pathType: ImplementationSpecific + backend: + service: + name: {{ include "spire.fullname" . }}-oidc + port: + name: http +{{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml new file mode 100644 index 0000000..77638c8 --- /dev/null +++ b/charts/spire/templates/oidc-service.yaml @@ -0,0 +1,15 @@ +{{- if eq (.Values.oidc.enabled | toString) "true" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire.fullname" . }}-oidc + namespace: {{ .Release.Namespace }} +spec: + type: {{ .Values.oidc.service.type }} + ports: + - name: http + port: {{ .Values.oidc.service.port }} + targetPort: spire-oidc-port + selector: + {{- include "spire.server.selectorLabels" . | nindent 4 }} +{{ end }} diff --git a/charts/spire/templates/server-cluster-role.yaml b/charts/spire/templates/server-cluster-role.yaml new file mode 100644 index 0000000..22b4996 --- /dev/null +++ b/charts/spire/templates/server-cluster-role.yaml @@ -0,0 +1,31 @@ +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server-cluster-role +rules: + # allow TokenReview requests (to verify service account tokens for PSAT + # attestation) + - apiGroups: ["authentication.k8s.io"] + resources: ["tokenreviews"] + verbs: ["get", "create"] + - apiGroups: [""] + resources: ["pods", "nodes"] + verbs: ["get", "list", "watch"] + +--- +# Binds above cluster role to spire-server service account +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server-cluster-role-binding + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.serviceAccountName" . }}-server + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire.fullname" . }}-server-cluster-role + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml new file mode 100644 index 0000000..e6d1ba6 --- /dev/null +++ b/charts/spire/templates/server-configmap.yaml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }}-server + namespace: {{ .Release.Namespace }} +data: + server.conf: | + server { + bind_address = "0.0.0.0" + bind_port = "8081" + socket_path = "{{ include "spire.sockets" . }}/registration.sock" + trust_domain = {{ .Values.spire.trustDomain | quote }} + data_dir = "/run/spire/data" + log_level = "{{ .Values.spire.server.logLevel }}" + #AWS requires the use of RSA. EC cryptography is not supported + ca_key_type = "rsa-2048" + + {{- if eq (.Values.oidc.enabled | toString) "true" }} + jwt_issuer = "{{ .Values.oidc.domain }}" + {{ end }} + default_svid_ttl = "1h" + ca_subject = { + country = ["NL"], + organization = ["EXAMPLE"], + common_name = "", + } + } + + plugins { + DataStore "sql" { + plugin_data { + database_type = "sqlite3" + connection_string = "/run/spire/data/datastore.sqlite3" + } + } + + NodeAttestor "k8s_psat" { + plugin_data { + clusters = { + {{ .Values.spire.clusterName | quote }} = { + service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"] + } + } + } + } + + KeyManager "disk" { + plugin_data { + keys_path = "/run/spire/data/keys.json" + } + } + + Notifier "k8sbundle" { + plugin_data { + namespace = "{{ .Release.Namespace }}" + config_map = "{{ include "spire.fullname" . }}-bundle" + } + } + } + + health_checks { + listener_enabled = true + bind_address = "0.0.0.0" + bind_port = "8080" + live_path = "/live" + ready_path = "/ready" + } diff --git a/charts/spire/templates/server-role.yaml b/charts/spire/templates/server-role.yaml new file mode 100644 index 0000000..7b3c8d6 --- /dev/null +++ b/charts/spire/templates/server-role.yaml @@ -0,0 +1,43 @@ +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server-role + namespace: {{ .Release.Namespace }} +rules: + # allow "get" access to pods (to resolve selectors for PSAT attestation) + - apiGroups: [""] + resources: ["pods"] + verbs: ["get"] + # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE + # agent bootstrapping, see the spire-bundle ConfigMap below) + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["{{ include "spire.fullname" . }}-bundle"] + verbs: ["get", "patch"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["spire-k8s-registrar-leader-election"] + verbs: ["update", "get"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create"] + +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server-role-binding + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.serviceAccountName" . }}-server + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "spire.fullname" . }}-server-role + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/server-service.yaml b/charts/spire/templates/server-service.yaml new file mode 100644 index 0000000..a3a5d06 --- /dev/null +++ b/charts/spire/templates/server-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire.fullname" . }}-server + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.server.labels" . | nindent 4 }} +spec: + type: {{ .Values.server.service.type }} + ports: + - name: grpc + port: {{ .Values.server.service.port }} + targetPort: grpc + protocol: TCP + selector: + {{- include "spire.server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/templates/server-serviceaccount.yaml b/charts/spire/templates/server-serviceaccount.yaml new file mode 100644 index 0000000..d3e9d3a --- /dev/null +++ b/charts/spire/templates/server-serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spire.serviceAccountName" . }}-server + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.server.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml new file mode 100644 index 0000000..6e587c4 --- /dev/null +++ b/charts/spire/templates/server-statefulset.yaml @@ -0,0 +1,162 @@ +{{- $fullname := include "spire.fullname" . }} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ $fullname }}-server + labels: + {{- include "spire.server.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + serviceName: {{ include "spire.fullname" . }}-server + selector: + matchLabels: + {{- include "spire.server.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire.server.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- range . }} + - name: {{ printf "%s-%s" $fullname .name }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "spire.serviceAccountName" . }}-server + shareProcessNamespace: true + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ .Chart.Name }}-server + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.server.image.pullPolicy }} + args: + - -config + - /run/spire/config/server.conf + ports: + - name: grpc + containerPort: 8081 + protocol: TCP + volumeMounts: + - name: spire-server-socket + mountPath: {{ include "spire.sockets" . }} + readOnly: false + - name: spire-config + mountPath: /run/spire/config + readOnly: true + {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} + - name: spire-data + mountPath: /run/spire/data + readOnly: false + {{ end }} + livenessProbe: + httpGet: + path: /live + port: 8080 + failureThreshold: 2 + initialDelaySeconds: 15 + periodSeconds: 60 + timeoutSeconds: 3 + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 5 + periodSeconds: 5 + resources: + {{- toYaml .Values.resources | nindent 12 }} + - name: {{ .Chart.Name }}-workload-registrar + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }} + args: + - -config + - /run/spire/k8s-workload-registrar/config/workload-registrar.conf + ports: + - containerPort: 8443 + name: registrar-port + volumeMounts: + - name: spire-server-socket + mountPath: {{ include "spire.sockets" . }} + readOnly: true + - name: spire-workload-registrar-config + mountPath: /run/spire/k8s-workload-registrar/config + readOnly: true + {{- if eq (.Values.oidc.enabled | toString) "true" }} + - name: spire-oidc + image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + args: + - -config + - /run/spire/oidc/config/oidc-discovery-provider.conf + ports: + - containerPort: {{ .Values.oidc.service.port }} + name: spire-oidc-port + volumeMounts: + - name: spire-server-socket + mountPath: {{ include "spire.sockets" . }} + readOnly: true + - name: spire-oidc-config + mountPath: /run/spire/oidc/config/ + readOnly: true + {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} + - name: spire-data + mountPath: /run/spire/data + readOnly: false + {{ end }} + readinessProbe: + exec: + command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] + initialDelaySeconds: 5 + periodSeconds: 5 + {{ end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: spire-workload-registrar-config + configMap: + name: {{ include "spire.fullname" . }}-workload-registrar + - name: spire-config + configMap: + name: {{ include "spire.fullname" . }}-server + {{- if eq (.Values.oidc.enabled | toString) "true" }} + - name: spire-oidc-config + configMap: + name: {{ include "spire.fullname" . }}-oidc-discovery-provider + {{ end }} + - name: spire-server-socket + hostPath: + path: /run/spire/server-sockets + type: DirectoryOrCreate + volumeClaimTemplates: + {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} + - metadata: + name: spire-data + spec: + accessModes: + - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} + resources: + requests: + storage: {{ .Values.server.dataStorage.size }} + {{- if .Values.server.dataStorage.storageClass }} + storageClassName: {{ .Values.server.dataStorage.storageClass }} + {{- end }} + {{ end }} diff --git a/charts/spire/templates/spire-bundle-configmap.yaml b/charts/spire/templates/spire-bundle-configmap.yaml new file mode 100644 index 0000000..017dd54 --- /dev/null +++ b/charts/spire/templates/spire-bundle-configmap.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }}-bundle + namespace: {{ .Release.Namespace }} diff --git a/charts/spire/templates/tests/server-test-connection.yaml b/charts/spire/templates/tests/server-test-connection.yaml new file mode 100644 index 0000000..2f15a90 --- /dev/null +++ b/charts/spire/templates/tests/server-test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spire.fullname" . }}-server-test-connection" + labels: + {{- include "spire.server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: check-port + image: busybox + command: ['nc'] + args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}'] + restartPolicy: Never diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml new file mode 100644 index 0000000..0e08f0a --- /dev/null +++ b/charts/spire/templates/workload-registrar-configmap.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }}-workload-registrar + namespace: {{ .Release.Namespace }} +data: + workload-registrar.conf: | + log_level = "debug" + mode = "reconcile" + trust_domain = {{ .Values.spire.trustDomain | quote }} + cluster = {{ .Values.spire.clusterName | quote }} + server_address = "unix://{{ include "spire.sockets" . }}/registration.sock" + leader_election = true + metrics_addr = "0.0.0.0:18080" diff --git a/charts/spire/templates/workload-registrar-service.yaml b/charts/spire/templates/workload-registrar-service.yaml new file mode 100644 index 0000000..5e8722a --- /dev/null +++ b/charts/spire/templates/workload-registrar-service.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire.fullname" . }}-k8s-workload-registrar + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.server.labels" . | nindent 4 }} +spec: + type: {{ .Values.server.service.type }} + ports: + - name: https + port: 443 + targetPort: registrar-port + protocol: TCP + selector: + {{- include "spire.server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml new file mode 100644 index 0000000..28e2bf5 --- /dev/null +++ b/charts/spire/values.yaml @@ -0,0 +1,123 @@ +# Default values for spire. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +workloadRegistrar: + image: + repository: gcr.io/spiffe-io/k8s-workload-registrar + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + +server: + image: + repository: gcr.io/spiffe-io/spire-server + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + + dataStorage: + enabled: true + size: 1Gi + accessMode: ReadWriteOnce + storageClass: null + + service: + type: NodePort + port: 8081 + +oidc: + enabled: false + + image: + repository: gcr.io/spiffe-io/oidc-discovery-provider + pullPolicy: IfNotPresent + tag: "" + + logLevel: INFO + + service: + type: NodePort + port: 80 + + ingress: + enabled: false + domain: "oidc-discovery.example.org" + + letsEncrypt: + emailAddress: letsencrypt@example.org + +agent: + image: + repository: gcr.io/spiffe-io/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + tag: "" + +imagePullSecrets: [] + # - name: my-docker-registry + # username: my-docker-user + # password: my-docker-password + # registryURL: my-private.docker-registry.com + +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +# spireSettings + +spire: + clusterName: "example-cluster" + trustDomain: "example.org" + agent: + logLevel: INFO + server: + logLevel: INFO From 1e5e84439b98146dfbd43591f091ea89b2c0c1ec Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 20 Jul 2021 15:04:07 +0200 Subject: [PATCH 02/97] Run Spire services by default on ClusterIP Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 ++-- charts/spire/values.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 775c3ce..7d10ba5 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -67,7 +67,7 @@ Kubernetes: `>=1.19.0-0` | oidc.letsEncrypt.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.service.port | int | `80` | | -| oidc.service.type | string | `"NodePort"` | | +| oidc.service.type | string | `"ClusterIP"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | | @@ -81,7 +81,7 @@ Kubernetes: `>=1.19.0-0` | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | | server.image.tag | string | `""` | | | server.service.port | int | `8081` | | -| server.service.type | string | `"NodePort"` | | +| server.service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 28e2bf5..c7cac43 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -25,7 +25,7 @@ server: storageClass: null service: - type: NodePort + type: ClusterIP port: 8081 oidc: @@ -39,7 +39,7 @@ oidc: logLevel: INFO service: - type: NodePort + type: ClusterIP port: 80 ingress: From 31bce3b09ef493c835a2b0b11e44aa618efde834 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Jul 2021 08:35:09 +0200 Subject: [PATCH 03/97] Remove spire ingress as it complicate SNI acme Signed-off-by: Marco Franssen --- charts/spire/README.md | 12 +++++--- charts/spire/templates/oidc-dp-configmap.yaml | 15 +++++----- charts/spire/templates/oidc-ingress.yaml | 30 ------------------- charts/spire/templates/oidc-service.yaml | 9 +++++- .../spire/templates/server-statefulset.yaml | 5 +++- charts/spire/values.yaml | 15 ++++++---- 6 files changed, 38 insertions(+), 48 deletions(-) delete mode 100644 charts/spire/templates/oidc-ingress.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 7d10ba5..4b684c5 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -58,16 +58,20 @@ Kubernetes: `>=1.19.0-0` | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | nodeSelector | object | `{}` | | +| oidc.acme.cacheDir | string | `"/run/spire"` | | +| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| oidc.acme.tosAccepted | bool | `false` | | +| oidc.allowInsecureScheme | bool | `false` | | +| oidc.domain | string | `"oidc-discovery.example.org"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | | oidc.image.tag | string | `""` | | -| oidc.ingress.domain | string | `"oidc-discovery.example.org"` | | -| oidc.ingress.enabled | bool | `false` | | -| oidc.letsEncrypt.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.logLevel | string | `"INFO"` | | +| oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | -| oidc.service.type | string | `"ClusterIP"` | | +| oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | | diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 4500ca0..0323909 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -8,14 +8,15 @@ data: oidc-discovery-provider.conf: | log_level = "{{ .Values.oidc.logLevel }}" - domain = "{{ .Values.oidc.ingress.domain }}" + domain = "{{ .Values.oidc.domain }}" insecure_addr = ":{{ .Values.oidc.service.port }}" - # acme { - # directory_url = "https://acme-v02.api.letsencrypt.org/directory" - # cache_dir = "/run/spire" - # tos_accepted = true - # email = "{{ .Values.oidc.letsEncrypt.emailAddress }}" - # } + allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }} + acme { + directory_url = "{{ .Values.oidc.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.acme.tosAccepted }} + email = "{{ .Values.oidc.acme.emailAddress }}" + } server_api { address = "unix://{{ include "spire.sockets" . }}/registration.sock" } diff --git a/charts/spire/templates/oidc-ingress.yaml b/charts/spire/templates/oidc-ingress.yaml deleted file mode 100644 index c6063de..0000000 --- a/charts/spire/templates/oidc-ingress.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if and (eq (.Values.oidc.enabled | toString) "true") (eq (.Values.oidc.ingress.enabled | toString) "true") }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ include "spire.fullname" . }}-oidc-ingress - namespace: spire -spec: - tls: - - hosts: - - {{ .Values.oidc.ingress.domain }} - secretName: oidc-secret - rules: - - host: {{ .Values.oidc.ingress.domain }} - http: - paths: - - path: /.well-known/openid-configuration - pathType: ImplementationSpecific - backend: - service: - name: {{ include "spire.fullname" . }}-oidc - port: - name: http - - path: /keys - pathType: ImplementationSpecific - backend: - service: - name: {{ include "spire.fullname" . }}-oidc - port: - name: http -{{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index 77638c8..4ac9afd 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -4,12 +4,19 @@ kind: Service metadata: name: {{ include "spire.fullname" . }}-oidc namespace: {{ .Release.Namespace }} + {{- with .Values.oidc.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} spec: type: {{ .Values.oidc.service.type }} ports: - name: http port: {{ .Values.oidc.service.port }} - targetPort: spire-oidc-port + targetPort: oidc-http + - name: https + port: 443 + targetPort: oidc-https selector: {{- include "spire.server.selectorLabels" . | nindent 4 }} {{ end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 6e587c4..ffa6cf7 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -94,12 +94,15 @@ spec: {{- if eq (.Values.oidc.enabled | toString) "true" }} - name: spire-oidc image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf ports: - containerPort: {{ .Values.oidc.service.port }} - name: spire-oidc-port + name: oidc-http + - containerPort: 443 + name: oidc-https volumeMounts: - name: spire-server-socket mountPath: {{ include "spire.sockets" . }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c7cac43..2fe9e99 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -39,14 +39,19 @@ oidc: logLevel: INFO service: - type: ClusterIP + type: NodePort port: 80 + annotations: {} + # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - ingress: - enabled: false - domain: "oidc-discovery.example.org" + domain: "oidc-discovery.example.org" - letsEncrypt: + allowInsecureScheme: false + + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory emailAddress: letsencrypt@example.org agent: From f2d7aa1f62159ca6ac04371d8f3c379ed5c555f7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 26 Jul 2021 10:33:51 +0200 Subject: [PATCH 04/97] Run oidc discovery provider as separate pod using workload api Signed-off-by: Marco Franssen --- charts/spire/templates/_helpers.tpl | 20 +++++ charts/spire/templates/oidc-deployment.yaml | 86 +++++++++++++++++++ charts/spire/templates/oidc-dp-configmap.yaml | 5 +- charts/spire/templates/oidc-service.yaml | 6 +- .../spire/templates/server-statefulset.yaml | 35 -------- 5 files changed, 112 insertions(+), 40 deletions(-) create mode 100644 charts/spire/templates/oidc-deployment.yaml diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index c80282a..97fcee0 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -90,6 +90,26 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-agent app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} +{{/* +Common oidc labels +*/}} +{{- define "spire.oidc.labels" -}} +helm.sh/chart: {{ include "spire.chart" . }} +{{ include "spire.oidc.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector oidc labels +*/}} +{{- define "spire.oidc.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire.name" . }}-oidc +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + {{/* Create the name of the service account to use */}} diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml new file mode 100644 index 0000000..97f8bfb --- /dev/null +++ b/charts/spire/templates/oidc-deployment.yaml @@ -0,0 +1,86 @@ +{{- if eq (.Values.oidc.enabled | toString) "true" }} +{{- $fullname := include "spire.fullname" . }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ printf "%s-oidc" $fullname }} + labels: + {{- include "spire.oidc.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "spire.oidc.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire.oidc.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- range . }} + - name: {{ printf "%s-%s" $fullname .name }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: spire-oidc + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} + args: + - -config + - /run/spire/oidc/config/oidc-discovery-provider.conf + ports: + - containerPort: {{ .Values.oidc.service.port }} + name: http + - containerPort: 443 + name: https + volumeMounts: + - name: spire-agent-socket + mountPath: {{ include "spire.sockets" . }} + readOnly: true + - name: spire-oidc-config + mountPath: /run/spire/oidc/config/ + readOnly: true + readinessProbe: + exec: + command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] + initialDelaySeconds: 5 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /.well-known/openid-configuration + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumes: + - name: spire-agent-socket + hostPath: + path: /run/spire/sockets + type: DirectoryOrCreate + - name: spire-oidc-config + configMap: + name: {{ include "spire.fullname" . }}-oidc-discovery-provider + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{ end }} diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 0323909..215ab35 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -17,7 +17,8 @@ data: tos_accepted = {{ .Values.oidc.acme.tosAccepted }} email = "{{ .Values.oidc.acme.emailAddress }}" } - server_api { - address = "unix://{{ include "spire.sockets" . }}/registration.sock" + workload_api { + socket_path = "{{ include "spire.sockets" . }}/agent.sock" + trust_domain = "{{ .Values.spire.trustDomain }}" } {{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index 4ac9afd..d1bd83d 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -13,10 +13,10 @@ spec: ports: - name: http port: {{ .Values.oidc.service.port }} - targetPort: oidc-http + targetPort: http - name: https port: 443 - targetPort: oidc-https + targetPort: https selector: - {{- include "spire.server.selectorLabels" . | nindent 4 }} + {{- include "spire.oidc.selectorLabels" . | nindent 4 }} {{ end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index ffa6cf7..2f08a95 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -91,36 +91,6 @@ spec: - name: spire-workload-registrar-config mountPath: /run/spire/k8s-workload-registrar/config readOnly: true - {{- if eq (.Values.oidc.enabled | toString) "true" }} - - name: spire-oidc - image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} - args: - - -config - - /run/spire/oidc/config/oidc-discovery-provider.conf - ports: - - containerPort: {{ .Values.oidc.service.port }} - name: oidc-http - - containerPort: 443 - name: oidc-https - volumeMounts: - - name: spire-server-socket - mountPath: {{ include "spire.sockets" . }} - readOnly: true - - name: spire-oidc-config - mountPath: /run/spire/oidc/config/ - readOnly: true - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} - - name: spire-data - mountPath: /run/spire/data - readOnly: false - {{ end }} - readinessProbe: - exec: - command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 - {{ end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -140,11 +110,6 @@ spec: - name: spire-config configMap: name: {{ include "spire.fullname" . }}-server - {{- if eq (.Values.oidc.enabled | toString) "true" }} - - name: spire-oidc-config - configMap: - name: {{ include "spire.fullname" . }}-oidc-discovery-provider - {{ end }} - name: spire-server-socket hostPath: path: /run/spire/server-sockets From 4d3fb47839484655002187f8df2f8e855711780c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 09:28:27 +0200 Subject: [PATCH 05/97] Change socket mounts for more control (readonly) pods like oidc mount more then one of these sockets, now we can control readonly vs non readonly better Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/templates/NOTES.txt | 2 +- charts/spire/templates/_helpers.tpl | 4 ---- charts/spire/templates/agent-configmap.yaml | 2 +- charts/spire/templates/agent-daemonset.yaml | 8 ++++---- charts/spire/templates/oidc-deployment.yaml | 10 +++++----- charts/spire/templates/oidc-dp-configmap.yaml | 2 +- charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/templates/server-statefulset.yaml | 4 ++-- .../spire/templates/workload-registrar-configmap.yaml | 2 +- 9 files changed, 16 insertions(+), 20 deletions(-) diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 2356615..21242d9 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1,4 +1,4 @@ 1. Get the currently registered SPIFFE entries from the server: kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ - bin/spire-server entry show -socketPath {{ include "spire.sockets" . }}/registration.sock + bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index 97fcee0..994a28f 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -120,7 +120,3 @@ Create the name of the service account to use {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} - -{{- define "spire.sockets" -}} -{{- "/run/spire/sockets" -}} -{{- end -}} diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index 577b5c6..fd5d41b 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -10,7 +10,7 @@ data: log_level = "{{ .Values.spire.agent.logLevel }}" server_address = "{{ include "spire.fullname" . }}-server" server_port = "{{ .Values.server.service.port }}" - socket_path = "/run/spire/sockets/agent.sock" + socket_path = "/run/spire/agent-sockets/agent.sock" trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.spire.trustDomain | quote }} } diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 17d57a1..ffa8616 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -38,8 +38,8 @@ spec: - name: spire-bundle mountPath: /run/spire/bundle readOnly: true - - name: spire-agent-socket - mountPath: /run/spire/sockets + - name: spire-agent-sockets + mountPath: /run/spire/agent-sockets readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -62,9 +62,9 @@ spec: - name: spire-bundle configMap: name: {{ include "spire.fullname" . }}-bundle - - name: spire-agent-socket + - name: spire-agent-sockets hostPath: - path: /run/spire/sockets + path: /run/spire/agent-sockets type: DirectoryOrCreate - name: spire-token projected: diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 97f8bfb..446aa2e 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -46,9 +46,9 @@ spec: - containerPort: 443 name: https volumeMounts: - - name: spire-agent-socket - mountPath: {{ include "spire.sockets" . }} - readOnly: true + - name: spire-oidc-sockets + mountPath: /run/spire/oidc-sockets + readOnly: false - name: spire-oidc-config mountPath: /run/spire/oidc/config/ readOnly: true @@ -64,9 +64,9 @@ spec: resources: {{- toYaml .Values.resources | nindent 12 }} volumes: - - name: spire-agent-socket + - name: spire-oidc-sockets hostPath: - path: /run/spire/sockets + path: /run/spire/oidc-sockets type: DirectoryOrCreate - name: spire-oidc-config configMap: diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 215ab35..f782e41 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -18,7 +18,7 @@ data: email = "{{ .Values.oidc.acme.emailAddress }}" } workload_api { - socket_path = "{{ include "spire.sockets" . }}/agent.sock" + socket_path = "/run/spire/agent-sockets/agent.sock" trust_domain = "{{ .Values.spire.trustDomain }}" } {{ end }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index e6d1ba6..581e98e 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -8,7 +8,7 @@ data: server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = "{{ include "spire.sockets" . }}/registration.sock" + socket_path = "/run/spire/server-sockets/registration.sock" trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" log_level = "{{ .Values.spire.server.logLevel }}" diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 2f08a95..58bcb18 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -47,7 +47,7 @@ spec: protocol: TCP volumeMounts: - name: spire-server-socket - mountPath: {{ include "spire.sockets" . }} + mountPath: /run/spire/server-sockets readOnly: false - name: spire-config mountPath: /run/spire/config @@ -86,7 +86,7 @@ spec: name: registrar-port volumeMounts: - name: spire-server-socket - mountPath: {{ include "spire.sockets" . }} + mountPath: /run/spire/server-sockets readOnly: true - name: spire-workload-registrar-config mountPath: /run/spire/k8s-workload-registrar/config diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml index 0e08f0a..71dfc3e 100644 --- a/charts/spire/templates/workload-registrar-configmap.yaml +++ b/charts/spire/templates/workload-registrar-configmap.yaml @@ -9,6 +9,6 @@ data: mode = "reconcile" trust_domain = {{ .Values.spire.trustDomain | quote }} cluster = {{ .Values.spire.clusterName | quote }} - server_address = "unix://{{ include "spire.sockets" . }}/registration.sock" + server_address = "unix:///run/spire/server-sockets/registration.sock" leader_election = true metrics_addr = "0.0.0.0:18080" From c9f69907ac16f5b18289cb930d0bb8892361ad22 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 10:55:04 +0200 Subject: [PATCH 06/97] Use new domains configuration Signed-off-by: Marco Franssen --- charts/spire/README.md | 5 ++++- charts/spire/templates/oidc-dp-configmap.yaml | 8 +++++--- charts/spire/values.yaml | 6 +++++- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 4b684c5..baa39ba 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -63,7 +63,10 @@ Kubernetes: `>=1.19.0-0` | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.acme.tosAccepted | bool | `false` | | | oidc.allowInsecureScheme | bool | `false` | | -| oidc.domain | string | `"oidc-discovery.example.org"` | | +| oidc.domains[0] | string | `"localhost"` | | +| oidc.domains[1] | string | `"spire-oidc.spire"` | | +| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | | +| oidc.domains[3] | string | `"oidc-discovery.example.org"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index f782e41..32910f2 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -7,9 +7,11 @@ metadata: data: oidc-discovery-provider.conf: | log_level = "{{ .Values.oidc.logLevel }}" - - domain = "{{ .Values.oidc.domain }}" - insecure_addr = ":{{ .Values.oidc.service.port }}" + {{ if gt (len .Values.oidc.domains) 0 }} + domains = ["{{- join "\", \"" .Values.oidc.domains }}"] + {{ else }} + domains = [] + {{ end }} allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }} acme { directory_url = "{{ .Values.oidc.acme.directoryUrl }}" diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 2fe9e99..06f135b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -44,7 +44,11 @@ oidc: annotations: {} # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - domain: "oidc-discovery.example.org" + domains: + - localhost + - spire-oidc.spire + - spire-oidc.spire.svc.cluster.local + - oidc-discovery.example.org allowInsecureScheme: false From 46466e5ec642639a34c3fc3e3e3a3c4acba7bc77 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 10:56:14 +0200 Subject: [PATCH 07/97] Run oidc insecure on unix socket using Nginx Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-deployment.yaml | 31 +++++++++++++++---- charts/spire/templates/oidc-dp-configmap.yaml | 21 +++++++++++++ charts/spire/templates/oidc-service.yaml | 3 ++ 3 files changed, 49 insertions(+), 6 deletions(-) diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 446aa2e..6d1d6e4 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -40,11 +40,11 @@ spec: args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf + {{- if not .Values.oidc.allowInsecureScheme }} ports: - - containerPort: {{ .Values.oidc.service.port }} - name: http - containerPort: 443 name: https + {{- end }} volumeMounts: - name: spire-oidc-sockets mountPath: /run/spire/oidc-sockets @@ -54,15 +54,34 @@ spec: readOnly: true readinessProbe: exec: - command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] + command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] initialDelaySeconds: 5 periodSeconds: 5 livenessProbe: - httpGet: - path: /.well-known/openid-configuration - port: http + exec: + command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] + initialDelaySeconds: 5 + periodSeconds: 5 resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.oidc.allowInsecureScheme }} + - name: nginx + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: nginx:latest + imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} + ports: + - containerPort: 80 + name: http + volumeMounts: + - name: spire-oidc-sockets + mountPath: /run/spire/oidc-sockets + readOnly: true + - name: spire-oidc-config + mountPath: /etc/nginx/templates/default.conf.template + subPath: default.conf.template + readOnly: true + {{- end }} volumes: - name: spire-oidc-sockets hostPath: diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 32910f2..8f4b20a 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -12,15 +12,36 @@ data: {{ else }} domains = [] {{ end }} + {{- if .Values.oidc.allowInsecureScheme }} allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }} + listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" + {{- else }} acme { directory_url = "{{ .Values.oidc.acme.directoryUrl }}" cache_dir = "{{ .Values.oidc.acme.cacheDir }}" tos_accepted = {{ .Values.oidc.acme.tosAccepted }} email = "{{ .Values.oidc.acme.emailAddress }}" } + {{- end }} + workload_api { socket_path = "/run/spire/agent-sockets/agent.sock" trust_domain = "{{ .Values.spire.trustDomain }}" } + {{- if .Values.oidc.allowInsecureScheme }} + default.conf.template: | + upstream oidc { + server unix:/run/spire/oidc-sockets/oidc-server.sock; + } + + server { + listen 80; + listen [::]:80; + + location / { + proxy_pass http://oidc; + proxy_set_header Host $host; + } + } + {{- end }} {{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index d1bd83d..cc9087e 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -11,12 +11,15 @@ metadata: spec: type: {{ .Values.oidc.service.type }} ports: + {{- if .Values.oidc.allowInsecureScheme }} - name: http port: {{ .Values.oidc.service.port }} targetPort: http + {{- else }} - name: https port: 443 targetPort: https + {{- end }} selector: {{- include "spire.oidc.selectorLabels" . | nindent 4 }} {{ end }} From 1c54ce82bb3054287ad882887520a444ec6b585e Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 11:29:04 +0200 Subject: [PATCH 08/97] Add jwtIssuer configuration Signed-off-by: Marco Franssen --- charts/spire/README.md | 1 + charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/values.yaml | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index baa39ba..6e2c002 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -71,6 +71,7 @@ Kubernetes: `>=1.19.0-0` | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | | oidc.image.tag | string | `""` | | +| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 581e98e..84d5bcd 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -16,7 +16,7 @@ data: ca_key_type = "rsa-2048" {{- if eq (.Values.oidc.enabled | toString) "true" }} - jwt_issuer = "{{ .Values.oidc.domain }}" + jwt_issuer = "{{ .Values.oidc.jwtIssuer }}" {{ end }} default_svid_ttl = "1h" ca_subject = { diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 06f135b..c49ccd9 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -44,6 +44,8 @@ oidc: annotations: {} # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org + jwtIssuer: oidc-discovery.example.org + domains: - localhost - spire-oidc.spire From 4f93ead90a69be8fa65da266094d0e3ed5e8b6ad Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 13:50:05 +0200 Subject: [PATCH 09/97] Configurable insecureScheme nginx image Co-Authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen --- charts/spire/README.md | 5 ++++- charts/spire/templates/oidc-deployment.yaml | 8 ++++---- charts/spire/templates/oidc-dp-configmap.yaml | 6 +++--- charts/spire/templates/oidc-service.yaml | 2 +- charts/spire/values.yaml | 8 +++++++- 5 files changed, 19 insertions(+), 10 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 6e2c002..471f7f8 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -62,7 +62,6 @@ Kubernetes: `>=1.19.0-0` | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.acme.tosAccepted | bool | `false` | | -| oidc.allowInsecureScheme | bool | `false` | | | oidc.domains[0] | string | `"localhost"` | | | oidc.domains[1] | string | `"spire-oidc.spire"` | | | oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | | @@ -71,6 +70,10 @@ Kubernetes: `>=1.19.0-0` | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | | oidc.image.tag | string | `""` | | +| oidc.insecureScheme.enabled | bool | `false` | | +| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` | | +| oidc.insecureScheme.nginx.repository | string | `"nginx"` | | +| oidc.insecureScheme.nginx.tag | string | `"alpine"` | | | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.service.annotations | object | `{}` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 6d1d6e4..5c58805 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -40,7 +40,7 @@ spec: args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf - {{- if not .Values.oidc.allowInsecureScheme }} + {{- if not .Values.oidc.insecureScheme.enabled }} ports: - containerPort: 443 name: https @@ -64,12 +64,12 @@ spec: periodSeconds: 5 resources: {{- toYaml .Values.resources | nindent 12 }} - {{- if .Values.oidc.allowInsecureScheme }} + {{- if .Values.oidc.insecureScheme.enabled }} - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: nginx:latest - imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} + image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}" + imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }} ports: - containerPort: 80 name: http diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 8f4b20a..e1f5650 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -12,8 +12,8 @@ data: {{ else }} domains = [] {{ end }} - {{- if .Values.oidc.allowInsecureScheme }} - allow_insecure_scheme = {{ .Values.oidc.allowInsecureScheme }} + {{- if .Values.oidc.insecureScheme.enabled }} + allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }} listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" {{- else }} acme { @@ -28,7 +28,7 @@ data: socket_path = "/run/spire/agent-sockets/agent.sock" trust_domain = "{{ .Values.spire.trustDomain }}" } - {{- if .Values.oidc.allowInsecureScheme }} + {{- if .Values.oidc.insecureScheme.enabled }} default.conf.template: | upstream oidc { server unix:/run/spire/oidc-sockets/oidc-server.sock; diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index cc9087e..b1cb3cc 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -11,7 +11,7 @@ metadata: spec: type: {{ .Values.oidc.service.type }} ports: - {{- if .Values.oidc.allowInsecureScheme }} + {{- if .Values.oidc.insecureScheme.enabled }} - name: http port: {{ .Values.oidc.service.port }} targetPort: http diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c49ccd9..f77c7b1 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -52,7 +52,13 @@ oidc: - spire-oidc.spire.svc.cluster.local - oidc-discovery.example.org - allowInsecureScheme: false + insecureScheme: + enabled: false + + nginx: + repository: nginx + pullPolicy: IfNotPresent + tag: "alpine" acme: tosAccepted: false From 48dacbca64b97c5a1054f332543604414190a175 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 3 Aug 2021 14:32:58 +0200 Subject: [PATCH 10/97] Fix agent socket mount in spire-oidc Co-authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-deployment.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 5c58805..9f4d48e 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -46,6 +46,9 @@ spec: name: https {{- end }} volumeMounts: + - name: spire-agent-sockets + mountPath: /run/spire/agent-sockets + readOnly: true - name: spire-oidc-sockets mountPath: /run/spire/oidc-sockets readOnly: false @@ -87,6 +90,10 @@ spec: hostPath: path: /run/spire/oidc-sockets type: DirectoryOrCreate + - name: spire-agent-sockets + hostPath: + path: /run/spire/agent-sockets + type: DirectoryOrCreate - name: spire-oidc-config configMap: name: {{ include "spire.fullname" . }}-oidc-discovery-provider From f11dc08b202d3eab290e4e96eacb440affe72f88 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 13 Aug 2021 12:12:38 +0200 Subject: [PATCH 11/97] Bump spire image versions from 1.0.0 to 1.0.1 Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 0bb99c5..1c472f1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -26,7 +26,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.0.0" +appVersion: "1.0.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 471f7f8..0d2d296 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.1](https://img.shields.io/badge/AppVersion-1.0.1-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. From 3a39fe5666da26cb5249cebb9d12142112c577cc Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 3 Sep 2021 15:28:45 +0200 Subject: [PATCH 12/97] Bump Spire version to 1.0.2 for oidc fixes Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 +++- charts/spire/README.md | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 1c472f1..9101842 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -5,6 +5,8 @@ description: | > :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + > :warning: Minimum Spire version is `v1.0.2`. + To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. @@ -26,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.0.1" +appVersion: "1.0.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 0d2d296..f96aeac 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,11 +1,13 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.1](https://img.shields.io/badge/AppVersion-1.0.1-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.2](https://img.shields.io/badge/AppVersion-1.0.2-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. > :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. +> :warning: Minimum Spire version is `v1.0.2`. + To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. From e9912ba39a5099f1d4ef60dbeba791227e85f7dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Batuhan=20Apayd=C4=B1n?= Date: Mon, 24 Oct 2022 20:54:56 +0300 Subject: [PATCH 13/97] Add spiffe-csi driver support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Batuhan Apaydın Co-authored-by: Furkan Türkal Signed-off-by: Batuhan Apaydın Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/templates/agent-daemonset.yaml | 71 ++++++++++++++++++- .../spire/templates/server-cluster-role.yaml | 3 + charts/spire/templates/spiffe-csi-driver.yaml | 20 ++++++ 5 files changed, 95 insertions(+), 3 deletions(-) create mode 100644 charts/spire/templates/spiffe-csi-driver.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 9101842..0cddbf1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.0.2" +appVersion: "1.4.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index f96aeac..84bd0a7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.2](https://img.shields.io/badge/AppVersion-1.0.2-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.4](https://img.shields.io/badge/AppVersion-1.4.4-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index ffa8616..ee3a443 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -38,7 +38,7 @@ spec: - name: spire-bundle mountPath: /run/spire/bundle readOnly: true - - name: spire-agent-sockets + - name: spire-agent-socket-dir mountPath: /run/spire/agent-sockets readOnly: false - name: spire-token @@ -55,6 +55,55 @@ spec: port: 8080 initialDelaySeconds: 15 periodSeconds: 60 + # This is the container which runs the SPIFFE CSI driver. + - name: spiffe-csi-driver + image: ghcr.io/spiffe/spiffe-csi-driver:nightly + imagePullPolicy: IfNotPresent + args: [ + "-workload-api-socket-dir", "/spire-agent-socket", + "-csi-socket-path", "/spiffe-csi/csi.sock", + ] + env: + # The CSI driver needs a unique node ID. The node name can be + # used for this purpose. + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + # The volume containing the SPIRE agent socket. The SPIFFE CSI + # driver will mount this directory into containers. + - mountPath: /spire-agent-socket + name: spire-agent-socket-dir + readOnly: true + # The volume that will contain the CSI driver socket shared + # with the kubelet and the driver registrar. + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The volume containing mount points for containers. + - mountPath: /var/lib/kubelet/pods + mountPropagation: Bidirectional + name: mountpoint-dir + securityContext: + privileged: true + # This container runs the CSI Node Driver Registrar which takes care + # of all the little details required to register a CSI driver with + # the kubelet. + - name: node-driver-registrar + image: quay.io/k8scsi/csi-node-driver-registrar:v2.0.1 + imagePullPolicy: IfNotPresent + args: [ + "-csi-address", "/spiffe-csi/csi.sock", + "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + ] + volumeMounts: + # The registrar needs access to the SPIFFE CSI driver socket + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The registrar needs access to the Kubelet plugin registration + # directory + - name: kubelet-plugin-registration-dir + mountPath: /registration volumes: - name: spire-config configMap: @@ -73,3 +122,23 @@ spec: path: spire-agent expirationSeconds: 7200 audience: spire-server + - name: spire-agent-socket-dir + hostPath: + path: /run/spire/agent-sockets + type: DirectoryOrCreate + # This volume is where the socket for kubelet->driver communication lives + - name: spiffe-csi-socket-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.spiffe.io + type: DirectoryOrCreate + # This volume is where the SPIFFE CSI driver mounts volumes + - name: mountpoint-dir + hostPath: + path: /var/lib/kubelet/pods + type: Directory + # This volume is where the node-driver-registrar registers the plugin + # with kubelet + - name: kubelet-plugin-registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry + type: Directory diff --git a/charts/spire/templates/server-cluster-role.yaml b/charts/spire/templates/server-cluster-role.yaml index 22b4996..db5793c 100644 --- a/charts/spire/templates/server-cluster-role.yaml +++ b/charts/spire/templates/server-cluster-role.yaml @@ -13,6 +13,9 @@ rules: - apiGroups: [""] resources: ["pods", "nodes"] verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create", "update", "delete", "get", "list", "watch"] --- # Binds above cluster role to spire-server service account diff --git a/charts/spire/templates/spiffe-csi-driver.yaml b/charts/spire/templates/spiffe-csi-driver.yaml new file mode 100644 index 0000000..e9d07bc --- /dev/null +++ b/charts/spire/templates/spiffe-csi-driver.yaml @@ -0,0 +1,20 @@ +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: "csi.spiffe.io" +spec: + # Only ephemeral, inline volumes are supported. There is no need for a + # controller to provision and attach volumes. + attachRequired: false + + # Request the pod information which the CSI driver uses to verify that an + # ephemeral mount was requested. + podInfoOnMount: true + + # Don't change ownership on the contents of the mount since the Workload API + # Unix Domain Socket is typically open to all (i.e. 0777). + fsGroupPolicy: None + + # Declare support for ephemeral volumes only. + volumeLifecycleModes: + - Ephemeral From 5cb6ebe95e7abfb9d8f8e993eb5d2a6324035d73 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 31 Oct 2022 09:00:12 +0100 Subject: [PATCH 14/97] Enforce to amd64 nodes using nodeSelector Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 +++- charts/spire/templates/agent-daemonset.yaml | 4 ++++ charts/spire/templates/server-statefulset.yaml | 4 ++++ charts/spire/values.yaml | 11 +++++++++-- 4 files changed, 20 insertions(+), 3 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 84bd0a7..03df42d 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -52,6 +52,7 @@ Kubernetes: `>=1.19.0-0` | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | | | agent.image.tag | string | `""` | | +| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `100` | | | autoscaling.minReplicas | int | `1` | | @@ -59,7 +60,6 @@ Kubernetes: `>=1.19.0-0` | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | -| nodeSelector | object | `{}` | | | oidc.acme.cacheDir | string | `"/run/spire"` | | | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | @@ -78,6 +78,7 @@ Kubernetes: `>=1.19.0-0` | oidc.insecureScheme.nginx.tag | string | `"alpine"` | | | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | +| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | @@ -93,6 +94,7 @@ Kubernetes: `>=1.19.0-0` | server.image.pullPolicy | string | `"IfNotPresent"` | | | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | | server.image.tag | string | `""` | | +| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index ee3a443..e7d73d3 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -27,6 +27,10 @@ spec: # from https://github.com/lqhl/wait-for-it image: gcr.io/spiffe-io/wait-for-it:latest args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] + {{- with .Values.agent.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} containers: - name: {{ .Chart.Name }}-agent image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}" diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 58bcb18..ed97871 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -32,6 +32,10 @@ spec: shareProcessNamespace: true securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- with .Values.server.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} containers: - name: {{ .Chart.Name }}-server securityContext: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index f77c7b1..e3d24d0 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -18,6 +18,9 @@ server: # Overrides the image tag whose default is the chart appVersion. tag: "" + nodeSelector: + kubernetes.io/arch: amd64 + dataStorage: enabled: true size: 1Gi @@ -36,6 +39,9 @@ oidc: pullPolicy: IfNotPresent tag: "" + nodeSelector: + kubernetes.io/arch: amd64 + logLevel: INFO service: @@ -73,6 +79,9 @@ agent: # Overrides the image tag whose default is the chart appVersion. tag: "" + nodeSelector: + kubernetes.io/arch: amd64 + imagePullSecrets: [] # - name: my-docker-registry # username: my-docker-user @@ -123,8 +132,6 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -nodeSelector: {} - tolerations: [] affinity: {} From fb5985ada497f83b7fb0c08b54ea65001dced7ed Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 31 Oct 2022 09:37:34 +0100 Subject: [PATCH 15/97] Bump spire chart version and require k8s 1.21+ Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 0cddbf1..44eb7d1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -37,4 +37,4 @@ maintainers: - name: marcofranssen email: marco.franssen@gmail.com url: https://marcofranssen.nl -kubeVersion: ">=1.19.0-0" +kubeVersion: ">=1.21.0-0" diff --git a/charts/spire/README.md b/charts/spire/README.md index 03df42d..89fc6ca 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -42,7 +42,7 @@ spec: ## Requirements -Kubernetes: `>=1.19.0-0` +Kubernetes: `>=1.21.0-0` ## Values From 569412b5d4762806676c9ee6570eabf398b58e1c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 27 Oct 2022 13:30:04 +0200 Subject: [PATCH 16/97] Allow to configure resources per object Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 9 ++- charts/spire/templates/agent-daemonset.yaml | 6 ++ charts/spire/templates/oidc-deployment.yaml | 2 +- .../spire/templates/server-statefulset.yaml | 2 +- charts/spire/values.yaml | 77 ++++++++++++++++--- 5 files changed, 81 insertions(+), 15 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 89fc6ca..55b740d 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -53,10 +53,15 @@ Kubernetes: `>=1.21.0-0` | agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | | | agent.image.tag | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| agent.resources | object | `{}` | | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `100` | | | autoscaling.minReplicas | int | `1` | | | autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | +| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | | +| csiDriver.image.tag | string | `"0.2.0"` | | +| csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | @@ -79,13 +84,13 @@ Kubernetes: `>=1.21.0-0` | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| oidc.resources | object | `{}` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | | -| resources | object | `{}` | | | securityContext | object | `{}` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | @@ -95,6 +100,7 @@ Kubernetes: `>=1.21.0-0` | server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | | server.image.tag | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| server.resources | object | `{}` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | @@ -108,6 +114,7 @@ Kubernetes: `>=1.21.0-0` | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | | | workloadRegistrar.image.tag | string | `""` | | +| workloadRegistrar.resources | object | `{}` | | ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index e7d73d3..cdc1eeb 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -59,6 +59,8 @@ spec: port: 8080 initialDelaySeconds: 15 periodSeconds: 60 + resources: + {{- toYaml .Values.agent.resources | nindent 12 }} # This is the container which runs the SPIFFE CSI driver. - name: spiffe-csi-driver image: ghcr.io/spiffe/spiffe-csi-driver:nightly @@ -90,6 +92,8 @@ spec: name: mountpoint-dir securityContext: privileged: true + resources: + {{- toYaml .Values.csiDriver.resources | nindent 12 }} # This container runs the CSI Node Driver Registrar which takes care # of all the little details required to register a CSI driver with # the kubelet. @@ -108,6 +112,8 @@ spec: # directory - name: kubelet-plugin-registration-dir mountPath: /registration + resources: + {{- toYaml .Values.csiDriver.resources | nindent 12 }} volumes: - name: spire-config configMap: diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 9f4d48e..6f81a76 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -66,7 +66,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.resources | nindent 12 }} + {{- toYaml .Values.oidc.resources | nindent 12 }} {{- if .Values.oidc.insecureScheme.enabled }} - name: nginx securityContext: diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index ed97871..81bdc8c 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -76,7 +76,7 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.resources | nindent 12 }} + {{- toYaml .Values.server.resources | nindent 12 }} - name: {{ .Chart.Name }}-workload-registrar securityContext: {{- toYaml .Values.securityContext | nindent 12 }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e3d24d0..8a85a0b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -11,6 +11,18 @@ workloadRegistrar: # Overrides the image tag whose default is the chart appVersion. tag: "" + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + server: image: repository: gcr.io/spiffe-io/spire-server @@ -21,6 +33,18 @@ server: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 200m + # memory: 256Mi + # limits: + # cpu: 200m + # memory: 256Mi + dataStorage: enabled: true size: 1Gi @@ -31,6 +55,23 @@ server: type: ClusterIP port: 8081 +csiDriver: + image: + repository: ghcr.io/spiffe/spiffe-csi-driver + pullPolicy: IfNotPresent + tag: 0.2.0 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + oidc: enabled: false @@ -42,6 +83,18 @@ oidc: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + logLevel: INFO service: @@ -82,6 +135,18 @@ agent: nodeSelector: kubernetes.io/arch: amd64 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + imagePullSecrets: [] # - name: my-docker-registry # username: my-docker-user @@ -113,18 +178,6 @@ securityContext: {} # runAsNonRoot: true # runAsUser: 1000 -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - autoscaling: enabled: false minReplicas: 1 From 4e5dd65aad67a73e80d48fec4ef113fbf791aa33 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Batuhan=20Apayd=C4=B1n?= Date: Tue, 1 Nov 2022 17:26:56 +0300 Subject: [PATCH 17/97] move spiffe-csi-driver and node-driver-registrar to values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Batuhan Apaydın Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 ++++ charts/spire/templates/agent-daemonset.yaml | 10 +++++----- charts/spire/values.yaml | 17 +++++++++++++++++ 3 files changed, 26 insertions(+), 5 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 55b740d..c197268 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -65,6 +65,10 @@ Kubernetes: `>=1.21.0-0` | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | +| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| nodeDriverRegistrar.image.repository | string | `"quay.io/k8scsi/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.tag | string | `"v2.0.1"` | | +| nodeDriverRegistrar.resources | object | `{}` | | | oidc.acme.cacheDir | string | `"/run/spire"` | | | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index cdc1eeb..dca0edb 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -63,8 +63,8 @@ spec: {{- toYaml .Values.agent.resources | nindent 12 }} # This is the container which runs the SPIFFE CSI driver. - name: spiffe-csi-driver - image: ghcr.io/spiffe/spiffe-csi-driver:nightly - imagePullPolicy: IfNotPresent + image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}} + imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}} args: [ "-workload-api-socket-dir", "/spire-agent-socket", "-csi-socket-path", "/spiffe-csi/csi.sock", @@ -98,8 +98,8 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: quay.io/k8scsi/csi-node-driver-registrar:v2.0.1 - imagePullPolicy: IfNotPresent + image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }} + imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", @@ -113,7 +113,7 @@ spec: - name: kubelet-plugin-registration-dir mountPath: /registration resources: - {{- toYaml .Values.csiDriver.resources | nindent 12 }} + {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} volumes: - name: spire-config configMap: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 8a85a0b..300adf6 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -72,6 +72,23 @@ csiDriver: # cpu: 100m # memory: 64Mi +nodeDriverRegistrar: + image: + repository: quay.io/k8scsi/csi-node-driver-registrar + pullPolicy: IfNotPresent + tag: v2.0.1 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + oidc: enabled: false From a5afe8979ef5f3d965b72203213a9468289f8881 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 13:18:35 +0100 Subject: [PATCH 18/97] Add a template to build the image string This also allows to use image digest as a version Signed-off-by: Marco Franssen --- charts/spire/README.md | 41 ++++++++++------- charts/spire/templates/_helpers.tpl | 12 +++++ charts/spire/templates/agent-daemonset.yaml | 12 ++--- charts/spire/templates/oidc-deployment.yaml | 6 +-- .../spire/templates/server-statefulset.yaml | 4 +- charts/spire/values.yaml | 45 ++++++++++++------- 6 files changed, 80 insertions(+), 40 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c197268..3176992 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -50,8 +50,9 @@ Kubernetes: `>=1.21.0-0` |-----|------|---------|-------------| | affinity | object | `{}` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | -| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | | -| agent.image.tag | string | `""` | | +| agent.image.registry | string | `"gcr.io"` | | +| agent.image.repository | string | `"spiffe-io/spire-agent"` | | +| agent.image.version | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | | autoscaling.enabled | bool | `false` | | @@ -59,15 +60,17 @@ Kubernetes: `>=1.21.0-0` | autoscaling.minReplicas | int | `1` | | | autoscaling.targetCPUUtilizationPercentage | int | `80` | | | csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | -| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | | -| csiDriver.image.tag | string | `"0.2.0"` | | +| csiDriver.image.registry | string | `"ghcr.io"` | | +| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | +| csiDriver.image.version | string | `"0.2.0"` | | | csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| nodeDriverRegistrar.image.repository | string | `"quay.io/k8scsi/csi-node-driver-registrar"` | | -| nodeDriverRegistrar.image.tag | string | `"v2.0.1"` | | +| nodeDriverRegistrar.image.registry | string | `"quay.io"` | | +| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | | | nodeDriverRegistrar.resources | object | `{}` | | | oidc.acme.cacheDir | string | `"/run/spire"` | | | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | @@ -79,12 +82,14 @@ Kubernetes: `>=1.21.0-0` | oidc.domains[3] | string | `"oidc-discovery.example.org"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | | -| oidc.image.tag | string | `""` | | +| oidc.image.registry | string | `"gcr.io"` | | +| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | | +| oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | -| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` | | -| oidc.insecureScheme.nginx.repository | string | `"nginx"` | | -| oidc.insecureScheme.nginx.tag | string | `"alpine"` | | +| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | +| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | | +| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | | +| oidc.insecureScheme.nginx.image.version | string | `"alpine"` | | | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | @@ -101,8 +106,9 @@ Kubernetes: `>=1.21.0-0` | server.dataStorage.size | string | `"1Gi"` | | | server.dataStorage.storageClass | string | `nil` | | | server.image.pullPolicy | string | `"IfNotPresent"` | | -| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | | -| server.image.tag | string | `""` | | +| server.image.registry | string | `"gcr.io"` | | +| server.image.repository | string | `"spiffe-io/spire-server"` | | +| server.image.version | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | server.resources | object | `{}` | | | server.service.port | int | `8081` | | @@ -115,9 +121,14 @@ Kubernetes: `>=1.21.0-0` | spire.server.logLevel | string | `"INFO"` | | | spire.trustDomain | string | `"example.org"` | | | tolerations | list | `[]` | | +| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | +| waitForIt.image.registry | string | `"gcr.io"` | | +| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | | +| waitForIt.image.version | string | `""` | | | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | | -| workloadRegistrar.image.tag | string | `""` | | +| workloadRegistrar.image.registry | string | `"gcr.io"` | | +| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | +| workloadRegistrar.image.version | string | `""` | | | workloadRegistrar.resources | object | `{}` | | ---------------------------------------------- diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index 994a28f..ee4073e 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -120,3 +120,15 @@ Create the name of the service account to use {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} + +{{- define "spire.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index dca0edb..f77fac7 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -25,7 +25,8 @@ spec: # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/lqhl/wait-for-it - image: gcr.io/spiffe-io/wait-for-it:latest + image: {{ template "spire.image" .Values.waitForIt }} + imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] {{- with .Values.agent.nodeSelector }} nodeSelector: @@ -33,7 +34,8 @@ spec: {{- end }} containers: - name: {{ .Chart.Name }}-agent - image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}" + image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }} + imagePullPolicy: {{ .Values.agent.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] volumeMounts: - name: spire-config @@ -63,8 +65,8 @@ spec: {{- toYaml .Values.agent.resources | nindent 12 }} # This is the container which runs the SPIFFE CSI driver. - name: spiffe-csi-driver - image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}} - imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}} + image: {{ template "spire.image" .Values.csiDriver }} + imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }} args: [ "-workload-api-socket-dir", "/spire-agent-socket", "-csi-socket-path", "/spiffe-csi/csi.sock", @@ -98,7 +100,7 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }} + image: {{ template "spire.image" .Values.nodeDriverRegistrar }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 6f81a76..b6024c7 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -35,7 +35,7 @@ spec: - name: spire-oidc securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }} imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} args: - -config @@ -71,8 +71,8 @@ spec: - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}" - imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }} + image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }} + imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }} ports: - containerPort: 80 name: http diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 81bdc8c..c47e6ac 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -40,7 +40,7 @@ spec: - name: {{ .Chart.Name }}-server securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}" + image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }} imagePullPolicy: {{ .Values.server.image.pullPolicy }} args: - -config @@ -80,7 +80,7 @@ spec: - name: {{ .Chart.Name }}-workload-registrar securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}" + image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }} imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }} args: - -config diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 300adf6..53bd9a5 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -4,12 +4,20 @@ replicaCount: 1 +waitForIt: + image: + registry: gcr.io + repository: spiffe-io/wait-for-it + pullPolicy: IfNotPresent + version: "" + workloadRegistrar: image: - repository: gcr.io/spiffe-io/k8s-workload-registrar + registry: gcr.io + repository: spiffe-io/k8s-workload-registrar pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: "" + version: "" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious @@ -25,10 +33,11 @@ workloadRegistrar: server: image: - repository: gcr.io/spiffe-io/spire-server + registry: gcr.io + repository: spiffe-io/spire-server pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: "" + version: "" nodeSelector: kubernetes.io/arch: amd64 @@ -57,9 +66,10 @@ server: csiDriver: image: - repository: ghcr.io/spiffe/spiffe-csi-driver + registry: ghcr.io + repository: spiffe/spiffe-csi-driver pullPolicy: IfNotPresent - tag: 0.2.0 + version: 0.2.0 resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -74,9 +84,10 @@ csiDriver: nodeDriverRegistrar: image: - repository: quay.io/k8scsi/csi-node-driver-registrar + registry: quay.io + repository: k8scsi/csi-node-driver-registrar pullPolicy: IfNotPresent - tag: v2.0.1 + version: v2.0.1 resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little @@ -93,9 +104,10 @@ oidc: enabled: false image: - repository: gcr.io/spiffe-io/oidc-discovery-provider + registry: gcr.io + repository: spiffe-io/oidc-discovery-provider pullPolicy: IfNotPresent - tag: "" + version: "" nodeSelector: kubernetes.io/arch: amd64 @@ -132,9 +144,11 @@ oidc: enabled: false nginx: - repository: nginx - pullPolicy: IfNotPresent - tag: "alpine" + image: + registry: docker.io + repository: nginx + pullPolicy: IfNotPresent + version: alpine acme: tosAccepted: false @@ -144,10 +158,11 @@ oidc: agent: image: - repository: gcr.io/spiffe-io/spire-agent + registry: gcr.io + repository: spiffe-io/spire-agent pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. - tag: "" + version: "" nodeSelector: kubernetes.io/arch: amd64 From 7f5346fc845c9efa0acb9d4fe9043f5ce196a0ff Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 14:26:18 +0100 Subject: [PATCH 19/97] Switch to ghcr.io for images and bump to 1.5.0 Resolves #31 Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 ++-- charts/spire/README.md | 14 +++++++------- charts/spire/values.yaml | 12 ++++++------ 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 44eb7d1..8d4e21a 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,8 +28,8 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.4.4" -keywords: ["spiffe", "spire", "spire-server", "spire-agent"] +appVersion: "1.5.0" +keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: - https://github.com/philips-labs/helm-charts/charts/spire diff --git a/charts/spire/README.md b/charts/spire/README.md index 3176992..b1e5315 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.4](https://img.shields.io/badge/AppVersion-1.4.4-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. @@ -50,8 +50,8 @@ Kubernetes: `>=1.21.0-0` |-----|------|---------|-------------| | affinity | object | `{}` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | -| agent.image.registry | string | `"gcr.io"` | | -| agent.image.repository | string | `"spiffe-io/spire-agent"` | | +| agent.image.registry | string | `"ghcr.io"` | | +| agent.image.repository | string | `"spiffe/spire-agent"` | | | agent.image.version | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | @@ -82,8 +82,8 @@ Kubernetes: `>=1.21.0-0` | oidc.domains[3] | string | `"oidc-discovery.example.org"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.image.registry | string | `"gcr.io"` | | -| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | | +| oidc.image.registry | string | `"ghcr.io"` | | +| oidc.image.repository | string | `"spiffe/spire-oidc-provider"` | | | oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | @@ -106,8 +106,8 @@ Kubernetes: `>=1.21.0-0` | server.dataStorage.size | string | `"1Gi"` | | | server.dataStorage.storageClass | string | `nil` | | | server.image.pullPolicy | string | `"IfNotPresent"` | | -| server.image.registry | string | `"gcr.io"` | | -| server.image.repository | string | `"spiffe-io/spire-server"` | | +| server.image.registry | string | `"ghcr.io"` | | +| server.image.repository | string | `"spiffe/spire-server"` | | | server.image.version | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | server.resources | object | `{}` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 53bd9a5..be6cf44 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -33,8 +33,8 @@ workloadRegistrar: server: image: - registry: gcr.io - repository: spiffe-io/spire-server + registry: ghcr.io + repository: spiffe/spire-server pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. version: "" @@ -104,8 +104,8 @@ oidc: enabled: false image: - registry: gcr.io - repository: spiffe-io/oidc-discovery-provider + registry: ghcr.io + repository: spiffe/spire-oidc-provider pullPolicy: IfNotPresent version: "" @@ -158,8 +158,8 @@ oidc: agent: image: - registry: gcr.io - repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent pullPolicy: IfNotPresent # Overrides the image tag whose default is the chart appVersion. version: "" From 765a4edaf899770eb1acd8342a9992b7fadf8cd7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 15:05:01 +0100 Subject: [PATCH 20/97] Update spire server config to remove deprecated settings Signed-off-by: Marco Franssen --- charts/spire/templates/server-configmap.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 84d5bcd..b358189 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -18,7 +18,8 @@ data: {{- if eq (.Values.oidc.enabled | toString) "true" }} jwt_issuer = "{{ .Values.oidc.jwtIssuer }}" {{ end }} - default_svid_ttl = "1h" + default_x509_svid_ttl = "1h" + default_jwt_svid_ttl = "1h" ca_subject = { country = ["NL"], organization = ["EXAMPLE"], From ec61c387b0dc9f7409d0948e7dbaa149446218cb Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 4 Nov 2022 11:39:33 +0100 Subject: [PATCH 21/97] Fix oidc health check using using scratch images Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-deployment.yaml | 27 +++++++++++-------- charts/spire/templates/oidc-dp-configmap.yaml | 18 ++++++++----- 2 files changed, 28 insertions(+), 17 deletions(-) diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index b6024c7..f40071a 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -40,8 +40,10 @@ spec: args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf - {{- if not .Values.oidc.insecureScheme.enabled }} ports: + - containerPort: 8008 + name: health + {{- if not .Values.oidc.insecureScheme.enabled }} - containerPort: 443 name: https {{- end }} @@ -55,16 +57,19 @@ spec: - name: spire-oidc-config mountPath: /run/spire/oidc/config/ readOnly: true - readinessProbe: - exec: - command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 - livenessProbe: - exec: - command: ["/bin/ps", "aux", "|", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 + # Needs new release of spire to fix the http healthchecks + # readinessProbe: + # httpGet: + # path: /ready + # port: health + # initialDelaySeconds: 5 + # periodSeconds: 5 + # livenessProbe: + # httpGet: + # path: /live + # port: health + # initialDelaySeconds: 5 + # periodSeconds: 5 resources: {{- toYaml .Values.oidc.resources | nindent 12 }} {{- if .Values.oidc.insecureScheme.enabled }} diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index e1f5650..6b06b98 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -17,16 +17,22 @@ data: listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" {{- else }} acme { - directory_url = "{{ .Values.oidc.acme.directoryUrl }}" - cache_dir = "{{ .Values.oidc.acme.cacheDir }}" - tos_accepted = {{ .Values.oidc.acme.tosAccepted }} - email = "{{ .Values.oidc.acme.emailAddress }}" + directory_url = "{{ .Values.oidc.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.acme.tosAccepted }} + email = "{{ .Values.oidc.acme.emailAddress }}" } {{- end }} workload_api { - socket_path = "/run/spire/agent-sockets/agent.sock" - trust_domain = "{{ .Values.spire.trustDomain }}" + socket_path = "/run/spire/agent-sockets/agent.sock" + trust_domain = "{{ .Values.spire.trustDomain }}" + } + + health_checks { + bind_port = "8008" + ready_path = "/ready" + live_path = "/live" } {{- if .Values.oidc.insecureScheme.enabled }} default.conf.template: | From 0b6198cf7c7c6b97f31f1a6a35648e29431fb9e6 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 11:40:21 +0100 Subject: [PATCH 22/97] Fix loglevel values Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 ++-- charts/spire/values.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index b1e5315..c73b9a0 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -116,9 +116,9 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | -| spire.agent.logLevel | string | `"INFO"` | | +| spire.agent.logLevel | string | `"info"` | | | spire.clusterName | string | `"example-cluster"` | | -| spire.server.logLevel | string | `"INFO"` | | +| spire.server.logLevel | string | `"info"` | | | spire.trustDomain | string | `"example.org"` | | | tolerations | list | `[]` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index be6cf44..6c6ff64 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -227,6 +227,6 @@ spire: clusterName: "example-cluster" trustDomain: "example.org" agent: - logLevel: INFO + logLevel: info server: - logLevel: INFO + logLevel: info From 445cde96047e465a333b8e03e4f976b9ff93055d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 13:21:23 +0100 Subject: [PATCH 23/97] Add the gcr.io images in comment in values.yaml Signed-off-by: Marco Franssen --- charts/spire/values.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 6c6ff64..2765d4b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -33,6 +33,8 @@ workloadRegistrar: server: image: + # registry: gcr.io + # repository: spiffe-io/spire-server registry: ghcr.io repository: spiffe/spire-server pullPolicy: IfNotPresent @@ -104,6 +106,8 @@ oidc: enabled: false image: + # registry: gcr.io + # repository: spiffe-io/oidc-discovery-provider registry: ghcr.io repository: spiffe/spire-oidc-provider pullPolicy: IfNotPresent @@ -158,6 +162,8 @@ oidc: agent: image: + # registry: gcr.io + # repository: spiffe-io/spire-agent registry: ghcr.io repository: spiffe/spire-agent pullPolicy: IfNotPresent From 78348004634b577dee748a72e722a9ec8a74b162 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 16:46:28 +0100 Subject: [PATCH 24/97] Move replicaCount to server and oidc components Signed-off-by: Marco Franssen --- charts/spire/README.md | 3 ++- charts/spire/templates/oidc-deployment.yaml | 2 +- charts/spire/templates/server-statefulset.yaml | 2 +- charts/spire/values.yaml | 8 ++------ 4 files changed, 6 insertions(+), 9 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c73b9a0..7c1d188 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -93,13 +93,13 @@ Kubernetes: `>=1.21.0-0` | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| oidc.replicaCount | int | `1` | | | oidc.resources | object | `{}` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | -| replicaCount | int | `1` | | | securityContext | object | `{}` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | @@ -110,6 +110,7 @@ Kubernetes: `>=1.21.0-0` | server.image.repository | string | `"spiffe/spire-server"` | | | server.image.version | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| server.replicaCount | int | `1` | | | server.resources | object | `{}` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index f40071a..e4b0dca 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -8,7 +8,7 @@ metadata: {{- include "spire.oidc.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} + replicas: {{ .Values.oidc.replicaCount }} {{- end }} selector: matchLabels: diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index c47e6ac..aa4ce15 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -7,7 +7,7 @@ metadata: {{- include "spire.server.labels" . | nindent 4 }} spec: {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} + replicas: {{ .Values.server.replicaCount }} {{- end }} serviceName: {{ include "spire.fullname" . }}-server selector: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 2765d4b..41eeac3 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,9 +1,3 @@ -# Default values for spire. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - waitForIt: image: registry: gcr.io @@ -32,6 +26,7 @@ workloadRegistrar: # memory: 64Mi server: + replicaCount: 1 image: # registry: gcr.io # repository: spiffe-io/spire-server @@ -104,6 +99,7 @@ nodeDriverRegistrar: oidc: enabled: false + replicaCount: 1 image: # registry: gcr.io From 8dd05399d14af9bb00556198c05627793a43f21b Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 16:49:27 +0100 Subject: [PATCH 25/97] Move some values to top Signed-off-by: Marco Franssen --- charts/spire/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 41eeac3..a5e847f 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,3 +1,6 @@ +nameOverride: "" +fullnameOverride: "" + waitForIt: image: registry: gcr.io @@ -187,9 +190,6 @@ imagePullSecrets: [] # password: my-docker-password # registryURL: my-private.docker-registry.com -nameOverride: "" -fullnameOverride: "" - serviceAccount: # Specifies whether a service account should be created create: true From 76a0c5ecfcf2e41b2fc8169b73416843cbfb5763 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 16:51:00 +0100 Subject: [PATCH 26/97] Move security values to server and oidc components Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 ++-- charts/spire/templates/oidc-deployment.yaml | 2 +- .../spire/templates/server-statefulset.yaml | 2 +- charts/spire/values.yaml | 32 +++++++++++++------ 4 files changed, 28 insertions(+), 14 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 7c1d188..c3981b8 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -93,14 +93,14 @@ Kubernetes: `>=1.21.0-0` | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| oidc.podSecurityContext | object | `{}` | | | oidc.replicaCount | int | `1` | | | oidc.resources | object | `{}` | | +| oidc.securityContext | object | `{}` | | | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | -| securityContext | object | `{}` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | @@ -110,8 +110,10 @@ Kubernetes: `>=1.21.0-0` | server.image.repository | string | `"spiffe/spire-server"` | | | server.image.version | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| server.podSecurityContext | object | `{}` | | | server.replicaCount | int | `1` | | | server.resources | object | `{}` | | +| server.securityContext | object | `{}` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | | serviceAccount.annotations | object | `{}` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index e4b0dca..e71d730 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -30,7 +30,7 @@ spec: {{- end }} serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- toYaml .Values.oidc.podSecurityContext | nindent 8 }} containers: - name: spire-oidc securityContext: diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index aa4ce15..e33b4ed 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -31,7 +31,7 @@ spec: serviceAccountName: {{ include "spire.serviceAccountName" . }}-server shareProcessNamespace: true securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} + {{- toYaml .Values.server.podSecurityContext | nindent 8 }} {{- with .Values.server.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index a5e847f..f81e981 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -64,6 +64,17 @@ server: type: ClusterIP port: 8081 + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + csiDriver: image: registry: ghcr.io @@ -143,6 +154,17 @@ oidc: - spire-oidc.spire.svc.cluster.local - oidc-discovery.example.org + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + insecureScheme: enabled: false @@ -201,16 +223,6 @@ serviceAccount: podAnnotations: {} -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 autoscaling: enabled: false From 1bdb9a5a50ca1d70f7912b1aa1aca79ad0d31a2d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 16:55:25 +0100 Subject: [PATCH 27/97] Move affinity, annotations and tolerations to oidc and server components Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/templates/oidc-deployment.yaml | 6 +++--- charts/spire/templates/server-statefulset.yaml | 6 +++--- charts/spire/values.yaml | 12 +++++------- 4 files changed, 14 insertions(+), 16 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c3981b8..083212e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -48,7 +48,6 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| -| affinity | object | `{}` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.registry | string | `"ghcr.io"` | | | agent.image.repository | string | `"spiffe/spire-agent"` | | @@ -76,6 +75,7 @@ Kubernetes: `>=1.21.0-0` | oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | | oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | | oidc.acme.tosAccepted | bool | `false` | | +| oidc.affinity | object | `{}` | | | oidc.domains[0] | string | `"localhost"` | | | oidc.domains[1] | string | `"spire-oidc.spire"` | | | oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | | @@ -93,6 +93,7 @@ Kubernetes: `>=1.21.0-0` | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | | oidc.replicaCount | int | `1` | | | oidc.resources | object | `{}` | | @@ -100,7 +101,7 @@ Kubernetes: `>=1.21.0-0` | oidc.service.annotations | object | `{}` | | | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | -| podAnnotations | object | `{}` | | +| oidc.tolerations | list | `[]` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | @@ -123,7 +124,6 @@ Kubernetes: `>=1.21.0-0` | spire.clusterName | string | `"example-cluster"` | | | spire.server.logLevel | string | `"info"` | | | spire.trustDomain | string | `"example.org"` | | -| tolerations | list | `[]` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"gcr.io"` | | | waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index e71d730..e4fe820 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -15,7 +15,7 @@ spec: {{- include "spire.oidc.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.podAnnotations }} + {{- with .Values.oidc.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} @@ -106,11 +106,11 @@ spec: nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.affinity }} + {{- with .Values.oidc.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.tolerations }} + {{- with .Values.oidc.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index e33b4ed..4d75708 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -15,7 +15,7 @@ spec: {{- include "spire.server.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.podAnnotations }} + {{- with .Values.oidc.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} @@ -99,11 +99,11 @@ spec: nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.affinity }} + {{- with .Values.server.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.tolerations }} + {{- with .Values.server.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index f81e981..45522c2 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -165,6 +165,11 @@ oidc: # runAsNonRoot: true # runAsUser: 1000 + tolerations: [] + + affinity: {} + podAnnotations: {} + insecureScheme: enabled: false @@ -221,9 +226,6 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" -podAnnotations: {} - - autoscaling: enabled: false minReplicas: 1 @@ -231,10 +233,6 @@ autoscaling: targetCPUUtilizationPercentage: 80 # targetMemoryUtilizationPercentage: 80 -tolerations: [] - -affinity: {} - # spireSettings spire: From 746768dc55a9105cd885b1d1a815d4ebc993b999 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 3 Nov 2022 20:25:32 +0100 Subject: [PATCH 28/97] Use chainguard nginx image Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 083212e..9f14f38 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -87,9 +87,9 @@ Kubernetes: `>=1.21.0-0` | oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | | -| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | | -| oidc.insecureScheme.nginx.image.version | string | `"alpine"` | | +| oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | | +| oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | | +| oidc.insecureScheme.nginx.image.version | float | `1.23` | | | oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | | oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 45522c2..967a079 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -175,10 +175,10 @@ oidc: nginx: image: - registry: docker.io - repository: nginx + registry: cgr.dev + repository: chainguard/nginx pullPolicy: IfNotPresent - version: alpine + version: 1.23 acme: tosAccepted: false From 79b26108f434fac69df6a31b8712b141eb65db98 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 4 Nov 2022 10:52:15 +0100 Subject: [PATCH 29/97] Fix oidc nodeSelector Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index e4fe820..860f6d2 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -102,7 +102,7 @@ spec: - name: spire-oidc-config configMap: name: {{ include "spire.fullname" . }}-oidc-discovery-provider - {{- with .Values.nodeSelector }} + {{- with .Values.oidc.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} From 10f0138a25730cbf0c71b920b134e25f3242a582 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 4 Nov 2022 12:13:56 +0100 Subject: [PATCH 30/97] Enable oidc service domains in oidc by default Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-dp-configmap.yaml | 14 +++++++++----- charts/spire/values.yaml | 2 -- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 6b06b98..e14d627 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -7,11 +7,15 @@ metadata: data: oidc-discovery-provider.conf: | log_level = "{{ .Values.oidc.logLevel }}" - {{ if gt (len .Values.oidc.domains) 0 }} - domains = ["{{- join "\", \"" .Values.oidc.domains }}"] - {{ else }} - domains = [] - {{ end }} + + domains = [ + "spire-oidc.{{ .Release.Namespace }}", + "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local", + {{- if gt (len .Values.oidc.domains) 0 }} + "{{- join "\",\n \"" .Values.oidc.domains }}" + {{- end }} + ] + {{- if .Values.oidc.insecureScheme.enabled }} allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }} listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 967a079..65993eb 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -150,8 +150,6 @@ oidc: domains: - localhost - - spire-oidc.spire - - spire-oidc.spire.svc.cluster.local - oidc-discovery.example.org podSecurityContext: {} From e770a1462935b1720ed6b5909b6c3db1d113bad5 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 14:00:33 +0100 Subject: [PATCH 31/97] Align config across components Signed-off-by: Marco Franssen --- charts/spire/README.md | 25 +++--- charts/spire/templates/agent-configmap.yaml | 2 +- charts/spire/templates/oidc-dp-configmap.yaml | 14 +-- charts/spire/templates/server-configmap.yaml | 14 +-- charts/spire/values.yaml | 88 ++++++++++--------- 5 files changed, 76 insertions(+), 67 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 9f14f38..484b019 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -48,6 +48,7 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| agent.config.logLevel | string | `"info"` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.registry | string | `"ghcr.io"` | | | agent.image.repository | string | `"spiffe/spire-agent"` | | @@ -71,15 +72,14 @@ Kubernetes: `>=1.21.0-0` | nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | | | nodeDriverRegistrar.image.version | string | `"v2.0.1"` | | | nodeDriverRegistrar.resources | object | `{}` | | -| oidc.acme.cacheDir | string | `"/run/spire"` | | -| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | -| oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | -| oidc.acme.tosAccepted | bool | `false` | | | oidc.affinity | object | `{}` | | -| oidc.domains[0] | string | `"localhost"` | | -| oidc.domains[1] | string | `"spire-oidc.spire"` | | -| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | | -| oidc.domains[3] | string | `"oidc-discovery.example.org"` | | +| oidc.config.acme.cacheDir | string | `"/run/spire"` | | +| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| oidc.config.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| oidc.config.acme.tosAccepted | bool | `false` | | +| oidc.config.domains[0] | string | `"localhost"` | | +| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` | | +| oidc.config.logLevel | string | `"info"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.registry | string | `"ghcr.io"` | | @@ -90,8 +90,6 @@ Kubernetes: `>=1.21.0-0` | oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | | | oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | | | oidc.insecureScheme.nginx.image.version | float | `1.23` | | -| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | -| oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | @@ -102,6 +100,11 @@ Kubernetes: `>=1.21.0-0` | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | oidc.tolerations | list | `[]` | | +| server.config.ca_subject.common_name | string | `"example.org"` | | +| server.config.ca_subject.country | string | `"NL"` | | +| server.config.ca_subject.organization | string | `"Example"` | | +| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | +| server.config.logLevel | string | `"info"` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | @@ -120,9 +123,7 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | -| spire.agent.logLevel | string | `"info"` | | | spire.clusterName | string | `"example-cluster"` | | -| spire.server.logLevel | string | `"info"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"gcr.io"` | | diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index fd5d41b..e0fb6e1 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -7,7 +7,7 @@ data: agent.conf: | agent { data_dir = "/run/spire" - log_level = "{{ .Values.spire.agent.logLevel }}" + log_level = "{{ .Values.agent.config.logLevel }}" server_address = "{{ include "spire.fullname" . }}-server" server_port = "{{ .Values.server.service.port }}" socket_path = "/run/spire/agent-sockets/agent.sock" diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index e14d627..18e1fdd 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -6,13 +6,13 @@ metadata: namespace: {{ .Release.Namespace }} data: oidc-discovery-provider.conf: | - log_level = "{{ .Values.oidc.logLevel }}" + log_level = "{{ .Values.oidc.config.logLevel }}" domains = [ "spire-oidc.{{ .Release.Namespace }}", "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local", - {{- if gt (len .Values.oidc.domains) 0 }} - "{{- join "\",\n \"" .Values.oidc.domains }}" + {{- if gt (len .Values.oidc.config.domains) 0 }} + "{{- join "\",\n \"" .Values.oidc.config.domains }}" {{- end }} ] @@ -21,10 +21,10 @@ data: listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" {{- else }} acme { - directory_url = "{{ .Values.oidc.acme.directoryUrl }}" - cache_dir = "{{ .Values.oidc.acme.cacheDir }}" - tos_accepted = {{ .Values.oidc.acme.tosAccepted }} - email = "{{ .Values.oidc.acme.emailAddress }}" + directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }} + email = "{{ .Values.oidc.config.acme.emailAddress }}" } {{- end }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index b358189..78ccb53 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -11,19 +11,21 @@ data: socket_path = "/run/spire/server-sockets/registration.sock" trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" - log_level = "{{ .Values.spire.server.logLevel }}" - #AWS requires the use of RSA. EC cryptography is not supported + log_level = "{{ .Values.server.config.logLevel }}" + # AWS requires the use of RSA. EC cryptography is not supported ca_key_type = "rsa-2048" {{- if eq (.Values.oidc.enabled | toString) "true" }} - jwt_issuer = "{{ .Values.oidc.jwtIssuer }}" + jwt_issuer = "{{ .Values.server.config.jwtIssuer }}" {{ end }} default_x509_svid_ttl = "1h" default_jwt_svid_ttl = "1h" ca_subject = { - country = ["NL"], - organization = ["EXAMPLE"], - common_name = "", + {{- with .Values.server.config.ca_subject }} + country = [{{ .country | quote }}], + organization = [{{ .organization | quote }}], + common_name = {{ .common_name | quote }}, + {{- end }} } } diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 65993eb..bbcc2f2 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -75,6 +75,43 @@ server: # runAsNonRoot: true # runAsUser: 1000 + config: + logLevel: info + jwtIssuer: oidc-discovery.example.org + + ca_subject: + country: NL + organization: Example + common_name: example.org + +agent: + image: + # registry: gcr.io + # repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + + nodeSelector: + kubernetes.io/arch: amd64 + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + + config: + logLevel: info + csiDriver: image: registry: ghcr.io @@ -138,20 +175,12 @@ oidc: # cpu: 100m # memory: 64Mi - logLevel: INFO - service: type: NodePort port: 80 annotations: {} # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - jwtIssuer: oidc-discovery.example.org - - domains: - - localhost - - oidc-discovery.example.org - podSecurityContext: {} # fsGroup: 2000 @@ -178,36 +207,17 @@ oidc: pullPolicy: IfNotPresent version: 1.23 - acme: - tosAccepted: false - cacheDir: /run/spire - directoryUrl: https://acme-v02.api.letsencrypt.org/directory - emailAddress: letsencrypt@example.org + config: + logLevel: info + domains: + - localhost + - oidc-discovery.example.org -agent: - image: - # registry: gcr.io - # repository: spiffe-io/spire-agent - registry: ghcr.io - repository: spiffe/spire-agent - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 64Mi - # limits: - # cpu: 100m - # memory: 128Mi + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory + emailAddress: letsencrypt@example.org imagePullSecrets: [] # - name: my-docker-registry @@ -236,7 +246,3 @@ autoscaling: spire: clusterName: "example-cluster" trustDomain: "example.org" - agent: - logLevel: info - server: - logLevel: info From 1e31a5e3597c18e5ada4f653b59172f23221fe7c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 14:25:19 +0100 Subject: [PATCH 32/97] Remove autoscaling using HPA Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 --- charts/spire/templates/hpa.yaml | 29 ------------------- charts/spire/templates/oidc-deployment.yaml | 2 -- .../spire/templates/server-statefulset.yaml | 2 -- charts/spire/values.yaml | 7 ----- 5 files changed, 44 deletions(-) delete mode 100644 charts/spire/templates/hpa.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 484b019..44d112f 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -55,10 +55,6 @@ Kubernetes: `>=1.21.0-0` | agent.image.version | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | -| autoscaling.enabled | bool | `false` | | -| autoscaling.maxReplicas | int | `100` | | -| autoscaling.minReplicas | int | `1` | | -| autoscaling.targetCPUUtilizationPercentage | int | `80` | | | csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | | csiDriver.image.registry | string | `"ghcr.io"` | | | csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | diff --git a/charts/spire/templates/hpa.yaml b/charts/spire/templates/hpa.yaml deleted file mode 100644 index 000dc45..0000000 --- a/charts/spire/templates/hpa.yaml +++ /dev/null @@ -1,29 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "spire.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - {{- include "spire.labels" . | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "spire.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 860f6d2..0c7b48f 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -7,9 +7,7 @@ metadata: labels: {{- include "spire.oidc.labels" . | nindent 4 }} spec: - {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.oidc.replicaCount }} - {{- end }} selector: matchLabels: {{- include "spire.oidc.selectorLabels" . | nindent 6 }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 4d75708..5618c7d 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -6,9 +6,7 @@ metadata: labels: {{- include "spire.server.labels" . | nindent 4 }} spec: - {{- if not .Values.autoscaling.enabled }} replicas: {{ .Values.server.replicaCount }} - {{- end }} serviceName: {{ include "spire.fullname" . }}-server selector: matchLabels: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index bbcc2f2..475a22b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -234,13 +234,6 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 - # spireSettings spire: From 60b2f7c7737246ec8e134c1e9f2ade45a0879487 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 11:40:00 +0100 Subject: [PATCH 33/97] Utilize spiffe csi driver in OIDC component Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/templates/agent-configmap.yaml | 2 +- charts/spire/templates/oidc-deployment.yaml | 12 ++++++------ charts/spire/templates/oidc-dp-configmap.yaml | 6 +++--- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index e0fb6e1..4530f6b 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -10,7 +10,7 @@ data: log_level = "{{ .Values.agent.config.logLevel }}" server_address = "{{ include "spire.fullname" . }}-server" server_port = "{{ .Values.server.service.port }}" - socket_path = "/run/spire/agent-sockets/agent.sock" + socket_path = "/run/spire/agent-sockets/spire-agent.sock" trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.spire.trustDomain | quote }} } diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 0c7b48f..8cb24f2 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -46,8 +46,8 @@ spec: name: https {{- end }} volumeMounts: - - name: spire-agent-sockets - mountPath: /run/spire/agent-sockets + - name: spiffe-workload-api + mountPath: /spiffe-workload-api readOnly: true - name: spire-oidc-sockets mountPath: /run/spire/oidc-sockets @@ -89,14 +89,14 @@ spec: readOnly: true {{- end }} volumes: + - name: spiffe-workload-api + csi: + driver: "csi.spiffe.io" + readOnly: true - name: spire-oidc-sockets hostPath: path: /run/spire/oidc-sockets type: DirectoryOrCreate - - name: spire-agent-sockets - hostPath: - path: /run/spire/agent-sockets - type: DirectoryOrCreate - name: spire-oidc-config configMap: name: {{ include "spire.fullname" . }}-oidc-discovery-provider diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 18e1fdd..ee5a317 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -18,7 +18,7 @@ data: {{- if .Values.oidc.insecureScheme.enabled }} allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }} - listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" + listen_socket_path = "/run/spire/oidc-sockets/spire-oidc-server.sock" {{- else }} acme { directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}" @@ -29,7 +29,7 @@ data: {{- end }} workload_api { - socket_path = "/run/spire/agent-sockets/agent.sock" + socket_path = "/spiffe-workload-api/spire-agent.sock" trust_domain = "{{ .Values.spire.trustDomain }}" } @@ -41,7 +41,7 @@ data: {{- if .Values.oidc.insecureScheme.enabled }} default.conf.template: | upstream oidc { - server unix:/run/spire/oidc-sockets/oidc-server.sock; + server unix:/run/spire/oidc-sockets/spire-oidc-server.sock; } server { From fc1bcb35d96adc30b0333088198f1809f7a7e438 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 7 Nov 2022 10:57:04 +0100 Subject: [PATCH 34/97] Align spire-server sock naming convention with agent Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/templates/workload-registrar-configmap.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 78ccb53..800f33e 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -8,7 +8,7 @@ data: server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = "/run/spire/server-sockets/registration.sock" + socket_path = "/run/spire/server-sockets/spire-server.sock" trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" log_level = "{{ .Values.server.config.logLevel }}" diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml index 71dfc3e..22cf8d3 100644 --- a/charts/spire/templates/workload-registrar-configmap.yaml +++ b/charts/spire/templates/workload-registrar-configmap.yaml @@ -9,6 +9,6 @@ data: mode = "reconcile" trust_domain = {{ .Values.spire.trustDomain | quote }} cluster = {{ .Values.spire.clusterName | quote }} - server_address = "unix:///run/spire/server-sockets/registration.sock" + server_address = "unix:///run/spire/server-sockets/spire-server.sock" leader_election = true metrics_addr = "0.0.0.0:18080" From 933a75bfd44a4ccf111c4af187e4a029eeb8d338 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sat, 12 Nov 2022 14:58:29 +0100 Subject: [PATCH 35/97] Bump spire version to 1.5.1 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 8d4e21a..63be9bd 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.5.0" +appVersion: "1.5.1" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 44d112f..d2817ac 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. From a159e7b663f5c0838b9f0933e88c65d0f8d5de73 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 14 Nov 2022 18:22:34 +0100 Subject: [PATCH 36/97] Fix image version failing in spire.image template Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 +- charts/spire/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index d2817ac..2c52009 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -85,7 +85,7 @@ Kubernetes: `>=1.21.0-0` | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | | | oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | | -| oidc.insecureScheme.nginx.image.version | float | `1.23` | | +| oidc.insecureScheme.nginx.image.version | string | `"1.23"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 475a22b..cd0a53b 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -205,7 +205,7 @@ oidc: registry: cgr.dev repository: chainguard/nginx pullPolicy: IfNotPresent - version: 1.23 + version: "1.23" config: logLevel: info From c010d6a4b0d3a9b2a497bb0f199bcabb69fafbf9 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 15 Nov 2022 11:48:18 +0100 Subject: [PATCH 37/97] Fix spire oidc nginx container Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/values.yaml | 12 +++++++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 2c52009..ec4dd73 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -83,9 +83,9 @@ Kubernetes: `>=1.21.0-0` | oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | | -| oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | | -| oidc.insecureScheme.nginx.image.version | string | `"1.23"` | | +| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | | +| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | | +| oidc.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index cd0a53b..9cbc664 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -202,10 +202,16 @@ oidc: nginx: image: - registry: cgr.dev - repository: chainguard/nginx + registry: docker.io + repository: nginx pullPolicy: IfNotPresent - version: "1.23" + version: 1.23.2-alpine + # chainguard image does not support the templates feature + # https://github.com/chainguard-images/nginx/issues/43 + # registry: cgr.dev + # repository: chainguard/nginx + # pullPolicy: IfNotPresent + # version: "1.23.2" config: logLevel: info From 83c3e45e93807cbd0faecab3614b4c3f5ddae127 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 15 Nov 2022 11:14:57 +0100 Subject: [PATCH 38/97] Make socketPaths configurable Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 ++ charts/spire/templates/NOTES.txt | 2 +- charts/spire/templates/agent-configmap.yaml | 6 +++--- charts/spire/templates/oidc-dp-configmap.yaml | 2 +- charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/templates/workload-registrar-configmap.yaml | 2 +- charts/spire/values.yaml | 2 ++ 7 files changed, 11 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index ec4dd73..7c08dae 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -49,6 +49,7 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | agent.config.logLevel | string | `"info"` | | +| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.registry | string | `"ghcr.io"` | | | agent.image.repository | string | `"spiffe/spire-agent"` | | @@ -101,6 +102,7 @@ Kubernetes: `>=1.21.0-0` | server.config.ca_subject.organization | string | `"Example"` | | | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | | server.config.logLevel | string | `"info"` | | +| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 21242d9..65e935f 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1,4 +1,4 @@ 1. Get the currently registered SPIFFE entries from the server: kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ - bin/spire-server entry show -socketPath /run/spire/server-sockets/registration.sock + bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }} diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index 4530f6b..7b348bb 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -7,10 +7,10 @@ data: agent.conf: | agent { data_dir = "/run/spire" - log_level = "{{ .Values.agent.config.logLevel }}" + log_level = {{ .Values.agent.config.logLevel | quote }} server_address = "{{ include "spire.fullname" . }}-server" - server_port = "{{ .Values.server.service.port }}" - socket_path = "/run/spire/agent-sockets/spire-agent.sock" + server_port = {{ .Values.server.service.port | quote }} + socket_path = {{ .Values.agent.config.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.spire.trustDomain | quote }} } diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index ee5a317..951cc5a 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -29,7 +29,7 @@ data: {{- end }} workload_api { - socket_path = "/spiffe-workload-api/spire-agent.sock" + socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}" trust_domain = "{{ .Values.spire.trustDomain }}" } diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 800f33e..78bd729 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -8,7 +8,7 @@ data: server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = "/run/spire/server-sockets/spire-server.sock" + socket_path = {{ .Values.server.config.socketPath | quote }} trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" log_level = "{{ .Values.server.config.logLevel }}" diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml index 22cf8d3..72f0ed5 100644 --- a/charts/spire/templates/workload-registrar-configmap.yaml +++ b/charts/spire/templates/workload-registrar-configmap.yaml @@ -9,6 +9,6 @@ data: mode = "reconcile" trust_domain = {{ .Values.spire.trustDomain | quote }} cluster = {{ .Values.spire.clusterName | quote }} - server_address = "unix:///run/spire/server-sockets/spire-server.sock" + server_address = "unix://{{ .Values.server.config.socketPath }}" leader_election = true metrics_addr = "0.0.0.0:18080" diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 9cbc664..4158201 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -77,6 +77,7 @@ server: config: logLevel: info + socketPath: /run/spire/server-sockets/spire-server.sock jwtIssuer: oidc-discovery.example.org ca_subject: @@ -111,6 +112,7 @@ agent: config: logLevel: info + socketPath: /run/spire/agent-sockets/spire-agent.sock csiDriver: image: From 0e480c605701748d0e3776b58b43d801b61d3dff Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 15 Nov 2022 14:03:49 +0100 Subject: [PATCH 39/97] Use variable for oidc socket Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/templates/oidc-dp-configmap.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 951cc5a..4e55a45 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -1,4 +1,5 @@ {{- if eq (.Values.oidc.enabled | toString) "true" }} +{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} apiVersion: v1 kind: ConfigMap metadata: @@ -18,7 +19,7 @@ data: {{- if .Values.oidc.insecureScheme.enabled }} allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }} - listen_socket_path = "/run/spire/oidc-sockets/spire-oidc-server.sock" + listen_socket_path = {{ $oidcSocket | quote }} {{- else }} acme { directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}" @@ -41,7 +42,7 @@ data: {{- if .Values.oidc.insecureScheme.enabled }} default.conf.template: | upstream oidc { - server unix:/run/spire/oidc-sockets/spire-oidc-server.sock; + server unix:{{ $oidcSocket }}; } server { From be163d26ccbfa09e48269877b5237f9f764b7e33 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 22 Nov 2022 10:47:08 +0100 Subject: [PATCH 40/97] Allow to configure oidc nginx container resources Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 1 + charts/spire/templates/oidc-deployment.yaml | 2 ++ charts/spire/values.yaml | 11 +++++++++++ 3 files changed, 14 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 7c08dae..00186ef 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -87,6 +87,7 @@ Kubernetes: `>=1.21.0-0` | oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | | | oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | | | oidc.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | +| oidc.insecureScheme.nginx.resources | object | `{}` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index 8cb24f2..a117eb1 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -87,6 +87,8 @@ spec: mountPath: /etc/nginx/templates/default.conf.template subPath: default.conf.template readOnly: true + resources: + {{- toYaml .Values.oidc.insecureScheme.nginx.resources | nindent 12 }} {{- end }} volumes: - name: spiffe-workload-api diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 4158201..576cdc7 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -214,6 +214,17 @@ oidc: # repository: chainguard/nginx # pullPolicy: IfNotPresent # version: "1.23.2" + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi config: logLevel: info From d84a1343c624f1154261d2a4c6ee9b0c4ec5ea7d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 7 Dec 2022 16:09:15 +0100 Subject: [PATCH 41/97] Bump csi-node-driver-registrar to v2.6.2 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 00186ef..5a9dbd4 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -65,9 +65,9 @@ Kubernetes: `>=1.21.0-0` | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| nodeDriverRegistrar.image.registry | string | `"quay.io"` | | -| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | | -| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | | +| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | +| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | | nodeDriverRegistrar.resources | object | `{}` | | | oidc.affinity | object | `{}` | | | oidc.config.acme.cacheDir | string | `"/run/spire"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 576cdc7..1e78ebc 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -134,10 +134,10 @@ csiDriver: nodeDriverRegistrar: image: - registry: quay.io - repository: k8scsi/csi-node-driver-registrar + registry: registry.k8s.io + repository: sig-storage/csi-node-driver-registrar pullPolicy: IfNotPresent - version: v2.0.1 + version: v2.6.2 resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little From cc54e3bfbe7f1ecbb40d14bd4f20b9ebdb62121c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 7 Dec 2022 16:12:47 +0100 Subject: [PATCH 42/97] Add liveness prove to csi-node-registrar Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/templates/agent-daemonset.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index f77fac7..c397104 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -105,6 +105,7 @@ spec: args: [ "-csi-address", "/spiffe-csi/csi.sock", "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + "-health-port", "9809" ] volumeMounts: # The registrar needs access to the SPIFFE CSI driver socket @@ -114,6 +115,15 @@ spec: # directory - name: kubelet-plugin-registration-dir mountPath: /registration + ports: + - containerPort: 9809 + name: healthz + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 5 + timeoutSeconds: 5 resources: {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} volumes: From 9634df136d156149b025187665bc3ce2c330dace Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 7 Dec 2022 16:16:05 +0100 Subject: [PATCH 43/97] Resolve CVE by bumping spire to 1.5.2 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 63be9bd..ac270bb 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.5.1" +appVersion: "1.5.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 5a9dbd4..1709d7b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.2](https://img.shields.io/badge/AppVersion-1.5.2-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. From a3f1901a6bd474ff0560e00c94ad586df8a5e000 Mon Sep 17 00:00:00 2001 From: Ken Huffman Date: Thu, 8 Dec 2022 02:50:40 -0500 Subject: [PATCH 44/97] adding annotations and resources (#81) Co-authored-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 5 +++++ charts/spire/templates/agent-daemonset.yaml | 12 +++++++++--- charts/spire/templates/server-service.yaml | 4 ++++ charts/spire/templates/server-statefulset.yaml | 6 ++++++ .../spire/templates/workload-registrar-service.yaml | 4 ++++ charts/spire/values.yaml | 10 ++++++++++ 6 files changed, 38 insertions(+), 3 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 1709d7b..93e3c84 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -56,6 +56,7 @@ Kubernetes: `>=1.21.0-0` | agent.image.version | string | `""` | | | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | +| agent.service.annotations | object | `{}` | | | csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | | csiDriver.image.registry | string | `"ghcr.io"` | | | csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | @@ -117,8 +118,10 @@ Kubernetes: `>=1.21.0-0` | server.replicaCount | int | `1` | | | server.resources | object | `{}` | | | server.securityContext | object | `{}` | | +| server.service.annotations | object | `{}` | | | server.service.port | int | `8081` | | | server.service.type | string | `"ClusterIP"` | | +| server.topologySpreadConstraints | list | `[]` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | @@ -128,11 +131,13 @@ Kubernetes: `>=1.21.0-0` | waitForIt.image.registry | string | `"gcr.io"` | | | waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | | | waitForIt.image.version | string | `""` | | +| waitForIt.resources | object | `{}` | | | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.registry | string | `"gcr.io"` | | | workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | | workloadRegistrar.image.version | string | `""` | | | workloadRegistrar.resources | object | `{}` | | +| workloadRegistrar.service.annotations | object | `{}` | | ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index c397104..895fa2b 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -13,6 +13,10 @@ spec: type: RollingUpdate template: metadata: + {{- with .Values.agent.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} labels: {{- include "spire.agent.selectorLabels" . | nindent 8 }} spec: @@ -28,6 +32,8 @@ spec: image: {{ template "spire.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] + resources: + {{- toYaml .Values.waitForIt.resources | nindent 12 }} {{- with .Values.agent.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -45,7 +51,7 @@ spec: mountPath: /run/spire/bundle readOnly: true - name: spire-agent-socket-dir - mountPath: /run/spire/agent-sockets + mountPath: {{ dir .Values.agent.config.socketPath }} readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -135,7 +141,7 @@ spec: name: {{ include "spire.fullname" . }}-bundle - name: spire-agent-sockets hostPath: - path: /run/spire/agent-sockets + path: {{ dir .Values.agent.config.socketPath }} type: DirectoryOrCreate - name: spire-token projected: @@ -146,7 +152,7 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: /run/spire/agent-sockets + path: {{ dir .Values.agent.config.socketPath }} type: DirectoryOrCreate # This volume is where the socket for kubelet->driver communication lives - name: spiffe-csi-socket-dir diff --git a/charts/spire/templates/server-service.yaml b/charts/spire/templates/server-service.yaml index a3a5d06..006bfc0 100644 --- a/charts/spire/templates/server-service.yaml +++ b/charts/spire/templates/server-service.yaml @@ -3,6 +3,10 @@ kind: Service metadata: name: {{ include "spire.fullname" . }}-server namespace: {{ .Release.Namespace }} + {{- with .Values.server.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} labels: {{- include "spire.server.labels" . | nindent 4 }} spec: diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 5618c7d..b7e09c9 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -93,6 +93,8 @@ spec: - name: spire-workload-registrar-config mountPath: /run/spire/k8s-workload-registrar/config readOnly: true + resources: + {{- toYaml .Values.workloadRegistrar.resources | nindent 12 }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -105,6 +107,10 @@ spec: tolerations: {{- toYaml . | nindent 8 }} {{- end }} + {{- with .Values.server.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} volumes: - name: spire-workload-registrar-config configMap: diff --git a/charts/spire/templates/workload-registrar-service.yaml b/charts/spire/templates/workload-registrar-service.yaml index 5e8722a..0588e90 100644 --- a/charts/spire/templates/workload-registrar-service.yaml +++ b/charts/spire/templates/workload-registrar-service.yaml @@ -3,6 +3,10 @@ kind: Service metadata: name: {{ include "spire.fullname" . }}-k8s-workload-registrar namespace: {{ .Release.Namespace }} + {{- with .Values.workloadRegistrar.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} labels: {{- include "spire.server.labels" . | nindent 4 }} spec: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 1e78ebc..ca38ff0 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -7,6 +7,7 @@ waitForIt: repository: spiffe-io/wait-for-it pullPolicy: IfNotPresent version: "" + resources: {} workloadRegistrar: image: @@ -28,6 +29,9 @@ workloadRegistrar: # cpu: 100m # memory: 64Mi + service: + annotations: {} + server: replicaCount: 1 image: @@ -63,6 +67,7 @@ server: service: type: ClusterIP port: 8081 + annotations: {} podSecurityContext: {} # fsGroup: 2000 @@ -75,6 +80,8 @@ server: # runAsNonRoot: true # runAsUser: 1000 + topologySpreadConstraints: [] + config: logLevel: info socketPath: /run/spire/server-sockets/spire-server.sock @@ -110,6 +117,9 @@ agent: # cpu: 100m # memory: 128Mi + service: + annotations: {} + config: logLevel: info socketPath: /run/spire/agent-sockets/spire-agent.sock From 109be1a3cc0aea5c528a03e0feda57334b7b8732 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 5 Dec 2022 13:09:18 +0100 Subject: [PATCH 45/97] Replaced wait-for-it image to resolve security issues This image was also outdated (no recent releases) and contains whole bunch of vulnerabilities Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/templates/agent-daemonset.yaml | 2 +- charts/spire/values.yaml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 93e3c84..989f437 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -128,9 +128,9 @@ Kubernetes: `>=1.21.0-0` | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | -| waitForIt.image.registry | string | `"gcr.io"` | | -| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | | -| waitForIt.image.version | string | `""` | | +| waitForIt.image.registry | string | `"cgr.dev"` | | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| waitForIt.image.version | string | `"latest-20221215"` | | | waitForIt.resources | object | `{}` | | | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.registry | string | `"gcr.io"` | | diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 895fa2b..0c0d394 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -31,7 +31,7 @@ spec: # from https://github.com/lqhl/wait-for-it image: {{ template "spire.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"] + args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} {{- with .Values.agent.nodeSelector }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index ca38ff0..7b22dff 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -3,10 +3,10 @@ fullnameOverride: "" waitForIt: image: - registry: gcr.io - repository: spiffe-io/wait-for-it + registry: cgr.dev + repository: chainguard/wait-for-it pullPolicy: IfNotPresent - version: "" + version: latest-20221215 resources: {} workloadRegistrar: From aff50434fa1815a24eb142cf9c0e10c60d0b0581 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 15 Dec 2022 10:11:56 +0100 Subject: [PATCH 46/97] Apply suggestions from code review Co-authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen --- charts/spire/templates/agent-daemonset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 0c0d394..8e8e6bf 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -28,7 +28,7 @@ spec: - name: init # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built - # from https://github.com/lqhl/wait-for-it + # from https://github.com/vishnubob/wait-for-it image: {{ template "spire.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"] From 94318b02a6848282ffb10e9146a33c39acb19c9f Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 15 Dec 2022 14:07:34 +0100 Subject: [PATCH 47/97] Bump spire to 1.5.3 to fix oidc healthchecks Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 6 ++--- charts/spire/templates/oidc-deployment.yaml | 25 ++++++++++----------- charts/spire/values.yaml | 8 +++---- 4 files changed, 20 insertions(+), 21 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index ac270bb..dda28fa 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.5.2" +appVersion: "1.5.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 989f437..2e5497b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.2](https://img.shields.io/badge/AppVersion-1.5.2-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. @@ -80,8 +80,8 @@ Kubernetes: `>=1.21.0-0` | oidc.config.logLevel | string | `"info"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.image.registry | string | `"ghcr.io"` | | -| oidc.image.repository | string | `"spiffe/spire-oidc-provider"` | | +| oidc.image.registry | string | `"gcr.io"` | | +| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | | | oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml index a117eb1..02838a3 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/templates/oidc-deployment.yaml @@ -55,19 +55,18 @@ spec: - name: spire-oidc-config mountPath: /run/spire/oidc/config/ readOnly: true - # Needs new release of spire to fix the http healthchecks - # readinessProbe: - # httpGet: - # path: /ready - # port: health - # initialDelaySeconds: 5 - # periodSeconds: 5 - # livenessProbe: - # httpGet: - # path: /live - # port: health - # initialDelaySeconds: 5 - # periodSeconds: 5 + readinessProbe: + httpGet: + path: /ready + port: health + initialDelaySeconds: 5 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /live + port: health + initialDelaySeconds: 5 + periodSeconds: 5 resources: {{- toYaml .Values.oidc.resources | nindent 12 }} {{- if .Values.oidc.insecureScheme.enabled }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 7b22dff..00b1f30 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -165,10 +165,10 @@ oidc: replicaCount: 1 image: - # registry: gcr.io - # repository: spiffe-io/oidc-discovery-provider - registry: ghcr.io - repository: spiffe/spire-oidc-provider + registry: gcr.io + repository: spiffe-io/oidc-discovery-provider + # registry: ghcr.io + # repository: spiffe/oidc-discovery-provider pullPolicy: IfNotPresent version: "" From a2abee2f953ec68207831ca1591f26fafbcedae1 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 16 Dec 2022 11:05:49 +0100 Subject: [PATCH 48/97] Switch oidc image back to static image The repo as private and is now set to public Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 ++-- charts/spire/values.yaml | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 2e5497b..b040886 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -80,8 +80,8 @@ Kubernetes: `>=1.21.0-0` | oidc.config.logLevel | string | `"info"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.image.registry | string | `"gcr.io"` | | -| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | | +| oidc.image.registry | string | `"ghcr.io"` | | +| oidc.image.repository | string | `"spiffe/oidc-discovery-provider"` | | | oidc.image.version | string | `""` | | | oidc.insecureScheme.enabled | bool | `false` | | | oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 00b1f30..7714418 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -165,10 +165,10 @@ oidc: replicaCount: 1 image: - registry: gcr.io - repository: spiffe-io/oidc-discovery-provider - # registry: ghcr.io - # repository: spiffe/oidc-discovery-provider + # registry: gcr.io + # repository: spiffe-io/oidc-discovery-provider + registry: ghcr.io + repository: spiffe/oidc-discovery-provider pullPolicy: IfNotPresent version: "" From bf31bdc2c026112cd5270091bd051160a1b73430 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 16 Dec 2022 11:06:22 +0100 Subject: [PATCH 49/97] Fix server podAnnotations configurable Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 1 + charts/spire/templates/server-statefulset.yaml | 2 +- charts/spire/values.yaml | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index b040886..e4afa9e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -114,6 +114,7 @@ Kubernetes: `>=1.21.0-0` | server.image.repository | string | `"spiffe/spire-server"` | | | server.image.version | string | `""` | | | server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| server.podAnnotations | object | `{}` | | | server.podSecurityContext | object | `{}` | | | server.replicaCount | int | `1` | | | server.resources | object | `{}` | | diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index b7e09c9..6c53a9e 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -13,7 +13,7 @@ spec: {{- include "spire.server.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.oidc.podAnnotations }} + {{- with .Values.server.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 7714418..17f0268 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -69,6 +69,8 @@ server: port: 8081 annotations: {} + podAnnotations: {} + podSecurityContext: {} # fsGroup: 2000 From ddf4be3d3dd083af25129f520c00bcfd21e2bfb4 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 16 Dec 2022 11:09:43 +0100 Subject: [PATCH 50/97] Bump csiDriver to 0.2.1 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 +- charts/spire/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index e4afa9e..81e3a30 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -60,7 +60,7 @@ Kubernetes: `>=1.21.0-0` | csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | | csiDriver.image.registry | string | `"ghcr.io"` | | | csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | -| csiDriver.image.version | string | `"0.2.0"` | | +| csiDriver.image.version | string | `"0.2.1"` | | | csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 17f0268..ad286ce 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -131,7 +131,7 @@ csiDriver: registry: ghcr.io repository: spiffe/spiffe-csi-driver pullPolicy: IfNotPresent - version: 0.2.0 + version: 0.2.1 resources: {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little From ce86fb97e19749266cbe09a8edc23ce619e9d1f2 Mon Sep 17 00:00:00 2001 From: Ken Huffman Date: Wed, 21 Dec 2022 06:10:58 -0500 Subject: [PATCH 51/97] Add optional UpstreamAuthority (#79) Co-authored-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 7 +++++++ charts/spire/templates/server-configmap.yaml | 14 ++++++++++++++ charts/spire/templates/server-statefulset.yaml | 10 ++++++++++ charts/spire/values.yaml | 12 ++++++++++++ 4 files changed, 43 insertions(+) diff --git a/charts/spire/README.md b/charts/spire/README.md index 81e3a30..73168a9 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -99,12 +99,19 @@ Kubernetes: `>=1.21.0-0` | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | oidc.tolerations | list | `[]` | | +| server.caSecretStorage.enabled | bool | `false` | | +| server.caSecretStorage.path | string | `"/conf/server/"` | | +| server.caSecretStorage.secretName | string | `"csi-driver-spiffe-ca"` | | | server.config.ca_subject.common_name | string | `"example.org"` | | | server.config.ca_subject.country | string | `"NL"` | | | server.config.ca_subject.organization | string | `"Example"` | | | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | | server.config.logLevel | string | `"info"` | | | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| server.config.upstreamAuthority.disk.bundleFilePath | string | `""` | | +| server.config.upstreamAuthority.disk.certFilePath | string | `"/conf/server/tls.crt"` | | +| server.config.upstreamAuthority.disk.enabled | bool | `false` | | +| server.config.upstreamAuthority.disk.keyFilePath | string | `"/conf/server/tls.key"` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 78bd729..5e2d12b 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -59,6 +59,20 @@ data: config_map = "{{ include "spire.fullname" . }}-bundle" } } + + {{- with .Values.server.config.upstreamAuthority.disk }} + {{- if eq (.enabled | toString) "true" }} + UpstreamAuthority "disk" { + plugin_data { + cert_file_path = "{{ .certFilePath }}" + key_file_path = "{{ .keyFilePath }}" + {{- if ne .bundleFilePath "" }} + bundle_file_path = "{{ .bundleFilePath }}" + {{- end }} + } + } + {{- end }} + {{- end }} } health_checks { diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 6c53a9e..a404408 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -59,6 +59,11 @@ spec: mountPath: /run/spire/data readOnly: false {{ end }} + {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }} + - name: secret-data + mountPath: {{ .Values.server.caSecretStorage.path }} + readOnly: false + {{ end }} livenessProbe: httpGet: path: /live @@ -122,6 +127,11 @@ spec: hostPath: path: /run/spire/server-sockets type: DirectoryOrCreate + {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }} + - name: secret-data + secret: + secretName: {{ .Values.server.caSecretStorage.secretName }} + {{- end }} volumeClaimTemplates: {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} - metadata: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index ad286ce..edbdb2a 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -84,6 +84,11 @@ server: topologySpreadConstraints: [] + caSecretStorage: + enabled: false + path: /conf/server/ + secretName: "csi-driver-spiffe-ca" + config: logLevel: info socketPath: /run/spire/server-sockets/spire-server.sock @@ -94,6 +99,13 @@ server: organization: Example common_name: example.org + upstreamAuthority: + disk: + enabled: false + certFilePath: /conf/server/tls.crt + keyFilePath: /conf/server/tls.key + bundleFilePath: "" + agent: image: # registry: gcr.io From 1ee42c53d3e9d6f25a75d7150b58d3b0cc7e1af3 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Dec 2022 11:34:53 +0100 Subject: [PATCH 52/97] Bump wait-for-it image latest-20221223 This version supports arm64 and amd64 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 2 +- charts/spire/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 73168a9..9db9f6e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -138,7 +138,7 @@ Kubernetes: `>=1.21.0-0` | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"cgr.dev"` | | | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | -| waitForIt.image.version | string | `"latest-20221215"` | | +| waitForIt.image.version | string | `"latest-20221223"` | | | waitForIt.resources | object | `{}` | | | workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | workloadRegistrar.image.registry | string | `"gcr.io"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index edbdb2a..5a4d5ee 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -6,7 +6,7 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - version: latest-20221215 + version: latest-20221223 resources: {} workloadRegistrar: From fe38a52a95326c22bd645518f9eab2262988ac94 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 22 Dec 2022 11:28:05 +0100 Subject: [PATCH 53/97] Improve upstream CA Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 9 +++------ charts/spire/templates/server-configmap.yaml | 8 ++++---- charts/spire/templates/server-statefulset.yaml | 12 ++++++------ charts/spire/templates/upstream-ca-secret.yaml | 15 +++++++++++++++ charts/spire/values.yaml | 11 +++-------- 5 files changed, 31 insertions(+), 24 deletions(-) create mode 100644 charts/spire/templates/upstream-ca-secret.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 9db9f6e..162dd6a 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -99,19 +99,16 @@ Kubernetes: `>=1.21.0-0` | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | oidc.tolerations | list | `[]` | | -| server.caSecretStorage.enabled | bool | `false` | | -| server.caSecretStorage.path | string | `"/conf/server/"` | | -| server.caSecretStorage.secretName | string | `"csi-driver-spiffe-ca"` | | | server.config.ca_subject.common_name | string | `"example.org"` | | | server.config.ca_subject.country | string | `"NL"` | | | server.config.ca_subject.organization | string | `"Example"` | | | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | | server.config.logLevel | string | `"info"` | | | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | -| server.config.upstreamAuthority.disk.bundleFilePath | string | `""` | | -| server.config.upstreamAuthority.disk.certFilePath | string | `"/conf/server/tls.crt"` | | +| server.config.upstreamAuthority.disk.bundle | string | `""` | | +| server.config.upstreamAuthority.disk.certificate | string | `""` | | | server.config.upstreamAuthority.disk.enabled | bool | `false` | | -| server.config.upstreamAuthority.disk.keyFilePath | string | `"/conf/server/tls.key"` | | +| server.config.upstreamAuthority.disk.key | string | `""` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 5e2d12b..948dd4b 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -64,10 +64,10 @@ data: {{- if eq (.enabled | toString) "true" }} UpstreamAuthority "disk" { plugin_data { - cert_file_path = "{{ .certFilePath }}" - key_file_path = "{{ .keyFilePath }}" - {{- if ne .bundleFilePath "" }} - bundle_file_path = "{{ .bundleFilePath }}" + cert_file_path = "/run/spire/upstream_ca/tls.crt" + key_file_path = "/run/spire/upstream_ca/tls.key" + {{- if ne .bundle "" }} + bundle_file_path = "/run/spire/upstream_ca/bundle.crt" {{- end }} } } diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index a404408..fd1aac3 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -59,9 +59,9 @@ spec: mountPath: /run/spire/data readOnly: false {{ end }} - {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }} - - name: secret-data - mountPath: {{ .Values.server.caSecretStorage.path }} + {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca + mountPath: /run/spire/upstream_ca readOnly: false {{ end }} livenessProbe: @@ -127,10 +127,10 @@ spec: hostPath: path: /run/spire/server-sockets type: DirectoryOrCreate - {{- if eq (.Values.server.caSecretStorage.enabled | toString) "true" }} - - name: secret-data + {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca secret: - secretName: {{ .Values.server.caSecretStorage.secretName }} + secretName: {{ include "spire.fullname" . }}-upstream-ca {{- end }} volumeClaimTemplates: {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} diff --git a/charts/spire/templates/upstream-ca-secret.yaml b/charts/spire/templates/upstream-ca-secret.yaml new file mode 100644 index 0000000..1c354ce --- /dev/null +++ b/charts/spire/templates/upstream-ca-secret.yaml @@ -0,0 +1,15 @@ +{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true"}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "spire.fullname" . }}-upstream-ca + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire.server.labels" . | nindent 4 }} +data: + tls.crt: {{ .Values.server.config.upstreamAuthority.disk.certificate | toYaml | indent 2 }} + tls.key: {{ .Values.server.config.upstreamAuthority.disk.key | toYaml | indent 2 }} + {{- if ne .Values.server.config.upstreamAuthority.disk.bundle ""}} + bundle.crt: {{ .Values.server.config.upstreamAuthority.disk.bundle | toYaml | indent 2 }} + {{- end }} +{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 5a4d5ee..8f4615e 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -84,11 +84,6 @@ server: topologySpreadConstraints: [] - caSecretStorage: - enabled: false - path: /conf/server/ - secretName: "csi-driver-spiffe-ca" - config: logLevel: info socketPath: /run/spire/server-sockets/spire-server.sock @@ -102,9 +97,9 @@ server: upstreamAuthority: disk: enabled: false - certFilePath: /conf/server/tls.crt - keyFilePath: /conf/server/tls.key - bundleFilePath: "" + certificate: "" + key: "" + bundle: "" agent: image: From 786c6a5d8994beb8a1612a5d51b236f537a00bac Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 22 Dec 2022 14:16:21 +0100 Subject: [PATCH 54/97] Use with statement for readability Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spire/templates/upstream-ca-secret.yaml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/charts/spire/templates/upstream-ca-secret.yaml b/charts/spire/templates/upstream-ca-secret.yaml index 1c354ce..40319df 100644 --- a/charts/spire/templates/upstream-ca-secret.yaml +++ b/charts/spire/templates/upstream-ca-secret.yaml @@ -1,15 +1,18 @@ -{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true"}} +{{- $root := . }} +{{- with .Values.server.config.upstreamAuthority.disk }} +{{- if eq (.enabled | toString) "true" }} apiVersion: v1 kind: Secret metadata: - name: {{ include "spire.fullname" . }}-upstream-ca - namespace: {{ .Release.Namespace }} + name: {{ include "spire.fullname" $root }}-upstream-ca + namespace: {{ $root.Release.Namespace }} labels: - {{- include "spire.server.labels" . | nindent 4 }} + {{- include "spire.server.labels" $root | nindent 4 }} data: - tls.crt: {{ .Values.server.config.upstreamAuthority.disk.certificate | toYaml | indent 2 }} - tls.key: {{ .Values.server.config.upstreamAuthority.disk.key | toYaml | indent 2 }} - {{- if ne .Values.server.config.upstreamAuthority.disk.bundle ""}} - bundle.crt: {{ .Values.server.config.upstreamAuthority.disk.bundle | toYaml | indent 2 }} + tls.crt: {{ .certificate | toYaml | indent 2 }} + tls.key: {{ .key | toYaml | indent 2 }} + {{- if ne .bundle ""}} + bundle.crt: {{ .bundle | toYaml | indent 2 }} {{- end }} {{- end }} +{{- end }} From 93156bf904da09be280f4bf9a87788e9300d04ac Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 23 Dec 2022 12:37:20 +0100 Subject: [PATCH 55/97] Allow to use external created secret Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/templates/_helpers.tpl | 11 +++++++++++ charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/templates/server-statefulset.yaml | 4 ++-- charts/spire/templates/upstream-ca-secret.yaml | 12 +++++++----- charts/spire/values.yaml | 13 ++++++++++--- 6 files changed, 34 insertions(+), 14 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 162dd6a..c34b841 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -105,10 +105,10 @@ Kubernetes: `>=1.21.0-0` | server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | | server.config.logLevel | string | `"info"` | | | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | -| server.config.upstreamAuthority.disk.bundle | string | `""` | | -| server.config.upstreamAuthority.disk.certificate | string | `""` | | | server.config.upstreamAuthority.disk.enabled | bool | `false` | | -| server.config.upstreamAuthority.disk.key | string | `""` | | +| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys yourself. | +| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled will create a secret with following certificate info | +| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled will look for a secret with this name. | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index ee4073e..0fdd519 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -132,3 +132,14 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} + +{{- define "spire.server-upstream-ca-secret" -}} +{{- $root := . }} +{{- with .Values.server.config.upstreamAuthority.disk -}} +{{- if eq (.secret.create | toString) "true" -}} +{{ include "spire.fullname" $root }}-upstream-ca +{{- else -}} +{{ default (include "spire.fullname" $root) .secret.name }} +{{- end -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 948dd4b..0b9c175 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -66,7 +66,7 @@ data: plugin_data { cert_file_path = "/run/spire/upstream_ca/tls.crt" key_file_path = "/run/spire/upstream_ca/tls.key" - {{- if ne .bundle "" }} + {{- if ne .secret.data.bundle "" }} bundle_file_path = "/run/spire/upstream_ca/bundle.crt" {{- end }} } diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index fd1aac3..64ef573 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -63,7 +63,7 @@ spec: - name: upstream-ca mountPath: /run/spire/upstream_ca readOnly: false - {{ end }} + {{- end }} livenessProbe: httpGet: path: /live @@ -130,7 +130,7 @@ spec: {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca secret: - secretName: {{ include "spire.fullname" . }}-upstream-ca + secretName: {{ include "spire.server-upstream-ca-secret" . }} {{- end }} volumeClaimTemplates: {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} diff --git a/charts/spire/templates/upstream-ca-secret.yaml b/charts/spire/templates/upstream-ca-secret.yaml index 40319df..36a2c21 100644 --- a/charts/spire/templates/upstream-ca-secret.yaml +++ b/charts/spire/templates/upstream-ca-secret.yaml @@ -1,18 +1,20 @@ {{- $root := . }} {{- with .Values.server.config.upstreamAuthority.disk }} -{{- if eq (.enabled | toString) "true" }} +{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }} apiVersion: v1 kind: Secret metadata: - name: {{ include "spire.fullname" $root }}-upstream-ca + name: {{ include "spire.server-upstream-ca-secret" $root }} namespace: {{ $root.Release.Namespace }} labels: {{- include "spire.server.labels" $root | nindent 4 }} data: - tls.crt: {{ .certificate | toYaml | indent 2 }} - tls.key: {{ .key | toYaml | indent 2 }} + {{- with .secret.data }} + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} {{- if ne .bundle ""}} - bundle.crt: {{ .bundle | toYaml | indent 2 }} + bundle.crt: {{ .bundle | b64enc }} + {{- end }} {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 8f4615e..e70d26e 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -97,9 +97,16 @@ server: upstreamAuthority: disk: enabled: false - certificate: "" - key: "" - bundle: "" + secret: + # -- If disabled requires you to create a secret with the given keys yourself. + create: true + # -- If secret creation is disabled will look for a secret with this name. + name: "spiffe-upstream-ca" + # -- If secret creation is enabled will create a secret with following certificate info + data: + certificate: "" + key: "" + bundle: "" agent: image: From 3fe5f8f14571248f147fc1db800e3404f6ec1874 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 10 Jan 2023 10:08:05 +0100 Subject: [PATCH 56/97] Improve documentation on values Co-authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen --- charts/spire/README.md | 6 +++--- charts/spire/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index c34b841..82f5030 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -106,9 +106,9 @@ Kubernetes: `>=1.21.0-0` | server.config.logLevel | string | `"info"` | | | server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | | server.config.upstreamAuthority.disk.enabled | bool | `false` | | -| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys yourself. | -| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled will create a secret with following certificate info | -| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled will look for a secret with this name. | +| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | +| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | +| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e70d26e..9ec6372 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -98,11 +98,11 @@ server: disk: enabled: false secret: - # -- If disabled requires you to create a secret with the given keys yourself. + # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. create: true - # -- If secret creation is disabled will look for a secret with this name. + # -- If secret creation is disabled, the secret with this name will be used. name: "spiffe-upstream-ca" - # -- If secret creation is enabled will create a secret with following certificate info + # -- If secret creation is enabled, will create a secret with following certificate info data: certificate: "" key: "" From 35b8ad3c00420c79ac8e22f5bcbb9f8887c4d9fc Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 15 Dec 2022 13:43:09 +0100 Subject: [PATCH 57/97] Move the spiffe-csi-driver into a sub chart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 + charts/spire/README.md | 14 +-- .../charts/spiffe-csi-driver/.helmignore | 23 ++++ .../spire/charts/spiffe-csi-driver/Chart.yaml | 6 + .../spire/charts/spiffe-csi-driver/README.md | 35 ++++++ .../spiffe-csi-driver/templates/NOTES.txt | 1 + .../spiffe-csi-driver/templates/_helpers.tpl | 86 +++++++++++++ .../templates/daemonset.yaml | 116 ++++++++++++++++++ .../templates/serviceaccount.yaml | 13 ++ .../templates/spiffe-csi-driver.yaml | 0 .../charts/spiffe-csi-driver/values.yaml | 67 ++++++++++ charts/spire/templates/agent-daemonset.yaml | 79 ------------ charts/spire/values.yaml | 36 ------ 13 files changed, 355 insertions(+), 125 deletions(-) create mode 100644 charts/spire/charts/spiffe-csi-driver/.helmignore create mode 100644 charts/spire/charts/spiffe-csi-driver/Chart.yaml create mode 100644 charts/spire/charts/spiffe-csi-driver/README.md create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml create mode 100644 charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml rename charts/spire/{ => charts/spiffe-csi-driver}/templates/spiffe-csi-driver.yaml (100%) create mode 100644 charts/spire/charts/spiffe-csi-driver/values.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index dda28fa..7bbf39f 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -38,3 +38,7 @@ maintainers: email: marco.franssen@gmail.com url: https://marcofranssen.nl kubeVersion: ">=1.21.0-0" +dependencies: + - name: spiffe-csi-driver + repository: file://./charts/spiffe-csi-driver + version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index 82f5030..c6ab41e 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -44,6 +44,10 @@ spec: Kubernetes: `>=1.21.0-0` +| Repository | Name | Version | +|------------|------|---------| +| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | + ## Values | Key | Type | Default | Description | @@ -57,19 +61,9 @@ Kubernetes: `>=1.21.0-0` | agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | agent.resources | object | `{}` | | | agent.service.annotations | object | `{}` | | -| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | | -| csiDriver.image.registry | string | `"ghcr.io"` | | -| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | | -| csiDriver.image.version | string | `"0.2.1"` | | -| csiDriver.resources | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | -| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | -| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | -| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | -| nodeDriverRegistrar.resources | object | `{}` | | | oidc.affinity | object | `{}` | | | oidc.config.acme.cacheDir | string | `"/run/spire"` | | | oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | diff --git a/charts/spire/charts/spiffe-csi-driver/.helmignore b/charts/spire/charts/spiffe-csi-driver/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spiffe-csi-driver/Chart.yaml b/charts/spire/charts/spiffe-csi-driver/Chart.yaml new file mode 100644 index 0000000..be915ee --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spiffe-csi-driver +description: A Helm chart to install the SPIFFE CSI driver. +type: application +version: 0.1.0 +appVersion: "0.2.1" diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md new file mode 100644 index 0000000..d3514b5 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -0,0 +1,35 @@ +# spiffe-csi-driver + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square) + +A Helm chart to install the SPIFFE CSI driver. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spiffe-csi-driver"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| nameOverride | string | `""` | | +| namespaceOverride | string | `""` | | +| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | | +| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | | +| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | | +| nodeDriverRegistrar.resources | object | `{}` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext.privileged | bool | `true` | | +| securityContext.readOnlyRootFilesystem | bool | `true` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt new file mode 100644 index 0000000..3d27b51 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/NOTES.txt @@ -0,0 +1 @@ +SPIFFE CSI Driver installed… diff --git a/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl new file mode 100644 index 0000000..7154e44 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/_helpers.tpl @@ -0,0 +1,86 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spiffe-csi-driver.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spiffe-csi-driver.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts +*/}} +{{- define "spiffe-csi-driver.namespace" -}} + {{- if .Values.namespaceOverride -}} + {{- .Values.namespaceOverride -}} + {{- else -}} + {{- .Release.Namespace -}} + {{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spiffe-csi-driver.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spiffe-csi-driver.labels" -}} +helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }} +{{ include "spiffe-csi-driver.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spiffe-csi-driver.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spiffe-csi-driver.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + + +{{- define "spiffe-csi-driver.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml new file mode 100644 index 0000000..09b7a9a --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -0,0 +1,116 @@ +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }} + updateStrategy: + type: RollingUpdate + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + # This is the container which runs the SPIFFE CSI driver. + - name: {{ .Chart.Name }} + image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: [ + "-workload-api-socket-dir", "/spire-agent-socket", + "-csi-socket-path", "/spiffe-csi/csi.sock", + ] + env: + # The CSI driver needs a unique node ID. The node name can be + # used for this purpose. + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + # The volume containing the SPIRE agent socket. The SPIFFE CSI + # driver will mount this directory into containers. + - mountPath: /spire-agent-socket + name: spire-agent-socket-dir + readOnly: true + # The volume that will contain the CSI driver socket shared + # with the kubelet and the driver registrar. + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The volume containing mount points for containers. + - mountPath: /var/lib/kubelet/pods + mountPropagation: Bidirectional + name: mountpoint-dir + securityContext: + privileged: true + resources: + {{- toYaml .Values.resources | nindent 12 }} + # This container runs the CSI Node Driver Registrar which takes care + # of all the little details required to register a CSI driver with + # the kubelet. + - name: node-driver-registrar + image: {{ template "spire.image" .Values.nodeDriverRegistrar }} + imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} + args: [ + "-csi-address", "/spiffe-csi/csi.sock", + "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + "-health-port", "9809" + ] + volumeMounts: + # The registrar needs access to the SPIFFE CSI driver socket + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The registrar needs access to the Kubelet plugin registration + # directory + - name: kubelet-plugin-registration-dir + mountPath: /registration + ports: + - containerPort: 9809 + name: healthz + livenessProbe: + httpGet: + path: /healthz + port: healthz + initialDelaySeconds: 5 + timeoutSeconds: 5 + resources: + {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} + volumes: + - name: spire-agent-sockets + hostPath: + path: {{ dir .Values.agentSocketPath }} + type: DirectoryOrCreate + - name: spire-agent-socket-dir + hostPath: + path: {{ dir .Values.agentSocketPath }} + type: DirectoryOrCreate + # This volume is where the socket for kubelet->driver communication lives + - name: spiffe-csi-socket-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.spiffe.io + type: DirectoryOrCreate + # This volume is where the SPIFFE CSI driver mounts volumes + - name: mountpoint-dir + hostPath: + path: /var/lib/kubelet/pods + type: Directory + # This volume is where the node-driver-registrar registers the plugin + # with kubelet + - name: kubelet-plugin-registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry + type: Directory diff --git a/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml new file mode 100644 index 0000000..2577265 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spiffe-csi-driver.serviceAccountName" . }} + namespace: {{ include "spiffe-csi-driver.namespace" . }} + labels: + {{- include "spiffe-csi-driver.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml similarity index 100% rename from charts/spire/templates/spiffe-csi-driver.yaml rename to charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml new file mode 100644 index 0000000..bf3760b --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -0,0 +1,67 @@ +image: + registry: ghcr.io + repository: spiffe/spiffe-csi-driver + pullPolicy: IfNotPresent + version: "" +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +imagePullSecrets: [] +nameOverride: "" +namespaceOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: + readOnlyRootFilesystem: true + privileged: true + # runAsNonRoot: true + # runAsUser: 1000 + # capabilities: + # drop: + # - ALL + +nodeSelector: + kubernetes.io/arch: amd64 + +nodeDriverRegistrar: + image: + registry: registry.k8s.io + repository: sig-storage/csi-node-driver-registrar + pullPolicy: IfNotPresent + version: v2.6.2 + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +agentSocketPath: /run/spire/agent-sockets/spire-agent.sock diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index 8e8e6bf..176e910 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -69,69 +69,6 @@ spec: periodSeconds: 60 resources: {{- toYaml .Values.agent.resources | nindent 12 }} - # This is the container which runs the SPIFFE CSI driver. - - name: spiffe-csi-driver - image: {{ template "spire.image" .Values.csiDriver }} - imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }} - args: [ - "-workload-api-socket-dir", "/spire-agent-socket", - "-csi-socket-path", "/spiffe-csi/csi.sock", - ] - env: - # The CSI driver needs a unique node ID. The node name can be - # used for this purpose. - - name: MY_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - volumeMounts: - # The volume containing the SPIRE agent socket. The SPIFFE CSI - # driver will mount this directory into containers. - - mountPath: /spire-agent-socket - name: spire-agent-socket-dir - readOnly: true - # The volume that will contain the CSI driver socket shared - # with the kubelet and the driver registrar. - - mountPath: /spiffe-csi - name: spiffe-csi-socket-dir - # The volume containing mount points for containers. - - mountPath: /var/lib/kubelet/pods - mountPropagation: Bidirectional - name: mountpoint-dir - securityContext: - privileged: true - resources: - {{- toYaml .Values.csiDriver.resources | nindent 12 }} - # This container runs the CSI Node Driver Registrar which takes care - # of all the little details required to register a CSI driver with - # the kubelet. - - name: node-driver-registrar - image: {{ template "spire.image" .Values.nodeDriverRegistrar }} - imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} - args: [ - "-csi-address", "/spiffe-csi/csi.sock", - "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", - "-health-port", "9809" - ] - volumeMounts: - # The registrar needs access to the SPIFFE CSI driver socket - - mountPath: /spiffe-csi - name: spiffe-csi-socket-dir - # The registrar needs access to the Kubelet plugin registration - # directory - - name: kubelet-plugin-registration-dir - mountPath: /registration - ports: - - containerPort: 9809 - name: healthz - livenessProbe: - httpGet: - path: /healthz - port: healthz - initialDelaySeconds: 5 - timeoutSeconds: 5 - resources: - {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} volumes: - name: spire-config configMap: @@ -154,19 +91,3 @@ spec: hostPath: path: {{ dir .Values.agent.config.socketPath }} type: DirectoryOrCreate - # This volume is where the socket for kubelet->driver communication lives - - name: spiffe-csi-socket-dir - hostPath: - path: /var/lib/kubelet/plugins/csi.spiffe.io - type: DirectoryOrCreate - # This volume is where the SPIFFE CSI driver mounts volumes - - name: mountpoint-dir - hostPath: - path: /var/lib/kubelet/pods - type: Directory - # This volume is where the node-driver-registrar registers the plugin - # with kubelet - - name: kubelet-plugin-registration-dir - hostPath: - path: /var/lib/kubelet/plugins_registry - type: Directory diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 9ec6372..a24af64 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -140,42 +140,6 @@ agent: logLevel: info socketPath: /run/spire/agent-sockets/spire-agent.sock -csiDriver: - image: - registry: ghcr.io - repository: spiffe/spiffe-csi-driver - pullPolicy: IfNotPresent - version: 0.2.1 - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - -nodeDriverRegistrar: - image: - registry: registry.k8s.io - repository: sig-storage/csi-node-driver-registrar - pullPolicy: IfNotPresent - version: v2.6.2 - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - oidc: enabled: false replicaCount: 1 From 99da500c1c770086347c32ac9816e9d53825eeb1 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 16 Dec 2022 11:00:29 +0100 Subject: [PATCH 58/97] Move oidc-discovery-provider to sub chart Signed-off-by: Marco Franssen Co-authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 + charts/spire/README.md | 31 +---- .../.helmignore | 23 ++++ .../spiffe-oidc-discovery-provider/Chart.yaml | 6 + .../spiffe-oidc-discovery-provider/README.md | 53 ++++++++ .../templates/NOTES.txt | 1 + .../templates/_helpers.tpl | 74 ++++++++++++ .../templates/configmap.yaml | 56 +++++++++ .../templates/deployment.yaml} | 51 ++++---- .../templates/hpa.yaml | 28 +++++ .../templates/service.yaml | 25 ++++ .../templates/serviceaccount.yaml | 12 ++ .../templates/tests/test-connection.yaml | 15 +++ .../values.yaml | 113 ++++++++++++++++++ charts/spire/templates/oidc-dp-configmap.yaml | 58 --------- charts/spire/templates/oidc-service.yaml | 25 ---- charts/spire/templates/server-configmap.yaml | 2 +- charts/spire/values.yaml | 87 +------------- 18 files changed, 438 insertions(+), 226 deletions(-) create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/README.md create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml rename charts/spire/{templates/oidc-deployment.yaml => charts/spiffe-oidc-discovery-provider/templates/deployment.yaml} (62%) create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml delete mode 100644 charts/spire/templates/oidc-dp-configmap.yaml delete mode 100644 charts/spire/templates/oidc-service.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 7bbf39f..6e036f3 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -42,3 +42,7 @@ dependencies: - name: spiffe-csi-driver repository: file://./charts/spiffe-csi-driver version: 0.1.0 + - name: spiffe-oidc-discovery-provider + condition: spiffe-oidc-discovery-provider.enabled + repository: file://./charts/spiffe-oidc-discovery-provider + version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index c6ab41e..48aab39 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -47,6 +47,7 @@ Kubernetes: `>=1.21.0-0` | Repository | Name | Version | |------------|------|---------| | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | +| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | ## Values @@ -64,35 +65,6 @@ Kubernetes: `>=1.21.0-0` | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | -| oidc.affinity | object | `{}` | | -| oidc.config.acme.cacheDir | string | `"/run/spire"` | | -| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | -| oidc.config.acme.emailAddress | string | `"letsencrypt@example.org"` | | -| oidc.config.acme.tosAccepted | bool | `false` | | -| oidc.config.domains[0] | string | `"localhost"` | | -| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` | | -| oidc.config.logLevel | string | `"info"` | | -| oidc.enabled | bool | `false` | | -| oidc.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.image.registry | string | `"ghcr.io"` | | -| oidc.image.repository | string | `"spiffe/oidc-discovery-provider"` | | -| oidc.image.version | string | `""` | | -| oidc.insecureScheme.enabled | bool | `false` | | -| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | -| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | | -| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | | -| oidc.insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | -| oidc.insecureScheme.nginx.resources | object | `{}` | | -| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | -| oidc.podAnnotations | object | `{}` | | -| oidc.podSecurityContext | object | `{}` | | -| oidc.replicaCount | int | `1` | | -| oidc.resources | object | `{}` | | -| oidc.securityContext | object | `{}` | | -| oidc.service.annotations | object | `{}` | | -| oidc.service.port | int | `80` | | -| oidc.service.type | string | `"NodePort"` | | -| oidc.tolerations | list | `[]` | | | server.config.ca_subject.common_name | string | `"example.org"` | | | server.config.ca_subject.country | string | `"NL"` | | | server.config.ca_subject.organization | string | `"Example"` | | @@ -124,6 +96,7 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | +| spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore b/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml new file mode 100644 index 0000000..431af1e --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spiffe-oidc-discovery-provider +description: A Helm chart to install the SPIFFE OIDC discovery provider. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md new file mode 100644 index 0000000..39403ea --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -0,0 +1,53 @@ +# spiffe-oidc-discovery-provider + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) + +A Helm chart to install the SPIFFE OIDC discovery provider. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `5` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| autoscaling.targetMemoryUtilizationPercentage | int | `80` | | +| config.acme.cacheDir | string | `"/run/spire"` | | +| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| config.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| config.acme.tosAccepted | bool | `false` | | +| config.domains[0] | string | `"localhost"` | | +| config.domains[1] | string | `"oidc-discovery.example.org"` | | +| config.logLevel | string | `"info"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/oidc-discovery-provider"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| insecureScheme.enabled | bool | `false` | | +| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | | +| insecureScheme.nginx.image.registry | string | `"docker.io"` | | +| insecureScheme.nginx.image.repository | string | `"nginx"` | | +| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | | +| insecureScheme.nginx.resources | object | `{}` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.annotations | object | `{}` | | +| service.port | int | `80` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| tolerations | list | `[]` | | +| trustDomain | string | `"example.org"` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt new file mode 100644 index 0000000..12c5222 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/NOTES.txt @@ -0,0 +1 @@ +SPIFFE OIDC discovery provider installed… diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl new file mode 100644 index 0000000..aea5274 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spiffe-oidc-discovery-provider.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spiffe-oidc-discovery-provider.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spiffe-oidc-discovery-provider.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spiffe-oidc-discovery-provider.labels" -}} +helm.sh/chart: {{ include "spiffe-oidc-discovery-provider.chart" . }} +{{ include "spiffe-oidc-discovery-provider.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spiffe-oidc-discovery-provider.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spiffe-oidc-discovery-provider.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spiffe-oidc-discovery-provider.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spiffe-oidc-discovery-provider.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spiffe-oidc-discovery-provider.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml new file mode 100644 index 0000000..13ccb04 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -0,0 +1,56 @@ +{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + oidc-discovery-provider.conf: | + log_level = "{{ .Values.config.logLevel }}" + + domains = [ + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.svc.cluster.local", + {{- if gt (len .Values.config.domains) 0 }} + "{{- join "\",\n \"" .Values.config.domains }}" + {{- end }} + ] + + {{- if .Values.insecureScheme.enabled }} + allow_insecure_scheme = {{ .Values.insecureScheme.enabled }} + listen_socket_path = {{ $oidcSocket | quote }} + {{- else }} + acme { + directory_url = "{{ .Values.config.acme.directoryUrl }}" + cache_dir = "{{ .Values.config.acme.cacheDir }}" + tos_accepted = {{ .Values.config.acme.tosAccepted }} + email = "{{ .Values.config.acme.emailAddress }}" + } + {{- end }} + + workload_api { + socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agentSocketPath | last }}" + trust_domain = "{{ .Values.trustDomain }}" + } + + health_checks { + bind_port = "8008" + ready_path = "/ready" + live_path = "/live" + } + {{- if .Values.insecureScheme.enabled }} + default.conf.template: | + upstream oidc { + server unix:{{ $oidcSocket }}; + } + + server { + listen 80; + listen [::]:80; + + location / { + proxy_pass http://oidc; + proxy_set_header Host $host; + } + } + {{- end }} diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml similarity index 62% rename from charts/spire/templates/oidc-deployment.yaml rename to charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index 02838a3..a9a78ae 100644 --- a/charts/spire/templates/oidc-deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -1,47 +1,45 @@ -{{- if eq (.Values.oidc.enabled | toString) "true" }} -{{- $fullname := include "spire.fullname" . }} apiVersion: apps/v1 kind: Deployment metadata: - name: {{ printf "%s-oidc" $fullname }} + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} labels: - {{- include "spire.oidc.labels" . | nindent 4 }} + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} spec: - replicas: {{ .Values.oidc.replicaCount }} + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} selector: matchLabels: - {{- include "spire.oidc.selectorLabels" . | nindent 6 }} + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.oidc.podAnnotations }} + {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- include "spire.oidc.selectorLabels" . | nindent 8 }} + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: - {{- range . }} - - name: {{ printf "%s-%s" $fullname .name }} - {{- end }} + {{- toYaml . | nindent 8 }} {{- end }} - serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} securityContext: - {{- toYaml .Values.oidc.podSecurityContext | nindent 8 }} + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - - name: spire-oidc + - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }} - imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} + image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config - /run/spire/oidc/config/oidc-discovery-provider.conf ports: - containerPort: 8008 name: health - {{- if not .Values.oidc.insecureScheme.enabled }} + {{- if not .Values.insecureScheme.enabled }} - containerPort: 443 name: https {{- end }} @@ -68,13 +66,13 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.oidc.resources | nindent 12 }} - {{- if .Values.oidc.insecureScheme.enabled }} + {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.insecureScheme.enabled }} - name: nginx securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }} - imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }} + image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }} + imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }} ports: - containerPort: 80 name: http @@ -87,7 +85,7 @@ spec: subPath: default.conf.template readOnly: true resources: - {{- toYaml .Values.oidc.insecureScheme.nginx.resources | nindent 12 }} + {{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }} {{- end }} volumes: - name: spiffe-workload-api @@ -100,17 +98,16 @@ spec: type: DirectoryOrCreate - name: spire-oidc-config configMap: - name: {{ include "spire.fullname" . }}-oidc-discovery-provider - {{- with .Values.oidc.nodeSelector }} + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.oidc.affinity }} + {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.oidc.tolerations }} + {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} -{{ end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml new file mode 100644 index 0000000..937d80c --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml new file mode 100644 index 0000000..3d1bd9e --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/service.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + ports: + {{- if .Values.insecureScheme.enabled }} + - name: http + port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + {{- else }} + - name: https + port: 443 + targetPort: https + protocol: TCP + {{- end }} + selector: + {{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml new file mode 100644 index 0000000..31cdf7b --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml new file mode 100644 index 0000000..b9a8c5f --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection" + labels: + {{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml new file mode 100644 index 0000000..768214a --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -0,0 +1,113 @@ +# Default values for spiffe-oidc-discovery-provider. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + # registry: gcr.io + # repository: spiffe-io/oidc-discovery-provider + registry: ghcr.io + repository: spiffe/oidc-discovery-provider + pullPolicy: IfNotPresent + version: "" + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +service: + type: ClusterIP + port: 80 + annotations: {} + # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +podAnnotations: {} + +insecureScheme: + enabled: false + + nginx: + image: + registry: docker.io + repository: nginx + pullPolicy: IfNotPresent + version: 1.23.2-alpine + # chainguard image does not support the templates feature + # https://github.com/chainguard-images/nginx/issues/43 + # registry: cgr.dev + # repository: chainguard/nginx + # pullPolicy: IfNotPresent + # version: "1.23.2" + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 32Mi + # limits: + # cpu: 100m + # memory: 64Mi + +config: + logLevel: info + domains: + - localhost + - oidc-discovery.example.org + + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory + emailAddress: letsencrypt@example.org + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +agentSocketPath: /run/spire/agent-sockets/spire-agent.sock +trustDomain: "example.org" diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml deleted file mode 100644 index 4e55a45..0000000 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ /dev/null @@ -1,58 +0,0 @@ -{{- if eq (.Values.oidc.enabled | toString) "true" }} -{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "spire.fullname" . }}-oidc-discovery-provider - namespace: {{ .Release.Namespace }} -data: - oidc-discovery-provider.conf: | - log_level = "{{ .Values.oidc.config.logLevel }}" - - domains = [ - "spire-oidc.{{ .Release.Namespace }}", - "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local", - {{- if gt (len .Values.oidc.config.domains) 0 }} - "{{- join "\",\n \"" .Values.oidc.config.domains }}" - {{- end }} - ] - - {{- if .Values.oidc.insecureScheme.enabled }} - allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }} - listen_socket_path = {{ $oidcSocket | quote }} - {{- else }} - acme { - directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}" - cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}" - tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }} - email = "{{ .Values.oidc.config.acme.emailAddress }}" - } - {{- end }} - - workload_api { - socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agent.config.socketPath | last }}" - trust_domain = "{{ .Values.spire.trustDomain }}" - } - - health_checks { - bind_port = "8008" - ready_path = "/ready" - live_path = "/live" - } - {{- if .Values.oidc.insecureScheme.enabled }} - default.conf.template: | - upstream oidc { - server unix:{{ $oidcSocket }}; - } - - server { - listen 80; - listen [::]:80; - - location / { - proxy_pass http://oidc; - proxy_set_header Host $host; - } - } - {{- end }} -{{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml deleted file mode 100644 index b1cb3cc..0000000 --- a/charts/spire/templates/oidc-service.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if eq (.Values.oidc.enabled | toString) "true" }} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire.fullname" . }}-oidc - namespace: {{ .Release.Namespace }} - {{- with .Values.oidc.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} -spec: - type: {{ .Values.oidc.service.type }} - ports: - {{- if .Values.oidc.insecureScheme.enabled }} - - name: http - port: {{ .Values.oidc.service.port }} - targetPort: http - {{- else }} - - name: https - port: 443 - targetPort: https - {{- end }} - selector: - {{- include "spire.oidc.selectorLabels" . | nindent 4 }} -{{ end }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index 0b9c175..f505289 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -15,7 +15,7 @@ data: # AWS requires the use of RSA. EC cryptography is not supported ca_key_type = "rsa-2048" - {{- if eq (.Values.oidc.enabled | toString) "true" }} + {{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }} jwt_issuer = "{{ .Values.server.config.jwtIssuer }}" {{ end }} default_x509_svid_ttl = "1h" diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index a24af64..652eaac 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -140,93 +140,8 @@ agent: logLevel: info socketPath: /run/spire/agent-sockets/spire-agent.sock -oidc: +spiffe-oidc-discovery-provider: enabled: false - replicaCount: 1 - - image: - # registry: gcr.io - # repository: spiffe-io/oidc-discovery-provider - registry: ghcr.io - repository: spiffe/oidc-discovery-provider - pullPolicy: IfNotPresent - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - - service: - type: NodePort - port: 80 - annotations: {} - # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - tolerations: [] - - affinity: {} - podAnnotations: {} - - insecureScheme: - enabled: false - - nginx: - image: - registry: docker.io - repository: nginx - pullPolicy: IfNotPresent - version: 1.23.2-alpine - # chainguard image does not support the templates feature - # https://github.com/chainguard-images/nginx/issues/43 - # registry: cgr.dev - # repository: chainguard/nginx - # pullPolicy: IfNotPresent - # version: "1.23.2" - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - - config: - logLevel: info - domains: - - localhost - - oidc-discovery.example.org - - acme: - tosAccepted: false - cacheDir: /run/spire - directoryUrl: https://acme-v02.api.letsencrypt.org/directory - emailAddress: letsencrypt@example.org imagePullSecrets: [] # - name: my-docker-registry From ab2636ae98828ccc0eff7c7743e99ae4269f3c2c Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 16 Dec 2022 16:15:57 +0100 Subject: [PATCH 59/97] Move k8s-workload-registrar to sub chart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 + charts/spire/README.md | 8 +- .../charts/k8s-workload-registrar/.helmignore | 23 ++++++ .../charts/k8s-workload-registrar/Chart.yaml | 6 ++ .../templates/NOTES.txt | 1 + .../templates/_helpers.tpl | 74 +++++++++++++++++ .../templates/configmap.yaml | 14 ++++ .../templates/deployment.yaml | 77 ++++++++++++++++++ .../k8s-workload-registrar/templates/hpa.yaml | 28 +++++++ .../templates/roles.yaml | 73 +++++++++++++++++ .../templates/serviceaccount.yaml | 12 +++ .../charts/k8s-workload-registrar/values.yaml | 80 +++++++++++++++++++ .../spire/charts/spiffe-csi-driver/README.md | 5 +- .../spiffe-oidc-discovery-provider/README.md | 5 +- .../spire/templates/server-cluster-role.yaml | 34 -------- charts/spire/templates/server-role.yaml | 43 ---------- charts/spire/templates/server-roles.yaml | 68 ++++++++++++++++ .../spire/templates/server-statefulset.yaml | 23 ------ .../workload-registrar-configmap.yaml | 14 ---- .../templates/workload-registrar-service.yaml | 20 ----- charts/spire/values.yaml | 24 +----- 21 files changed, 470 insertions(+), 166 deletions(-) create mode 100644 charts/spire/charts/k8s-workload-registrar/.helmignore create mode 100644 charts/spire/charts/k8s-workload-registrar/Chart.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/roles.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml create mode 100644 charts/spire/charts/k8s-workload-registrar/values.yaml delete mode 100644 charts/spire/templates/server-cluster-role.yaml delete mode 100644 charts/spire/templates/server-role.yaml create mode 100644 charts/spire/templates/server-roles.yaml delete mode 100644 charts/spire/templates/workload-registrar-configmap.yaml delete mode 100644 charts/spire/templates/workload-registrar-service.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 6e036f3..c391ed7 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -46,3 +46,7 @@ dependencies: condition: spiffe-oidc-discovery-provider.enabled repository: file://./charts/spiffe-oidc-discovery-provider version: 0.1.0 + - name: k8s-workload-registrar + condition: k8s-workload-registrar.enabled + repository: file://./charts/k8s-workload-registrar + version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index 48aab39..b54bace 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -46,6 +46,7 @@ Kubernetes: `>=1.21.0-0` | Repository | Name | Version | |------------|------|---------| +| file://./charts/k8s-workload-registrar | k8s-workload-registrar | 0.1.0 | | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | @@ -64,6 +65,7 @@ Kubernetes: `>=1.21.0-0` | agent.service.annotations | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | +| k8s-workload-registrar.enabled | bool | `true` | | | nameOverride | string | `""` | | | server.config.ca_subject.common_name | string | `"example.org"` | | | server.config.ca_subject.country | string | `"NL"` | | @@ -104,12 +106,6 @@ Kubernetes: `>=1.21.0-0` | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | | waitForIt.image.version | string | `"latest-20221223"` | | | waitForIt.resources | object | `{}` | | -| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| workloadRegistrar.image.registry | string | `"gcr.io"` | | -| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | -| workloadRegistrar.image.version | string | `""` | | -| workloadRegistrar.resources | object | `{}` | | -| workloadRegistrar.service.annotations | object | `{}` | | ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/k8s-workload-registrar/.helmignore b/charts/spire/charts/k8s-workload-registrar/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/k8s-workload-registrar/Chart.yaml b/charts/spire/charts/k8s-workload-registrar/Chart.yaml new file mode 100644 index 0000000..d417224 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: k8s-workload-registrar +description: A Helm chart to install the SPIRE k8s workload registrator. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt b/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt new file mode 100644 index 0000000..2bdde8f --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ include "k8s-workload-registrar.fullname" . }}… diff --git a/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl b/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl new file mode 100644 index 0000000..4d2b19a --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "k8s-workload-registrar.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "k8s-workload-registrar.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "k8s-workload-registrar.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "k8s-workload-registrar.labels" -}} +helm.sh/chart: {{ include "k8s-workload-registrar.chart" . }} +{{ include "k8s-workload-registrar.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "k8s-workload-registrar.selectorLabels" -}} +app.kubernetes.io/name: {{ include "k8s-workload-registrar.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "k8s-workload-registrar.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "k8s-workload-registrar.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "k8s-workload-registrar.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml b/charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml new file mode 100644 index 0000000..0693990 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + workload-registrar.conf: | + log_level = "{{ .Values.logLevel }}" + mode = "reconcile" + trust_domain = {{ .Values.trustDomain | quote }} + cluster = {{ .Values.clusterName | quote }} + server_address = "unix://{{ .Values.server.socketPath }}" + leader_election = true + metrics_addr = "0.0.0.0:18080" diff --git a/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml b/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml new file mode 100644 index 0000000..8ae39e2 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml @@ -0,0 +1,77 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} + labels: + {{- include "k8s-workload-registrar.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "k8s-workload-registrar.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "k8s-workload-registrar.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "k8s-workload-registrar.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + initContainers: + - name: init + # This is a small image with wait-for-it, choose whatever image + # you prefer that waits for a service to be up. This image is built + # from https://github.com/vishnubob/wait-for-it + image: {{ template "k8s-workload-registrar.image" .Values.waitForIt }} + imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} + args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}] + resources: + {{- toYaml .Values.waitForIt.resources | nindent 12 }} + containers: + - name: {{ .Chart.Name }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: {{ template "k8s-workload-registrar.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - -config + - /run/spire/k8s-workload-registrar/config/workload-registrar.conf + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: true + - name: k8s-workload-registrar-config + mountPath: /run/spire/k8s-workload-registrar/config + readOnly: true + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + - name: k8s-workload-registrar-config + configMap: + name: {{ include "k8s-workload-registrar.fullname" . }} + - name: spire-server-socket + hostPath: + path: /run/spire/server-sockets + type: DirectoryOrCreate diff --git a/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml b/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml new file mode 100644 index 0000000..1936616 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} + labels: + {{- include "k8s-workload-registrar.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "k8s-workload-registrar.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml b/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml new file mode 100644 index 0000000..0539854 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml @@ -0,0 +1,73 @@ +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: [coordination.k8s.io] + resources: [leases] + verbs: [create] + - apiGroups: [coordination.k8s.io] + resources: [leases] + resourceNames: [spire-k8s-registrar-leader-election] + verbs: + - get + - update + # - apiGroups: [""] + # resources: [configmaps] + # verbs: [create] + # - apiGroups: [""] + # resources: [configmaps] + # resourceNames: [k8s-workload-registrar-leader-election] + # verbs: + # - get + # - update + - apiGroups: [""] + resources: [events] + verbs: [create] +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "k8s-workload-registrar.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "k8s-workload-registrar.fullname" . }} + apiGroup: rbac.authorization.k8s.io +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} +rules: + - apiGroups: [""] + resources: [pods, nodes, endpoints] + verbs: + - get + - list + - watch + - apiGroups: [coordination.k8s.io] + resources: [leases] + verbs: + - create + - get + - list + - update +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "k8s-workload-registrar.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire.fullname" . }} + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml b/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml new file mode 100644 index 0000000..2198b39 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "k8s-workload-registrar.serviceAccountName" . }} + labels: + {{- include "k8s-workload-registrar.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/values.yaml b/charts/spire/charts/k8s-workload-registrar/values.yaml new file mode 100644 index 0000000..7acb677 --- /dev/null +++ b/charts/spire/charts/k8s-workload-registrar/values.yaml @@ -0,0 +1,80 @@ +# Default values for k8s-workload-registrar. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + registry: gcr.io + repository: spiffe-io/k8s-workload-registrar + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +server: + socketPath: /run/spire/server-sockets/spire-server.sock + host: spire-server + port: 8081 +clusterName: "example-cluster" +trustDomain: "example.org" +logLevel: info + +waitForIt: + image: + registry: cgr.dev + repository: chainguard/wait-for-it + pullPolicy: IfNotPresent + version: latest-20221215 + resources: {} diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index d3514b5..9038f62 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -1,7 +1,5 @@ # spiffe-csi-driver - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square) A Helm chart to install the SPIFFE CSI driver. @@ -33,3 +31,6 @@ A Helm chart to install the SPIFFE CSI driver. | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 39403ea..b55240b 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -1,7 +1,5 @@ # spiffe-oidc-discovery-provider - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. @@ -51,3 +49,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | serviceAccount.name | string | `""` | | | tolerations | list | `[]` | | | trustDomain | string | `"example.org"` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/templates/server-cluster-role.yaml b/charts/spire/templates/server-cluster-role.yaml deleted file mode 100644 index db5793c..0000000 --- a/charts/spire/templates/server-cluster-role.yaml +++ /dev/null @@ -1,34 +0,0 @@ -# ClusterRole to allow spire-server node attestor to query Token Review API -# and to be able to push certificate bundles to a configmap -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire.fullname" . }}-server-cluster-role -rules: - # allow TokenReview requests (to verify service account tokens for PSAT - # attestation) - - apiGroups: ["authentication.k8s.io"] - resources: ["tokenreviews"] - verbs: ["get", "create"] - - apiGroups: [""] - resources: ["pods", "nodes"] - verbs: ["get", "list", "watch"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["create", "update", "delete", "get", "list", "watch"] - ---- -# Binds above cluster role to spire-server service account -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire.fullname" . }}-server-cluster-role-binding - namespace: {{ .Release.Namespace }} -subjects: - - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ include "spire.fullname" . }}-server-cluster-role - apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/server-role.yaml b/charts/spire/templates/server-role.yaml deleted file mode 100644 index 7b3c8d6..0000000 --- a/charts/spire/templates/server-role.yaml +++ /dev/null @@ -1,43 +0,0 @@ -# ClusterRole to allow spire-server node attestor to query Token Review API -# and to be able to push certificate bundles to a configmap -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire.fullname" . }}-server-role - namespace: {{ .Release.Namespace }} -rules: - # allow "get" access to pods (to resolve selectors for PSAT attestation) - - apiGroups: [""] - resources: ["pods"] - verbs: ["get"] - # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE - # agent bootstrapping, see the spire-bundle ConfigMap below) - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["{{ include "spire.fullname" . }}-bundle"] - verbs: ["get", "patch"] - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["create"] - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["spire-k8s-registrar-leader-election"] - verbs: ["update", "get"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create"] - ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "spire.fullname" . }}-server-role-binding - namespace: {{ .Release.Namespace }} -subjects: - - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ include "spire.fullname" . }}-server-role - apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/server-roles.yaml b/charts/spire/templates/server-roles.yaml new file mode 100644 index 0000000..0a74adb --- /dev/null +++ b/charts/spire/templates/server-roles.yaml @@ -0,0 +1,68 @@ +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server + namespace: {{ .Release.Namespace }} +rules: + # allow "get" access to pods (to resolve selectors for PSAT attestation) + - apiGroups: [""] + resources: [pods] + verbs: [get] + # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE + # agent bootstrapping, see the spire-bundle ConfigMap below) + - apiGroups: [""] + resources: [configmaps] + resourceNames: ["{{ include "spire.fullname" . }}-bundle"] + verbs: + - get + - patch +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.serviceAccountName" . }}-server + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "spire.fullname" . }}-server + apiGroup: rbac.authorization.k8s.io +--- +# ClusterRole to allow spire-server node attestor to query Token Review API +# and to be able to push certificate bundles to a configmap +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server +rules: + # allow TokenReview requests (to verify service account tokens for PSAT + # attestation) + - apiGroups: [authentication.k8s.io] + resources: [tokenreviews] + verbs: + - get + - create + - apiGroups: [""] + resources: [nodes] + verbs: + - get +--- +# Binds above cluster role to spire-server service account +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire.fullname" . }}-server + namespace: {{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire.serviceAccountName" . }}-server + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "spire.fullname" . }}-server + apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index 64ef573..8ad50d0 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -80,26 +80,6 @@ spec: periodSeconds: 5 resources: {{- toYaml .Values.server.resources | nindent 12 }} - - name: {{ .Chart.Name }}-workload-registrar - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }} - imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }} - args: - - -config - - /run/spire/k8s-workload-registrar/config/workload-registrar.conf - ports: - - containerPort: 8443 - name: registrar-port - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: true - - name: spire-workload-registrar-config - mountPath: /run/spire/k8s-workload-registrar/config - readOnly: true - resources: - {{- toYaml .Values.workloadRegistrar.resources | nindent 12 }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -117,9 +97,6 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} volumes: - - name: spire-workload-registrar-config - configMap: - name: {{ include "spire.fullname" . }}-workload-registrar - name: spire-config configMap: name: {{ include "spire.fullname" . }}-server diff --git a/charts/spire/templates/workload-registrar-configmap.yaml b/charts/spire/templates/workload-registrar-configmap.yaml deleted file mode 100644 index 72f0ed5..0000000 --- a/charts/spire/templates/workload-registrar-configmap.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "spire.fullname" . }}-workload-registrar - namespace: {{ .Release.Namespace }} -data: - workload-registrar.conf: | - log_level = "debug" - mode = "reconcile" - trust_domain = {{ .Values.spire.trustDomain | quote }} - cluster = {{ .Values.spire.clusterName | quote }} - server_address = "unix://{{ .Values.server.config.socketPath }}" - leader_election = true - metrics_addr = "0.0.0.0:18080" diff --git a/charts/spire/templates/workload-registrar-service.yaml b/charts/spire/templates/workload-registrar-service.yaml deleted file mode 100644 index 0588e90..0000000 --- a/charts/spire/templates/workload-registrar-service.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire.fullname" . }}-k8s-workload-registrar - namespace: {{ .Release.Namespace }} - {{- with .Values.workloadRegistrar.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "spire.server.labels" . | nindent 4 }} -spec: - type: {{ .Values.server.service.type }} - ports: - - name: https - port: 443 - targetPort: registrar-port - protocol: TCP - selector: - {{- include "spire.server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 652eaac..c350e71 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -9,28 +9,8 @@ waitForIt: version: latest-20221223 resources: {} -workloadRegistrar: - image: - registry: gcr.io - repository: spiffe-io/k8s-workload-registrar - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 32Mi - # limits: - # cpu: 100m - # memory: 64Mi - - service: - annotations: {} +k8s-workload-registrar: + enabled: true server: replicaCount: 1 From e312d423506c064b519604d54768aa26df64873d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 13:49:40 +0100 Subject: [PATCH 60/97] Move spire-agent to dedicated subchart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 10 +-- charts/spire/charts/spire-agent/.helmignore | 23 ++++++ charts/spire/charts/spire-agent/Chart.yaml | 6 ++ charts/spire/charts/spire-agent/README.md | 38 ++++++++++ .../charts/spire-agent/templates/NOTES.txt | 1 + .../charts/spire-agent/templates/_helpers.tpl | 74 +++++++++++++++++++ .../spire-agent/templates/configmap.yaml} | 14 ++-- .../spire-agent/templates/daemonset.yaml} | 52 ++++++------- .../spire-agent/templates/roles.yaml} | 14 ++-- .../templates/serviceaccount.yaml} | 4 +- charts/spire/charts/spire-agent/values.yaml | 70 ++++++++++++++++++ charts/spire/templates/_helpers.tpl | 20 ----- charts/spire/values.yaml | 33 +-------- 13 files changed, 258 insertions(+), 101 deletions(-) create mode 100644 charts/spire/charts/spire-agent/.helmignore create mode 100644 charts/spire/charts/spire-agent/Chart.yaml create mode 100644 charts/spire/charts/spire-agent/README.md create mode 100644 charts/spire/charts/spire-agent/templates/NOTES.txt create mode 100644 charts/spire/charts/spire-agent/templates/_helpers.tpl rename charts/spire/{templates/agent-configmap.yaml => charts/spire-agent/templates/configmap.yaml} (68%) rename charts/spire/{templates/agent-daemonset.yaml => charts/spire-agent/templates/daemonset.yaml} (61%) rename charts/spire/{templates/agent-cluster-role.yaml => charts/spire-agent/templates/roles.yaml} (63%) rename charts/spire/{templates/agent-serviceaccount.yaml => charts/spire-agent/templates/serviceaccount.yaml} (69%) create mode 100644 charts/spire/charts/spire-agent/values.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index b54bace..0089e98 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -54,15 +54,6 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| -| agent.config.logLevel | string | `"info"` | | -| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | -| agent.image.pullPolicy | string | `"IfNotPresent"` | | -| agent.image.registry | string | `"ghcr.io"` | | -| agent.image.repository | string | `"spiffe/spire-agent"` | | -| agent.image.version | string | `""` | | -| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | -| agent.resources | object | `{}` | | -| agent.service.annotations | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | k8s-workload-registrar.enabled | bool | `true` | | @@ -99,6 +90,7 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spire-agent.nameOverride | string | `"agent"` | | | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/.helmignore b/charts/spire/charts/spire-agent/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-agent/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml new file mode 100644 index 0000000..c15c5f5 --- /dev/null +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-agent +description: A Helm chart to install the SPIRE agent. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md new file mode 100644 index 0000000..714e557 --- /dev/null +++ b/charts/spire/charts/spire-agent/README.md @@ -0,0 +1,38 @@ +# spire-agent + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) + +A Helm chart to install the SPIRE agent. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| clusterName | string | `"example-cluster"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-agent"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| server.host | string | `"spire-server"` | | +| server.port | int | `8081` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| trustDomain | string | `"example.org"` | | +| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | +| waitForIt.image.registry | string | `"cgr.dev"` | | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| waitForIt.image.version | string | `"latest-20221215"` | | +| waitForIt.resources | object | `{}` | | diff --git a/charts/spire/charts/spire-agent/templates/NOTES.txt b/charts/spire/charts/spire-agent/templates/NOTES.txt new file mode 100644 index 0000000..dfe3e24 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ .Chart.Name }}… diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl new file mode 100644 index 0000000..5bb2ffe --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-agent.labels" -}} +helm.sh/chart: {{ include "spire-agent.chart" . }} +{{ include "spire-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-agent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-agent.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-agent.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml similarity index 68% rename from charts/spire/templates/agent-configmap.yaml rename to charts/spire/charts/spire-agent/templates/configmap.yaml index 7b348bb..54b2dfa 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -1,24 +1,24 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} data: agent.conf: | agent { data_dir = "/run/spire" - log_level = {{ .Values.agent.config.logLevel | quote }} - server_address = "{{ include "spire.fullname" . }}-server" - server_port = {{ .Values.server.service.port | quote }} - socket_path = {{ .Values.agent.config.socketPath | quote }} + log_level = {{ .Values.logLevel | quote }} + server_address = {{ .Values.server.host | quote }} + server_port = {{ .Values.server.port | quote }} + socket_path = {{ .Values.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" - trust_domain = {{ .Values.spire.trustDomain | quote }} + trust_domain = {{ .Values.trustDomain | quote }} } plugins { NodeAttestor "k8s_psat" { plugin_data { - cluster = {{ .Values.spire.clusterName | quote }} + cluster = {{ .Values.clusterName | quote }} } } diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml similarity index 61% rename from charts/spire/templates/agent-daemonset.yaml rename to charts/spire/charts/spire-agent/templates/daemonset.yaml index 176e910..4aa7443 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,47 +1,47 @@ apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} labels: - {{- include "spire.agent.labels" . | nindent 4 }} + {{- include "spire-agent.labels" . | nindent 4 }} spec: selector: matchLabels: - {{- include "spire.agent.selectorLabels" . | nindent 6 }} - updateStrategy: - type: RollingUpdate + {{- include "spire-agent.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.agent.service.annotations }} + {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- include "spire.agent.selectorLabels" . | nindent 8 }} + {{- include "spire-agent.selectorLabels" . | nindent 8 }} spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} hostPID: true hostNetwork: true dnsPolicy: ClusterFirstWithHostNet - serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} initContainers: - name: init # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire.image" .Values.waitForIt }} + image: {{ template "spire-agent.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"] + args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} - {{- with .Values.agent.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} containers: - - name: {{ .Chart.Name }}-agent - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }} - imagePullPolicy: {{ .Values.agent.image.pullPolicy }} + - name: {{ .Chart.Name }} + image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] volumeMounts: - name: spire-config @@ -51,7 +51,7 @@ spec: mountPath: /run/spire/bundle readOnly: true - name: spire-agent-socket-dir - mountPath: {{ dir .Values.agent.config.socketPath }} + mountPath: {{ dir .Values.socketPath }} readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -68,18 +68,18 @@ spec: initialDelaySeconds: 15 periodSeconds: 60 resources: - {{- toYaml .Values.agent.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} volumes: - name: spire-config configMap: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: {{ include "spire.fullname" . }}-bundle - - name: spire-agent-sockets - hostPath: - path: {{ dir .Values.agent.config.socketPath }} - type: DirectoryOrCreate + name: spire-bundle - name: spire-token projected: sources: @@ -89,5 +89,5 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: {{ dir .Values.agent.config.socketPath }} + path: {{ dir .Values.socketPath }} type: DirectoryOrCreate diff --git a/charts/spire/templates/agent-cluster-role.yaml b/charts/spire/charts/spire-agent/templates/roles.yaml similarity index 63% rename from charts/spire/templates/agent-cluster-role.yaml rename to charts/spire/charts/spire-agent/templates/roles.yaml index 298a655..8aa1c7e 100644 --- a/charts/spire/templates/agent-cluster-role.yaml +++ b/charts/spire/charts/spire-agent/templates/roles.yaml @@ -2,24 +2,26 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-agent-cluster-role + name: {{ include "spire-agent.fullname" . }} rules: - apiGroups: [""] - resources: ["pods", "nodes", "nodes/proxy"] + resources: + - pods + - nodes + - nodes/proxy verbs: ["get"] - --- # Binds above cluster role to spire-agent service account kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-agent-cluster-role-binding + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ include "spire.fullname" . }}-agent-cluster-role + name: {{ include "spire-agent.fullname" . }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/agent-serviceaccount.yaml b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml similarity index 69% rename from charts/spire/templates/agent-serviceaccount.yaml rename to charts/spire/charts/spire-agent/templates/serviceaccount.yaml index 750f1da..8bbb3bb 100644 --- a/charts/spire/templates/agent-serviceaccount.yaml +++ b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml @@ -2,10 +2,10 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "spire.serviceAccountName" . }}-agent + name: {{ include "spire-agent.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: - {{- include "spire.agent.labels" . | nindent 4 }} + {{- include "spire-agent.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml new file mode 100644 index 0000000..cf7ba0f --- /dev/null +++ b/charts/spire/charts/spire-agent/values.yaml @@ -0,0 +1,70 @@ +# Default values for spire-agent. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + # registry: gcr.io + # repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/arch: amd64 + +logLevel: info +socketPath: /run/spire/agent-sockets/spire-agent.sock +clusterName: example-cluster +trustDomain: example.org + +server: + host: spire-server + port: 8081 + +waitForIt: + image: + registry: cgr.dev + repository: chainguard/wait-for-it + pullPolicy: IfNotPresent + version: latest-20221215 + resources: {} diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index 0fdd519..dbbbea3 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -70,26 +70,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-server app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{/* -Common agent labels -*/}} -{{- define "spire.agent.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.agent.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector agent labels -*/}} -{{- define "spire.agent.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }}-agent -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - {{/* Common oidc labels */}} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c350e71..67e71b1 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -88,37 +88,8 @@ server: key: "" bundle: "" -agent: - image: - # registry: gcr.io - # repository: spiffe-io/spire-agent - registry: ghcr.io - repository: spiffe/spire-agent - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 64Mi - # limits: - # cpu: 100m - # memory: 128Mi - - service: - annotations: {} - - config: - logLevel: info - socketPath: /run/spire/agent-sockets/spire-agent.sock +spire-agent: + nameOverride: agent spiffe-oidc-discovery-provider: enabled: false From ce9b58e725ee3d83bd6351957927fe1c26575271 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 15:33:47 +0100 Subject: [PATCH 61/97] Move spire-server to dedicated subchart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 31 +---- charts/spire/charts/spire-agent/README.md | 1 + .../spire-agent/templates/daemonset.yaml | 2 +- charts/spire/charts/spire-agent/values.yaml | 2 + charts/spire/charts/spire-server/.helmignore | 23 ++++ charts/spire/charts/spire-server/Chart.yaml | 6 + charts/spire/charts/spire-server/README.md | 55 +++++++++ .../charts/spire-server/templates/NOTES.txt | 6 + .../spire-server/templates/_helpers.tpl | 86 ++++++++++++++ .../templates/bundle-configmap.yaml} | 2 +- .../spire-server/templates/configmap.yaml} | 23 ++-- .../charts/spire-server/templates/hpa.yaml | 28 +++++ .../spire-server/templates/roles.yaml} | 18 +-- .../spire-server/templates/service.yaml | 20 ++++ .../templates/serviceaccount.yaml} | 5 +- .../spire-server/templates/statefulset.yaml} | 96 ++++++++-------- .../templates/tests/test-connection.yaml | 15 +++ .../templates/upstream-ca-secret.yaml | 6 +- charts/spire/charts/spire-server/values.yaml | 107 ++++++++++++++++++ charts/spire/templates/NOTES.txt | 5 +- charts/spire/templates/_helpers.tpl | 31 ----- charts/spire/templates/server-service.yaml | 20 ---- .../tests/server-test-connection.yaml | 15 --- charts/spire/values.yaml | 79 +------------ 24 files changed, 430 insertions(+), 252 deletions(-) create mode 100644 charts/spire/charts/spire-server/.helmignore create mode 100644 charts/spire/charts/spire-server/Chart.yaml create mode 100644 charts/spire/charts/spire-server/README.md create mode 100644 charts/spire/charts/spire-server/templates/NOTES.txt create mode 100644 charts/spire/charts/spire-server/templates/_helpers.tpl rename charts/spire/{templates/spire-bundle-configmap.yaml => charts/spire-server/templates/bundle-configmap.yaml} (62%) rename charts/spire/{templates/server-configmap.yaml => charts/spire-server/templates/configmap.yaml} (71%) create mode 100644 charts/spire/charts/spire-server/templates/hpa.yaml rename charts/spire/{templates/server-roles.yaml => charts/spire-server/templates/roles.yaml} (77%) create mode 100644 charts/spire/charts/spire-server/templates/service.yaml rename charts/spire/{templates/server-serviceaccount.yaml => charts/spire-server/templates/serviceaccount.yaml} (58%) rename charts/spire/{templates/server-statefulset.yaml => charts/spire-server/templates/statefulset.yaml} (56%) create mode 100644 charts/spire/charts/spire-server/templates/tests/test-connection.yaml rename charts/spire/{ => charts/spire-server}/templates/upstream-ca-secret.yaml (69%) create mode 100644 charts/spire/charts/spire-server/values.yaml delete mode 100644 charts/spire/templates/server-service.yaml delete mode 100644 charts/spire/templates/tests/server-test-connection.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 0089e98..7e98f7b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -58,39 +58,14 @@ Kubernetes: `>=1.21.0-0` | imagePullSecrets | list | `[]` | | | k8s-workload-registrar.enabled | bool | `true` | | | nameOverride | string | `""` | | -| server.config.ca_subject.common_name | string | `"example.org"` | | -| server.config.ca_subject.country | string | `"NL"` | | -| server.config.ca_subject.organization | string | `"Example"` | | -| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | -| server.config.logLevel | string | `"info"` | | -| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | -| server.config.upstreamAuthority.disk.enabled | bool | `false` | | -| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | -| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | -| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | -| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | -| server.dataStorage.enabled | bool | `true` | | -| server.dataStorage.size | string | `"1Gi"` | | -| server.dataStorage.storageClass | string | `nil` | | -| server.image.pullPolicy | string | `"IfNotPresent"` | | -| server.image.registry | string | `"ghcr.io"` | | -| server.image.repository | string | `"spiffe/spire-server"` | | -| server.image.version | string | `""` | | -| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | -| server.podAnnotations | object | `{}` | | -| server.podSecurityContext | object | `{}` | | -| server.replicaCount | int | `1` | | -| server.resources | object | `{}` | | -| server.securityContext | object | `{}` | | -| server.service.annotations | object | `{}` | | -| server.service.port | int | `8081` | | -| server.service.type | string | `"ClusterIP"` | | -| server.topologySpreadConstraints | list | `[]` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | | spire-agent.nameOverride | string | `"agent"` | | +| spire-server.bundleConfigMap | string | `"spire-bundle"` | | +| spire-server.nameOverride | string | `"server"` | | | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 714e557..0f41f31 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -10,6 +10,7 @@ A Helm chart to install the SPIRE agent. | Key | Type | Default | Description | |-----|------|---------|-------------| +| bundleConfigMap | string | `"spire-bundle"` | | | clusterName | string | `"example-cluster"` | | | fullnameOverride | string | `""` | | | image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4aa7443..0614690 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -79,7 +79,7 @@ spec: name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: spire-bundle + name: {{ .Values.bundleConfigMap }} - name: spire-token projected: sources: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index cf7ba0f..5b0a05d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -57,6 +57,8 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock clusterName: example-cluster trustDomain: example.org +bundleConfigMap: spire-bundle + server: host: spire-server port: 8081 diff --git a/charts/spire/charts/spire-server/.helmignore b/charts/spire/charts/spire-server/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-server/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml new file mode 100644 index 0000000..cee16b7 --- /dev/null +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-server +description: A Helm chart to install the SPIRE server. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md new file mode 100644 index 0000000..860f0c4 --- /dev/null +++ b/charts/spire/charts/spire-server/README.md @@ -0,0 +1,55 @@ +# spire-server + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) + +A Helm chart to install the SPIRE server. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| bundleConfigMap | string | `"spire-server"` | | +| ca_subject.common_name | string | `"example.org"` | | +| ca_subject.country | string | `"NL"` | | +| ca_subject.organization | string | `"Example"` | | +| clusterName | string | `"example-cluster"` | | +| dataStorage.accessMode | string | `"ReadWriteOnce"` | | +| dataStorage.enabled | bool | `true` | | +| dataStorage.size | string | `"1Gi"` | | +| dataStorage.storageClass | string | `nil` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-server"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| jwtIssuer | string | `"oidc-discovery.example.org"` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.annotations | object | `{}` | | +| service.port | int | `8081` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| tolerations | list | `[]` | | +| topologySpreadConstraints | list | `[]` | | +| trustDomain | string | `"example.org"` | | +| upstreamAuthority.disk.enabled | bool | `false` | | +| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | +| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | +| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt new file mode 100644 index 0000000..69e0da7 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/NOTES.txt @@ -0,0 +1,6 @@ +Installed {{ .Chart.Name }}… + +1. Get the currently registered SPIFFE entries from the server: + + kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \ + bin/spire-server entry show -socketPath {{ .Values.socketPath }} diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl new file mode 100644 index 0000000..c6de080 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -0,0 +1,86 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-server.labels" -}} +helm.sh/chart: {{ include "spire-server.chart" . }} +{{ include "spire-server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-server.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-server.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} + + +{{- define "spire-server.upstream-ca-secret" -}} +{{- $root := . }} +{{- with .Values.upstreamAuthority.disk -}} +{{- if eq (.secret.create | toString) "true" -}} +{{ include "spire.fullname" $root }}-upstream-ca +{{- else -}} +{{ default (include "spire.fullname" $root) .secret.name }} +{{- end -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/spire-bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml similarity index 62% rename from charts/spire/templates/spire-bundle-configmap.yaml rename to charts/spire/charts/spire-server/templates/bundle-configmap.yaml index 017dd54..ae55ad4 100644 --- a/charts/spire/templates/spire-bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -1,5 +1,5 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-bundle + name: {{ .Values.bundleConfigMap }} namespace: {{ .Release.Namespace }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml similarity index 71% rename from charts/spire/templates/server-configmap.yaml rename to charts/spire/charts/spire-server/templates/configmap.yaml index f505289..1b69148 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,27 +1,26 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} data: server.conf: | server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = {{ .Values.server.config.socketPath | quote }} - trust_domain = {{ .Values.spire.trustDomain | quote }} + socket_path = {{ .Values.socketPath | quote }} + trust_domain = {{ .Values.trustDomain | quote }} data_dir = "/run/spire/data" - log_level = "{{ .Values.server.config.logLevel }}" + log_level = "{{ .Values.logLevel }}" # AWS requires the use of RSA. EC cryptography is not supported ca_key_type = "rsa-2048" - {{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }} - jwt_issuer = "{{ .Values.server.config.jwtIssuer }}" - {{ end }} + jwt_issuer = "{{ .Values.jwtIssuer }}" + default_x509_svid_ttl = "1h" default_jwt_svid_ttl = "1h" ca_subject = { - {{- with .Values.server.config.ca_subject }} + {{- with .Values.ca_subject }} country = [{{ .country | quote }}], organization = [{{ .organization | quote }}], common_name = {{ .common_name | quote }}, @@ -40,8 +39,8 @@ data: NodeAttestor "k8s_psat" { plugin_data { clusters = { - {{ .Values.spire.clusterName | quote }} = { - service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"] + {{ .Values.clusterName | quote }} = { + service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"] } } } @@ -56,11 +55,11 @@ data: Notifier "k8sbundle" { plugin_data { namespace = "{{ .Release.Namespace }}" - config_map = "{{ include "spire.fullname" . }}-bundle" + config_map = {{ .Values.bundleConfigMap | quote }} } } - {{- with .Values.server.config.upstreamAuthority.disk }} + {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} UpstreamAuthority "disk" { plugin_data { diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml new file mode 100644 index 0000000..5121749 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spire-server.fullname" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spire-server.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/server-roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml similarity index 77% rename from charts/spire/templates/server-roles.yaml rename to charts/spire/charts/spire-server/templates/roles.yaml index 0a74adb..5d4c946 100644 --- a/charts/spire/templates/server-roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -3,7 +3,7 @@ kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} rules: # allow "get" access to pods (to resolve selectors for PSAT attestation) @@ -14,7 +14,7 @@ rules: # agent bootstrapping, see the spire-bundle ConfigMap below) - apiGroups: [""] resources: [configmaps] - resourceNames: ["{{ include "spire.fullname" . }}-bundle"] + resourceNames: [{{ .Values.bundleConfigMap }}] verbs: - get - patch @@ -22,15 +22,15 @@ rules: kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server + name: {{ include "spire-server.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: Role - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} apiGroup: rbac.authorization.k8s.io --- # ClusterRole to allow spire-server node attestor to query Token Review API @@ -38,7 +38,7 @@ roleRef: kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} rules: # allow TokenReview requests (to verify service account tokens for PSAT # attestation) @@ -56,13 +56,13 @@ rules: kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server + name: {{ include "spire-server.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml new file mode 100644 index 0000000..ba42c07 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: grpc + port: {{ .Values.service.port }} + targetPort: grpc + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/templates/server-serviceaccount.yaml b/charts/spire/charts/spire-server/templates/serviceaccount.yaml similarity index 58% rename from charts/spire/templates/server-serviceaccount.yaml rename to charts/spire/charts/spire-server/templates/serviceaccount.yaml index d3e9d3a..48d513b 100644 --- a/charts/spire/templates/server-serviceaccount.yaml +++ b/charts/spire/charts/spire-server/templates/serviceaccount.yaml @@ -2,10 +2,9 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "spire.serviceAccountName" . }}-server - namespace: {{ .Release.Namespace }} + name: {{ include "spire-server.serviceAccountName" . }} labels: - {{- include "spire.server.labels" . | nindent 4 }} + {{- include "spire-server.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml similarity index 56% rename from charts/spire/templates/server-statefulset.yaml rename to charts/spire/charts/spire-server/templates/statefulset.yaml index 8ad50d0..507978d 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -1,45 +1,41 @@ -{{- $fullname := include "spire.fullname" . }} +{{- $fullname := include "spire-server.fullname" . }} apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ $fullname }}-server + name: {{ include "spire-server.fullname" . }} labels: - {{- include "spire.server.labels" . | nindent 4 }} + {{- include "spire-server.labels" . | nindent 4 }} spec: - replicas: {{ .Values.server.replicaCount }} - serviceName: {{ include "spire.fullname" . }}-server + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + serviceName: {{ include "spire-server.fullname" . }} selector: matchLabels: - {{- include "spire.server.selectorLabels" . | nindent 6 }} + {{- include "spire-server.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.server.podAnnotations }} + {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- include "spire.server.selectorLabels" . | nindent 8 }} + {{- include "spire-server.selectorLabels" . | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: - {{- range . }} - - name: {{ printf "%s-%s" $fullname .name }} - {{- end }} - {{- end }} - serviceAccountName: {{ include "spire.serviceAccountName" . }}-server - shareProcessNamespace: true - securityContext: - {{- toYaml .Values.server.podSecurityContext | nindent 8 }} - {{- with .Values.server.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} + serviceAccountName: {{ include "spire-server.serviceAccountName" . }} + shareProcessNamespace: true + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - - name: {{ .Chart.Name }}-server + - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }} - imagePullPolicy: {{ .Values.server.image.pullPolicy }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config - /run/spire/config/server.conf @@ -47,23 +43,6 @@ spec: - name: grpc containerPort: 8081 protocol: TCP - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: false - - name: spire-config - mountPath: /run/spire/config - readOnly: true - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} - - name: spire-data - mountPath: /run/spire/data - readOnly: false - {{ end }} - {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} - - name: upstream-ca - mountPath: /run/spire/upstream_ca - readOnly: false - {{- end }} livenessProbe: httpGet: path: /live @@ -79,47 +58,64 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.server.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: false + - name: spire-config + mountPath: /run/spire/config + readOnly: true + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} + - name: spire-data + mountPath: /run/spire/data + readOnly: false + {{- end }} + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca + mountPath: /run/spire/upstream_ca + readOnly: false + {{ end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.affinity }} + {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.tolerations }} + {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.topologySpreadConstraints }} + {{- with .Values.topologySpreadConstraints }} topologySpreadConstraints: {{- toYaml . | nindent 8 }} {{- end }} volumes: - name: spire-config configMap: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} - name: spire-server-socket hostPath: path: /run/spire/server-sockets type: DirectoryOrCreate - {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca secret: - secretName: {{ include "spire.server-upstream-ca-secret" . }} + secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} volumeClaimTemplates: - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} - metadata: name: spire-data spec: accessModes: - - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} + - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }} resources: requests: - storage: {{ .Values.server.dataStorage.size }} - {{- if .Values.server.dataStorage.storageClass }} - storageClassName: {{ .Values.server.dataStorage.storageClass }} + storage: {{ .Values.dataStorage.size }} + {{- if .Values.dataStorage.storageClass }} + storageClassName: {{ .Values.dataStorage.storageClass }} {{- end }} {{ end }} diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml new file mode 100644 index 0000000..60f83f3 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spire-server.fullname" . }}-test-connection" + labels: + {{- include "spire-server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['nc'] + args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/charts/spire/templates/upstream-ca-secret.yaml b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml similarity index 69% rename from charts/spire/templates/upstream-ca-secret.yaml rename to charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml index 36a2c21..3d62360 100644 --- a/charts/spire/templates/upstream-ca-secret.yaml +++ b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml @@ -1,13 +1,13 @@ {{- $root := . }} -{{- with .Values.server.config.upstreamAuthority.disk }} +{{- with .Values.upstreamAuthority.disk }} {{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }} apiVersion: v1 kind: Secret metadata: - name: {{ include "spire.server-upstream-ca-secret" $root }} + name: {{ include "spire-server.upstream-ca-secret" $root }} namespace: {{ $root.Release.Namespace }} labels: - {{- include "spire.server.labels" $root | nindent 4 }} + {{- include "spire-server.labels" $root | nindent 4 }} data: {{- with .secret.data }} tls.crt: {{ .certificate | b64enc }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml new file mode 100644 index 0000000..a025d65 --- /dev/null +++ b/charts/spire/charts/spire-server/values.yaml @@ -0,0 +1,107 @@ +# Default values for spire-server. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + # registry: gcr.io + # repository: spiffe-io/spire-server + registry: ghcr.io + repository: spiffe/spire-server + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8081 + annotations: {} + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 200m + # memory: 256Mi + # limits: + # cpu: 200m + # memory: 256Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +topologySpreadConstraints: [] + +dataStorage: + enabled: true + size: 1Gi + accessMode: ReadWriteOnce + storageClass: null + +logLevel: info +socketPath: /run/spire/server-sockets/spire-server.sock +jwtIssuer: oidc-discovery.example.org + +clusterName: example-cluster +trustDomain: example.org + +bundleConfigMap: spire-server + +ca_subject: + country: NL + organization: Example + common_name: example.org + +upstreamAuthority: + disk: + enabled: false + secret: + # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. + create: true + # -- If secret creation is disabled, the secret with this name will be used. + name: "spiffe-upstream-ca" + # -- If secret creation is enabled, will create a secret with following certificate info + data: + certificate: "" + key: "" + bundle: "" diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 65e935f..dfe3e24 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1,4 +1 @@ -1. Get the currently registered SPIFFE entries from the server: - - kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ - bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }} +Installed {{ .Chart.Name }}… diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index dbbbea3..bf3542c 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -50,26 +50,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{/* -Common server labels -*/}} -{{- define "spire.server.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.server.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector server labels -*/}} -{{- define "spire.server.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }}-server -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - {{/* Common oidc labels */}} @@ -112,14 +92,3 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} - -{{- define "spire.server-upstream-ca-secret" -}} -{{- $root := . }} -{{- with .Values.server.config.upstreamAuthority.disk -}} -{{- if eq (.secret.create | toString) "true" -}} -{{ include "spire.fullname" $root }}-upstream-ca -{{- else -}} -{{ default (include "spire.fullname" $root) .secret.name }} -{{- end -}} -{{- end -}} -{{- end }} diff --git a/charts/spire/templates/server-service.yaml b/charts/spire/templates/server-service.yaml deleted file mode 100644 index 006bfc0..0000000 --- a/charts/spire/templates/server-service.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire.fullname" . }}-server - namespace: {{ .Release.Namespace }} - {{- with .Values.server.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "spire.server.labels" . | nindent 4 }} -spec: - type: {{ .Values.server.service.type }} - ports: - - name: grpc - port: {{ .Values.server.service.port }} - targetPort: grpc - protocol: TCP - selector: - {{- include "spire.server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/templates/tests/server-test-connection.yaml b/charts/spire/templates/tests/server-test-connection.yaml deleted file mode 100644 index 2f15a90..0000000 --- a/charts/spire/templates/tests/server-test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "spire.fullname" . }}-server-test-connection" - labels: - {{- include "spire.server.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: check-port - image: busybox - command: ['nc'] - args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}'] - restartPolicy: Never diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 67e71b1..a4c9646 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -12,84 +12,13 @@ waitForIt: k8s-workload-registrar: enabled: true -server: - replicaCount: 1 - image: - # registry: gcr.io - # repository: spiffe-io/spire-server - registry: ghcr.io - repository: spiffe/spire-server - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 200m - # memory: 256Mi - # limits: - # cpu: 200m - # memory: 256Mi - - dataStorage: - enabled: true - size: 1Gi - accessMode: ReadWriteOnce - storageClass: null - - service: - type: ClusterIP - port: 8081 - annotations: {} - - podAnnotations: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - topologySpreadConstraints: [] - - config: - logLevel: info - socketPath: /run/spire/server-sockets/spire-server.sock - jwtIssuer: oidc-discovery.example.org - - ca_subject: - country: NL - organization: Example - common_name: example.org - - upstreamAuthority: - disk: - enabled: false - secret: - # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. - create: true - # -- If secret creation is disabled, the secret with this name will be used. - name: "spiffe-upstream-ca" - # -- If secret creation is enabled, will create a secret with following certificate info - data: - certificate: "" - key: "" - bundle: "" +spire-server: + nameOverride: server + bundleConfigMap: &bundleConfigMap spire-bundle spire-agent: nameOverride: agent + bundleConfigMap: *bundleConfigMap spiffe-oidc-discovery-provider: enabled: false From b3d5b7d80ab6fd28eba0f516ef15acf5bafe8fb5 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 16:08:34 +0100 Subject: [PATCH 62/97] Remove unused template + fix spiffe-csi-driver Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spiffe-csi-driver/templates/daemonset.yaml | 2 +- charts/spire/templates/_helpers.tpl | 12 ------------ 2 files changed, 1 insertion(+), 13 deletions(-) diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 09b7a9a..40e72b9 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -63,7 +63,7 @@ spec: # of all the little details required to register a CSI driver with # the kubelet. - name: node-driver-registrar - image: {{ template "spire.image" .Values.nodeDriverRegistrar }} + image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }} imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }} args: [ "-csi-address", "/spiffe-csi/csi.sock", diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index bf3542c..a7a399a 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -80,15 +80,3 @@ Create the name of the service account to use {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} - -{{- define "spire.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} From cdbee1bc1b744bdc9e71c03838c6f399f199bf5f Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 16:14:50 +0100 Subject: [PATCH 63/97] Cleanup values.yaml Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 25 +++++---- .../charts/k8s-workload-registrar/values.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 5 +- charts/spire/charts/spire-server/README.md | 5 +- charts/spire/values.yaml | 53 +++++++++---------- 5 files changed, 45 insertions(+), 45 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 7e98f7b..cd76f03 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -55,24 +55,27 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | fullnameOverride | string | `""` | | -| imagePullSecrets | list | `[]` | | +| k8s-workload-registrar.clusterName | string | `"example-cluster"` | | | k8s-workload-registrar.enabled | bool | `true` | | +| k8s-workload-registrar.fullNameOverride | string | `"k8s-workload-registrar"` | | +| k8s-workload-registrar.server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| k8s-workload-registrar.trustDomain | string | `"example.org"` | | | nameOverride | string | `""` | | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `true` | | -| serviceAccount.name | string | `""` | | +| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| spiffe-csi-driver.fullNameOverride | string | `"spiffe-csi-driver"` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spiffe-oidc-discovery-provider.fullNameOverride | string | `"spiffe-oidc-discovery-provider"` | | +| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | | | spire-agent.bundleConfigMap | string | `"spire-bundle"` | | +| spire-agent.clusterName | string | `"example-cluster"` | | | spire-agent.nameOverride | string | `"agent"` | | +| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| spire-agent.trustDomain | string | `"example.org"` | | | spire-server.bundleConfigMap | string | `"spire-bundle"` | | +| spire-server.clusterName | string | `"example-cluster"` | | | spire-server.nameOverride | string | `"server"` | | -| spire.clusterName | string | `"example-cluster"` | | -| spire.trustDomain | string | `"example.org"` | | -| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | -| waitForIt.image.registry | string | `"cgr.dev"` | | -| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | -| waitForIt.image.version | string | `"latest-20221223"` | | -| waitForIt.resources | object | `{}` | | +| spire-server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| spire-server.trustDomain | string | `"example.org"` | | ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/k8s-workload-registrar/values.yaml b/charts/spire/charts/k8s-workload-registrar/values.yaml index 7acb677..d6d0999 100644 --- a/charts/spire/charts/k8s-workload-registrar/values.yaml +++ b/charts/spire/charts/k8s-workload-registrar/values.yaml @@ -76,5 +76,5 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - version: latest-20221215 + version: latest-20221223 resources: {} diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 0f41f31..8e86746 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -1,7 +1,5 @@ # spire-agent - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) A Helm chart to install the SPIRE agent. @@ -37,3 +35,6 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | | waitForIt.image.version | string | `"latest-20221215"` | | | waitForIt.resources | object | `{}` | | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 860f0c4..421c4b5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -1,7 +1,5 @@ # spire-server - - ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) A Helm chart to install the SPIRE server. @@ -53,3 +51,6 @@ A Helm chart to install the SPIRE server. | upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | | upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | | upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index a4c9646..05011ef 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,45 +1,40 @@ nameOverride: "" fullnameOverride: "" -waitForIt: - image: - registry: cgr.dev - repository: chainguard/wait-for-it - pullPolicy: IfNotPresent - version: latest-20221223 - resources: {} - -k8s-workload-registrar: - enabled: true - +# subcharts spire-server: nameOverride: server bundleConfigMap: &bundleConfigMap spire-bundle + clusterName: &clusterName "example-cluster" + trustDomain: &trustDomain "example.org" + + socketPath: &serverSocketPath /run/spire/server-sockets/spire-server.sock + spire-agent: nameOverride: agent bundleConfigMap: *bundleConfigMap + clusterName: *clusterName + trustDomain: *trustDomain + + socketPath: &agentSocketPath /run/spire/agent-sockets/spire-agent.sock + +spiffe-csi-driver: + fullNameOverride: spiffe-csi-driver + agentSocketPath: *agentSocketPath + spiffe-oidc-discovery-provider: + fullNameOverride: spiffe-oidc-discovery-provider enabled: false + trustDomain: *trustDomain -imagePullSecrets: [] - # - name: my-docker-registry - # username: my-docker-user - # password: my-docker-password - # registryURL: my-private.docker-registry.com +k8s-workload-registrar: + fullNameOverride: k8s-workload-registrar + enabled: true -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" + clusterName: *clusterName + trustDomain: *trustDomain -# spireSettings - -spire: - clusterName: "example-cluster" - trustDomain: "example.org" + server: + socketPath: *serverSocketPath From c7ebf72d13597740d94514ac124f504e592bce76 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 16:18:04 +0100 Subject: [PATCH 64/97] Remove unused helpers from root Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 3 -- .../templates/roles.yaml | 4 +- charts/spire/templates/_helpers.tpl | 51 ------------------- .../spire/templates/image-pull-secrets.yaml | 21 -------- charts/spire/values.yaml | 3 -- 5 files changed, 2 insertions(+), 80 deletions(-) delete mode 100644 charts/spire/templates/image-pull-secrets.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index cd76f03..0366609 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -57,14 +57,11 @@ Kubernetes: `>=1.21.0-0` | fullnameOverride | string | `""` | | | k8s-workload-registrar.clusterName | string | `"example-cluster"` | | | k8s-workload-registrar.enabled | bool | `true` | | -| k8s-workload-registrar.fullNameOverride | string | `"k8s-workload-registrar"` | | | k8s-workload-registrar.server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | | k8s-workload-registrar.trustDomain | string | `"example.org"` | | | nameOverride | string | `""` | | | spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | -| spiffe-csi-driver.fullNameOverride | string | `"spiffe-csi-driver"` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.fullNameOverride | string | `"spiffe-oidc-discovery-provider"` | | | spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | | | spire-agent.bundleConfigMap | string | `"spire-bundle"` | | | spire-agent.clusterName | string | `"example-cluster"` | | diff --git a/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml b/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml index 0539854..c34635c 100644 --- a/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml +++ b/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml @@ -65,9 +65,9 @@ metadata: name: {{ include "k8s-workload-registrar.fullname" . }} subjects: - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }} + name: {{ include "k8s-workload-registrar.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ include "spire.fullname" . }} + name: {{ include "k8s-workload-registrar.fullname" . }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index a7a399a..7d7d356 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -29,54 +29,3 @@ Create chart name and version as used by the chart label. {{- define "spire.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} - -{{/* -Common labels -*/}} -{{- define "spire.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "spire.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Common oidc labels -*/}} -{{- define "spire.oidc.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.oidc.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector oidc labels -*/}} -{{- define "spire.oidc.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }}-oidc -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "spire.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "spire.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} diff --git a/charts/spire/templates/image-pull-secrets.yaml b/charts/spire/templates/image-pull-secrets.yaml deleted file mode 100644 index 71b675f..0000000 --- a/charts/spire/templates/image-pull-secrets.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- $fullname := include "spire.fullname" . }} -{{- $ns := .Release.Namespace }} -{{- $labels := include "spire.labels" . }} -{{- range .Values.imagePullSecrets }} -{{- $registryAuthDocument := dict -}} -{{- $authMessage := printf "%s:%s" .username .password | b64enc }} -{{- $_ := set $registryAuthDocument "auth" $authMessage }} -{{- $dockerAuthDocument := dict .registryURL $registryAuthDocument }} -{{- $dockerConfigJSONDocument := dict "auths" $dockerAuthDocument -}} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ (printf "%s-%s" $fullname .name) }} - namespace: {{ $ns }} - labels: - {{- $labels | nindent 4 }} -data: - .dockerconfigjson: {{ $dockerConfigJSONDocument | toJson | b64enc | quote }} -type: kubernetes.io/dockerconfigjson -{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 05011ef..4c9bcc1 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -21,16 +21,13 @@ spire-agent: socketPath: &agentSocketPath /run/spire/agent-sockets/spire-agent.sock spiffe-csi-driver: - fullNameOverride: spiffe-csi-driver agentSocketPath: *agentSocketPath spiffe-oidc-discovery-provider: - fullNameOverride: spiffe-oidc-discovery-provider enabled: false trustDomain: *trustDomain k8s-workload-registrar: - fullNameOverride: k8s-workload-registrar enabled: true clusterName: *clusterName From 2c8ca0a23765b4c99ff7e9f8beaa9f82f83523a8 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 19 Dec 2022 16:42:55 +0100 Subject: [PATCH 65/97] List spire-server and spire-agent in dependencies Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 6 ++++++ charts/spire/README.md | 2 ++ 2 files changed, 8 insertions(+) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index c391ed7..8f10999 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -39,6 +39,12 @@ maintainers: url: https://marcofranssen.nl kubeVersion: ">=1.21.0-0" dependencies: + - name: spire-server + repository: file://./charts/spire-server + version: 0.1.0 + - name: spire-agent + repository: file://./charts/spire-agent + version: 0.1.0 - name: spiffe-csi-driver repository: file://./charts/spiffe-csi-driver version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index 0366609..997fe2d 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -49,6 +49,8 @@ Kubernetes: `>=1.21.0-0` | file://./charts/k8s-workload-registrar | k8s-workload-registrar | 0.1.0 | | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | +| file://./charts/spire-agent | spire-agent | 0.1.0 | +| file://./charts/spire-server | spire-server | 0.1.0 | ## Values From 738842de16c933a8bf7ab371d2cbb7cb5e628244 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 10 Jan 2023 21:42:24 +0100 Subject: [PATCH 66/97] Fix oidc-discovery-provider config mount Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spiffe-oidc-discovery-provider/templates/deployment.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml index a9a78ae..a3a7d6a 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/deployment.yaml @@ -51,7 +51,8 @@ spec: mountPath: /run/spire/oidc-sockets readOnly: false - name: spire-oidc-config - mountPath: /run/spire/oidc/config/ + mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf + subPath: oidc-discovery-provider.conf readOnly: true readinessProbe: httpGet: From 0a0ddb4a9b50b4748d7311746dacdf20f0e174f7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 11 Jan 2023 10:52:31 +0100 Subject: [PATCH 67/97] Move the k8s-workload-registrar back into same pod as spire-server The k8s-workload-registrar needs access to the spire-server socket and therefore has to run in the same pod to be able to mount the socket into the container. Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 - charts/spire/README.md | 5 -- .../charts/k8s-workload-registrar/.helmignore | 23 ------ .../charts/k8s-workload-registrar/Chart.yaml | 6 -- .../templates/NOTES.txt | 1 - .../templates/_helpers.tpl | 74 ----------------- .../templates/deployment.yaml | 77 ------------------ .../k8s-workload-registrar/templates/hpa.yaml | 28 ------- .../templates/roles.yaml | 73 ----------------- .../templates/serviceaccount.yaml | 12 --- .../charts/k8s-workload-registrar/values.yaml | 80 ------------------- charts/spire/charts/spire-server/README.md | 8 ++ .../k8s-workload-registrar-configmap.yaml} | 8 +- .../k8s-workload-registrar-roles.yaml | 56 +++++++++++++ .../charts/spire-server/templates/roles.yaml | 5 +- .../spire-server/templates/statefulset.yaml | 24 ++++++ charts/spire/charts/spire-server/values.yaml | 32 ++++++++ charts/spire/values.yaml | 9 --- 18 files changed, 129 insertions(+), 396 deletions(-) delete mode 100644 charts/spire/charts/k8s-workload-registrar/.helmignore delete mode 100644 charts/spire/charts/k8s-workload-registrar/Chart.yaml delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/roles.yaml delete mode 100644 charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml delete mode 100644 charts/spire/charts/k8s-workload-registrar/values.yaml rename charts/spire/charts/{k8s-workload-registrar/templates/configmap.yaml => spire-server/templates/k8s-workload-registrar-configmap.yaml} (54%) create mode 100644 charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 8f10999..fa4b7cf 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -52,7 +52,3 @@ dependencies: condition: spiffe-oidc-discovery-provider.enabled repository: file://./charts/spiffe-oidc-discovery-provider version: 0.1.0 - - name: k8s-workload-registrar - condition: k8s-workload-registrar.enabled - repository: file://./charts/k8s-workload-registrar - version: 0.1.0 diff --git a/charts/spire/README.md b/charts/spire/README.md index 997fe2d..5cdcf2b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -46,7 +46,6 @@ Kubernetes: `>=1.21.0-0` | Repository | Name | Version | |------------|------|---------| -| file://./charts/k8s-workload-registrar | k8s-workload-registrar | 0.1.0 | | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 | | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 | | file://./charts/spire-agent | spire-agent | 0.1.0 | @@ -57,10 +56,6 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | fullnameOverride | string | `""` | | -| k8s-workload-registrar.clusterName | string | `"example-cluster"` | | -| k8s-workload-registrar.enabled | bool | `true` | | -| k8s-workload-registrar.server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | -| k8s-workload-registrar.trustDomain | string | `"example.org"` | | | nameOverride | string | `""` | | | spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | diff --git a/charts/spire/charts/k8s-workload-registrar/.helmignore b/charts/spire/charts/k8s-workload-registrar/.helmignore deleted file mode 100644 index 0e8a0eb..0000000 --- a/charts/spire/charts/k8s-workload-registrar/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/spire/charts/k8s-workload-registrar/Chart.yaml b/charts/spire/charts/k8s-workload-registrar/Chart.yaml deleted file mode 100644 index d417224..0000000 --- a/charts/spire/charts/k8s-workload-registrar/Chart.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v2 -name: k8s-workload-registrar -description: A Helm chart to install the SPIRE k8s workload registrator. -type: application -version: 0.1.0 -appVersion: "1.5.3" diff --git a/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt b/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt deleted file mode 100644 index 2bdde8f..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt +++ /dev/null @@ -1 +0,0 @@ -Installed {{ include "k8s-workload-registrar.fullname" . }}… diff --git a/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl b/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl deleted file mode 100644 index 4d2b19a..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl +++ /dev/null @@ -1,74 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "k8s-workload-registrar.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "k8s-workload-registrar.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "k8s-workload-registrar.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "k8s-workload-registrar.labels" -}} -helm.sh/chart: {{ include "k8s-workload-registrar.chart" . }} -{{ include "k8s-workload-registrar.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "k8s-workload-registrar.selectorLabels" -}} -app.kubernetes.io/name: {{ include "k8s-workload-registrar.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "k8s-workload-registrar.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "k8s-workload-registrar.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} - -{{- define "k8s-workload-registrar.image" -}} -{{- if eq (substr 0 7 .image.version) "sha256:" -}} -{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} -{{- else if .appVersion -}} -{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} -{{- else if .image.version -}} -{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} -{{- else -}} -{{- printf "%s/%s" .image.registry .image.repository -}} -{{- end -}} -{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml b/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml deleted file mode 100644 index 8ae39e2..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml +++ /dev/null @@ -1,77 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} - labels: - {{- include "k8s-workload-registrar.labels" . | nindent 4 }} -spec: - {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} - {{- end }} - selector: - matchLabels: - {{- include "k8s-workload-registrar.selectorLabels" . | nindent 6 }} - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "k8s-workload-registrar.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "k8s-workload-registrar.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - initContainers: - - name: init - # This is a small image with wait-for-it, choose whatever image - # you prefer that waits for a service to be up. This image is built - # from https://github.com/vishnubob/wait-for-it - image: {{ template "k8s-workload-registrar.image" .Values.waitForIt }} - imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}] - resources: - {{- toYaml .Values.waitForIt.resources | nindent 12 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "k8s-workload-registrar.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - args: - - -config - - /run/spire/k8s-workload-registrar/config/workload-registrar.conf - resources: - {{- toYaml .Values.resources | nindent 12 }} - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: true - - name: k8s-workload-registrar-config - mountPath: /run/spire/k8s-workload-registrar/config - readOnly: true - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - volumes: - - name: k8s-workload-registrar-config - configMap: - name: {{ include "k8s-workload-registrar.fullname" . }} - - name: spire-server-socket - hostPath: - path: /run/spire/server-sockets - type: DirectoryOrCreate diff --git a/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml b/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml deleted file mode 100644 index 1936616..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml +++ /dev/null @@ -1,28 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2beta1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} - labels: - {{- include "k8s-workload-registrar.labels" . | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "k8s-workload-registrar.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml b/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml deleted file mode 100644 index c34635c..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/roles.yaml +++ /dev/null @@ -1,73 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: [coordination.k8s.io] - resources: [leases] - verbs: [create] - - apiGroups: [coordination.k8s.io] - resources: [leases] - resourceNames: [spire-k8s-registrar-leader-election] - verbs: - - get - - update - # - apiGroups: [""] - # resources: [configmaps] - # verbs: [create] - # - apiGroups: [""] - # resources: [configmaps] - # resourceNames: [k8s-workload-registrar-leader-election] - # verbs: - # - get - # - update - - apiGroups: [""] - resources: [events] - verbs: [create] ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -subjects: - - kind: ServiceAccount - name: {{ include "k8s-workload-registrar.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ include "k8s-workload-registrar.fullname" . }} - apiGroup: rbac.authorization.k8s.io ---- -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} -rules: - - apiGroups: [""] - resources: [pods, nodes, endpoints] - verbs: - - get - - list - - watch - - apiGroups: [coordination.k8s.io] - resources: [leases] - verbs: - - create - - get - - list - - update ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ include "k8s-workload-registrar.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: ClusterRole - name: {{ include "k8s-workload-registrar.fullname" . }} - apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml b/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml deleted file mode 100644 index 2198b39..0000000 --- a/charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "k8s-workload-registrar.serviceAccountName" . }} - labels: - {{- include "k8s-workload-registrar.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -{{- end }} diff --git a/charts/spire/charts/k8s-workload-registrar/values.yaml b/charts/spire/charts/k8s-workload-registrar/values.yaml deleted file mode 100644 index d6d0999..0000000 --- a/charts/spire/charts/k8s-workload-registrar/values.yaml +++ /dev/null @@ -1,80 +0,0 @@ -# Default values for k8s-workload-registrar. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - -replicaCount: 1 - -image: - registry: gcr.io - repository: spiffe-io/k8s-workload-registrar - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -serviceAccount: - # Specifies whether a service account should be created - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" - -podAnnotations: {} - -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 5 - targetCPUUtilizationPercentage: 80 - targetMemoryUtilizationPercentage: 80 - -nodeSelector: - kubernetes.io/arch: amd64 - -tolerations: [] - -affinity: {} - -server: - socketPath: /run/spire/server-sockets/spire-server.sock - host: spire-server - port: 8081 -clusterName: "example-cluster" -trustDomain: "example.org" -logLevel: info - -waitForIt: - image: - registry: cgr.dev - repository: chainguard/wait-for-it - pullPolicy: IfNotPresent - version: latest-20221223 - resources: {} diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 421c4b5..db99db3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -29,6 +29,14 @@ A Helm chart to install the SPIRE server. | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | jwtIssuer | string | `"oidc-discovery.example.org"` | | +| k8sWorkloadRegistrar.enabled | bool | `true` | | +| k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | +| k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` | | +| k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | +| k8sWorkloadRegistrar.image.version | string | `""` | | +| k8sWorkloadRegistrar.logLevel | string | `"info"` | | +| k8sWorkloadRegistrar.resources | object | `{}` | | +| k8sWorkloadRegistrar.securityContext | object | `{}` | | | logLevel | string | `"info"` | | | nameOverride | string | `""` | | | nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | diff --git a/charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml similarity index 54% rename from charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml rename to charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml index 0693990..17ffead 100644 --- a/charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml @@ -1,14 +1,16 @@ +{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "k8s-workload-registrar.fullname" . }} + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar namespace: {{ .Release.Namespace }} data: workload-registrar.conf: | - log_level = "{{ .Values.logLevel }}" + log_level = "{{ .Values.k8sWorkloadRegistrar.logLevel }}" mode = "reconcile" trust_domain = {{ .Values.trustDomain | quote }} cluster = {{ .Values.clusterName | quote }} - server_address = "unix://{{ .Values.server.socketPath }}" + server_address = "unix://{{ .Values.socketPath }}" leader_election = true metrics_addr = "0.0.0.0:18080" +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml new file mode 100644 index 0000000..7e9ff39 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml @@ -0,0 +1,56 @@ +{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} +# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree. +# These roles are needed for the k8s registrar to work properly in reconciling mode. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar +rules: + - apiGroups: [""] + resources: ["pods", "nodes", "endpoints"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["create"] + - apiGroups: [""] + resources: ["configmaps"] + resourceNames: ["controller-leader-election-helper"] + verbs: ["update", "get"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + apiGroup: rbac.authorization.k8s.io +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 5d4c946..439c1bc 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -46,11 +46,14 @@ rules: resources: [tokenreviews] verbs: - get + - watch + - list - create - apiGroups: [""] - resources: [nodes] + resources: [nodes, pods] verbs: - get + - list --- # Binds above cluster role to spire-server service account kind: ClusterRoleBinding diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 507978d..09029de 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -76,6 +76,25 @@ spec: mountPath: /run/spire/upstream_ca readOnly: false {{ end }} + {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} + - name: spire-k8s-workload-registrar + securityContext: + {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - -config + - /run/spire/k8s-workload-registrar/config/workload-registrar.conf + resources: + {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: true + - name: k8s-workload-registrar-config + mountPath: /run/spire/k8s-workload-registrar/config + readOnly: true + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -105,6 +124,11 @@ spec: secret: secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} + {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} + - name: k8s-workload-registrar-config + configMap: + name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + {{- end }} volumeClaimTemplates: {{- if eq (.Values.dataStorage.enabled | toString) "true" }} - metadata: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index a025d65..f610b22 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -105,3 +105,35 @@ upstreamAuthority: certificate: "" key: "" bundle: "" + +k8sWorkloadRegistrar: + enabled: true + + image: + registry: gcr.io + repository: spiffe-io/k8s-workload-registrar + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + + logLevel: info diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 4c9bcc1..16cf92c 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -26,12 +26,3 @@ spiffe-csi-driver: spiffe-oidc-discovery-provider: enabled: false trustDomain: *trustDomain - -k8s-workload-registrar: - enabled: true - - clusterName: *clusterName - trustDomain: *trustDomain - - server: - socketPath: *serverSocketPath From 92440c72ccffc8d26cd588cdc9954cb69d48200f Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 11 Jan 2023 15:09:33 +0100 Subject: [PATCH 68/97] Add note on scaling spire-server to value docs Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 2 +- charts/spire/charts/spire-server/values.yaml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index db99db3..869e79f 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -42,7 +42,7 @@ A Helm chart to install the SPIRE server. | nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | -| replicaCount | int | `1` | | +| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | | resources | object | `{}` | | | securityContext | object | `{}` | | | service.annotations | object | `{}` | | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f610b22..cb1693c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -2,6 +2,7 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. +# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. replicaCount: 1 image: From f0921014cf0ef9c6923df2dfebb20b18259a60fe Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 12 Jan 2023 13:26:50 +0100 Subject: [PATCH 69/97] Use template function from the right chart for oidc discovery provider configmap Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index 13ccb04..c2f0124 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }} + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} namespace: {{ .Release.Namespace }} data: oidc-discovery-provider.conf: | From 8277bf0bd493cdcc2871ab6673fda027c78b7887 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 13 Jan 2023 15:25:25 +0100 Subject: [PATCH 70/97] Patch wait-for-it to latest Januari release Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-agent/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 8e86746..4ee7454 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -33,7 +33,7 @@ A Helm chart to install the SPIRE agent. | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"cgr.dev"` | | | waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | -| waitForIt.image.version | string | `"latest-20221215"` | | +| waitForIt.image.version | string | `"latest-20230113"` | | | waitForIt.resources | object | `{}` | | ---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 5b0a05d..31299ba 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -68,5 +68,5 @@ waitForIt: registry: cgr.dev repository: chainguard/wait-for-it pullPolicy: IfNotPresent - version: latest-20221215 + version: latest-20230113 resources: {} From 05e1c2f7365be38c7d7a4d860d974a8e442992a7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Fri, 13 Jan 2023 15:51:43 +0100 Subject: [PATCH 71/97] Bump spire to latest 1.5.4 patch release Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-server/Chart.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 431af1e..ee29699 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,4 +3,4 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.5.3" +appVersion: "1.5.4" diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index c15c5f5..ed2233f 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,4 +3,4 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.5.3" +appVersion: "1.5.4" diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index cee16b7..b1b7be3 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,4 +3,4 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.5.3" +appVersion: "1.5.4" From 065689a6a4abb59034459c14e7ad3b41eba1e53e Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 16 Jan 2023 09:23:43 +0100 Subject: [PATCH 72/97] Fix k8s workload registrar image pullPolicy Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/templates/statefulset.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 09029de..8e607e2 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -81,7 +81,7 @@ spec: securityContext: {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }} image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }} - imagePullPolicy: {{ .Values.image.pullPolicy }} + imagePullPolicy: {{ .Values.k8sWorkloadRegistrar.image.pullPolicy }} args: - -config - /run/spire/k8s-workload-registrar/config/workload-registrar.conf From 5ff662aceaa88bf01ef05501d0b516b9a1e88552 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 12:01:01 +0100 Subject: [PATCH 73/97] Update statement on minimum required spire version Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 ++-- charts/spire/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index fa4b7cf..b8fa0a2 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -3,9 +3,9 @@ name: spire description: | A Helm chart for deploying spire-server and spire-agent. - > :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + > **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. - > :warning: Minimum Spire version is `v1.0.2`. + > **Note**: Minimum Spire version is `v1.5.3`. To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. diff --git a/charts/spire/README.md b/charts/spire/README.md index 5cdcf2b..ddbaa10 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -4,9 +4,9 @@ A Helm chart for deploying spire-server and spire-agent. -> :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. +> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. -> :warning: Minimum Spire version is `v1.0.2`. +> **Note**: Minimum Spire version is `v1.5.3`. To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. From 175d4483419a9fa53deb0c57114d9b673f1188ef Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 11:51:49 +0100 Subject: [PATCH 74/97] Utilize helper function for spire-k8s-workload-registrar Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spire/charts/spire-server/templates/_helpers.tpl | 4 ++++ .../templates/k8s-workload-registrar-configmap.yaml | 2 +- .../templates/k8s-workload-registrar-roles.yaml | 12 ++++++------ .../charts/spire-server/templates/statefulset.yaml | 2 +- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index c6de080..726f40e 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -84,3 +84,7 @@ Create the name of the service account to use {{- end -}} {{- end -}} {{- end }} + +{{- define "spire-k8s-workload-registrar.fullname" -}} +{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml index 17ffead..5cdcc86 100644 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} namespace: {{ .Release.Namespace }} data: workload-registrar.conf: | diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml index 7e9ff39..e4022f3 100644 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml @@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} rules: - apiGroups: [""] resources: ["pods", "nodes", "endpoints"] @@ -13,11 +13,11 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} subjects: - kind: ServiceAccount name: {{ include "spire-server.serviceAccountName" . }} @@ -26,7 +26,7 @@ subjects: apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} namespace: {{ .Release.Namespace }} rules: - apiGroups: [""] @@ -43,11 +43,11 @@ rules: apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} namespace: {{ .Release.Namespace }} roleRef: kind: Role - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} apiGroup: rbac.authorization.k8s.io subjects: - kind: ServiceAccount diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 8e607e2..3904a9d 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -127,7 +127,7 @@ spec: {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} - name: k8s-workload-registrar-config configMap: - name: {{ include "spire-server.fullname" . }}-k8s-workload-registrar + name: {{ include "spire-k8s-workload-registrar.fullname" . }} {{- end }} volumeClaimTemplates: {{- if eq (.Values.dataStorage.enabled | toString) "true" }} From 4a2b0ac69a6ecbb8eacc9dec61bdb4e6c6c6ef1b Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 11:53:07 +0100 Subject: [PATCH 75/97] Add spire-k8s-registrar service Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../k8s-workload-registrar-service.yaml | 22 +++++++++++++++++++ .../spire-server/templates/statefulset.yaml | 4 ++++ 2 files changed, 26 insertions(+) create mode 100644 charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml new file mode 100644 index 0000000..1fd54b7 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml @@ -0,0 +1,22 @@ +{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-k8s-workload-registrar.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: https + port: 443 + targetPort: k8s-registrar + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 3904a9d..c9b81f7 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -85,6 +85,10 @@ spec: args: - -config - /run/spire/k8s-workload-registrar/config/workload-registrar.conf + ports: + - name: k8s-registrar + containerPort: 9443 + protocol: TCP resources: {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }} volumeMounts: From 9921d1df4094beaf30e3ebf23322cbac10fa6612 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 11:54:55 +0100 Subject: [PATCH 76/97] Use correct helper function for upstream-ca-secret Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/templates/_helpers.tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 726f40e..e7124d6 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -78,9 +78,9 @@ Create the name of the service account to use {{- $root := . }} {{- with .Values.upstreamAuthority.disk -}} {{- if eq (.secret.create | toString) "true" -}} -{{ include "spire.fullname" $root }}-upstream-ca +{{ include "spire-server.fullname" $root }}-upstream-ca {{- else -}} -{{ default (include "spire.fullname" $root) .secret.name }} +{{ default (include "spire-server.fullname" $root) .secret.name }} {{- end -}} {{- end -}} {{- end }} From 016e8336d0cbfbf5bb4295597aba10172e69762d Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 12:38:40 +0100 Subject: [PATCH 77/97] Fix agent connectivity if deployed with different name e.g. if deploying with spire-65de556ac Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-agent/README.md | 1 - charts/spire/charts/spire-agent/templates/_helpers.tpl | 4 ++++ charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 2 +- charts/spire/charts/spire-agent/values.yaml | 1 - charts/spire/charts/spire-server/templates/configmap.yaml | 2 +- 6 files changed, 7 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 4ee7454..157e890 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -23,7 +23,6 @@ A Helm chart to install the SPIRE agent. | podSecurityContext | object | `{}` | | | resources | object | `{}` | | | securityContext | object | `{}` | | -| server.host | string | `"spire-server"` | | | server.port | int | `8081` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 5bb2ffe..0a1db74 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -72,3 +72,7 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} + +{{- define "spire-server-service" -}} +{{ include "spire-agent.fullname" . | trimSuffix "-agent" }}-server +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 54b2dfa..b7a8111 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -8,7 +8,7 @@ data: agent { data_dir = "/run/spire" log_level = {{ .Values.logLevel | quote }} - server_address = {{ .Values.server.host | quote }} + server_address = {{ (include "spire-server-service" .) | quote }} server_port = {{ .Values.server.port | quote }} socket_path = {{ .Values.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 0614690..248e824 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -35,7 +35,7 @@ spec: # from https://github.com/vishnubob/wait-for-it image: {{ template "spire-agent.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}] + args: ["-t", "30", "-h", "{{ .Release.Name }}-server", "-p", {{ .Values.server.port | quote }}] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} containers: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 31299ba..e636778 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -60,7 +60,6 @@ trustDomain: example.org bundleConfigMap: spire-bundle server: - host: spire-server port: 8081 waitForIt: diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 1b69148..52de751 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -40,7 +40,7 @@ data: plugin_data { clusters = { {{ .Values.clusterName | quote }} = { - service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"] + service_account_allow_list = ["{{ .Release.Namespace }}:{{ .Release.Name }}-agent"] } } } From 875b17a948443bfcf02652824af39bd56fbef2ca Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 12:47:38 +0100 Subject: [PATCH 78/97] Fix RBAC permissions k8s-workload-registrar Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-agent/templates/_helpers.tpl | 4 ---- charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +- .../spire-server/templates/k8s-workload-registrar-roles.yaml | 3 +++ 3 files changed, 4 insertions(+), 5 deletions(-) diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index 0a1db74..5bb2ffe 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -72,7 +72,3 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} - -{{- define "spire-server-service" -}} -{{ include "spire-agent.fullname" . | trimSuffix "-agent" }}-server -{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index b7a8111..0f2fc85 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -8,7 +8,7 @@ data: agent { data_dir = "/run/spire" log_level = {{ .Values.logLevel | quote }} - server_address = {{ (include "spire-server-service" .) | quote }} + server_address = "{{ .Release.Name }}-server" server_port = {{ .Values.server.port | quote }} socket_path = {{ .Values.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml index e4022f3..ec35eab 100644 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml +++ b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml @@ -39,6 +39,9 @@ rules: - apiGroups: [""] resources: ["events"] verbs: ["create"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding From 977468bc6af27252235781ea61b75f9879a98565 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 12:38:40 +0100 Subject: [PATCH 79/97] Fix agent connectivity if deployed with different name e.g. if deploying with spire-65de556ac Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index ddbaa10..5cdcf2b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -4,9 +4,9 @@ A Helm chart for deploying spire-server and spire-agent. -> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. +> :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. -> **Note**: Minimum Spire version is `v1.5.3`. +> :warning: Minimum Spire version is `v1.0.2`. To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. From 0d49280cdae5114418adaacfe98f9f8edef73e29 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 16 Jan 2023 13:02:11 +0100 Subject: [PATCH 80/97] Add support for spire-controller-manager Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/README.md | 1 - charts/spire/charts/spire-server/README.md | 12 +- .../crds/clusterfederatedtrustdomains.yaml | 96 ++++++++ .../spire-server/crds/clusterspiffeids.yaml | 221 ++++++++++++++++++ .../crds/controllermanagerconfigs.yaml | 59 +++++ .../spire-server/templates/_helpers.tpl | 4 + .../controller-manager-configmap.yaml | 32 +++ .../templates/controller-manager-roles.yaml | 80 +++++++ .../templates/controller-manager-service.yaml | 22 ++ .../templates/controller-manager-webhook.yaml | 35 +++ .../spire-server/templates/statefulset.yaml | 37 +++ charts/spire/charts/spire-server/values.yaml | 37 +++ charts/spire/values.yaml | 2 - 13 files changed, 634 insertions(+), 4 deletions(-) create mode 100644 charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml create mode 100644 charts/spire/charts/spire-server/crds/clusterspiffeids.yaml create mode 100644 charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-roles.yaml create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-service.yaml create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml diff --git a/charts/spire/README.md b/charts/spire/README.md index 5cdcf2b..75b3abb 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -68,7 +68,6 @@ Kubernetes: `>=1.21.0-0` | spire-server.bundleConfigMap | string | `"spire-bundle"` | | | spire-server.clusterName | string | `"example-cluster"` | | | spire-server.nameOverride | string | `"server"` | | -| spire-server.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | | spire-server.trustDomain | string | `"example.org"` | | ---------------------------------------------- diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 869e79f..ac57838 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -18,6 +18,16 @@ A Helm chart to install the SPIRE server. | ca_subject.country | string | `"NL"` | | | ca_subject.organization | string | `"Example"` | | | clusterName | string | `"example-cluster"` | | +| controllerManager.enabled | bool | `false` | | +| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | | +| controllerManager.image.registry | string | `"ghcr.io"` | | +| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | | +| controllerManager.image.version | string | `"0.2.1"` | | +| controllerManager.resources | object | `{}` | | +| controllerManager.securityContext | object | `{}` | | +| controllerManager.service.annotations | object | `{}` | | +| controllerManager.service.port | int | `443` | | +| controllerManager.service.type | string | `"ClusterIP"` | | | dataStorage.accessMode | string | `"ReadWriteOnce"` | | | dataStorage.enabled | bool | `true` | | | dataStorage.size | string | `"1Gi"` | | @@ -29,7 +39,7 @@ A Helm chart to install the SPIRE server. | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | jwtIssuer | string | `"oidc-discovery.example.org"` | | -| k8sWorkloadRegistrar.enabled | bool | `true` | | +| k8sWorkloadRegistrar.enabled | bool | `true` | The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` A next release will switch to use the `spire-controller-manager` by default. | | k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | | k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` | | | k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | diff --git a/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml b/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml new file mode 100644 index 0000000..91aae17 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/clusterfederatedtrustdomains.yaml @@ -0,0 +1,96 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: clusterfederatedtrustdomains.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ClusterFederatedTrustDomain + listKind: ClusterFederatedTrustDomainList + plural: clusterfederatedtrustdomains + singular: clusterfederatedtrustdomain + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.trustDomain + name: Trust Domain + type: string + - jsonPath: .spec.bundleEndpointURL + name: Endpoint URL + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterFederatedTrustDomainSpec defines the desired state + of ClusterFederatedTrustDomain + properties: + bundleEndpointProfile: + description: BundleEndpointProfile is the profile for the bundle endpoint. + properties: + endpointSPIFFEID: + description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint. + It is required for the "https_spiffe" profile. + type: string + type: + description: Type is the type of the bundle endpoint profile. + enum: + - https_spiffe + - https_web + type: string + required: + - type + type: object + bundleEndpointURL: + description: BundleEndpointURL is the URL of the bundle endpoint. + It must be an HTTPS URL and cannot contain userinfo (i.e. username/password). + type: string + trustDomain: + description: TrustDomain is the name of the trust domain to federate + with (e.g. example.org) + pattern: '[a-z0-9._-]{1,255}' + type: string + trustDomainBundle: + description: TrustDomainBundle is the contents of the bundle for the + referenced trust domain. This field is optional when the resource + is created. + type: string + required: + - bundleEndpointProfile + - bundleEndpointURL + - trustDomain + type: object + status: + description: ClusterFederatedTrustDomainStatus defines the observed state + of ClusterFederatedTrustDomain + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml b/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml new file mode 100644 index 0000000..74758a5 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/clusterspiffeids.yaml @@ -0,0 +1,221 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: clusterspiffeids.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ClusterSPIFFEID + listKind: ClusterSPIFFEIDList + plural: clusterspiffeids + singular: clusterspiffeid + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterSPIFFEID is the Schema for the clusterspiffeids API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID + properties: + admin: + description: Admin indicates whether or not the SVID can be used to + access the SPIRE administrative APIs. Extra care should be taken + to only apply this SPIFFE ID to admin workloads. + type: boolean + dnsNameTemplates: + description: DNSNameTemplate represents templates for extra DNS names + that are applicable to SVIDs minted for this ClusterSPIFFEID. The + node and pod spec are made available to the template under .NodeSpec, + .PodSpec respectively. + items: + type: string + type: array + federatesWith: + description: FederatesWith is a list of trust domain names that workloads + that obtain this SPIFFE ID will federate with. + items: + type: string + type: array + namespaceSelector: + description: NamespaceSelector selects the namespaces that are targetted + by this CRD. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + podSelector: + description: PodSelector selects the pods that are targetted by this + CRD. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + spiffeIDTemplate: + description: SPIFFEID is the SPIFFE ID template. The node and pod + spec are made available to the template under .NodeSpec, .PodSpec + respectively. + type: string + ttl: + description: TTL indicates an upper-bound time-to-live for SVIDs minted + for this ClusterSPIFFEID. If unset, a default will be chosen. + type: string + workloadSelectorTemplates: + description: WorkloadSelectorTemplates are templates to produce arbitrary + workload selectors that apply to a given workload before it will + receive this SPIFFE ID. The rendered value is interpreted by SPIRE + and are of the form type:value, where the value may, and often does, + contain semicolons, .e.g., k8s:container-image:docker/hello-world + The node and pod spec are made available to the template under .NodeSpec, + .PodSpec respectively. + items: + type: string + type: array + required: + - spiffeIDTemplate + type: object + status: + description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID + properties: + stats: + description: Stats produced by the last entry reconciliation run + properties: + entriesMasked: + description: How many entries were masked by entries for other + ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs + produce an entry for the same pod with the same set of workload + selectors. + type: integer + entriesToSet: + description: How many entries are to be set for this ClusterSPIFFEID. + In nominal conditions, this should reflect the number of pods + selected, but not always if there were problems encountered + rendering an entry for the pod (RenderFailures) or entries are + masked (EntriesMasked). + type: integer + entryFailures: + description: How many entries were unable to be set due to failures + to create or update the entries via the SPIRE Server API. + type: integer + namespacesIgnored: + description: How many (selected) namespaces were ignored (based + on configuration). + type: integer + namespacesSelected: + description: How many namespaces were selected. + type: integer + podEntryRenderFailures: + description: How many failures were encountered rendering an entry + selected pods. This could be due to either a bad template in + the ClusterSPIFFEID or Pod metadata that when applied to the + template did not produce valid entry values. + type: integer + podsSelected: + description: How many pods were selected out of the namespaces. + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml b/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml new file mode 100644 index 0000000..7845a10 --- /dev/null +++ b/charts/spire/charts/spire-server/crds/controllermanagerconfigs.yaml @@ -0,0 +1,59 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.8.0 + creationTimestamp: null + name: controllermanagerconfigs.spire.spiffe.io +spec: + group: spire.spiffe.io + names: + kind: ControllerManagerConfig + listKind: ControllerManagerConfigList + plural: controllermanagerconfigs + singular: controllermanagerconfig + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ControllerManagerConfig is the Schema for the controllermanagerconfigs + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ControllerManagerConfigSpec defines the desired state of + ControllerManagerConfig + properties: + foo: + description: Foo is an example field of ControllerManagerConfig. Edit + controllermanagerconfig_types.go to remove/update + type: string + type: object + status: + description: ControllerManagerConfigStatus defines the observed state + of ControllerManagerConfig + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index e7124d6..9e68939 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -85,6 +85,10 @@ Create the name of the service account to use {{- end -}} {{- end }} +{{- define "spire-controller-manager.fullname" -}} +{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager +{{- end }} + {{- define "spire-k8s-workload-registrar.fullname" -}} {{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar {{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml new file mode 100644 index 0000000..0d40782 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -0,0 +1,32 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "spire-controller-manager.fullname" . }} + namespace: {{ .Release.Namespace }} +data: + controller-manager-config.yaml: | + apiVersion: spire.spiffe.io/v1alpha1 + kind: ControllerManagerConfig + metadata: + name: {{ include "spire-controller-manager.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-server.labels" . | nindent 8 }} + metrics: + bindAddress: 127.0.0.1:8082 + healthProbe: + bindAddress: 127.0.0.1:8083 + leaderElection: + leaderElect: true + resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io + resourceNamespace: {{ .Release.Namespace }} + clusterName: {{ .Values.clusterName }} + trustDomain: {{ .Values.trustDomain }} + ignoreNamespaces: + - kube-system + - kube-public + - {{ .Release.Namespace }} + - local-path-storage + spireServerSocketPath: {{ .Values.socketPath | quote }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml new file mode 100644 index 0000000..795a06f --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-roles.yaml @@ -0,0 +1,80 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-leader-election + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-leader-election + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "spire-controller-manager.fullname" . }}-leader-election +subjects: +- kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "spire-controller-manager.fullname" . }} +rules: + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["get", "list", "watch"] + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations"] + verbs: ["get", "list", "patch", "watch"] + - apiGroups: [""] + resources: ["nodes"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "watch"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains/finalizers"] + verbs: ["update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterfederatedtrustdomains/status"] + verbs: ["get", "patch", "update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids"] + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids/finalizers"] + verbs: ["update"] + - apiGroups: ["spire.spiffe.io"] + resources: ["clusterspiffeids/status"] + verbs: ["get", "patch", "update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "spire-controller-manager.fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "spire-controller-manager.fullname" . }} +subjects: +- kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-service.yaml b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml new file mode 100644 index 0000000..c7a33a0 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-service.yaml @@ -0,0 +1,22 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} + {{- with .Values.controllerManager.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} +spec: + type: {{ .Values.controllerManager.service.type }} + ports: + - name: https + port: {{ .Values.controllerManager.service.port }} + targetPort: https + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml new file mode 100644 index 0000000..3a9dcf6 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-webhook.yaml @@ -0,0 +1,35 @@ +{{- if eq (.Values.controllerManager.enabled | toString) "true" }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "spire-controller-manager.fullname" . }}-webhook +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain + failurePolicy: Fail + name: vclusterfederatedtrustdomain.kb.io + rules: + - apiGroups: ["spire.spiffe.io"] + apiVersions: ["v1alpha1"] + operations: ["CREATE", "UPDATE"] + resources: ["clusterfederatedtrustdomains"] + sideEffects: None + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: {{ include "spire-controller-manager.fullname" . }}-webhook + namespace: {{ .Release.Namespace }} + path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid + failurePolicy: Fail + name: vclusterspiffeid.kb.io + rules: + - apiGroups: ["spire.spiffe.io"] + apiVersions: ["v1alpha1"] + operations: ["CREATE", "UPDATE"] + resources: ["clusterspiffeids"] + sideEffects: None +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index c9b81f7..dc2b978 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -99,6 +99,38 @@ spec: mountPath: /run/spire/k8s-workload-registrar/config readOnly: true {{- end }} + {{- if eq (.Values.controllerManager.enabled | toString) "true" }} + - name: spire-controller-manager + securityContext: + {{- toYaml .Values.controllerManager.securityContext | nindent 12 }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }} + imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }} + args: + - --config=controller-manager-config.yaml + ports: + - name: https + containerPort: 9443 + protocol: TCP + # TODO: implement probes + # livenessProbe: + # httpGet: + # path: / + # port: https + # readinessProbe: + # httpGet: + # path: / + # port: https + resources: + {{- toYaml .Values.controllerManager.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: true + - name: controller-manager-config + mountPath: /controller-manager-config.yaml + subPath: controller-manager-config.yaml + readOnly: true + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -133,6 +165,11 @@ spec: configMap: name: {{ include "spire-k8s-workload-registrar.fullname" . }} {{- end }} + {{- if eq (.Values.controllerManager.enabled | toString) "true" }} + - name: controller-manager-config + configMap: + name: {{ include "spire-controller-manager.fullname" . }} + {{- end }} volumeClaimTemplates: {{- if eq (.Values.dataStorage.enabled | toString) "true" }} - metadata: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index cb1693c..86ec2de 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -107,7 +107,44 @@ upstreamAuthority: key: "" bundle: "" +controllerManager: + enabled: false + + image: + registry: ghcr.io + repository: spiffe/spire-controller-manager + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "0.2.1" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + + service: + type: ClusterIP + port: 443 + annotations: {} + k8sWorkloadRegistrar: + # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` + # A next release will switch to use the `spire-controller-manager` by default. enabled: true image: diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 16cf92c..310fe73 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -9,8 +9,6 @@ spire-server: clusterName: &clusterName "example-cluster" trustDomain: &trustDomain "example.org" - socketPath: &serverSocketPath /run/spire/server-sockets/spire-server.sock - spire-agent: nameOverride: agent bundleConfigMap: *bundleConfigMap From 31a75aeb437a8cb44aa9d65831cfe2ced057b170 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 16 Jan 2023 16:04:13 +0100 Subject: [PATCH 81/97] Bump minimum spire version to 1.5.4 Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 6 +++--- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 2 +- charts/spire/charts/spire-agent/README.md | 2 +- charts/spire/charts/spire-server/README.md | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index b8fa0a2..364c572 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.5.3" +appVersion: "1.5.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index 75b3abb..bc3d697 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,12 +1,12 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. -> :warning: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. +> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. -> :warning: Minimum Spire version is `v1.0.2`. +> **Note**: Minimum Spire version is `v1.5.3`. To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM. diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index b55240b..9c59615 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -1,6 +1,6 @@ # spiffe-oidc-discovery-provider -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 157e890..90e77f9 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -1,6 +1,6 @@ # spire-agent -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIRE agent. diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ac57838..2730c86 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -1,6 +1,6 @@ # spire-server -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIRE server. From 456c9cc53b1c2ff9c5e3baeff2e30727f8d99ff3 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 16 Jan 2023 16:01:40 +0100 Subject: [PATCH 82/97] Add by default k8s workload registrar compatible SPIFFEIDs to controller-manager setup Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 5 +++++ .../controller-manager-cluster-ids.yaml | 19 +++++++++++++++++++ .../controller-manager-configmap.yaml | 3 +++ charts/spire/charts/spire-server/values.yaml | 12 ++++++++++++ 4 files changed, 39 insertions(+) create mode 100644 charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2730c86..7f248f9 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -19,6 +19,11 @@ A Helm chart to install the SPIRE server. | ca_subject.organization | string | `"Example"` | | | clusterName | string | `"example-cluster"` | | | controllerManager.enabled | bool | `false` | | +| controllerManager.identities.dnsNameTemplates | list | `[]` | | +| controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.podSelector | object | `{}` | | +| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | +| controllerManager.ignoreNamespaces | list | `[]` | | | controllerManager.image.pullPolicy | string | `"IfNotPresent"` | | | controllerManager.image.registry | string | `"ghcr.io"` | | | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml new file mode 100644 index 0000000..2818c1f --- /dev/null +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -0,0 +1,19 @@ +{{- $root := . }} +{{- with .Values.controllerManager }} +{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }} +apiVersion: spire.spiffe.io/v1alpha1 +kind: ClusterSPIFFEID +metadata: + name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based +spec: + spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }} + {{- with .identities.podSelector }} + podSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .identities.dnsNameTemplates }} + dnsNameTemplates: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 0d40782..5a2edb3 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -28,5 +28,8 @@ data: - kube-public - {{ .Release.Namespace }} - local-path-storage + {{- with .Values.controllerManager.ignoreNamespaces }} + {{- toYaml . | nindent 6 }} + {{- end }} spireServerSocketPath: {{ .Values.socketPath | quote }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 86ec2de..091cb07 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -142,6 +142,18 @@ controllerManager: port: 443 annotations: {} + ignoreNamespaces: [] + + identities: + enabled: true + + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }} + podSelector: {} + # matchLabels: + # spiffe.io/spiffe-id: "true" + dnsNameTemplates: [] + # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' + k8sWorkloadRegistrar: # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` # A next release will switch to use the `spire-controller-manager` by default. From 225931565a301167629466d77de3436274fad981 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 16 Jan 2023 17:11:06 +0100 Subject: [PATCH 83/97] Include spire namespace to fix oidc-provider Signed-off-by: Marco Franssen Co-authored-by: Gert Jan Kamstra Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 4 +++- .../spire-server/templates/controller-manager-configmap.yaml | 4 ---- charts/spire/charts/spire-server/values.yaml | 5 ++++- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 7f248f9..d4de0d9 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -23,7 +23,9 @@ A Helm chart to install the SPIRE server. | controllerManager.identities.enabled | bool | `true` | | | controllerManager.identities.podSelector | object | `{}` | | | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | -| controllerManager.ignoreNamespaces | list | `[]` | | +| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | +| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | | +| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | | | controllerManager.image.pullPolicy | string | `"IfNotPresent"` | | | controllerManager.image.registry | string | `"ghcr.io"` | | | controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index 5a2edb3..b177acc 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -24,10 +24,6 @@ data: clusterName: {{ .Values.clusterName }} trustDomain: {{ .Values.trustDomain }} ignoreNamespaces: - - kube-system - - kube-public - - {{ .Release.Namespace }} - - local-path-storage {{- with .Values.controllerManager.ignoreNamespaces }} {{- toYaml . | nindent 6 }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 091cb07..5b3d429 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -142,7 +142,10 @@ controllerManager: port: 443 annotations: {} - ignoreNamespaces: [] + ignoreNamespaces: + - kube-system + - kube-public + - local-path-storage identities: enabled: true From 3018ef84691e95181a9526f32265493f773875f5 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 09:45:08 +0100 Subject: [PATCH 84/97] Add icon to spire chart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 364c572..3057e12 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -33,6 +33,7 @@ keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: - https://github.com/philips-labs/helm-charts/charts/spire +icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png maintainers: - name: marcofranssen email: marco.franssen@gmail.com From 8be96e4530f68886f9671bbc64c8fd88c4d6e23a Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 11:31:45 +0100 Subject: [PATCH 85/97] Fix spire validating webhook configuration Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spire-server/templates/controller-manager-configmap.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index b177acc..a447676 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -21,6 +21,7 @@ data: leaderElect: true resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ .Release.Namespace }} + validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook clusterName: {{ .Values.clusterName }} trustDomain: {{ .Values.trustDomain }} ignoreNamespaces: From 5fe83469ba1ea05c4f8f4de96c8cbd4e2ec41621 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 14:57:24 +0100 Subject: [PATCH 86/97] Fix link to sources Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 4 ++-- charts/spire/README.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 3057e12..1e0bd28 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -30,9 +30,9 @@ type: application version: 0.1.0 appVersion: "1.5.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] -home: https://github.com/philips-labs/helm-charts/charts/spire +home: https://github.com/philips-labs/helm-charts/tree/main/charts/spire sources: - - https://github.com/philips-labs/helm-charts/charts/spire + - https://github.com/philips-labs/helm-charts/tree/main/charts/spire icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png maintainers: - name: marcofranssen diff --git a/charts/spire/README.md b/charts/spire/README.md index bc3d697..5df6990 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -28,7 +28,7 @@ spec: - --service-account-signing-key-file=/run/config/pki/sa.key ``` -**Homepage:** +**Homepage:** ## Maintainers @@ -38,7 +38,7 @@ spec: ## Source Code -* +* ## Requirements From 5c8f1a7c9b4c872a8b771d90138e7ca723fac97b Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 17 Jan 2023 14:59:19 +0100 Subject: [PATCH 87/97] Add spire-controller-manager keyword to chart Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 1e0bd28..b062568 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -29,7 +29,7 @@ description: | type: application version: 0.1.0 appVersion: "1.5.4" -keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"] +keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/philips-labs/helm-charts/tree/main/charts/spire sources: - https://github.com/philips-labs/helm-charts/tree/main/charts/spire From 7d9ab07e238804c88bbb295702368eadeb690e8e Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 18 Jan 2023 12:58:37 +0100 Subject: [PATCH 88/97] Add the namespace to the oidc-discovery-provider allowed dns names Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../spiffe-oidc-discovery-provider/templates/configmap.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index c2f0124..f8a8b8e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -10,7 +10,8 @@ data: domains = [ "{{ include "spiffe-oidc-discovery-provider.fullname" . }}", - "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.svc.cluster.local", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}", + "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local", {{- if gt (len .Values.config.domains) 0 }} "{{- join "\",\n \"" .Values.config.domains }}" {{- end }} From bba395b015d1c764f1baeb3b41ddfcfddd5ca868 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 18 Jan 2023 13:08:37 +0100 Subject: [PATCH 89/97] Add test for oidc discovery provider Signed-off-by: Marco Franssen Signed-off-by: Marco Franssen --- .../templates/tests/test-connection.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index b9a8c5f..c71ad51 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -8,8 +8,16 @@ metadata: "helm.sh/hook": test spec: containers: - - name: wget + - name: wget-service-name image: busybox command: ['wget'] - args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + - name: wget-service-name-namespace + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration'] + - name: wget-service-name-namespace-svc-cluster-local + image: busybox + command: ['wget'] + args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration'] restartPolicy: Never From 34488973165d1dcab9ba136deda29e24c9d63d12 Mon Sep 17 00:00:00 2001 From: Ken Huffman Date: Fri, 3 Feb 2023 09:22:20 -0500 Subject: [PATCH 90/97] Add namespaceSelector for spire-controller-manager (#112) Co-authored-by: Marco Franssen Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 1 + .../templates/controller-manager-cluster-ids.yaml | 4 ++++ charts/spire/charts/spire-server/values.yaml | 3 +++ 3 files changed, 8 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index d4de0d9..8650943 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -21,6 +21,7 @@ A Helm chart to install the SPIRE server. | controllerManager.enabled | bool | `false` | | | controllerManager.identities.dnsNameTemplates | list | `[]` | | | controllerManager.identities.enabled | bool | `true` | | +| controllerManager.identities.namespaceSelector | object | `{}` | | | controllerManager.identities.podSelector | object | `{}` | | | controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | | | controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 2818c1f..6bac89f 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -11,6 +11,10 @@ spec: podSelector: {{- toYaml . | nindent 4 }} {{- end }} + {{- with .identities.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} + {{- end }} {{- with .identities.dnsNameTemplates }} dnsNameTemplates: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5b3d429..9176fac 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -154,6 +154,9 @@ controllerManager: podSelector: {} # matchLabels: # spiffe.io/spiffe-id: "true" + namespaceSelector: {} + # matchLabels: + # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' From b3248e5c9ca3ab4cc443a7170d77f0cec14f3e6b Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 14 Feb 2023 20:11:51 +0100 Subject: [PATCH 91/97] Remove deprecated k8s workload registrar support Signed-off-by: Marco Franssen --- charts/spire/charts/spire-server/README.md | 8 --- .../k8s-workload-registrar-configmap.yaml | 16 ----- .../k8s-workload-registrar-roles.yaml | 59 ------------------- .../k8s-workload-registrar-service.yaml | 22 ------- .../spire-server/templates/statefulset.yaml | 28 --------- charts/spire/charts/spire-server/values.yaml | 34 ----------- 6 files changed, 167 deletions(-) delete mode 100644 charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml delete mode 100644 charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml delete mode 100644 charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8650943..3afd7b3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -47,14 +47,6 @@ A Helm chart to install the SPIRE server. | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | jwtIssuer | string | `"oidc-discovery.example.org"` | | -| k8sWorkloadRegistrar.enabled | bool | `true` | The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` A next release will switch to use the `spire-controller-manager` by default. | -| k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` | | -| k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | -| k8sWorkloadRegistrar.image.version | string | `""` | | -| k8sWorkloadRegistrar.logLevel | string | `"info"` | | -| k8sWorkloadRegistrar.resources | object | `{}` | | -| k8sWorkloadRegistrar.securityContext | object | `{}` | | | logLevel | string | `"info"` | | | nameOverride | string | `""` | | | nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml deleted file mode 100644 index 5cdcc86..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -data: - workload-registrar.conf: | - log_level = "{{ .Values.k8sWorkloadRegistrar.logLevel }}" - mode = "reconcile" - trust_domain = {{ .Values.trustDomain | quote }} - cluster = {{ .Values.clusterName | quote }} - server_address = "unix://{{ .Values.socketPath }}" - leader_election = true - metrics_addr = "0.0.0.0:18080" -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml deleted file mode 100644 index ec35eab..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml +++ /dev/null @@ -1,59 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree. -# These roles are needed for the k8s registrar to work properly in reconciling mode. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -rules: - - apiGroups: [""] - resources: ["pods", "nodes", "endpoints"] - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["create"] - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["controller-leader-election-helper"] - verbs: ["update", "get"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - apiGroup: rbac.authorization.k8s.io -subjects: - - kind: ServiceAccount - name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml deleted file mode 100644 index 1fd54b7..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} - {{- with .Values.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "spire-server.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - name: https - port: 443 - targetPort: k8s-registrar - protocol: TCP - selector: - {{- include "spire-server.selectorLabels" . | nindent 4 }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index dc2b978..3d71059 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -76,29 +76,6 @@ spec: mountPath: /run/spire/upstream_ca readOnly: false {{ end }} - {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} - - name: spire-k8s-workload-registrar - securityContext: - {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }} - imagePullPolicy: {{ .Values.k8sWorkloadRegistrar.image.pullPolicy }} - args: - - -config - - /run/spire/k8s-workload-registrar/config/workload-registrar.conf - ports: - - name: k8s-registrar - containerPort: 9443 - protocol: TCP - resources: - {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }} - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: true - - name: k8s-workload-registrar-config - mountPath: /run/spire/k8s-workload-registrar/config - readOnly: true - {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: spire-controller-manager securityContext: @@ -160,11 +137,6 @@ spec: secret: secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} - {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} - - name: k8s-workload-registrar-config - configMap: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: controller-manager-config configMap: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9176fac..9efa2c0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -159,37 +159,3 @@ controllerManager: # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' - -k8sWorkloadRegistrar: - # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` - # A next release will switch to use the `spire-controller-manager` by default. - enabled: true - - image: - registry: gcr.io - repository: spiffe-io/k8s-workload-registrar - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - logLevel: info From ff9ab8693c5439a99228e67251bb62318907c7eb Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 14 Feb 2023 20:30:59 +0100 Subject: [PATCH 92/97] Replace LICENSE Signed-off-by: Marco Franssen --- charts/spire/LICENSE | 214 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 197 insertions(+), 17 deletions(-) diff --git a/charts/spire/LICENSE b/charts/spire/LICENSE index fff6bbb..261eeb9 100644 --- a/charts/spire/LICENSE +++ b/charts/spire/LICENSE @@ -1,21 +1,201 @@ -MIT License + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ -Copyright (c) 2020 Koninklijke Philips N.V, https://www.philips.com + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: + 1. Definitions. -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. From 4e1d3d78bb0079f4c9a5969053e36ae1830ccafc Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Tue, 14 Feb 2023 20:39:50 +0100 Subject: [PATCH 93/97] Improve README.md and artifacthub.io Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 28 +----------- charts/spire/README.md | 9 ++-- charts/spire/README.md.gotmpl | 45 +++++++++++++++++++ .../spire/charts/spiffe-csi-driver/README.md | 3 +- .../charts/spiffe-csi-driver/README.md.gotmpl | 21 +++++++++ .../spiffe-oidc-discovery-provider/README.md | 3 +- .../README.md.gotmpl | 21 +++++++++ charts/spire/charts/spire-agent/README.md | 3 +- .../spire/charts/spire-agent/README.md.gotmpl | 21 +++++++++ charts/spire/charts/spire-server/README.md | 3 +- .../charts/spire-server/README.md.gotmpl | 21 +++++++++ 11 files changed, 144 insertions(+), 34 deletions(-) create mode 100644 charts/spire/README.md.gotmpl create mode 100644 charts/spire/charts/spiffe-csi-driver/README.md.gotmpl create mode 100644 charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl create mode 100644 charts/spire/charts/spire-agent/README.md.gotmpl create mode 100644 charts/spire/charts/spire-server/README.md.gotmpl diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index b062568..e6c6696 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -1,31 +1,7 @@ apiVersion: v2 name: spire -description: | - A Helm chart for deploying spire-server and spire-agent. - - > **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. - - > **Note**: Minimum Spire version is `v1.5.3`. - - To enable Projected Service Account Tokens on Docker for Mac/Windows run the following - command to SSH into the Docker Desktop K8s VM. - - ```bash - docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh - ``` - - Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` - - ```yaml - spec: - containers: - - command: - - kube-apiserver - - --api-audiences=api,spire-server - - --service-account-issuer=api,spire-agent - - --service-account-key-file=/run/config/pki/sa.pub - - --service-account-signing-key-file=/run/config/pki/sa.key - ``` +description: > + A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.1.0 appVersion: "1.5.4" diff --git a/charts/spire/README.md b/charts/spire/README.md index 5df6990..e831202 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,8 +1,12 @@ # spire + + ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) -A Helm chart for deploying spire-server and spire-agent. +A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. + +**Homepage:** > **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. @@ -28,8 +32,6 @@ spec: - --service-account-signing-key-file=/run/config/pki/sa.key ``` -**Homepage:** - ## Maintainers | Name | Email | Url | @@ -71,4 +73,3 @@ Kubernetes: `>=1.21.0-0` | spire-server.trustDomain | string | `"example.org"` | | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/README.md.gotmpl b/charts/spire/README.md.gotmpl new file mode 100644 index 0000000..677a8f4 --- /dev/null +++ b/charts/spire/README.md.gotmpl @@ -0,0 +1,45 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server. + +> **Note**: Minimum Spire version is `v1.5.3`. + +To enable Projected Service Account Tokens on Docker for Mac/Windows run the following +command to SSH into the Docker Desktop K8s VM. + +```bash +docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh +``` + +Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml` + +```yaml +spec: + containers: + - command: + - kube-apiserver + - --api-audiences=api,spire-server + - --service-account-issuer=api,spire-agent + - --service-account-key-file=/run/config/pki/sa.pub + - --service-account-signing-key-file=/run/config/pki/sa.key +``` + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 9038f62..4b4579e 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -1,5 +1,7 @@ # spiffe-csi-driver + + ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square) A Helm chart to install the SPIFFE CSI driver. @@ -33,4 +35,3 @@ A Helm chart to install the SPIFFE CSI driver. | serviceAccount.name | string | `""` | | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index 9c59615..eaaf064 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -1,5 +1,7 @@ # spiffe-oidc-discovery-provider + + ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIFFE OIDC discovery provider. @@ -51,4 +53,3 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | trustDomain | string | `"example.org"` | | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 90e77f9..dd4af6d 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -1,5 +1,7 @@ # spire-agent + + ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIRE agent. @@ -36,4 +38,3 @@ A Helm chart to install the SPIRE agent. | waitForIt.resources | object | `{}` | | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spire-agent/README.md.gotmpl b/charts/spire/charts/spire-agent/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spire-agent/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 3afd7b3..d0571d6 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -1,5 +1,7 @@ # spire-server + + ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.4](https://img.shields.io/badge/AppVersion-1.5.4-informational?style=flat-square) A Helm chart to install the SPIRE server. @@ -71,4 +73,3 @@ A Helm chart to install the SPIRE server. | upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | ---------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/spire/charts/spire-server/README.md.gotmpl b/charts/spire/charts/spire-server/README.md.gotmpl new file mode 100644 index 0000000..13545c4 --- /dev/null +++ b/charts/spire/charts/spire-server/README.md.gotmpl @@ -0,0 +1,21 @@ +{{ template "chart.header" . }} + + + +{{ template "chart.deprecationWarning" . }} + +{{ template "chart.badgesSection" . }} + +{{ template "chart.description" . }} + +{{ template "chart.homepageLine" . }} + +{{ template "chart.maintainersSection" . }} + +{{ template "chart.sourcesSection" . }} + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + +---------------------------------------------- From 50846ebe9a122ce05fbc11ffb8b5142a53054b16 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 16 Feb 2023 10:38:01 +0100 Subject: [PATCH 94/97] Improve spiffe-csi security-context Co-authored-by: Faisal Memon Signed-off-by: Marco Franssen --- .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 40e72b9..c9c06d0 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -56,6 +56,10 @@ spec: mountPropagation: Bidirectional name: mountpoint-dir securityContext: + readOnlyRootFilesystem: true + capabilities: + drop: + - all privileged: true resources: {{- toYaml .Values.resources | nindent 12 }} From 99d32050ba584059542af2202a3c162a8bae22a2 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Thu, 16 Feb 2023 11:04:08 +0100 Subject: [PATCH 95/97] Remove option to choose different agent socket path Resolves #19 Signed-off-by: Marco Franssen --- charts/spire/README.md | 3 +-- charts/spire/charts/spiffe-csi-driver/README.md | 1 - .../charts/spiffe-csi-driver/templates/daemonset.yaml | 4 ++-- charts/spire/charts/spiffe-csi-driver/values.yaml | 2 -- .../spire/charts/spiffe-oidc-discovery-provider/README.md | 1 - .../templates/configmap.yaml | 2 +- .../charts/spiffe-oidc-discovery-provider/values.yaml | 1 - charts/spire/charts/spire-agent/README.md | 1 - charts/spire/charts/spire-agent/templates/configmap.yaml | 2 +- charts/spire/charts/spire-agent/templates/daemonset.yaml | 4 ++-- charts/spire/charts/spire-agent/values.yaml | 1 - charts/spire/templates/_helpers.tpl | 8 ++++++++ charts/spire/values.yaml | 5 +---- 13 files changed, 16 insertions(+), 19 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index e831202..8f23256 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -59,13 +59,12 @@ Kubernetes: `>=1.21.0-0` |-----|------|---------|-------------| | fullnameOverride | string | `""` | | | nameOverride | string | `""` | | -| spiffe-csi-driver.agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| spiffe-csi-driver | object | `{}` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | | | spire-agent.bundleConfigMap | string | `"spire-bundle"` | | | spire-agent.clusterName | string | `"example-cluster"` | | | spire-agent.nameOverride | string | `"agent"` | | -| spire-agent.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | spire-agent.trustDomain | string | `"example.org"` | | | spire-server.bundleConfigMap | string | `"spire-bundle"` | | | spire-server.clusterName | string | `"example-cluster"` | | diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index 4b4579e..03ee62c 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -10,7 +10,6 @@ A Helm chart to install the SPIFFE CSI driver. | Key | Type | Default | Description | |-----|------|---------|-------------| -| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | fullnameOverride | string | `""` | | | image.pullPolicy | string | `"IfNotPresent"` | | | image.registry | string | `"ghcr.io"` | | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index c9c06d0..1e02f6a 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -96,11 +96,11 @@ spec: volumes: - name: spire-agent-sockets hostPath: - path: {{ dir .Values.agentSocketPath }} + path: {{ include "spire.agent-socket-path" . | dir }} type: DirectoryOrCreate - name: spire-agent-socket-dir hostPath: - path: {{ dir .Values.agentSocketPath }} + path: {{ include "spire.agent-socket-path" . | dir }} type: DirectoryOrCreate # This volume is where the socket for kubelet->driver communication lives - name: spiffe-csi-socket-dir diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index bf3760b..b6be7ee 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -63,5 +63,3 @@ nodeDriverRegistrar: # limits: # cpu: 100m # memory: 64Mi - -agentSocketPath: /run/spire/agent-sockets/spire-agent.sock diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index eaaf064..3499858 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -11,7 +11,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | Key | Type | Default | Description | |-----|------|---------|-------------| | affinity | object | `{}` | | -| agentSocketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | autoscaling.enabled | bool | `false` | | | autoscaling.maxReplicas | int | `5` | | | autoscaling.minReplicas | int | `1` | | diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml index f8a8b8e..b44c456 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml @@ -30,7 +30,7 @@ data: {{- end }} workload_api { - socket_path = "/spiffe-workload-api/{{ splitList "/" .Values.agentSocketPath | last }}" + socket_path = "/spiffe-workload-api/{{ include "spire.agent-socket-path" . | splitList "/" | last }}" trust_domain = "{{ .Values.trustDomain }}" } diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 768214a..a4b6827 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -109,5 +109,4 @@ tolerations: [] affinity: {} -agentSocketPath: /run/spire/agent-sockets/spire-agent.sock trustDomain: "example.org" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index dd4af6d..3b90505 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -29,7 +29,6 @@ A Helm chart to install the SPIRE agent. | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | -| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | | trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"cgr.dev"` | | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 0f2fc85..55d4e78 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -10,7 +10,7 @@ data: log_level = {{ .Values.logLevel | quote }} server_address = "{{ .Release.Name }}-server" server_port = {{ .Values.server.port | quote }} - socket_path = {{ .Values.socketPath | quote }} + socket_path = {{ include "spire.agent-socket-path" . | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" trust_domain = {{ .Values.trustDomain | quote }} } diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 248e824..acee537 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -51,7 +51,7 @@ spec: mountPath: /run/spire/bundle readOnly: true - name: spire-agent-socket-dir - mountPath: {{ dir .Values.socketPath }} + mountPath: {{ include "spire.agent-socket-path" . | dir }} readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -89,5 +89,5 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: {{ dir .Values.socketPath }} + path: {{ include "spire.agent-socket-path" . | dir }} type: DirectoryOrCreate diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index e636778..607e04f 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -53,7 +53,6 @@ nodeSelector: kubernetes.io/arch: amd64 logLevel: info -socketPath: /run/spire/agent-sockets/spire-agent.sock clusterName: example-cluster trustDomain: example.org diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index 7d7d356..e052bfc 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -29,3 +29,11 @@ Create chart name and version as used by the chart label. {{- define "spire.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} + +{{- define "spire.agent-socket-path" -}} +{{- print "/run/spire/agent-sockets/spire-agent.sock" }} +{{- end }} + +{{- define "spire.server-socket-path" -}} +{{- print "/run/spire/server-sockets/spire-server.sock" }} +{{- end }} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 310fe73..7e26097 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -16,10 +16,7 @@ spire-agent: clusterName: *clusterName trustDomain: *trustDomain - socketPath: &agentSocketPath /run/spire/agent-sockets/spire-agent.sock - -spiffe-csi-driver: - agentSocketPath: *agentSocketPath +spiffe-csi-driver: {} spiffe-oidc-discovery-provider: enabled: false From 73d4ed2ee5e9968d062e22758f4c8509613d8740 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sat, 18 Feb 2023 13:06:31 +0100 Subject: [PATCH 96/97] Add .gitignore for the bin folder containing helm-docs Signed-off-by: Marco Franssen --- .gitignore | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 34ca862..6df9c8e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -.github/scripts/bin -.idea/ \ No newline at end of file +bin/ +.idea/ From cb3f94022fe84feedd888fbb695ecb9984f20013 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sat, 18 Feb 2023 13:19:09 +0100 Subject: [PATCH 97/97] Remove duplicate volume creation Signed-off-by: Marco Franssen --- .../spire/charts/spiffe-csi-driver/templates/daemonset.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 1e02f6a..6a681df 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -94,10 +94,6 @@ spec: resources: {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }} volumes: - - name: spire-agent-sockets - hostPath: - path: {{ include "spire.agent-socket-path" . | dir }} - type: DirectoryOrCreate - name: spire-agent-socket-dir hostPath: path: {{ include "spire.agent-socket-path" . | dir }}