Merge pull request #14 from spiffe/base-chart
This commit is contained in:
Marco Franssen
+1
-1
@@ -1,2 +1,2 @@
|
|||||||
.github/scripts/bin
|
bin/
|
||||||
.idea/
|
.idea/
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
@@ -0,0 +1,31 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spire
|
||||||
|
description: >
|
||||||
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "1.5.4"
|
||||||
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
|
home: https://github.com/philips-labs/helm-charts/tree/main/charts/spire
|
||||||
|
sources:
|
||||||
|
- https://github.com/philips-labs/helm-charts/tree/main/charts/spire
|
||||||
|
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||||
|
maintainers:
|
||||||
|
- name: marcofranssen
|
||||||
|
email: [email protected]
|
||||||
|
url: https://marcofranssen.nl
|
||||||
|
kubeVersion: ">=1.21.0-0"
|
||||||
|
dependencies:
|
||||||
|
- name: spire-server
|
||||||
|
repository: file://./charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-agent
|
||||||
|
repository: file://./charts/spire-agent
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spiffe-csi-driver
|
||||||
|
repository: file://./charts/spiffe-csi-driver
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spiffe-oidc-discovery-provider
|
||||||
|
condition: spiffe-oidc-discovery-provider.enabled
|
||||||
|
repository: file://./charts/spiffe-oidc-discovery-provider
|
||||||
|
version: 0.1.0
|
||||||
@@ -0,0 +1,201 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright [yyyy] [name of copyright owner]
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
@@ -0,0 +1,74 @@
|
|||||||
|
# spire
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
|
||||||
|
**Homepage:** <https://github.com/philips-labs/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
|
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
||||||
|
|
||||||
|
> **Note**: Minimum Spire version is `v1.5.3`.
|
||||||
|
|
||||||
|
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
||||||
|
command to SSH into the Docker Desktop K8s VM.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- command:
|
||||||
|
- kube-apiserver
|
||||||
|
- --api-audiences=api,spire-server
|
||||||
|
- --service-account-issuer=api,spire-agent
|
||||||
|
- --service-account-key-file=/run/config/pki/sa.pub
|
||||||
|
- --service-account-signing-key-file=/run/config/pki/sa.key
|
||||||
|
```
|
||||||
|
|
||||||
|
## Maintainers
|
||||||
|
|
||||||
|
| Name | Email | Url |
|
||||||
|
| ---- | ------ | --- |
|
||||||
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||||
|
|
||||||
|
## Source Code
|
||||||
|
|
||||||
|
* <https://github.com/philips-labs/helm-charts/tree/main/charts/spire>
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
Kubernetes: `>=1.21.0-0`
|
||||||
|
|
||||||
|
| Repository | Name | Version |
|
||||||
|
|------------|------|---------|
|
||||||
|
| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
|
||||||
|
| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
|
||||||
|
| file://./charts/spire-agent | spire-agent | 0.1.0 |
|
||||||
|
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||||
|
|
||||||
|
## Values
|
||||||
|
|
||||||
|
| Key | Type | Default | Description |
|
||||||
|
|-----|------|---------|-------------|
|
||||||
|
| fullnameOverride | string | `""` | |
|
||||||
|
| nameOverride | string | `""` | |
|
||||||
|
| spiffe-csi-driver | object | `{}` | |
|
||||||
|
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
|
||||||
|
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | |
|
||||||
|
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
|
||||||
|
| spire-agent.clusterName | string | `"example-cluster"` | |
|
||||||
|
| spire-agent.nameOverride | string | `"agent"` | |
|
||||||
|
| spire-agent.trustDomain | string | `"example.org"` | |
|
||||||
|
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
|
||||||
|
| spire-server.clusterName | string | `"example-cluster"` | |
|
||||||
|
| spire-server.nameOverride | string | `"server"` | |
|
||||||
|
| spire-server.trustDomain | string | `"example.org"` | |
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,45 @@
|
|||||||
|
{{ template "chart.header" . }}
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
{{ template "chart.deprecationWarning" . }}
|
||||||
|
|
||||||
|
{{ template "chart.badgesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.description" . }}
|
||||||
|
|
||||||
|
{{ template "chart.homepageLine" . }}
|
||||||
|
|
||||||
|
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
||||||
|
|
||||||
|
> **Note**: Minimum Spire version is `v1.5.3`.
|
||||||
|
|
||||||
|
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
||||||
|
command to SSH into the Docker Desktop K8s VM.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||||
|
```
|
||||||
|
|
||||||
|
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- command:
|
||||||
|
- kube-apiserver
|
||||||
|
- --api-audiences=api,spire-server
|
||||||
|
- --service-account-issuer=api,spire-agent
|
||||||
|
- --service-account-key-file=/run/config/pki/sa.pub
|
||||||
|
- --service-account-signing-key-file=/run/config/pki/sa.key
|
||||||
|
```
|
||||||
|
|
||||||
|
{{ template "chart.maintainersSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.sourcesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.requirementsSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.valuesSection" . }}
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spiffe-csi-driver
|
||||||
|
description: A Helm chart to install the SPIFFE CSI driver.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "0.2.1"
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
# spiffe-csi-driver
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart to install the SPIFFE CSI driver.
|
||||||
|
|
||||||
|
## Values
|
||||||
|
|
||||||
|
| Key | Type | Default | Description |
|
||||||
|
|-----|------|---------|-------------|
|
||||||
|
| fullnameOverride | string | `""` | |
|
||||||
|
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| image.registry | string | `"ghcr.io"` | |
|
||||||
|
| image.repository | string | `"spiffe/spiffe-csi-driver"` | |
|
||||||
|
| image.version | string | `""` | |
|
||||||
|
| imagePullSecrets | list | `[]` | |
|
||||||
|
| nameOverride | string | `""` | |
|
||||||
|
| namespaceOverride | string | `""` | |
|
||||||
|
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | |
|
||||||
|
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | |
|
||||||
|
| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
|
||||||
|
| nodeDriverRegistrar.resources | object | `{}` | |
|
||||||
|
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||||
|
| podAnnotations | object | `{}` | |
|
||||||
|
| podSecurityContext | object | `{}` | |
|
||||||
|
| resources | object | `{}` | |
|
||||||
|
| securityContext.privileged | bool | `true` | |
|
||||||
|
| securityContext.readOnlyRootFilesystem | bool | `true` | |
|
||||||
|
| serviceAccount.annotations | object | `{}` | |
|
||||||
|
| serviceAccount.create | bool | `true` | |
|
||||||
|
| serviceAccount.name | string | `""` | |
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{{ template "chart.header" . }}
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
{{ template "chart.deprecationWarning" . }}
|
||||||
|
|
||||||
|
{{ template "chart.badgesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.description" . }}
|
||||||
|
|
||||||
|
{{ template "chart.homepageLine" . }}
|
||||||
|
|
||||||
|
{{ template "chart.maintainersSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.sourcesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.requirementsSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.valuesSection" . }}
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
SPIFFE CSI Driver installed…
|
||||||
@@ -0,0 +1,86 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.namespace" -}}
|
||||||
|
{{- if .Values.namespaceOverride -}}
|
||||||
|
{{- .Values.namespaceOverride -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- .Release.Namespace -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }}
|
||||||
|
{{ include "spiffe-csi-driver.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-csi-driver.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
|
||||||
|
{{- define "spiffe-csi-driver.image" -}}
|
||||||
|
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||||
|
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else if .appVersion -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||||
|
{{- else if .image.version -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-csi-driver.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
# This is the container which runs the SPIFFE CSI driver.
|
||||||
|
- name: {{ .Chart.Name }}
|
||||||
|
image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args: [
|
||||||
|
"-workload-api-socket-dir", "/spire-agent-socket",
|
||||||
|
"-csi-socket-path", "/spiffe-csi/csi.sock",
|
||||||
|
]
|
||||||
|
env:
|
||||||
|
# The CSI driver needs a unique node ID. The node name can be
|
||||||
|
# used for this purpose.
|
||||||
|
- name: MY_NODE_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: spec.nodeName
|
||||||
|
volumeMounts:
|
||||||
|
# The volume containing the SPIRE agent socket. The SPIFFE CSI
|
||||||
|
# driver will mount this directory into containers.
|
||||||
|
- mountPath: /spire-agent-socket
|
||||||
|
name: spire-agent-socket-dir
|
||||||
|
readOnly: true
|
||||||
|
# The volume that will contain the CSI driver socket shared
|
||||||
|
# with the kubelet and the driver registrar.
|
||||||
|
- mountPath: /spiffe-csi
|
||||||
|
name: spiffe-csi-socket-dir
|
||||||
|
# The volume containing mount points for containers.
|
||||||
|
- mountPath: /var/lib/kubelet/pods
|
||||||
|
mountPropagation: Bidirectional
|
||||||
|
name: mountpoint-dir
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- all
|
||||||
|
privileged: true
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
# This container runs the CSI Node Driver Registrar which takes care
|
||||||
|
# of all the little details required to register a CSI driver with
|
||||||
|
# the kubelet.
|
||||||
|
- name: node-driver-registrar
|
||||||
|
image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
|
||||||
|
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
|
||||||
|
args: [
|
||||||
|
"-csi-address", "/spiffe-csi/csi.sock",
|
||||||
|
"-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
|
||||||
|
"-health-port", "9809"
|
||||||
|
]
|
||||||
|
volumeMounts:
|
||||||
|
# The registrar needs access to the SPIFFE CSI driver socket
|
||||||
|
- mountPath: /spiffe-csi
|
||||||
|
name: spiffe-csi-socket-dir
|
||||||
|
# The registrar needs access to the Kubelet plugin registration
|
||||||
|
# directory
|
||||||
|
- name: kubelet-plugin-registration-dir
|
||||||
|
mountPath: /registration
|
||||||
|
ports:
|
||||||
|
- containerPort: 9809
|
||||||
|
name: healthz
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: healthz
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
timeoutSeconds: 5
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
|
||||||
|
volumes:
|
||||||
|
- name: spire-agent-socket-dir
|
||||||
|
hostPath:
|
||||||
|
path: {{ include "spire.agent-socket-path" . | dir }}
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
# This volume is where the socket for kubelet->driver communication lives
|
||||||
|
- name: spiffe-csi-socket-dir
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/kubelet/plugins/csi.spiffe.io
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
# This volume is where the SPIFFE CSI driver mounts volumes
|
||||||
|
- name: mountpoint-dir
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/kubelet/pods
|
||||||
|
type: Directory
|
||||||
|
# This volume is where the node-driver-registrar registers the plugin
|
||||||
|
# with kubelet
|
||||||
|
- name: kubelet-plugin-registration-dir
|
||||||
|
hostPath:
|
||||||
|
path: /var/lib/kubelet/plugins_registry
|
||||||
|
type: Directory
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "spiffe-csi-driver.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
apiVersion: storage.k8s.io/v1
|
||||||
|
kind: CSIDriver
|
||||||
|
metadata:
|
||||||
|
name: "csi.spiffe.io"
|
||||||
|
spec:
|
||||||
|
# Only ephemeral, inline volumes are supported. There is no need for a
|
||||||
|
# controller to provision and attach volumes.
|
||||||
|
attachRequired: false
|
||||||
|
|
||||||
|
# Request the pod information which the CSI driver uses to verify that an
|
||||||
|
# ephemeral mount was requested.
|
||||||
|
podInfoOnMount: true
|
||||||
|
|
||||||
|
# Don't change ownership on the contents of the mount since the Workload API
|
||||||
|
# Unix Domain Socket is typically open to all (i.e. 0777).
|
||||||
|
fsGroupPolicy: None
|
||||||
|
|
||||||
|
# Declare support for ephemeral volumes only.
|
||||||
|
volumeLifecycleModes:
|
||||||
|
- Ephemeral
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spiffe-csi-driver
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: ""
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
nameOverride: ""
|
||||||
|
namespaceOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
privileged: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/arch: amd64
|
||||||
|
|
||||||
|
nodeDriverRegistrar:
|
||||||
|
image:
|
||||||
|
registry: registry.k8s.io
|
||||||
|
repository: sig-storage/csi-node-driver-registrar
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: v2.6.2
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spiffe-oidc-discovery-provider
|
||||||
|
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "1.5.4"
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
# spiffe-oidc-discovery-provider
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||||
|
|
||||||
|
## Values
|
||||||
|
|
||||||
|
| Key | Type | Default | Description |
|
||||||
|
|-----|------|---------|-------------|
|
||||||
|
| affinity | object | `{}` | |
|
||||||
|
| autoscaling.enabled | bool | `false` | |
|
||||||
|
| autoscaling.maxReplicas | int | `5` | |
|
||||||
|
| autoscaling.minReplicas | int | `1` | |
|
||||||
|
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
||||||
|
| autoscaling.targetMemoryUtilizationPercentage | int | `80` | |
|
||||||
|
| config.acme.cacheDir | string | `"/run/spire"` | |
|
||||||
|
| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
|
||||||
|
| config.acme.emailAddress | string | `"[email protected]"` | |
|
||||||
|
| config.acme.tosAccepted | bool | `false` | |
|
||||||
|
| config.domains[0] | string | `"localhost"` | |
|
||||||
|
| config.domains[1] | string | `"oidc-discovery.example.org"` | |
|
||||||
|
| config.logLevel | string | `"info"` | |
|
||||||
|
| fullnameOverride | string | `""` | |
|
||||||
|
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| image.registry | string | `"ghcr.io"` | |
|
||||||
|
| image.repository | string | `"spiffe/oidc-discovery-provider"` | |
|
||||||
|
| image.version | string | `""` | |
|
||||||
|
| imagePullSecrets | list | `[]` | |
|
||||||
|
| insecureScheme.enabled | bool | `false` | |
|
||||||
|
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| insecureScheme.nginx.image.registry | string | `"docker.io"` | |
|
||||||
|
| insecureScheme.nginx.image.repository | string | `"nginx"` | |
|
||||||
|
| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
|
||||||
|
| insecureScheme.nginx.resources | object | `{}` | |
|
||||||
|
| nameOverride | string | `""` | |
|
||||||
|
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||||
|
| podAnnotations | object | `{}` | |
|
||||||
|
| podSecurityContext | object | `{}` | |
|
||||||
|
| replicaCount | int | `1` | |
|
||||||
|
| resources | object | `{}` | |
|
||||||
|
| securityContext | object | `{}` | |
|
||||||
|
| service.annotations | object | `{}` | |
|
||||||
|
| service.port | int | `80` | |
|
||||||
|
| service.type | string | `"ClusterIP"` | |
|
||||||
|
| serviceAccount.annotations | object | `{}` | |
|
||||||
|
| serviceAccount.create | bool | `true` | |
|
||||||
|
| serviceAccount.name | string | `""` | |
|
||||||
|
| tolerations | list | `[]` | |
|
||||||
|
| trustDomain | string | `"example.org"` | |
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{{ template "chart.header" . }}
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
{{ template "chart.deprecationWarning" . }}
|
||||||
|
|
||||||
|
{{ template "chart.badgesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.description" . }}
|
||||||
|
|
||||||
|
{{ template "chart.homepageLine" . }}
|
||||||
|
|
||||||
|
{{ template "chart.maintainersSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.sourcesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.requirementsSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.valuesSection" . }}
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
SPIFFE OIDC discovery provider installed…
|
||||||
@@ -0,0 +1,74 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "spiffe-oidc-discovery-provider.chart" . }}
|
||||||
|
{{ include "spiffe-oidc-discovery-provider.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "spiffe-oidc-discovery-provider.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "spiffe-oidc-discovery-provider.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.image" -}}
|
||||||
|
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||||
|
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else if .appVersion -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||||
|
{{- else if .image.version -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,57 @@
|
|||||||
|
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
data:
|
||||||
|
oidc-discovery-provider.conf: |
|
||||||
|
log_level = "{{ .Values.config.logLevel }}"
|
||||||
|
|
||||||
|
domains = [
|
||||||
|
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
|
||||||
|
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}",
|
||||||
|
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local",
|
||||||
|
{{- if gt (len .Values.config.domains) 0 }}
|
||||||
|
"{{- join "\",\n \"" .Values.config.domains }}"
|
||||||
|
{{- end }}
|
||||||
|
]
|
||||||
|
|
||||||
|
{{- if .Values.insecureScheme.enabled }}
|
||||||
|
allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
|
||||||
|
listen_socket_path = {{ $oidcSocket | quote }}
|
||||||
|
{{- else }}
|
||||||
|
acme {
|
||||||
|
directory_url = "{{ .Values.config.acme.directoryUrl }}"
|
||||||
|
cache_dir = "{{ .Values.config.acme.cacheDir }}"
|
||||||
|
tos_accepted = {{ .Values.config.acme.tosAccepted }}
|
||||||
|
email = "{{ .Values.config.acme.emailAddress }}"
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
workload_api {
|
||||||
|
socket_path = "/spiffe-workload-api/{{ include "spire.agent-socket-path" . | splitList "/" | last }}"
|
||||||
|
trust_domain = "{{ .Values.trustDomain }}"
|
||||||
|
}
|
||||||
|
|
||||||
|
health_checks {
|
||||||
|
bind_port = "8008"
|
||||||
|
ready_path = "/ready"
|
||||||
|
live_path = "/live"
|
||||||
|
}
|
||||||
|
{{- if .Values.insecureScheme.enabled }}
|
||||||
|
default.conf.template: |
|
||||||
|
upstream oidc {
|
||||||
|
server unix:{{ $oidcSocket }};
|
||||||
|
}
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
listen [::]:80;
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://oidc;
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,114 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.autoscaling.enabled }}
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||||
|
image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||||
|
ports:
|
||||||
|
- containerPort: 8008
|
||||||
|
name: health
|
||||||
|
{{- if not .Values.insecureScheme.enabled }}
|
||||||
|
- containerPort: 443
|
||||||
|
name: https
|
||||||
|
{{- end }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: /spiffe-workload-api
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-oidc-sockets
|
||||||
|
mountPath: /run/spire/oidc-sockets
|
||||||
|
readOnly: false
|
||||||
|
- name: spire-oidc-config
|
||||||
|
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||||
|
subPath: oidc-discovery-provider.conf
|
||||||
|
readOnly: true
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /ready
|
||||||
|
port: health
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /live
|
||||||
|
port: health
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
{{- if .Values.insecureScheme.enabled }}
|
||||||
|
- name: nginx
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||||
|
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
|
||||||
|
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
name: http
|
||||||
|
volumeMounts:
|
||||||
|
- name: spire-oidc-sockets
|
||||||
|
mountPath: /run/spire/oidc-sockets
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-oidc-config
|
||||||
|
mountPath: /etc/nginx/templates/default.conf.template
|
||||||
|
subPath: default.conf.template
|
||||||
|
readOnly: true
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
csi:
|
||||||
|
driver: "csi.spiffe.io"
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-oidc-sockets
|
||||||
|
hostPath:
|
||||||
|
path: /run/spire/oidc-sockets
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
- name: spire-oidc-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
{{- if .Values.autoscaling.enabled }}
|
||||||
|
apiVersion: autoscaling/v2beta1
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: memory
|
||||||
|
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
{{- with .Values.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.service.type }}
|
||||||
|
ports:
|
||||||
|
{{- if .Values.insecureScheme.enabled }}
|
||||||
|
- name: http
|
||||||
|
port: {{ .Values.service.port }}
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
{{- else }}
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
targetPort: https
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
||||||
|
selector:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 4 }}
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
+23
@@ -0,0 +1,23 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection"
|
||||||
|
labels:
|
||||||
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": test
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: wget-service-name
|
||||||
|
image: busybox
|
||||||
|
command: ['wget']
|
||||||
|
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||||
|
- name: wget-service-name-namespace
|
||||||
|
image: busybox
|
||||||
|
command: ['wget']
|
||||||
|
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||||
|
- name: wget-service-name-namespace-svc-cluster-local
|
||||||
|
image: busybox
|
||||||
|
command: ['wget']
|
||||||
|
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||||
|
restartPolicy: Never
|
||||||
@@ -0,0 +1,112 @@
|
|||||||
|
# Default values for spiffe-oidc-discovery-provider.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
image:
|
||||||
|
# registry: gcr.io
|
||||||
|
# repository: spiffe-io/oidc-discovery-provider
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/oidc-discovery-provider
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: ""
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 80
|
||||||
|
annotations: {}
|
||||||
|
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext: {}
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
insecureScheme:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
nginx:
|
||||||
|
image:
|
||||||
|
registry: docker.io
|
||||||
|
repository: nginx
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: 1.23.2-alpine
|
||||||
|
# chainguard image does not support the templates feature
|
||||||
|
# https://github.com/chainguard-images/nginx/issues/43
|
||||||
|
# registry: cgr.dev
|
||||||
|
# repository: chainguard/nginx
|
||||||
|
# pullPolicy: IfNotPresent
|
||||||
|
# version: "1.23.2"
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 32Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 64Mi
|
||||||
|
|
||||||
|
config:
|
||||||
|
logLevel: info
|
||||||
|
domains:
|
||||||
|
- localhost
|
||||||
|
- oidc-discovery.example.org
|
||||||
|
|
||||||
|
acme:
|
||||||
|
tosAccepted: false
|
||||||
|
cacheDir: /run/spire
|
||||||
|
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
||||||
|
emailAddress: [email protected]
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
autoscaling:
|
||||||
|
enabled: false
|
||||||
|
minReplicas: 1
|
||||||
|
maxReplicas: 5
|
||||||
|
targetCPUUtilizationPercentage: 80
|
||||||
|
targetMemoryUtilizationPercentage: 80
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/arch: amd64
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
trustDomain: "example.org"
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spire-agent
|
||||||
|
description: A Helm chart to install the SPIRE agent.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "1.5.4"
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
# spire-agent
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart to install the SPIRE agent.
|
||||||
|
|
||||||
|
## Values
|
||||||
|
|
||||||
|
| Key | Type | Default | Description |
|
||||||
|
|-----|------|---------|-------------|
|
||||||
|
| bundleConfigMap | string | `"spire-bundle"` | |
|
||||||
|
| clusterName | string | `"example-cluster"` | |
|
||||||
|
| fullnameOverride | string | `""` | |
|
||||||
|
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| image.registry | string | `"ghcr.io"` | |
|
||||||
|
| image.repository | string | `"spiffe/spire-agent"` | |
|
||||||
|
| image.version | string | `""` | |
|
||||||
|
| imagePullSecrets | list | `[]` | |
|
||||||
|
| logLevel | string | `"info"` | |
|
||||||
|
| nameOverride | string | `""` | |
|
||||||
|
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||||
|
| podAnnotations | object | `{}` | |
|
||||||
|
| podSecurityContext | object | `{}` | |
|
||||||
|
| resources | object | `{}` | |
|
||||||
|
| securityContext | object | `{}` | |
|
||||||
|
| server.port | int | `8081` | |
|
||||||
|
| serviceAccount.annotations | object | `{}` | |
|
||||||
|
| serviceAccount.create | bool | `true` | |
|
||||||
|
| serviceAccount.name | string | `""` | |
|
||||||
|
| trustDomain | string | `"example.org"` | |
|
||||||
|
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| waitForIt.image.registry | string | `"cgr.dev"` | |
|
||||||
|
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | |
|
||||||
|
| waitForIt.image.version | string | `"latest-20230113"` | |
|
||||||
|
| waitForIt.resources | object | `{}` | |
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{{ template "chart.header" . }}
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
{{ template "chart.deprecationWarning" . }}
|
||||||
|
|
||||||
|
{{ template "chart.badgesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.description" . }}
|
||||||
|
|
||||||
|
{{ template "chart.homepageLine" . }}
|
||||||
|
|
||||||
|
{{ template "chart.maintainersSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.sourcesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.requirementsSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.valuesSection" . }}
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
Installed {{ .Chart.Name }}…
|
||||||
@@ -0,0 +1,74 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "spire-agent.chart" . }}
|
||||||
|
{{ include "spire-agent.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "spire-agent.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-agent.image" -}}
|
||||||
|
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||||
|
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else if .appVersion -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||||
|
{{- else if .image.version -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,51 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
data:
|
||||||
|
agent.conf: |
|
||||||
|
agent {
|
||||||
|
data_dir = "/run/spire"
|
||||||
|
log_level = {{ .Values.logLevel | quote }}
|
||||||
|
server_address = "{{ .Release.Name }}-server"
|
||||||
|
server_port = {{ .Values.server.port | quote }}
|
||||||
|
socket_path = {{ include "spire.agent-socket-path" . | quote }}
|
||||||
|
trust_bundle_path = "/run/spire/bundle/bundle.crt"
|
||||||
|
trust_domain = {{ .Values.trustDomain | quote }}
|
||||||
|
}
|
||||||
|
|
||||||
|
plugins {
|
||||||
|
NodeAttestor "k8s_psat" {
|
||||||
|
plugin_data {
|
||||||
|
cluster = {{ .Values.clusterName | quote }}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
KeyManager "memory" {
|
||||||
|
plugin_data {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
WorkloadAttestor "k8s" {
|
||||||
|
plugin_data {
|
||||||
|
# Defaults to the secure kubelet port by default.
|
||||||
|
# Minikube does not have a cert in the cluster CA bundle that
|
||||||
|
# can authenticate the kubelet cert, so skip validation.
|
||||||
|
skip_kubelet_verification = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
WorkloadAttestor "unix" {
|
||||||
|
plugin_data {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
health_checks {
|
||||||
|
listener_enabled = true
|
||||||
|
bind_address = "0.0.0.0"
|
||||||
|
bind_port = "8080"
|
||||||
|
live_path = "/live"
|
||||||
|
ready_path = "/ready"
|
||||||
|
}
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: DaemonSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-agent.selectorLabels" . | nindent 8 }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
hostPID: true
|
||||||
|
hostNetwork: true
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
|
initContainers:
|
||||||
|
- name: init
|
||||||
|
# This is a small image with wait-for-it, choose whatever image
|
||||||
|
# you prefer that waits for a service to be up. This image is built
|
||||||
|
# from https://github.com/vishnubob/wait-for-it
|
||||||
|
image: {{ template "spire-agent.image" .Values.waitForIt }}
|
||||||
|
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
|
||||||
|
args: ["-t", "30", "-h", "{{ .Release.Name }}-server", "-p", {{ .Values.server.port | quote }}]
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}
|
||||||
|
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args: ["-config", "/run/spire/config/agent.conf"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: spire-config
|
||||||
|
mountPath: /run/spire/config
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-bundle
|
||||||
|
mountPath: /run/spire/bundle
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-agent-socket-dir
|
||||||
|
mountPath: {{ include "spire.agent-socket-path" . | dir }}
|
||||||
|
readOnly: false
|
||||||
|
- name: spire-token
|
||||||
|
mountPath: /var/run/secrets/tokens
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /live
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 60
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /ready
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 60
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: spire-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
- name: spire-bundle
|
||||||
|
configMap:
|
||||||
|
name: {{ .Values.bundleConfigMap }}
|
||||||
|
- name: spire-token
|
||||||
|
projected:
|
||||||
|
sources:
|
||||||
|
- serviceAccountToken:
|
||||||
|
path: spire-agent
|
||||||
|
expirationSeconds: 7200
|
||||||
|
audience: spire-server
|
||||||
|
- name: spire-agent-socket-dir
|
||||||
|
hostPath:
|
||||||
|
path: {{ include "spire.agent-socket-path" . | dir }}
|
||||||
|
type: DirectoryOrCreate
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
# Required cluster role to allow spire-agent to query k8s API server
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- nodes
|
||||||
|
- nodes/proxy
|
||||||
|
verbs: ["get"]
|
||||||
|
---
|
||||||
|
# Binds above cluster role to spire-agent service account
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-agent.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,70 @@
|
|||||||
|
# Default values for spire-agent.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
|
||||||
|
image:
|
||||||
|
# registry: gcr.io
|
||||||
|
# repository: spiffe-io/spire-agent
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-agent
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
# Overrides the image tag whose default is the chart appVersion.
|
||||||
|
version: ""
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext: {}
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 50m
|
||||||
|
# memory: 64Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 128Mi
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/arch: amd64
|
||||||
|
|
||||||
|
logLevel: info
|
||||||
|
clusterName: example-cluster
|
||||||
|
trustDomain: example.org
|
||||||
|
|
||||||
|
bundleConfigMap: spire-bundle
|
||||||
|
|
||||||
|
server:
|
||||||
|
port: 8081
|
||||||
|
|
||||||
|
waitForIt:
|
||||||
|
image:
|
||||||
|
registry: cgr.dev
|
||||||
|
repository: chainguard/wait-for-it
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
version: latest-20230113
|
||||||
|
resources: {}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spire-server
|
||||||
|
description: A Helm chart to install the SPIRE server.
|
||||||
|
type: application
|
||||||
|
version: 0.1.0
|
||||||
|
appVersion: "1.5.4"
|
||||||
@@ -0,0 +1,75 @@
|
|||||||
|
# spire-server
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
  
|
||||||
|
|
||||||
|
A Helm chart to install the SPIRE server.
|
||||||
|
|
||||||
|
## Values
|
||||||
|
|
||||||
|
| Key | Type | Default | Description |
|
||||||
|
|-----|------|---------|-------------|
|
||||||
|
| affinity | object | `{}` | |
|
||||||
|
| autoscaling.enabled | bool | `false` | |
|
||||||
|
| autoscaling.maxReplicas | int | `100` | |
|
||||||
|
| autoscaling.minReplicas | int | `1` | |
|
||||||
|
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
||||||
|
| bundleConfigMap | string | `"spire-server"` | |
|
||||||
|
| ca_subject.common_name | string | `"example.org"` | |
|
||||||
|
| ca_subject.country | string | `"NL"` | |
|
||||||
|
| ca_subject.organization | string | `"Example"` | |
|
||||||
|
| clusterName | string | `"example-cluster"` | |
|
||||||
|
| controllerManager.enabled | bool | `false` | |
|
||||||
|
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
||||||
|
| controllerManager.identities.enabled | bool | `true` | |
|
||||||
|
| controllerManager.identities.namespaceSelector | object | `{}` | |
|
||||||
|
| controllerManager.identities.podSelector | object | `{}` | |
|
||||||
|
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
||||||
|
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
||||||
|
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
||||||
|
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
||||||
|
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| controllerManager.image.registry | string | `"ghcr.io"` | |
|
||||||
|
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
|
||||||
|
| controllerManager.image.version | string | `"0.2.1"` | |
|
||||||
|
| controllerManager.resources | object | `{}` | |
|
||||||
|
| controllerManager.securityContext | object | `{}` | |
|
||||||
|
| controllerManager.service.annotations | object | `{}` | |
|
||||||
|
| controllerManager.service.port | int | `443` | |
|
||||||
|
| controllerManager.service.type | string | `"ClusterIP"` | |
|
||||||
|
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
|
||||||
|
| dataStorage.enabled | bool | `true` | |
|
||||||
|
| dataStorage.size | string | `"1Gi"` | |
|
||||||
|
| dataStorage.storageClass | string | `nil` | |
|
||||||
|
| fullnameOverride | string | `""` | |
|
||||||
|
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||||
|
| image.registry | string | `"ghcr.io"` | |
|
||||||
|
| image.repository | string | `"spiffe/spire-server"` | |
|
||||||
|
| image.version | string | `""` | |
|
||||||
|
| imagePullSecrets | list | `[]` | |
|
||||||
|
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
|
||||||
|
| logLevel | string | `"info"` | |
|
||||||
|
| nameOverride | string | `""` | |
|
||||||
|
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||||
|
| podAnnotations | object | `{}` | |
|
||||||
|
| podSecurityContext | object | `{}` | |
|
||||||
|
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
||||||
|
| resources | object | `{}` | |
|
||||||
|
| securityContext | object | `{}` | |
|
||||||
|
| service.annotations | object | `{}` | |
|
||||||
|
| service.port | int | `8081` | |
|
||||||
|
| service.type | string | `"ClusterIP"` | |
|
||||||
|
| serviceAccount.annotations | object | `{}` | |
|
||||||
|
| serviceAccount.create | bool | `true` | |
|
||||||
|
| serviceAccount.name | string | `""` | |
|
||||||
|
| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
|
||||||
|
| tolerations | list | `[]` | |
|
||||||
|
| topologySpreadConstraints | list | `[]` | |
|
||||||
|
| trustDomain | string | `"example.org"` | |
|
||||||
|
| upstreamAuthority.disk.enabled | bool | `false` | |
|
||||||
|
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
||||||
|
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
||||||
|
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{{ template "chart.header" . }}
|
||||||
|
|
||||||
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||||
|
|
||||||
|
{{ template "chart.deprecationWarning" . }}
|
||||||
|
|
||||||
|
{{ template "chart.badgesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.description" . }}
|
||||||
|
|
||||||
|
{{ template "chart.homepageLine" . }}
|
||||||
|
|
||||||
|
{{ template "chart.maintainersSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.sourcesSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.requirementsSection" . }}
|
||||||
|
|
||||||
|
{{ template "chart.valuesSection" . }}
|
||||||
|
|
||||||
|
----------------------------------------------
|
||||||
@@ -0,0 +1,96 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.8.0
|
||||||
|
creationTimestamp: null
|
||||||
|
name: clusterfederatedtrustdomains.spire.spiffe.io
|
||||||
|
spec:
|
||||||
|
group: spire.spiffe.io
|
||||||
|
names:
|
||||||
|
kind: ClusterFederatedTrustDomain
|
||||||
|
listKind: ClusterFederatedTrustDomainList
|
||||||
|
plural: clusterfederatedtrustdomains
|
||||||
|
singular: clusterfederatedtrustdomain
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .spec.trustDomain
|
||||||
|
name: Trust Domain
|
||||||
|
type: string
|
||||||
|
- jsonPath: .spec.bundleEndpointURL
|
||||||
|
name: Endpoint URL
|
||||||
|
type: string
|
||||||
|
name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ClusterFederatedTrustDomainSpec defines the desired state
|
||||||
|
of ClusterFederatedTrustDomain
|
||||||
|
properties:
|
||||||
|
bundleEndpointProfile:
|
||||||
|
description: BundleEndpointProfile is the profile for the bundle endpoint.
|
||||||
|
properties:
|
||||||
|
endpointSPIFFEID:
|
||||||
|
description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint.
|
||||||
|
It is required for the "https_spiffe" profile.
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: Type is the type of the bundle endpoint profile.
|
||||||
|
enum:
|
||||||
|
- https_spiffe
|
||||||
|
- https_web
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
bundleEndpointURL:
|
||||||
|
description: BundleEndpointURL is the URL of the bundle endpoint.
|
||||||
|
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
|
||||||
|
type: string
|
||||||
|
trustDomain:
|
||||||
|
description: TrustDomain is the name of the trust domain to federate
|
||||||
|
with (e.g. example.org)
|
||||||
|
pattern: '[a-z0-9._-]{1,255}'
|
||||||
|
type: string
|
||||||
|
trustDomainBundle:
|
||||||
|
description: TrustDomainBundle is the contents of the bundle for the
|
||||||
|
referenced trust domain. This field is optional when the resource
|
||||||
|
is created.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- bundleEndpointProfile
|
||||||
|
- bundleEndpointURL
|
||||||
|
- trustDomain
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ClusterFederatedTrustDomainStatus defines the observed state
|
||||||
|
of ClusterFederatedTrustDomain
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
status:
|
||||||
|
acceptedNames:
|
||||||
|
kind: ""
|
||||||
|
plural: ""
|
||||||
|
conditions: []
|
||||||
|
storedVersions: []
|
||||||
@@ -0,0 +1,221 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.8.0
|
||||||
|
creationTimestamp: null
|
||||||
|
name: clusterspiffeids.spire.spiffe.io
|
||||||
|
spec:
|
||||||
|
group: spire.spiffe.io
|
||||||
|
names:
|
||||||
|
kind: ClusterSPIFFEID
|
||||||
|
listKind: ClusterSPIFFEIDList
|
||||||
|
plural: clusterspiffeids
|
||||||
|
singular: clusterspiffeid
|
||||||
|
scope: Cluster
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ClusterSPIFFEID is the Schema for the clusterspiffeids API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID
|
||||||
|
properties:
|
||||||
|
admin:
|
||||||
|
description: Admin indicates whether or not the SVID can be used to
|
||||||
|
access the SPIRE administrative APIs. Extra care should be taken
|
||||||
|
to only apply this SPIFFE ID to admin workloads.
|
||||||
|
type: boolean
|
||||||
|
dnsNameTemplates:
|
||||||
|
description: DNSNameTemplate represents templates for extra DNS names
|
||||||
|
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
|
||||||
|
node and pod spec are made available to the template under .NodeSpec,
|
||||||
|
.PodSpec respectively.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
federatesWith:
|
||||||
|
description: FederatesWith is a list of trust domain names that workloads
|
||||||
|
that obtain this SPIFFE ID will federate with.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
namespaceSelector:
|
||||||
|
description: NamespaceSelector selects the namespaces that are targetted
|
||||||
|
by this CRD.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector requirements.
|
||||||
|
The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector that
|
||||||
|
contains values, a key, and an operator that relates the key
|
||||||
|
and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship to
|
||||||
|
a set of values. Valid operators are In, NotIn, Exists
|
||||||
|
and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values. If the
|
||||||
|
operator is In or NotIn, the values array must be non-empty.
|
||||||
|
If the operator is Exists or DoesNotExist, the values
|
||||||
|
array must be empty. This array is replaced during a strategic
|
||||||
|
merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs. A single
|
||||||
|
{key,value} in the matchLabels map is equivalent to an element
|
||||||
|
of matchExpressions, whose key field is "key", the operator
|
||||||
|
is "In", and the values array contains only "value". The requirements
|
||||||
|
are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
podSelector:
|
||||||
|
description: PodSelector selects the pods that are targetted by this
|
||||||
|
CRD.
|
||||||
|
properties:
|
||||||
|
matchExpressions:
|
||||||
|
description: matchExpressions is a list of label selector requirements.
|
||||||
|
The requirements are ANDed.
|
||||||
|
items:
|
||||||
|
description: A label selector requirement is a selector that
|
||||||
|
contains values, a key, and an operator that relates the key
|
||||||
|
and values.
|
||||||
|
properties:
|
||||||
|
key:
|
||||||
|
description: key is the label key that the selector applies
|
||||||
|
to.
|
||||||
|
type: string
|
||||||
|
operator:
|
||||||
|
description: operator represents a key's relationship to
|
||||||
|
a set of values. Valid operators are In, NotIn, Exists
|
||||||
|
and DoesNotExist.
|
||||||
|
type: string
|
||||||
|
values:
|
||||||
|
description: values is an array of string values. If the
|
||||||
|
operator is In or NotIn, the values array must be non-empty.
|
||||||
|
If the operator is Exists or DoesNotExist, the values
|
||||||
|
array must be empty. This array is replaced during a strategic
|
||||||
|
merge patch.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- key
|
||||||
|
- operator
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
matchLabels:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: matchLabels is a map of {key,value} pairs. A single
|
||||||
|
{key,value} in the matchLabels map is equivalent to an element
|
||||||
|
of matchExpressions, whose key field is "key", the operator
|
||||||
|
is "In", and the values array contains only "value". The requirements
|
||||||
|
are ANDed.
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
spiffeIDTemplate:
|
||||||
|
description: SPIFFEID is the SPIFFE ID template. The node and pod
|
||||||
|
spec are made available to the template under .NodeSpec, .PodSpec
|
||||||
|
respectively.
|
||||||
|
type: string
|
||||||
|
ttl:
|
||||||
|
description: TTL indicates an upper-bound time-to-live for SVIDs minted
|
||||||
|
for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||||
|
type: string
|
||||||
|
workloadSelectorTemplates:
|
||||||
|
description: WorkloadSelectorTemplates are templates to produce arbitrary
|
||||||
|
workload selectors that apply to a given workload before it will
|
||||||
|
receive this SPIFFE ID. The rendered value is interpreted by SPIRE
|
||||||
|
and are of the form type:value, where the value may, and often does,
|
||||||
|
contain semicolons, .e.g., k8s:container-image:docker/hello-world
|
||||||
|
The node and pod spec are made available to the template under .NodeSpec,
|
||||||
|
.PodSpec respectively.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- spiffeIDTemplate
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID
|
||||||
|
properties:
|
||||||
|
stats:
|
||||||
|
description: Stats produced by the last entry reconciliation run
|
||||||
|
properties:
|
||||||
|
entriesMasked:
|
||||||
|
description: How many entries were masked by entries for other
|
||||||
|
ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs
|
||||||
|
produce an entry for the same pod with the same set of workload
|
||||||
|
selectors.
|
||||||
|
type: integer
|
||||||
|
entriesToSet:
|
||||||
|
description: How many entries are to be set for this ClusterSPIFFEID.
|
||||||
|
In nominal conditions, this should reflect the number of pods
|
||||||
|
selected, but not always if there were problems encountered
|
||||||
|
rendering an entry for the pod (RenderFailures) or entries are
|
||||||
|
masked (EntriesMasked).
|
||||||
|
type: integer
|
||||||
|
entryFailures:
|
||||||
|
description: How many entries were unable to be set due to failures
|
||||||
|
to create or update the entries via the SPIRE Server API.
|
||||||
|
type: integer
|
||||||
|
namespacesIgnored:
|
||||||
|
description: How many (selected) namespaces were ignored (based
|
||||||
|
on configuration).
|
||||||
|
type: integer
|
||||||
|
namespacesSelected:
|
||||||
|
description: How many namespaces were selected.
|
||||||
|
type: integer
|
||||||
|
podEntryRenderFailures:
|
||||||
|
description: How many failures were encountered rendering an entry
|
||||||
|
selected pods. This could be due to either a bad template in
|
||||||
|
the ClusterSPIFFEID or Pod metadata that when applied to the
|
||||||
|
template did not produce valid entry values.
|
||||||
|
type: integer
|
||||||
|
podsSelected:
|
||||||
|
description: How many pods were selected out of the namespaces.
|
||||||
|
type: integer
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
status:
|
||||||
|
acceptedNames:
|
||||||
|
kind: ""
|
||||||
|
plural: ""
|
||||||
|
conditions: []
|
||||||
|
storedVersions: []
|
||||||
@@ -0,0 +1,59 @@
|
|||||||
|
---
|
||||||
|
apiVersion: apiextensions.k8s.io/v1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
controller-gen.kubebuilder.io/version: v0.8.0
|
||||||
|
creationTimestamp: null
|
||||||
|
name: controllermanagerconfigs.spire.spiffe.io
|
||||||
|
spec:
|
||||||
|
group: spire.spiffe.io
|
||||||
|
names:
|
||||||
|
kind: ControllerManagerConfig
|
||||||
|
listKind: ControllerManagerConfigList
|
||||||
|
plural: controllermanagerconfigs
|
||||||
|
singular: controllermanagerconfig
|
||||||
|
scope: Namespaced
|
||||||
|
versions:
|
||||||
|
- name: v1alpha1
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: ControllerManagerConfig is the Schema for the controllermanagerconfigs
|
||||||
|
API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: ControllerManagerConfigSpec defines the desired state of
|
||||||
|
ControllerManagerConfig
|
||||||
|
properties:
|
||||||
|
foo:
|
||||||
|
description: Foo is an example field of ControllerManagerConfig. Edit
|
||||||
|
controllermanagerconfig_types.go to remove/update
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: ControllerManagerConfigStatus defines the observed state
|
||||||
|
of ControllerManagerConfig
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
status:
|
||||||
|
acceptedNames:
|
||||||
|
kind: ""
|
||||||
|
plural: ""
|
||||||
|
conditions: []
|
||||||
|
storedVersions: []
|
||||||
@@ -0,0 +1,6 @@
|
|||||||
|
Installed {{ .Chart.Name }}…
|
||||||
|
|
||||||
|
1. Get the currently registered SPIFFE entries from the server:
|
||||||
|
|
||||||
|
kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
|
||||||
|
bin/spire-server entry show -socketPath {{ .Values.socketPath }}
|
||||||
@@ -0,0 +1,94 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Common labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.labels" -}}
|
||||||
|
helm.sh/chart: {{ include "spire-server.chart" . }}
|
||||||
|
{{ include "spire-server.selectorLabels" . }}
|
||||||
|
{{- if .Chart.AppVersion }}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- end }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Selector labels
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.selectorLabels" -}}
|
||||||
|
app.kubernetes.io/name: {{ include "spire-server.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-server.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else }}
|
||||||
|
{{- default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-server.image" -}}
|
||||||
|
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||||
|
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else if .appVersion -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||||
|
{{- else if .image.version -}}
|
||||||
|
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
|
||||||
|
{{- define "spire-server.upstream-ca-secret" -}}
|
||||||
|
{{- $root := . }}
|
||||||
|
{{- with .Values.upstreamAuthority.disk -}}
|
||||||
|
{{- if eq (.secret.create | toString) "true" -}}
|
||||||
|
{{ include "spire-server.fullname" $root }}-upstream-ca
|
||||||
|
{{- else -}}
|
||||||
|
{{ default (include "spire-server.fullname" $root) .secret.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-controller-manager.fullname" -}}
|
||||||
|
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire-k8s-workload-registrar.fullname" -}}
|
||||||
|
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,5 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ .Values.bundleConfigMap }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
@@ -0,0 +1,83 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
data:
|
||||||
|
server.conf: |
|
||||||
|
server {
|
||||||
|
bind_address = "0.0.0.0"
|
||||||
|
bind_port = "8081"
|
||||||
|
socket_path = {{ .Values.socketPath | quote }}
|
||||||
|
trust_domain = {{ .Values.trustDomain | quote }}
|
||||||
|
data_dir = "/run/spire/data"
|
||||||
|
log_level = "{{ .Values.logLevel }}"
|
||||||
|
# AWS requires the use of RSA. EC cryptography is not supported
|
||||||
|
ca_key_type = "rsa-2048"
|
||||||
|
|
||||||
|
jwt_issuer = "{{ .Values.jwtIssuer }}"
|
||||||
|
|
||||||
|
default_x509_svid_ttl = "1h"
|
||||||
|
default_jwt_svid_ttl = "1h"
|
||||||
|
ca_subject = {
|
||||||
|
{{- with .Values.ca_subject }}
|
||||||
|
country = [{{ .country | quote }}],
|
||||||
|
organization = [{{ .organization | quote }}],
|
||||||
|
common_name = {{ .common_name | quote }},
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
plugins {
|
||||||
|
DataStore "sql" {
|
||||||
|
plugin_data {
|
||||||
|
database_type = "sqlite3"
|
||||||
|
connection_string = "/run/spire/data/datastore.sqlite3"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
NodeAttestor "k8s_psat" {
|
||||||
|
plugin_data {
|
||||||
|
clusters = {
|
||||||
|
{{ .Values.clusterName | quote }} = {
|
||||||
|
service_account_allow_list = ["{{ .Release.Namespace }}:{{ .Release.Name }}-agent"]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
KeyManager "disk" {
|
||||||
|
plugin_data {
|
||||||
|
keys_path = "/run/spire/data/keys.json"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
Notifier "k8sbundle" {
|
||||||
|
plugin_data {
|
||||||
|
namespace = "{{ .Release.Namespace }}"
|
||||||
|
config_map = {{ .Values.bundleConfigMap | quote }}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
{{- with .Values.upstreamAuthority.disk }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
UpstreamAuthority "disk" {
|
||||||
|
plugin_data {
|
||||||
|
cert_file_path = "/run/spire/upstream_ca/tls.crt"
|
||||||
|
key_file_path = "/run/spire/upstream_ca/tls.key"
|
||||||
|
{{- if ne .secret.data.bundle "" }}
|
||||||
|
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
}
|
||||||
|
|
||||||
|
health_checks {
|
||||||
|
listener_enabled = true
|
||||||
|
bind_address = "0.0.0.0"
|
||||||
|
bind_port = "8080"
|
||||||
|
live_path = "/live"
|
||||||
|
ready_path = "/ready"
|
||||||
|
}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
{{- $root := . }}
|
||||||
|
{{- with .Values.controllerManager }}
|
||||||
|
{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }}
|
||||||
|
apiVersion: spire.spiffe.io/v1alpha1
|
||||||
|
kind: ClusterSPIFFEID
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||||
|
spec:
|
||||||
|
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
|
||||||
|
{{- with .identities.podSelector }}
|
||||||
|
podSelector:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .identities.namespaceSelector }}
|
||||||
|
namespaceSelector:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .identities.dnsNameTemplates }}
|
||||||
|
dnsNameTemplates:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,32 @@
|
|||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
data:
|
||||||
|
controller-manager-config.yaml: |
|
||||||
|
apiVersion: spire.spiffe.io/v1alpha1
|
||||||
|
kind: ControllerManagerConfig
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 8 }}
|
||||||
|
metrics:
|
||||||
|
bindAddress: 127.0.0.1:8082
|
||||||
|
healthProbe:
|
||||||
|
bindAddress: 127.0.0.1:8083
|
||||||
|
leaderElection:
|
||||||
|
leaderElect: true
|
||||||
|
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||||
|
resourceNamespace: {{ .Release.Namespace }}
|
||||||
|
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||||
|
clusterName: {{ .Values.clusterName }}
|
||||||
|
trustDomain: {{ .Values.trustDomain }}
|
||||||
|
ignoreNamespaces:
|
||||||
|
{{- with .Values.controllerManager.ignoreNamespaces }}
|
||||||
|
{{- toYaml . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
spireServerSocketPath: {{ .Values.socketPath | quote }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,80 @@
|
|||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["namespaces"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||||||
|
resources: ["validatingwebhookconfigurations"]
|
||||||
|
verbs: ["get", "list", "patch", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["nodes"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterfederatedtrustdomains"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterfederatedtrustdomains/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterfederatedtrustdomains/status"]
|
||||||
|
verbs: ["get", "patch", "update"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterspiffeids"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterspiffeids/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
resources: ["clusterspiffeids/status"]
|
||||||
|
verbs: ["get", "patch", "update"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,22 @@
|
|||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.controllerManager.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.controllerManager.service.type }}
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: {{ .Values.controllerManager.service.port }}
|
||||||
|
targetPort: https
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,35 @@
|
|||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||||
|
webhooks:
|
||||||
|
- admissionReviewVersions: ["v1"]
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
|
||||||
|
failurePolicy: Fail
|
||||||
|
name: vclusterfederatedtrustdomain.kb.io
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
apiVersions: ["v1alpha1"]
|
||||||
|
operations: ["CREATE", "UPDATE"]
|
||||||
|
resources: ["clusterfederatedtrustdomains"]
|
||||||
|
sideEffects: None
|
||||||
|
- admissionReviewVersions: ["v1"]
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
|
||||||
|
failurePolicy: Fail
|
||||||
|
name: vclusterspiffeid.kb.io
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["spire.spiffe.io"]
|
||||||
|
apiVersions: ["v1alpha1"]
|
||||||
|
operations: ["CREATE", "UPDATE"]
|
||||||
|
resources: ["clusterspiffeids"]
|
||||||
|
sideEffects: None
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
{{- if .Values.autoscaling.enabled }}
|
||||||
|
apiVersion: autoscaling/v2beta1
|
||||||
|
kind: HorizontalPodAutoscaler
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
scaleTargetRef:
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||||
|
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||||
|
metrics:
|
||||||
|
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: cpu
|
||||||
|
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
- type: Resource
|
||||||
|
resource:
|
||||||
|
name: memory
|
||||||
|
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,71 @@
|
|||||||
|
# ClusterRole to allow spire-server node attestor to query Token Review API
|
||||||
|
# and to be able to push certificate bundles to a configmap
|
||||||
|
kind: Role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
rules:
|
||||||
|
# allow "get" access to pods (to resolve selectors for PSAT attestation)
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: [pods]
|
||||||
|
verbs: [get]
|
||||||
|
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
|
||||||
|
# agent bootstrapping, see the spire-bundle ConfigMap below)
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: [configmaps]
|
||||||
|
resourceNames: [{{ .Values.bundleConfigMap }}]
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
---
|
||||||
|
kind: RoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
---
|
||||||
|
# ClusterRole to allow spire-server node attestor to query Token Review API
|
||||||
|
# and to be able to push certificate bundles to a configmap
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
rules:
|
||||||
|
# allow TokenReview requests (to verify service account tokens for PSAT
|
||||||
|
# attestation)
|
||||||
|
- apiGroups: [authentication.k8s.io]
|
||||||
|
resources: [tokenreviews]
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- watch
|
||||||
|
- list
|
||||||
|
- create
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: [nodes, pods]
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
# Binds above cluster role to spire-server service account
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
namespace: {{ .Release.Namespace }}
|
||||||
|
{{- with .Values.service.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.service.type }}
|
||||||
|
ports:
|
||||||
|
- name: grpc
|
||||||
|
port: {{ .Values.service.port }}
|
||||||
|
targetPort: grpc
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,158 @@
|
|||||||
|
{{- $fullname := include "spire-server.fullname" . }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
{{- if not .Values.autoscaling.enabled }}
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
{{- end }}
|
||||||
|
serviceName: {{ include "spire-server.fullname" . }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spire-server.selectorLabels" . | nindent 6 }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.selectorLabels" . | nindent 8 }}
|
||||||
|
spec:
|
||||||
|
{{- with .Values.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
|
||||||
|
shareProcessNamespace: true
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||||
|
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /run/spire/config/server.conf
|
||||||
|
ports:
|
||||||
|
- name: grpc
|
||||||
|
containerPort: 8081
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /live
|
||||||
|
port: 8080
|
||||||
|
failureThreshold: 2
|
||||||
|
initialDelaySeconds: 15
|
||||||
|
periodSeconds: 60
|
||||||
|
timeoutSeconds: 3
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /ready
|
||||||
|
port: 8080
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: spire-server-socket
|
||||||
|
mountPath: /run/spire/server-sockets
|
||||||
|
readOnly: false
|
||||||
|
- name: spire-config
|
||||||
|
mountPath: /run/spire/config
|
||||||
|
readOnly: true
|
||||||
|
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||||
|
- name: spire-data
|
||||||
|
mountPath: /run/spire/data
|
||||||
|
readOnly: false
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||||
|
- name: upstream-ca
|
||||||
|
mountPath: /run/spire/upstream_ca
|
||||||
|
readOnly: false
|
||||||
|
{{ end }}
|
||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
- name: spire-controller-manager
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
||||||
|
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
|
||||||
|
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- --config=controller-manager-config.yaml
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
containerPort: 9443
|
||||||
|
protocol: TCP
|
||||||
|
# TODO: implement probes
|
||||||
|
# livenessProbe:
|
||||||
|
# httpGet:
|
||||||
|
# path: /
|
||||||
|
# port: https
|
||||||
|
# readinessProbe:
|
||||||
|
# httpGet:
|
||||||
|
# path: /
|
||||||
|
# port: https
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.controllerManager.resources | nindent 12 }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: spire-server-socket
|
||||||
|
mountPath: /run/spire/server-sockets
|
||||||
|
readOnly: true
|
||||||
|
- name: controller-manager-config
|
||||||
|
mountPath: /controller-manager-config.yaml
|
||||||
|
subPath: controller-manager-config.yaml
|
||||||
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
volumes:
|
||||||
|
- name: spire-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-server.fullname" . }}
|
||||||
|
- name: spire-server-socket
|
||||||
|
hostPath:
|
||||||
|
path: /run/spire/server-sockets
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||||
|
- name: upstream-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "spire-server.upstream-ca-secret" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||||
|
- name: controller-manager-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-controller-manager.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||||
|
- metadata:
|
||||||
|
name: spire-data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: {{ .Values.dataStorage.size }}
|
||||||
|
{{- if .Values.dataStorage.storageClass }}
|
||||||
|
storageClassName: {{ .Values.dataStorage.storageClass }}
|
||||||
|
{{- end }}
|
||||||
|
{{ end }}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: "{{ include "spire-server.fullname" . }}-test-connection"
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": test
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: wget
|
||||||
|
image: busybox
|
||||||
|
command: ['nc']
|
||||||
|
args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
|
||||||
|
restartPolicy: Never
|
||||||
@@ -0,0 +1,20 @@
|
|||||||
|
{{- $root := . }}
|
||||||
|
{{- with .Values.upstreamAuthority.disk }}
|
||||||
|
{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.upstream-ca-secret" $root }}
|
||||||
|
namespace: {{ $root.Release.Namespace }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-server.labels" $root | nindent 4 }}
|
||||||
|
data:
|
||||||
|
{{- with .secret.data }}
|
||||||
|
tls.crt: {{ .certificate | b64enc }}
|
||||||
|
tls.key: {{ .key | b64enc }}
|
||||||
|
{{- if ne .bundle ""}}
|
||||||
|
bundle.crt: {{ .bundle | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,161 @@
|
|||||||
|
# Default values for spire-server.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
|
||||||
|
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
image:
|
||||||
|
# registry: gcr.io
|
||||||
|
# repository: spiffe-io/spire-server
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-server
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
# Overrides the image tag whose default is the chart appVersion.
|
||||||
|
version: ""
|
||||||
|
|
||||||
|
imagePullSecrets: []
|
||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# Annotations to add to the service account
|
||||||
|
annotations: {}
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
podAnnotations: {}
|
||||||
|
|
||||||
|
podSecurityContext: {}
|
||||||
|
# fsGroup: 2000
|
||||||
|
|
||||||
|
securityContext: {}
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 8081
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# requests:
|
||||||
|
# cpu: 200m
|
||||||
|
# memory: 256Mi
|
||||||
|
# limits:
|
||||||
|
# cpu: 200m
|
||||||
|
# memory: 256Mi
|
||||||
|
|
||||||
|
autoscaling:
|
||||||
|
enabled: false
|
||||||
|
minReplicas: 1
|
||||||
|
maxReplicas: 100
|
||||||
|
targetCPUUtilizationPercentage: 80
|
||||||
|
# targetMemoryUtilizationPercentage: 80
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/arch: amd64
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
dataStorage:
|
||||||
|
enabled: true
|
||||||
|
size: 1Gi
|
||||||
|
accessMode: ReadWriteOnce
|
||||||
|
storageClass: null
|
||||||
|
|
||||||
|
logLevel: info
|
||||||
|
socketPath: /run/spire/server-sockets/spire-server.sock
|
||||||
|
jwtIssuer: oidc-discovery.example.org
|
||||||
|
|
||||||
|
clusterName: example-cluster
|
||||||
|
trustDomain: example.org
|
||||||
|
|
||||||
|
bundleConfigMap: spire-server
|
||||||
|
|
||||||
|
ca_subject:
|
||||||
|
country: NL
|
||||||
|
organization: Example
|
||||||
|
common_name: example.org
|
||||||
|
|
||||||
|
upstreamAuthority:
|
||||||
|
disk:
|
||||||
|
enabled: false
|
||||||
|
secret:
|
||||||
|
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
||||||
|
create: true
|
||||||
|
# -- If secret creation is disabled, the secret with this name will be used.
|
||||||
|
name: "spiffe-upstream-ca"
|
||||||
|
# -- If secret creation is enabled, will create a secret with following certificate info
|
||||||
|
data:
|
||||||
|
certificate: ""
|
||||||
|
key: ""
|
||||||
|
bundle: ""
|
||||||
|
|
||||||
|
controllerManager:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-controller-manager
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
# Overrides the image tag whose default is the chart appVersion.
|
||||||
|
version: "0.2.1"
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
# choice for the user. This also increases chances charts run on environments with little
|
||||||
|
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||||
|
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||||
|
# limits:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 128Mi
|
||||||
|
# requests:
|
||||||
|
# cpu: 100m
|
||||||
|
# memory: 128Mi
|
||||||
|
|
||||||
|
securityContext: {}
|
||||||
|
# capabilities:
|
||||||
|
# drop:
|
||||||
|
# - ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
# runAsUser: 1000
|
||||||
|
|
||||||
|
service:
|
||||||
|
type: ClusterIP
|
||||||
|
port: 443
|
||||||
|
annotations: {}
|
||||||
|
|
||||||
|
ignoreNamespaces:
|
||||||
|
- kube-system
|
||||||
|
- kube-public
|
||||||
|
- local-path-storage
|
||||||
|
|
||||||
|
identities:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
|
podSelector: {}
|
||||||
|
# matchLabels:
|
||||||
|
# spiffe.io/spiffe-id: "true"
|
||||||
|
namespaceSelector: {}
|
||||||
|
# matchLabels:
|
||||||
|
# spiffe.io/spiffe-id: "true"
|
||||||
|
dnsNameTemplates: []
|
||||||
|
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
Installed {{ .Chart.Name }}…
|
||||||
@@ -0,0 +1,39 @@
|
|||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride }}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||||
|
{{- if contains $name .Release.Name }}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire.chart" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire.agent-socket-path" -}}
|
||||||
|
{{- print "/run/spire/agent-sockets/spire-agent.sock" }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spire.server-socket-path" -}}
|
||||||
|
{{- print "/run/spire/server-sockets/spire-server.sock" }}
|
||||||
|
{{- end }}
|
||||||
@@ -0,0 +1,23 @@
|
|||||||
|
nameOverride: ""
|
||||||
|
fullnameOverride: ""
|
||||||
|
|
||||||
|
# subcharts
|
||||||
|
spire-server:
|
||||||
|
nameOverride: server
|
||||||
|
bundleConfigMap: &bundleConfigMap spire-bundle
|
||||||
|
|
||||||
|
clusterName: &clusterName "example-cluster"
|
||||||
|
trustDomain: &trustDomain "example.org"
|
||||||
|
|
||||||
|
spire-agent:
|
||||||
|
nameOverride: agent
|
||||||
|
bundleConfigMap: *bundleConfigMap
|
||||||
|
|
||||||
|
clusterName: *clusterName
|
||||||
|
trustDomain: *trustDomain
|
||||||
|
|
||||||
|
spiffe-csi-driver: {}
|
||||||
|
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
enabled: false
|
||||||
|
trustDomain: *trustDomain
|
||||||
Reference in New Issue
Block a user