Merge pull request #14 from spiffe/base-chart
This commit is contained in:
Marco Franssen
+1
-1
@@ -1,2 +1,2 @@
|
||||
.github/scripts/bin
|
||||
bin/
|
||||
.idea/
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,31 @@
|
||||
apiVersion: v2
|
||||
name: spire
|
||||
description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.5.4"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/philips-labs/helm-charts/tree/main/charts/spire
|
||||
sources:
|
||||
- https://github.com/philips-labs/helm-charts/tree/main/charts/spire
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
kubeVersion: ">=1.21.0-0"
|
||||
dependencies:
|
||||
- name: spire-server
|
||||
repository: file://./charts/spire-server
|
||||
version: 0.1.0
|
||||
- name: spire-agent
|
||||
repository: file://./charts/spire-agent
|
||||
version: 0.1.0
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://./charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spiffe-oidc-discovery-provider
|
||||
condition: spiffe-oidc-discovery-provider.enabled
|
||||
repository: file://./charts/spiffe-oidc-discovery-provider
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,201 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -0,0 +1,74 @@
|
||||
# spire
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
**Homepage:** <https://github.com/philips-labs/helm-charts/tree/main/charts/spire>
|
||||
|
||||
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
||||
|
||||
> **Note**: Minimum Spire version is `v1.5.3`.
|
||||
|
||||
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
||||
command to SSH into the Docker Desktop K8s VM.
|
||||
|
||||
```bash
|
||||
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||
```
|
||||
|
||||
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||
|
||||
```yaml
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- kube-apiserver
|
||||
- --api-audiences=api,spire-server
|
||||
- --service-account-issuer=api,spire-agent
|
||||
- --service-account-key-file=/run/config/pki/sa.pub
|
||||
- --service-account-signing-key-file=/run/config/pki/sa.key
|
||||
```
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/philips-labs/helm-charts/tree/main/charts/spire>
|
||||
|
||||
## Requirements
|
||||
|
||||
Kubernetes: `>=1.21.0-0`
|
||||
|
||||
| Repository | Name | Version |
|
||||
|------------|------|---------|
|
||||
| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
|
||||
| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
|
||||
| file://./charts/spire-agent | spire-agent | 0.1.0 |
|
||||
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| fullnameOverride | string | `""` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| spiffe-csi-driver | object | `{}` | |
|
||||
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
|
||||
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | |
|
||||
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
|
||||
| spire-agent.clusterName | string | `"example-cluster"` | |
|
||||
| spire-agent.nameOverride | string | `"agent"` | |
|
||||
| spire-agent.trustDomain | string | `"example.org"` | |
|
||||
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
|
||||
| spire-server.clusterName | string | `"example-cluster"` | |
|
||||
| spire-server.nameOverride | string | `"server"` | |
|
||||
| spire-server.trustDomain | string | `"example.org"` | |
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,45 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
||||
|
||||
> **Note**: Minimum Spire version is `v1.5.3`.
|
||||
|
||||
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
||||
command to SSH into the Docker Desktop K8s VM.
|
||||
|
||||
```bash
|
||||
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
||||
```
|
||||
|
||||
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
||||
|
||||
```yaml
|
||||
spec:
|
||||
containers:
|
||||
- command:
|
||||
- kube-apiserver
|
||||
- --api-audiences=api,spire-server
|
||||
- --service-account-issuer=api,spire-agent
|
||||
- --service-account-key-file=/run/config/pki/sa.pub
|
||||
- --service-account-signing-key-file=/run/config/pki/sa.key
|
||||
```
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: spiffe-csi-driver
|
||||
description: A Helm chart to install the SPIFFE CSI driver.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "0.2.1"
|
||||
@@ -0,0 +1,36 @@
|
||||
# spiffe-csi-driver
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE CSI driver.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.registry | string | `"ghcr.io"` | |
|
||||
| image.repository | string | `"spiffe/spiffe-csi-driver"` | |
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| namespaceOverride | string | `""` | |
|
||||
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| nodeDriverRegistrar.image.registry | string | `"registry.k8s.io"` | |
|
||||
| nodeDriverRegistrar.image.repository | string | `"sig-storage/csi-node-driver-registrar"` | |
|
||||
| nodeDriverRegistrar.image.version | string | `"v2.6.2"` | |
|
||||
| nodeDriverRegistrar.resources | object | `{}` | |
|
||||
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext.privileged | bool | `true` | |
|
||||
| securityContext.readOnlyRootFilesystem | bool | `true` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1 @@
|
||||
SPIFFE CSI Driver installed…
|
||||
@@ -0,0 +1,86 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-csi-driver.chart" . }}
|
||||
{{ include "spiffe-csi-driver.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-csi-driver.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-csi-driver.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-csi-driver.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- define "spiffe-csi-driver.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,116 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spiffe-csi-driver.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 6 }}
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
# This is the container which runs the SPIFFE CSI driver.
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "spiffe-csi-driver.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: [
|
||||
"-workload-api-socket-dir", "/spire-agent-socket",
|
||||
"-csi-socket-path", "/spiffe-csi/csi.sock",
|
||||
]
|
||||
env:
|
||||
# The CSI driver needs a unique node ID. The node name can be
|
||||
# used for this purpose.
|
||||
- name: MY_NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
volumeMounts:
|
||||
# The volume containing the SPIRE agent socket. The SPIFFE CSI
|
||||
# driver will mount this directory into containers.
|
||||
- mountPath: /spire-agent-socket
|
||||
name: spire-agent-socket-dir
|
||||
readOnly: true
|
||||
# The volume that will contain the CSI driver socket shared
|
||||
# with the kubelet and the driver registrar.
|
||||
- mountPath: /spiffe-csi
|
||||
name: spiffe-csi-socket-dir
|
||||
# The volume containing mount points for containers.
|
||||
- mountPath: /var/lib/kubelet/pods
|
||||
mountPropagation: Bidirectional
|
||||
name: mountpoint-dir
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- all
|
||||
privileged: true
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
# This container runs the CSI Node Driver Registrar which takes care
|
||||
# of all the little details required to register a CSI driver with
|
||||
# the kubelet.
|
||||
- name: node-driver-registrar
|
||||
image: {{ template "spiffe-csi-driver.image" .Values.nodeDriverRegistrar }}
|
||||
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
|
||||
args: [
|
||||
"-csi-address", "/spiffe-csi/csi.sock",
|
||||
"-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
|
||||
"-health-port", "9809"
|
||||
]
|
||||
volumeMounts:
|
||||
# The registrar needs access to the SPIFFE CSI driver socket
|
||||
- mountPath: /spiffe-csi
|
||||
name: spiffe-csi-socket-dir
|
||||
# The registrar needs access to the Kubelet plugin registration
|
||||
# directory
|
||||
- name: kubelet-plugin-registration-dir
|
||||
mountPath: /registration
|
||||
ports:
|
||||
- containerPort: 9809
|
||||
name: healthz
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: healthz
|
||||
initialDelaySeconds: 5
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ include "spire.agent-socket-path" . | dir }}
|
||||
type: DirectoryOrCreate
|
||||
# This volume is where the socket for kubelet->driver communication lives
|
||||
- name: spiffe-csi-socket-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins/csi.spiffe.io
|
||||
type: DirectoryOrCreate
|
||||
# This volume is where the SPIFFE CSI driver mounts volumes
|
||||
- name: mountpoint-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/pods
|
||||
type: Directory
|
||||
# This volume is where the node-driver-registrar registers the plugin
|
||||
# with kubelet
|
||||
- name: kubelet-plugin-registration-dir
|
||||
hostPath:
|
||||
path: /var/lib/kubelet/plugins_registry
|
||||
type: Directory
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-csi-driver.serviceAccountName" . }}
|
||||
namespace: {{ include "spiffe-csi-driver.namespace" . }}
|
||||
labels:
|
||||
{{- include "spiffe-csi-driver.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: CSIDriver
|
||||
metadata:
|
||||
name: "csi.spiffe.io"
|
||||
spec:
|
||||
# Only ephemeral, inline volumes are supported. There is no need for a
|
||||
# controller to provision and attach volumes.
|
||||
attachRequired: false
|
||||
|
||||
# Request the pod information which the CSI driver uses to verify that an
|
||||
# ephemeral mount was requested.
|
||||
podInfoOnMount: true
|
||||
|
||||
# Don't change ownership on the contents of the mount since the Workload API
|
||||
# Unix Domain Socket is typically open to all (i.e. 0777).
|
||||
fsGroupPolicy: None
|
||||
|
||||
# Declare support for ephemeral volumes only.
|
||||
volumeLifecycleModes:
|
||||
- Ephemeral
|
||||
@@ -0,0 +1,65 @@
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spiffe-csi-driver
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
namespaceOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext:
|
||||
readOnlyRootFilesystem: true
|
||||
privileged: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
nodeDriverRegistrar:
|
||||
image:
|
||||
registry: registry.k8s.io
|
||||
repository: sig-storage/csi-node-driver-registrar
|
||||
pullPolicy: IfNotPresent
|
||||
version: v2.6.2
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.5.4"
|
||||
@@ -0,0 +1,54 @@
|
||||
# spiffe-oidc-discovery-provider
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{}` | |
|
||||
| autoscaling.enabled | bool | `false` | |
|
||||
| autoscaling.maxReplicas | int | `5` | |
|
||||
| autoscaling.minReplicas | int | `1` | |
|
||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
||||
| autoscaling.targetMemoryUtilizationPercentage | int | `80` | |
|
||||
| config.acme.cacheDir | string | `"/run/spire"` | |
|
||||
| config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
|
||||
| config.acme.emailAddress | string | `"[email protected]"` | |
|
||||
| config.acme.tosAccepted | bool | `false` | |
|
||||
| config.domains[0] | string | `"localhost"` | |
|
||||
| config.domains[1] | string | `"oidc-discovery.example.org"` | |
|
||||
| config.logLevel | string | `"info"` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.registry | string | `"ghcr.io"` | |
|
||||
| image.repository | string | `"spiffe/oidc-discovery-provider"` | |
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| insecureScheme.enabled | bool | `false` | |
|
||||
| insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| insecureScheme.nginx.image.registry | string | `"docker.io"` | |
|
||||
| insecureScheme.nginx.image.repository | string | `"nginx"` | |
|
||||
| insecureScheme.nginx.image.version | string | `"1.23.2-alpine"` | |
|
||||
| insecureScheme.nginx.resources | object | `{}` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| replicaCount | int | `1` | |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext | object | `{}` | |
|
||||
| service.annotations | object | `{}` | |
|
||||
| service.port | int | `80` | |
|
||||
| service.type | string | `"ClusterIP"` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
| tolerations | list | `[]` | |
|
||||
| trustDomain | string | `"example.org"` | |
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1 @@
|
||||
SPIFFE OIDC discovery provider installed…
|
||||
@@ -0,0 +1,74 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-oidc-discovery-provider.chart" . }}
|
||||
{{ include "spiffe-oidc-discovery-provider.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-oidc-discovery-provider.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-oidc-discovery-provider.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-oidc-discovery-provider.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spiffe-oidc-discovery-provider.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,57 @@
|
||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
oidc-discovery-provider.conf: |
|
||||
log_level = "{{ .Values.config.logLevel }}"
|
||||
|
||||
domains = [
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}",
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local",
|
||||
{{- if gt (len .Values.config.domains) 0 }}
|
||||
"{{- join "\",\n \"" .Values.config.domains }}"
|
||||
{{- end }}
|
||||
]
|
||||
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
|
||||
listen_socket_path = {{ $oidcSocket | quote }}
|
||||
{{- else }}
|
||||
acme {
|
||||
directory_url = "{{ .Values.config.acme.directoryUrl }}"
|
||||
cache_dir = "{{ .Values.config.acme.cacheDir }}"
|
||||
tos_accepted = {{ .Values.config.acme.tosAccepted }}
|
||||
email = "{{ .Values.config.acme.emailAddress }}"
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
workload_api {
|
||||
socket_path = "/spiffe-workload-api/{{ include "spire.agent-socket-path" . | splitList "/" | last }}"
|
||||
trust_domain = "{{ .Values.trustDomain }}"
|
||||
}
|
||||
|
||||
health_checks {
|
||||
bind_port = "8008"
|
||||
ready_path = "/ready"
|
||||
live_path = "/live"
|
||||
}
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
default.conf.template: |
|
||||
upstream oidc {
|
||||
server unix:{{ $oidcSocket }};
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
listen [::]:80;
|
||||
|
||||
location / {
|
||||
proxy_pass http://oidc;
|
||||
proxy_set_header Host $host;
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,114 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spiffe-oidc-discovery-provider.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -config
|
||||
- /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
name: health
|
||||
{{- if not .Values.insecureScheme.enabled }}
|
||||
- containerPort: 443
|
||||
name: https
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: spire-oidc-sockets
|
||||
mountPath: /run/spire/oidc-sockets
|
||||
readOnly: false
|
||||
- name: spire-oidc-config
|
||||
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||
subPath: oidc-discovery-provider.conf
|
||||
readOnly: true
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
port: health
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
- name: nginx
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spiffe-oidc-discovery-provider.image" .Values.insecureScheme.nginx }}
|
||||
imagePullPolicy: {{ .Values.insecureScheme.nginx.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
volumeMounts:
|
||||
- name: spire-oidc-sockets
|
||||
mountPath: /run/spire/oidc-sockets
|
||||
readOnly: true
|
||||
- name: spire-oidc-config
|
||||
mountPath: /etc/nginx/templates/default.conf.template
|
||||
subPath: default.conf.template
|
||||
readOnly: true
|
||||
resources:
|
||||
{{- toYaml .Values.insecureScheme.nginx.resources | nindent 12 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "csi.spiffe.io"
|
||||
readOnly: true
|
||||
- name: spire-oidc-sockets
|
||||
hostPath:
|
||||
path: /run/spire/oidc-sockets
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-oidc-config
|
||||
configMap:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- else }}
|
||||
- name: https
|
||||
port: 443
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
selector:
|
||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
+23
@@ -0,0 +1,23 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "spiffe-oidc-discovery-provider.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
containers:
|
||||
- name: wget-service-name
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
- name: wget-service-name-namespace
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
- name: wget-service-name-namespace-svc-cluster-local
|
||||
image: busybox
|
||||
command: ['wget']
|
||||
args: ['{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
restartPolicy: Never
|
||||
@@ -0,0 +1,112 @@
|
||||
# Default values for spiffe-oidc-discovery-provider.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
# registry: gcr.io
|
||||
# repository: spiffe-io/oidc-discovery-provider
|
||||
registry: ghcr.io
|
||||
repository: spiffe/oidc-discovery-provider
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
annotations: {}
|
||||
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
insecureScheme:
|
||||
enabled: false
|
||||
|
||||
nginx:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: nginx
|
||||
pullPolicy: IfNotPresent
|
||||
version: 1.23.2-alpine
|
||||
# chainguard image does not support the templates feature
|
||||
# https://github.com/chainguard-images/nginx/issues/43
|
||||
# registry: cgr.dev
|
||||
# repository: chainguard/nginx
|
||||
# pullPolicy: IfNotPresent
|
||||
# version: "1.23.2"
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
config:
|
||||
logLevel: info
|
||||
domains:
|
||||
- localhost
|
||||
- oidc-discovery.example.org
|
||||
|
||||
acme:
|
||||
tosAccepted: false
|
||||
cacheDir: /run/spire
|
||||
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
||||
emailAddress: [email protected]
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 5
|
||||
targetCPUUtilizationPercentage: 80
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
trustDomain: "example.org"
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.5.4"
|
||||
@@ -0,0 +1,39 @@
|
||||
# spire-agent
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE agent.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| bundleConfigMap | string | `"spire-bundle"` | |
|
||||
| clusterName | string | `"example-cluster"` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.registry | string | `"ghcr.io"` | |
|
||||
| image.repository | string | `"spiffe/spire-agent"` | |
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| logLevel | string | `"info"` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext | object | `{}` | |
|
||||
| server.port | int | `8081` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
| trustDomain | string | `"example.org"` | |
|
||||
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| waitForIt.image.registry | string | `"cgr.dev"` | |
|
||||
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | |
|
||||
| waitForIt.image.version | string | `"latest-20230113"` | |
|
||||
| waitForIt.resources | object | `{}` | |
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,74 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-agent.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-agent.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-agent.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-agent.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-agent.chart" . }}
|
||||
{{ include "spire-agent.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-agent.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-agent.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-agent.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-agent.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,51 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
agent.conf: |
|
||||
agent {
|
||||
data_dir = "/run/spire"
|
||||
log_level = {{ .Values.logLevel | quote }}
|
||||
server_address = "{{ .Release.Name }}-server"
|
||||
server_port = {{ .Values.server.port | quote }}
|
||||
socket_path = {{ include "spire.agent-socket-path" . | quote }}
|
||||
trust_bundle_path = "/run/spire/bundle/bundle.crt"
|
||||
trust_domain = {{ .Values.trustDomain | quote }}
|
||||
}
|
||||
|
||||
plugins {
|
||||
NodeAttestor "k8s_psat" {
|
||||
plugin_data {
|
||||
cluster = {{ .Values.clusterName | quote }}
|
||||
}
|
||||
}
|
||||
|
||||
KeyManager "memory" {
|
||||
plugin_data {
|
||||
}
|
||||
}
|
||||
|
||||
WorkloadAttestor "k8s" {
|
||||
plugin_data {
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification = true
|
||||
}
|
||||
}
|
||||
|
||||
WorkloadAttestor "unix" {
|
||||
plugin_data {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8080"
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
@@ -0,0 +1,93 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire-agent.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostPID: true
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: init
|
||||
# This is a small image with wait-for-it, choose whatever image
|
||||
# you prefer that waits for a service to be up. This image is built
|
||||
# from https://github.com/vishnubob/wait-for-it
|
||||
image: {{ template "spire-agent.image" .Values.waitForIt }}
|
||||
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
|
||||
args: ["-t", "30", "-h", "{{ .Release.Name }}-server", "-p", {{ .Values.server.port | quote }}]
|
||||
resources:
|
||||
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["-config", "/run/spire/config/agent.conf"]
|
||||
volumeMounts:
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
readOnly: true
|
||||
- name: spire-bundle
|
||||
mountPath: /run/spire/bundle
|
||||
readOnly: true
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ include "spire.agent-socket-path" . | dir }}
|
||||
readOnly: false
|
||||
- name: spire-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 60
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 60
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
- name: spire-bundle
|
||||
configMap:
|
||||
name: {{ .Values.bundleConfigMap }}
|
||||
- name: spire-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: spire-agent
|
||||
expirationSeconds: 7200
|
||||
audience: spire-server
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ include "spire.agent-socket-path" . | dir }}
|
||||
type: DirectoryOrCreate
|
||||
@@ -0,0 +1,27 @@
|
||||
# Required cluster role to allow spire-agent to query k8s API server
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
- nodes/proxy
|
||||
verbs: ["get"]
|
||||
---
|
||||
# Binds above cluster role to spire-agent service account
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-agent.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,70 @@
|
||||
# Default values for spire-agent.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
image:
|
||||
# registry: gcr.io
|
||||
# repository: spiffe-io/spire-agent
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-agent
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
logLevel: info
|
||||
clusterName: example-cluster
|
||||
trustDomain: example.org
|
||||
|
||||
bundleConfigMap: spire-bundle
|
||||
|
||||
server:
|
||||
port: 8081
|
||||
|
||||
waitForIt:
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
version: latest-20230113
|
||||
resources: {}
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.5.4"
|
||||
@@ -0,0 +1,75 @@
|
||||
# spire-server
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE server.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| affinity | object | `{}` | |
|
||||
| autoscaling.enabled | bool | `false` | |
|
||||
| autoscaling.maxReplicas | int | `100` | |
|
||||
| autoscaling.minReplicas | int | `1` | |
|
||||
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
|
||||
| bundleConfigMap | string | `"spire-server"` | |
|
||||
| ca_subject.common_name | string | `"example.org"` | |
|
||||
| ca_subject.country | string | `"NL"` | |
|
||||
| ca_subject.organization | string | `"Example"` | |
|
||||
| clusterName | string | `"example-cluster"` | |
|
||||
| controllerManager.enabled | bool | `false` | |
|
||||
| controllerManager.identities.dnsNameTemplates | list | `[]` | |
|
||||
| controllerManager.identities.enabled | bool | `true` | |
|
||||
| controllerManager.identities.namespaceSelector | object | `{}` | |
|
||||
| controllerManager.identities.podSelector | object | `{}` | |
|
||||
| controllerManager.identities.spiffeIDTemplate | string | `"spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}"` | |
|
||||
| controllerManager.ignoreNamespaces[0] | string | `"kube-system"` | |
|
||||
| controllerManager.ignoreNamespaces[1] | string | `"kube-public"` | |
|
||||
| controllerManager.ignoreNamespaces[2] | string | `"local-path-storage"` | |
|
||||
| controllerManager.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controllerManager.image.registry | string | `"ghcr.io"` | |
|
||||
| controllerManager.image.repository | string | `"spiffe/spire-controller-manager"` | |
|
||||
| controllerManager.image.version | string | `"0.2.1"` | |
|
||||
| controllerManager.resources | object | `{}` | |
|
||||
| controllerManager.securityContext | object | `{}` | |
|
||||
| controllerManager.service.annotations | object | `{}` | |
|
||||
| controllerManager.service.port | int | `443` | |
|
||||
| controllerManager.service.type | string | `"ClusterIP"` | |
|
||||
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
|
||||
| dataStorage.enabled | bool | `true` | |
|
||||
| dataStorage.size | string | `"1Gi"` | |
|
||||
| dataStorage.storageClass | string | `nil` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.registry | string | `"ghcr.io"` | |
|
||||
| image.repository | string | `"spiffe/spire-server"` | |
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
|
||||
| logLevel | string | `"info"` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext | object | `{}` | |
|
||||
| service.annotations | object | `{}` | |
|
||||
| service.port | int | `8081` | |
|
||||
| service.type | string | `"ClusterIP"` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
|
||||
| tolerations | list | `[]` | |
|
||||
| topologySpreadConstraints | list | `[]` | |
|
||||
| trustDomain | string | `"example.org"` | |
|
||||
| upstreamAuthority.disk.enabled | bool | `false` | |
|
||||
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
|
||||
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
|
||||
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,21 @@
|
||||
{{ template "chart.header" . }}
|
||||
|
||||
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
||||
|
||||
{{ template "chart.deprecationWarning" . }}
|
||||
|
||||
{{ template "chart.badgesSection" . }}
|
||||
|
||||
{{ template "chart.description" . }}
|
||||
|
||||
{{ template "chart.homepageLine" . }}
|
||||
|
||||
{{ template "chart.maintainersSection" . }}
|
||||
|
||||
{{ template "chart.sourcesSection" . }}
|
||||
|
||||
{{ template "chart.requirementsSection" . }}
|
||||
|
||||
{{ template "chart.valuesSection" . }}
|
||||
|
||||
----------------------------------------------
|
||||
@@ -0,0 +1,96 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: clusterfederatedtrustdomains.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterFederatedTrustDomain
|
||||
listKind: ClusterFederatedTrustDomainList
|
||||
plural: clusterfederatedtrustdomains
|
||||
singular: clusterfederatedtrustdomain
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.trustDomain
|
||||
name: Trust Domain
|
||||
type: string
|
||||
- jsonPath: .spec.bundleEndpointURL
|
||||
name: Endpoint URL
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterFederatedTrustDomain is the Schema for the clusterfederatedtrustdomains
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterFederatedTrustDomainSpec defines the desired state
|
||||
of ClusterFederatedTrustDomain
|
||||
properties:
|
||||
bundleEndpointProfile:
|
||||
description: BundleEndpointProfile is the profile for the bundle endpoint.
|
||||
properties:
|
||||
endpointSPIFFEID:
|
||||
description: EndpointSPIFFEID is the SPIFFE ID of the bundle endpoint.
|
||||
It is required for the "https_spiffe" profile.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of the bundle endpoint profile.
|
||||
enum:
|
||||
- https_spiffe
|
||||
- https_web
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
bundleEndpointURL:
|
||||
description: BundleEndpointURL is the URL of the bundle endpoint.
|
||||
It must be an HTTPS URL and cannot contain userinfo (i.e. username/password).
|
||||
type: string
|
||||
trustDomain:
|
||||
description: TrustDomain is the name of the trust domain to federate
|
||||
with (e.g. example.org)
|
||||
pattern: '[a-z0-9._-]{1,255}'
|
||||
type: string
|
||||
trustDomainBundle:
|
||||
description: TrustDomainBundle is the contents of the bundle for the
|
||||
referenced trust domain. This field is optional when the resource
|
||||
is created.
|
||||
type: string
|
||||
required:
|
||||
- bundleEndpointProfile
|
||||
- bundleEndpointURL
|
||||
- trustDomain
|
||||
type: object
|
||||
status:
|
||||
description: ClusterFederatedTrustDomainStatus defines the observed state
|
||||
of ClusterFederatedTrustDomain
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,221 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: clusterspiffeids.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ClusterSPIFFEID
|
||||
listKind: ClusterSPIFFEIDList
|
||||
plural: clusterspiffeids
|
||||
singular: clusterspiffeid
|
||||
scope: Cluster
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterSPIFFEID is the Schema for the clusterspiffeids API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterSPIFFEIDSpec defines the desired state of ClusterSPIFFEID
|
||||
properties:
|
||||
admin:
|
||||
description: Admin indicates whether or not the SVID can be used to
|
||||
access the SPIRE administrative APIs. Extra care should be taken
|
||||
to only apply this SPIFFE ID to admin workloads.
|
||||
type: boolean
|
||||
dnsNameTemplates:
|
||||
description: DNSNameTemplate represents templates for extra DNS names
|
||||
that are applicable to SVIDs minted for this ClusterSPIFFEID. The
|
||||
node and pod spec are made available to the template under .NodeSpec,
|
||||
.PodSpec respectively.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
federatesWith:
|
||||
description: FederatesWith is a list of trust domain names that workloads
|
||||
that obtain this SPIFFE ID will federate with.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector selects the namespaces that are targetted
|
||||
by this CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the key
|
||||
and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to
|
||||
a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
podSelector:
|
||||
description: PodSelector selects the pods that are targetted by this
|
||||
CRD.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements.
|
||||
The requirements are ANDed.
|
||||
items:
|
||||
description: A label selector requirement is a selector that
|
||||
contains values, a key, and an operator that relates the key
|
||||
and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies
|
||||
to.
|
||||
type: string
|
||||
operator:
|
||||
description: operator represents a key's relationship to
|
||||
a set of values. Valid operators are In, NotIn, Exists
|
||||
and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: values is an array of string values. If the
|
||||
operator is In or NotIn, the values array must be non-empty.
|
||||
If the operator is Exists or DoesNotExist, the values
|
||||
array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: matchLabels is a map of {key,value} pairs. A single
|
||||
{key,value} in the matchLabels map is equivalent to an element
|
||||
of matchExpressions, whose key field is "key", the operator
|
||||
is "In", and the values array contains only "value". The requirements
|
||||
are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
spiffeIDTemplate:
|
||||
description: SPIFFEID is the SPIFFE ID template. The node and pod
|
||||
spec are made available to the template under .NodeSpec, .PodSpec
|
||||
respectively.
|
||||
type: string
|
||||
ttl:
|
||||
description: TTL indicates an upper-bound time-to-live for SVIDs minted
|
||||
for this ClusterSPIFFEID. If unset, a default will be chosen.
|
||||
type: string
|
||||
workloadSelectorTemplates:
|
||||
description: WorkloadSelectorTemplates are templates to produce arbitrary
|
||||
workload selectors that apply to a given workload before it will
|
||||
receive this SPIFFE ID. The rendered value is interpreted by SPIRE
|
||||
and are of the form type:value, where the value may, and often does,
|
||||
contain semicolons, .e.g., k8s:container-image:docker/hello-world
|
||||
The node and pod spec are made available to the template under .NodeSpec,
|
||||
.PodSpec respectively.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- spiffeIDTemplate
|
||||
type: object
|
||||
status:
|
||||
description: ClusterSPIFFEIDStatus defines the observed state of ClusterSPIFFEID
|
||||
properties:
|
||||
stats:
|
||||
description: Stats produced by the last entry reconciliation run
|
||||
properties:
|
||||
entriesMasked:
|
||||
description: How many entries were masked by entries for other
|
||||
ClusterSPIFFEIDs. This happens when one or more ClusterSPIFFEIDs
|
||||
produce an entry for the same pod with the same set of workload
|
||||
selectors.
|
||||
type: integer
|
||||
entriesToSet:
|
||||
description: How many entries are to be set for this ClusterSPIFFEID.
|
||||
In nominal conditions, this should reflect the number of pods
|
||||
selected, but not always if there were problems encountered
|
||||
rendering an entry for the pod (RenderFailures) or entries are
|
||||
masked (EntriesMasked).
|
||||
type: integer
|
||||
entryFailures:
|
||||
description: How many entries were unable to be set due to failures
|
||||
to create or update the entries via the SPIRE Server API.
|
||||
type: integer
|
||||
namespacesIgnored:
|
||||
description: How many (selected) namespaces were ignored (based
|
||||
on configuration).
|
||||
type: integer
|
||||
namespacesSelected:
|
||||
description: How many namespaces were selected.
|
||||
type: integer
|
||||
podEntryRenderFailures:
|
||||
description: How many failures were encountered rendering an entry
|
||||
selected pods. This could be due to either a bad template in
|
||||
the ClusterSPIFFEID or Pod metadata that when applied to the
|
||||
template did not produce valid entry values.
|
||||
type: integer
|
||||
podsSelected:
|
||||
description: How many pods were selected out of the namespaces.
|
||||
type: integer
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,59 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: controllermanagerconfigs.spire.spiffe.io
|
||||
spec:
|
||||
group: spire.spiffe.io
|
||||
names:
|
||||
kind: ControllerManagerConfig
|
||||
listKind: ControllerManagerConfigList
|
||||
plural: controllermanagerconfigs
|
||||
singular: controllermanagerconfig
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ControllerManagerConfig is the Schema for the controllermanagerconfigs
|
||||
API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ControllerManagerConfigSpec defines the desired state of
|
||||
ControllerManagerConfig
|
||||
properties:
|
||||
foo:
|
||||
description: Foo is an example field of ControllerManagerConfig. Edit
|
||||
controllermanagerconfig_types.go to remove/update
|
||||
type: string
|
||||
type: object
|
||||
status:
|
||||
description: ControllerManagerConfigStatus defines the observed state
|
||||
of ControllerManagerConfig
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
@@ -0,0 +1,6 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
|
||||
1. Get the currently registered SPIFFE entries from the server:
|
||||
|
||||
kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
|
||||
bin/spire-server entry show -socketPath {{ .Values.socketPath }}
|
||||
@@ -0,0 +1,94 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-server.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-server.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-server.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-server.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-server.chart" . }}
|
||||
{{ include "spire-server.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-server.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-server.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-server.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- define "spire-server.upstream-ca-secret" -}}
|
||||
{{- $root := . }}
|
||||
{{- with .Values.upstreamAuthority.disk -}}
|
||||
{{- if eq (.secret.create | toString) "true" -}}
|
||||
{{ include "spire-server.fullname" $root }}-upstream-ca
|
||||
{{- else -}}
|
||||
{{ default (include "spire-server.fullname" $root) .secret.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-controller-manager.fullname" -}}
|
||||
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-controller-manager
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-k8s-workload-registrar.fullname" -}}
|
||||
{{ include "spire-server.fullname" . | trimSuffix "-server" }}-k8s-workload-registrar
|
||||
{{- end }}
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.bundleConfigMap }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
@@ -0,0 +1,83 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
server.conf: |
|
||||
server {
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8081"
|
||||
socket_path = {{ .Values.socketPath | quote }}
|
||||
trust_domain = {{ .Values.trustDomain | quote }}
|
||||
data_dir = "/run/spire/data"
|
||||
log_level = "{{ .Values.logLevel }}"
|
||||
# AWS requires the use of RSA. EC cryptography is not supported
|
||||
ca_key_type = "rsa-2048"
|
||||
|
||||
jwt_issuer = "{{ .Values.jwtIssuer }}"
|
||||
|
||||
default_x509_svid_ttl = "1h"
|
||||
default_jwt_svid_ttl = "1h"
|
||||
ca_subject = {
|
||||
{{- with .Values.ca_subject }}
|
||||
country = [{{ .country | quote }}],
|
||||
organization = [{{ .organization | quote }}],
|
||||
common_name = {{ .common_name | quote }},
|
||||
{{- end }}
|
||||
}
|
||||
}
|
||||
|
||||
plugins {
|
||||
DataStore "sql" {
|
||||
plugin_data {
|
||||
database_type = "sqlite3"
|
||||
connection_string = "/run/spire/data/datastore.sqlite3"
|
||||
}
|
||||
}
|
||||
|
||||
NodeAttestor "k8s_psat" {
|
||||
plugin_data {
|
||||
clusters = {
|
||||
{{ .Values.clusterName | quote }} = {
|
||||
service_account_allow_list = ["{{ .Release.Namespace }}:{{ .Release.Name }}-agent"]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
KeyManager "disk" {
|
||||
plugin_data {
|
||||
keys_path = "/run/spire/data/keys.json"
|
||||
}
|
||||
}
|
||||
|
||||
Notifier "k8sbundle" {
|
||||
plugin_data {
|
||||
namespace = "{{ .Release.Namespace }}"
|
||||
config_map = {{ .Values.bundleConfigMap | quote }}
|
||||
}
|
||||
}
|
||||
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
UpstreamAuthority "disk" {
|
||||
plugin_data {
|
||||
cert_file_path = "/run/spire/upstream_ca/tls.crt"
|
||||
key_file_path = "/run/spire/upstream_ca/tls.key"
|
||||
{{- if ne .secret.data.bundle "" }}
|
||||
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
|
||||
{{- end }}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8080"
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- $root := . }}
|
||||
{{- with .Values.controllerManager }}
|
||||
{{- if and (eq (.enabled | toString) "true") (eq (.identities.enabled | toString) "true") }}
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterSPIFFEID
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" $root }}-service-account-based
|
||||
spec:
|
||||
spiffeIDTemplate: {{ .identities.spiffeIDTemplate | quote }}
|
||||
{{- with .identities.podSelector }}
|
||||
podSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .identities.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .identities.dnsNameTemplates }}
|
||||
dnsNameTemplates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
controller-manager-config.yaml: |
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ControllerManagerConfig
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 8 }}
|
||||
metrics:
|
||||
bindAddress: 127.0.0.1:8082
|
||||
healthProbe:
|
||||
bindAddress: 127.0.0.1:8083
|
||||
leaderElection:
|
||||
leaderElect: true
|
||||
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
|
||||
resourceNamespace: {{ .Release.Namespace }}
|
||||
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
clusterName: {{ .Values.clusterName }}
|
||||
trustDomain: {{ .Values.trustDomain }}
|
||||
ignoreNamespaces:
|
||||
{{- with .Values.controllerManager.ignoreNamespaces }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
spireServerSocketPath: {{ .Values.socketPath | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-leader-election
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "patch", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterfederatedtrustdomains/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
resources: ["clusterspiffeids/status"]
|
||||
verbs: ["get", "patch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.controllerManager.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.controllerManager.service.type }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.controllerManager.service.port }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,35 @@
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
webhooks:
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-spire-spiffe-io-v1alpha1-clusterfederatedtrustdomain
|
||||
failurePolicy: Fail
|
||||
name: vclusterfederatedtrustdomain.kb.io
|
||||
rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
apiVersions: ["v1alpha1"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["clusterfederatedtrustdomains"]
|
||||
sideEffects: None
|
||||
- admissionReviewVersions: ["v1"]
|
||||
clientConfig:
|
||||
service:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}-webhook
|
||||
namespace: {{ .Release.Namespace }}
|
||||
path: /validate-spire-spiffe-io-v1alpha1-clusterspiffeid
|
||||
failurePolicy: Fail
|
||||
name: vclusterspiffeid.kb.io
|
||||
rules:
|
||||
- apiGroups: ["spire.spiffe.io"]
|
||||
apiVersions: ["v1alpha1"]
|
||||
operations: ["CREATE", "UPDATE"]
|
||||
resources: ["clusterspiffeids"]
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,71 @@
|
||||
# ClusterRole to allow spire-server node attestor to query Token Review API
|
||||
# and to be able to push certificate bundles to a configmap
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
# allow "get" access to pods (to resolve selectors for PSAT attestation)
|
||||
- apiGroups: [""]
|
||||
resources: [pods]
|
||||
verbs: [get]
|
||||
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
|
||||
# agent bootstrapping, see the spire-bundle ConfigMap below)
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
resourceNames: [{{ .Values.bundleConfigMap }}]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# ClusterRole to allow spire-server node attestor to query Token Review API
|
||||
# and to be able to push certificate bundles to a configmap
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
rules:
|
||||
# allow TokenReview requests (to verify service account tokens for PSAT
|
||||
# attestation)
|
||||
- apiGroups: [authentication.k8s.io]
|
||||
resources: [tokenreviews]
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
- create
|
||||
- apiGroups: [""]
|
||||
resources: [nodes, pods]
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
---
|
||||
# Binds above cluster role to spire-server service account
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
- name: grpc
|
||||
port: {{ .Values.service.port }}
|
||||
targetPort: grpc
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-server.serviceAccountName" . }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,158 @@
|
||||
{{- $fullname := include "spire-server.fullname" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
serviceName: {{ include "spire-server.fullname" . }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
|
||||
shareProcessNamespace: true
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -config
|
||||
- /run/spire/config/server.conf
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 8081
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
port: 8080
|
||||
failureThreshold: 2
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 60
|
||||
timeoutSeconds: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8080
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /run/spire/server-sockets
|
||||
readOnly: false
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
readOnly: true
|
||||
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||
- name: spire-data
|
||||
mountPath: /run/spire/data
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||
- name: upstream-ca
|
||||
mountPath: /run/spire/upstream_ca
|
||||
readOnly: false
|
||||
{{ end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
- name: spire-controller-manager
|
||||
securityContext:
|
||||
{{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.image) }}
|
||||
imagePullPolicy: {{ .Values.controllerManager.image.pullPolicy }}
|
||||
args:
|
||||
- --config=controller-manager-config.yaml
|
||||
ports:
|
||||
- name: https
|
||||
containerPort: 9443
|
||||
protocol: TCP
|
||||
# TODO: implement probes
|
||||
# livenessProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: https
|
||||
# readinessProbe:
|
||||
# httpGet:
|
||||
# path: /
|
||||
# port: https
|
||||
resources:
|
||||
{{- toYaml .Values.controllerManager.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spire-server-socket
|
||||
mountPath: /run/spire/server-sockets
|
||||
readOnly: true
|
||||
- name: controller-manager-config
|
||||
mountPath: /controller-manager-config.yaml
|
||||
subPath: controller-manager-config.yaml
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: {{ include "spire-server.fullname" . }}
|
||||
- name: spire-server-socket
|
||||
hostPath:
|
||||
path: /run/spire/server-sockets
|
||||
type: DirectoryOrCreate
|
||||
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||
- name: upstream-ca
|
||||
secret:
|
||||
secretName: {{ include "spire-server.upstream-ca-secret" . }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
|
||||
- name: controller-manager-config
|
||||
configMap:
|
||||
name: {{ include "spire-controller-manager.fullname" . }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||
- metadata:
|
||||
name: spire-data
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.dataStorage.size }}
|
||||
{{- if .Values.dataStorage.storageClass }}
|
||||
storageClassName: {{ .Values.dataStorage.storageClass }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: "{{ include "spire-server.fullname" . }}-test-connection"
|
||||
labels:
|
||||
{{- include "spire-server.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
containers:
|
||||
- name: wget
|
||||
image: busybox
|
||||
command: ['nc']
|
||||
args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
|
||||
restartPolicy: Never
|
||||
@@ -0,0 +1,20 @@
|
||||
{{- $root := . }}
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.upstream-ca-secret" $root }}
|
||||
namespace: {{ $root.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire-server.labels" $root | nindent 4 }}
|
||||
data:
|
||||
{{- with .secret.data }}
|
||||
tls.crt: {{ .certificate | b64enc }}
|
||||
tls.key: {{ .key | b64enc }}
|
||||
{{- if ne .bundle ""}}
|
||||
bundle.crt: {{ .bundle | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,161 @@
|
||||
# Default values for spire-server.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
# -- SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database.
|
||||
replicaCount: 1
|
||||
|
||||
image:
|
||||
# registry: gcr.io
|
||||
# repository: spiffe-io/spire-server
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-server
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8081
|
||||
annotations: {}
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 200m
|
||||
# memory: 256Mi
|
||||
# limits:
|
||||
# cpu: 200m
|
||||
# memory: 256Mi
|
||||
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 100
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
tolerations: []
|
||||
|
||||
affinity: {}
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
dataStorage:
|
||||
enabled: true
|
||||
size: 1Gi
|
||||
accessMode: ReadWriteOnce
|
||||
storageClass: null
|
||||
|
||||
logLevel: info
|
||||
socketPath: /run/spire/server-sockets/spire-server.sock
|
||||
jwtIssuer: oidc-discovery.example.org
|
||||
|
||||
clusterName: example-cluster
|
||||
trustDomain: example.org
|
||||
|
||||
bundleConfigMap: spire-server
|
||||
|
||||
ca_subject:
|
||||
country: NL
|
||||
organization: Example
|
||||
common_name: example.org
|
||||
|
||||
upstreamAuthority:
|
||||
disk:
|
||||
enabled: false
|
||||
secret:
|
||||
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
|
||||
create: true
|
||||
# -- If secret creation is disabled, the secret with this name will be used.
|
||||
name: "spiffe-upstream-ca"
|
||||
# -- If secret creation is enabled, will create a secret with following certificate info
|
||||
data:
|
||||
certificate: ""
|
||||
key: ""
|
||||
bundle: ""
|
||||
|
||||
controllerManager:
|
||||
enabled: false
|
||||
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-controller-manager
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: "0.2.1"
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
|
||||
ignoreNamespaces:
|
||||
- kube-system
|
||||
- kube-public
|
||||
- local-path-storage
|
||||
|
||||
identities:
|
||||
enabled: true
|
||||
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
podSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
namespaceSelector: {}
|
||||
# matchLabels:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
dnsNameTemplates: []
|
||||
# - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
|
||||
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,39 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire.agent-socket-path" -}}
|
||||
{{- print "/run/spire/agent-sockets/spire-agent.sock" }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire.server-socket-path" -}}
|
||||
{{- print "/run/spire/server-sockets/spire-server.sock" }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# subcharts
|
||||
spire-server:
|
||||
nameOverride: server
|
||||
bundleConfigMap: &bundleConfigMap spire-bundle
|
||||
|
||||
clusterName: &clusterName "example-cluster"
|
||||
trustDomain: &trustDomain "example.org"
|
||||
|
||||
spire-agent:
|
||||
nameOverride: agent
|
||||
bundleConfigMap: *bundleConfigMap
|
||||
|
||||
clusterName: *clusterName
|
||||
trustDomain: *trustDomain
|
||||
|
||||
spiffe-csi-driver: {}
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
trustDomain: *trustDomain
|
||||
Reference in New Issue
Block a user