From a15e44588a82320404d23a17f3e45de7f307e329 Mon Sep 17 00:00:00 2001 From: anhpatel <162738027+anhpatel@users.noreply.github.com> Date: Tue, 26 Mar 2024 22:53:52 -0700 Subject: [PATCH] Run SPIRE server as deployment (#293) * Bump spire Helm Chart version from 0.18.1 to 0.18.2 * fd3b7d5 Fix duplicate securityContext section in spire-agent (#279) Signed-off-by: Faisal Memon Signed-off-by: aniket patel * Add spire-server as deployment Signed-off-by: aniket patel Signed-off-by: aniket patel * Add stateless-server example Signed-off-by: aniket patel Signed-off-by: aniket patel * Update README.md to add deploymentType Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel Signed-off-by: aniket patel * Set hpa type based on deploymentType Signed-off-by: aniket patel Signed-off-by: aniket patel * Change deploymentType values to lowercase in README Signed-off-by: aniket patel Signed-off-by: aniket patel * Update readme for stateless-server Signed-off-by: aniket patel Signed-off-by: aniket patel * Revert README changes Signed-off-by: aniket patel Signed-off-by: aniket patel * Update readme for deploymentType Signed-off-by: aniket patel Signed-off-by: aniket patel * Failure handling only when deployment type checked Signed-off-by: aniket patel Signed-off-by: aniket patel * Fix issue with tests not running on automated PRs (#266) * Use github app for version checker Signed-off-by: Faisal Memon * Use full version Signed-off-by: Faisal Memon --------- Signed-off-by: Faisal Memon Signed-off-by: aniket patel * Bump test chart dependencies (#282) Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Signed-off-by: aniket patel * Bump peter-evans/create-pull-request from 6.0.1 to 6.0.2 (#283) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.1 to 6.0.2. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/v6.0.1...v6.0.2) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Complete Server K8S PSAT support (#242) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox * Fix merge conflict Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Add basic psat test Signed-off-by: Kevin Fox * Fix linter Signed-off-by: Kevin Fox * Fix up test Signed-off-by: Kevin Fox * Add missing file Signed-off-by: Kevin Fox * Better encode config Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update default Signed-off-by: Kevin Fox * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix up kind Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Signed-off-by: aniket patel * Add external k8s bundler (#270) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox * Fix merge conflict Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Add basic psat test Signed-off-by: Kevin Fox * Fix linter Signed-off-by: Kevin Fox * Fix up test Signed-off-by: Kevin Fox * Add missing file Signed-off-by: Kevin Fox * Better encode config Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Update docs Signed-off-by: Kevin Fox * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox * Update default Signed-off-by: Kevin Fox * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Update based on parent pr feedback Signed-off-by: Kevin Fox * Reformat config file Signed-off-by: Kevin Fox * Fix some things Signed-off-by: Kevin Fox * Reconfigure kind Signed-off-by: Kevin Fox * More debugging Signed-off-by: Kevin Fox * Fix up kind Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Signed-off-by: aniket patel * Bump helm.sh/helm/v3 from 3.14.2 to 3.14.3 in /tests (#285) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.14.2 to 3.14.3. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.14.2...v3.14.3) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Bump docker/login-action from 3.0.0 to 3.1.0 (#286) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v3.1.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Bump test chart dependencies Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /tests (#291) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.31.1 to 1.32.0. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.31.1...v1.32.0) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /tests (#292) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.16.0 to 2.17.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.16.0...v2.17.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel * Update examples/stateless-server/README.md Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/templates/hpa.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Update examples/stateless-server/README.md Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Update examples/stateless-server/README.md Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Move spire-server pod spec to _pod_spec Signed-off-by: aniket patel * Support hybrid nodes with different attestors or config (#218) * Add direct tpm support for spire-agent Signed-off-by: Kevin Fox * Add fingerprinting support Signed-off-by: Kevin Fox * Add example Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 * Support hybrid nodes with different attestors In some clusters, you may have a mix of nodes with differing attestor needs. For example, some nodes have hardware TPMs and some without. This patch enables configuring multiple daemonsets for the agent that you can target to pools of nodes. Signed-off-by: Kevin Fox * Remove extra slash Signed-off-by: Kevin Fox * Update docs Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 * Fix broken tests Signed-off-by: Kevin Fox * Add daemonset labels Signed-off-by: Kevin Fox * Add temporary upgrade hook Signed-off-by: Kevin Fox * Fix docs Signed-off-by: Kevin Fox * Fix include Signed-off-by: Kevin Fox * Add missing values Signed-off-by: Kevin Fox * Fix perms, add upgrade note Signed-off-by: Kevin Fox * Fix hardcoded nodeAttestor and keyManager in spire-agent Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220 Signed-off-by: Kevin Fox * Fix merge issues Signed-off-by: Kevin Fox * Fix unit tests Signed-off-by: Kevin Fox * Pass the agent's securityContext on to Kubernetes Currently its ignored. Signed-off-by: Kevin Fox * Update example to be usable Signed-off-by: Kevin Fox * Apply suggestions from code review Signed-off-by: kfox1111 * Update example Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Fix merge conflict issue Signed-off-by: Kevin Fox * Update to the newest release Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Apply suggestions from code review Signed-off-by: kfox1111 * Apply suggestions from code review Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix version numbers in docs Signed-off-by: Kevin Fox * Remove merge conflicted extra code Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Signed-off-by: aniket patel * Change production example to be an integration test (#237) * Change production example to be an integration test The documentation is a better example then the test now. Separate the two. Signed-off-by: Kevin Fox * Fix job name reference Signed-off-by: Kevin Fox * Fix job name reference Signed-off-by: Kevin Fox * Update postgresql example Signed-off-by: Kevin Fox * Update mysql example Signed-off-by: Kevin Fox * Update nested and mysql Signed-off-by: Kevin Fox * Fix typo Signed-off-by: Kevin Fox * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox * Fix split issue and typo Signed-off-by: Kevin Fox * Fix split issue Signed-off-by: Kevin Fox * Try folding example your values into bash so that its not laying around in an fs for a user to accidently use. Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Fix test Signed-off-by: Kevin Fox * Cleanup Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon Signed-off-by: aniket patel * Remove production values reference Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/templates/pre-delete-hook.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Update examples/stateless-server/run-tests.sh Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: aniket patel * Bump spire Helm Chart version from 0.18.2 to 0.19.0 * 72768ec Support hybrid nodes with different attestors or config (#218) * 5299642 Bump test chart dependencies * 36e9315 Add external k8s bundler (#270) * ef610df Complete Server K8S PSAT support (#242) * d96271c Bump test chart dependencies (#282) Signed-off-by: Faisal Memon Signed-off-by: aniket patel * Fix production test (#297) Signed-off-by: aniket patel * Bump test chart dependencies (#299) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Signed-off-by: aniket patel * Bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /tests (#298) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.17.0 to 2.17.1. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.17.0...v2.17.1) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kfox1111 Signed-off-by: aniket patel * Fix documentation issue (#300) Signed-off-by: Kevin Fox Co-authored-by: Faisal Memon Signed-off-by: aniket patel * Move statefulset and deployment to server-resource Signed-off-by: aniket patel * Change deploymentType to kind Signed-off-by: aniket patel --------- Signed-off-by: Faisal Memon Signed-off-by: aniket patel Signed-off-by: aniket patel Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Signed-off-by: dependabot[bot] Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Faisal Memon Co-authored-by: aniket patel Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <694733+marcofranssen@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kfox1111 --- .github/tests/common.sh | 1 + charts/spire/README.md | 11 ++-- charts/spire/charts/spire-server/README.md | 1 + .../spire-server/templates/_helpers.tpl | 11 ++++ .../charts/spire-server/templates/hpa.yaml | 4 ++ .../templates/pre-delete-hook.yaml | 4 +- ...{statefulset.yaml => server-resource.yaml} | 27 ++++++++- charts/spire/charts/spire-server/values.yaml | 3 + charts/spire/values.yaml | 2 + examples/stateless-server/README.md | 23 ++++++++ examples/stateless-server/run-tests.sh | 59 +++++++++++++++++++ examples/stateless-server/values.yaml | 18 ++++++ 12 files changed, 154 insertions(+), 10 deletions(-) rename charts/spire/charts/spire-server/templates/{statefulset.yaml => server-resource.yaml} (95%) create mode 100644 examples/stateless-server/README.md create mode 100755 examples/stateless-server/run-tests.sh create mode 100644 examples/stateless-server/values.yaml diff --git a/.github/tests/common.sh b/.github/tests/common.sh index 3211e38..7d5323b 100755 --- a/.github/tests/common.sh +++ b/.github/tests/common.sh @@ -55,6 +55,7 @@ print_spire_workload_status () { | Namespace | Workload | Status | | --------- | ---------------------------------------------- | ------ | | ${ns1} | ${release_name}-server | 
$(k_rollout_status "${ns1}" statefulset "${release_name}-server")
| +| ${ns1} | ${release_name}-server | 
$(k_rollout_status "${ns1}" deployments.apps "${release_name}-server")
| | ${ns2} | ${release_name}-spiffe-csi-driver | 
$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")
| | ${ns2} | ${release_name}-agent | 
$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")
| | ${ns1} | ${release_name}-spiffe-oidc-discovery-provider | 
$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")
| diff --git a/charts/spire/README.md b/charts/spire/README.md index 570d01a..be050e8 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -244,11 +244,12 @@ Now you can interact with the Spire agent socket from your own application. The ### Spire server parameters -| Name | Description | Value | -| ---------------------------------------- | --------------------------------------------- | -------- | -| `spire-server.enabled` | Flag to enable Spire server | `true` | -| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` | -| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------------------- | ------------- | +| `spire-server.enabled` | Flag to enable Spire server | `true` | +| `spire-server.nameOverride` | Overrides the name of Spire server pods | `server` | +| `spire-server.kind` | Run spire server as deployment/statefulset. This feature is experimental. | `statefulset` | +| `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | ### Spire agent parameters diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 243f7b0..1ecad75 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -86,6 +86,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `image.repository` | The repository within the registry | `spiffe/spire-server` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `kind` | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. | `statefulset` | | `imagePullSecrets` | Pull secrets for images | `[]` | | `nameOverride` | Name override | `""` | | `crNameOverride` | Name override for any custom resources | `""` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index cd81b6a..87d8060 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -5,6 +5,17 @@ Expand the name of the chart. {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} {{- end }} +{{/* +Spire Server deployment/statefulset +*/}} +{{- define "spire-server.kind" -}} +{{- if not (has .Values.kind (list "statefulset" "deployment")) -}} + {{- fail "Unsupported deployment type" -}} +{{- else -}} + {{- .Values.kind -}} +{{- end -}} +{{- end }} + {{/* Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml index 4c1c41c..65b195e 100644 --- a/charts/spire/charts/spire-server/templates/hpa.yaml +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -9,7 +9,11 @@ metadata: spec: scaleTargetRef: apiVersion: apps/v1 + {{- if eq .Values.kind "statefulset" }} kind: StatefulSet + {{- else if eq .Values.kind "deployment" }} + kind: Deployment + {{- end }} name: {{ include "spire-server.fullname" . }} minReplicas: {{ .Values.autoscaling.minReplicas }} {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") .Values.autoscaling.enabled (gt (int .Values.autoscaling.maxReplicas) 1) }} diff --git a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml index 86226a1..2a14be9 100644 --- a/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml +++ b/charts/spire/charts/spire-server/templates/pre-delete-hook.yaml @@ -21,7 +21,7 @@ metadata: "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed rules: - apiGroups: ["apps"] - resources: ["statefulsets"] + resources: ["{{ include "spire-server.kind" . }}s"] resourceNames: [{{ include "spire-server.fullname" . | quote }}] verbs: ["get", "delete"] - apiGroups: [""] @@ -73,7 +73,7 @@ spec: - delete - -n - {{ include "spire-server.namespace" . }} - - statefulset + - {{ include "spire-server.kind" . }} - {{ include "spire-server.fullname" . }} - --wait - name: pre-delete-check diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml similarity index 95% rename from charts/spire/charts/spire-server/templates/statefulset.yaml rename to charts/spire/charts/spire-server/templates/server-resource.yaml index 2d3f48a..8a0634b 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -3,11 +3,30 @@ {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }} {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }} {{- $fullname := include "spire-server.fullname" . }} -{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} -{{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} + +{{- if eq .Values.kind "statefulset" }} +{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} +{{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} +{{- end }} +{{- else if eq .Values.kind "deployment" }} +{{- if (has .Values.persistence.type (list "pvc" "hostPath")) }} +{{- fail "When running as deployment, persistence can't be set. 'persistence.type' must be [\"emptyDir\"]" }} +{{- end }} +{{- if (eq .Values.dataStore.sql.databaseType "sqlite3") }} +{{- fail "When running as deployment, sqlite3 can't be used." }} +{{- end }} +{{- if (eq (.Values.keyManager.disk.enabled | toString) "true") }} +{{- fail "When running as deployment, disk keymanager can't be used. 'keyManager.disk.enabled' must be false." }} +{{- end }} +{{- else }} +{{- fail "Unsupported kind." }} {{- end }} apiVersion: apps/v1 +{{- if eq .Values.kind "statefulset" }} kind: StatefulSet +{{- else if eq .Values.kind "deployment" }} +kind: Deployment +{{- end }} metadata: name: {{ include "spire-server.fullname" . }} namespace: {{ include "spire-server.namespace" . }} @@ -21,7 +40,9 @@ spec: {{- end }} replicas: {{ .Values.replicaCount }} {{- end }} + {{- if eq .Values.kind "statefulset" }} serviceName: {{ include "spire-server.fullname" . }} + {{- end }} selector: matchLabels: {{- include "spire-server.selectorLabels" . | nindent 6 }} @@ -491,4 +512,4 @@ spec: {{- if .Values.persistence.storageClass }} storageClassName: {{ .Values.persistence.storageClass }} {{- end }} - {{- end }} + {{- end }} \ No newline at end of file diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 501cda8..5c449be 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -20,6 +20,9 @@ image: pullPolicy: IfNotPresent tag: "" +## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental. +kind: statefulset + ## @param imagePullSecrets [array] Pull secrets for images imagePullSecrets: [] diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index e5de054..81558a3 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -108,6 +108,8 @@ spire-server: enabled: true ## @param spire-server.nameOverride Overrides the name of Spire server pods nameOverride: server + ## @param spire-server.kind Run spire server as deployment/statefulset. This feature is experimental. + kind: statefulset controllerManager: ## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's enabled: true diff --git a/examples/stateless-server/README.md b/examples/stateless-server/README.md new file mode 100644 index 0000000..4475fae --- /dev/null +++ b/examples/stateless-server/README.md @@ -0,0 +1,23 @@ +# Example stateless server + +To install Spire Server as a deployment(stateless), you need to use an external database. This runs spire-server as stateless microservice enabling HA. + +### WARNING +The following configurations are not supported for running spire-server as deployment. +1. spire-server.persistence.type +2. spire-server.dataStore.sql.databaseType: "sqlite3" +3. spire-server.keyManager.disk +4. spire-server.tornjak + +If manually deploying for testing, you can create an incluster or use an external database and put the database password into an environment variable. + +Next, edit your-values.yaml with your settings as described in the [production install instructions](https://artifacthub.io/packages/helm/spiffe/spire#production). Check it into your git repo if using one. + +Then, deploy the chart pointing at your mysql instance like so: + +```shell +helm upgrade --install --namespace spire-mgmt spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f examples/stateless-server/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" -f your-values.yaml +``` + +See the [production install instructions](https://artifacthub.io/packages/helm/spiffe/spire#production) for production recommendations. +See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup. diff --git a/examples/stateless-server/run-tests.sh b/examples/stateless-server/run-tests.sh new file mode 100755 index 0000000..6f3bd7a --- /dev/null +++ b/examples/stateless-server/run-tests.sh @@ -0,0 +1,59 @@ +#!/usr/bin/env bash + +set -xe + +SCRIPT="$(readlink -f "$0")" +SCRIPTPATH="$(dirname "${SCRIPT}")" +TESTDIR="${SCRIPTPATH}/../../.github/tests" +DEPS="${TESTDIR}/dependencies" + +# shellcheck source=/dev/null +source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh" +# shellcheck source=/dev/null +source "${TESTDIR}/common.sh" + +CLEANUP=1 + +for i in "$@"; do + case $i in + -c) + CLEANUP=0 + shift # past argument=value + ;; + esac +done + +teardown() { + print_helm_releases + print_spire_workload_status spire-server + print_spire_workload_status spire-system + + if [[ "$1" -ne 0 ]]; then + get_namespace_details spire-server + get_namespace_details spire-system + fi + + if [ "${CLEANUP}" -eq 1 ]; then + helm uninstall --namespace "spire-server" spire 2>/dev/null || true + helm uninstall --namespace mysql mysql 2>/dev/null || true + kubectl delete ns spire-server 2>/dev/null || true + kubectl delete ns spire-system 2>/dev/null || true + fi +} + +trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT + +kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true +kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f - +kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true + +helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \ + --namespace spire-server \ + --values "${DEPS}/mysql.yaml" \ + --wait + +helm upgrade --install --namespace "spire-server" \ + --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \ + --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire +helm test --namespace "spire-server" spire diff --git a/examples/stateless-server/values.yaml b/examples/stateless-server/values.yaml new file mode 100644 index 0000000..f9f2753 --- /dev/null +++ b/examples/stateless-server/values.yaml @@ -0,0 +1,18 @@ +spire-server: + deploymentType: deployment + replicaCount: 2 + persistence: + type: emptyDir + keyManager: + disk: + enabled: false + memory: + enabled: true + dataStore: + sql: + databaseType: mysql + databaseName: spire-server + host: mysql + port: 3306 + username: spire + # password: CHANGE_ME