Run SPIRE server as deployment (#293)

* Bump spire Helm Chart version from 0.18.1 to 0.18.2 * fd3b7d5 Fix duplicate securityContext section in spire-agent (#279) Signed-off-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Add spire-server as deployment Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Add stateless-server example Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update README.md to add deploymentType Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Set hpa type based on deploymentType Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Change deploymentType values to lowercase in README Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update readme for stateless-server Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Revert README changes Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update readme for deploymentType Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Failure handling only when deployment type checked Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Fix issue with tests not running on automated PRs (#266) * Use github app for version checker Signed-off-by: Faisal Memon <[email protected]> * Use full version Signed-off-by: Faisal Memon <[email protected]> --------- Signed-off-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Bump test chart dependencies (#282) Co-authored-by: marcofranssen <[email protected]> Signed-off-by: aniket patel <[email protected]> * Bump peter-evans/create-pull-request from 6.0.1 to 6.0.2 (#283) Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) from 6.0.1 to 6.0.2. - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](https://github.com/peter-evans/create-pull-request/compare/v6.0.1...v6.0.2) --- updated-dependencies: - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Complete Server K8S PSAT support (#242) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Add external k8s bundler (#270) * Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update based on parent pr feedback Signed-off-by: Kevin Fox <[email protected]> * Reformat config file Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Reconfigure kind Signed-off-by: Kevin Fox <[email protected]> * More debugging Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Bump helm.sh/helm/v3 from 3.14.2 to 3.14.3 in /tests (#285) Bumps [helm.sh/helm/v3](https://github.com/helm/helm) from 3.14.2 to 3.14.3. - [Release notes](https://github.com/helm/helm/releases) - [Commits](https://github.com/helm/helm/compare/v3.14.2...v3.14.3) --- updated-dependencies: - dependency-name: helm.sh/helm/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Bump docker/login-action from 3.0.0 to 3.1.0 (#286) Bumps [docker/login-action](https://github.com/docker/login-action) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v3.1.0) --- updated-dependencies: - dependency-name: docker/login-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Bump test chart dependencies Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Bump github.com/onsi/gomega from 1.31.1 to 1.32.0 in /tests (#291) Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.31.1 to 1.32.0. - [Release notes](https://github.com/onsi/gomega/releases) - [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/gomega/compare/v1.31.1...v1.32.0) --- updated-dependencies: - dependency-name: github.com/onsi/gomega dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Bump github.com/onsi/ginkgo/v2 from 2.16.0 to 2.17.0 in /tests (#292) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.16.0 to 2.17.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.16.0...v2.17.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Signed-off-by: aniket patel <[email protected]> * Update examples/stateless-server/README.md Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/templates/hpa.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update examples/stateless-server/README.md Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update examples/stateless-server/README.md Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Move spire-server pod spec to _pod_spec Signed-off-by: aniket patel <[email protected]> * Support hybrid nodes with different attestors or config (#218) * Add direct tpm support for spire-agent Signed-off-by: Kevin Fox <[email protected]> * Add fingerprinting support Signed-off-by: Kevin Fox <[email protected]> * Add example Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Support hybrid nodes with different attestors In some clusters, you may have a mix of nodes with differing attestor needs. For example, some nodes have hardware TPMs and some without. This patch enables configuring multiple daemonsets for the agent that you can target to pools of nodes. Signed-off-by: Kevin Fox <[email protected]> * Remove extra slash Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Fix broken tests Signed-off-by: Kevin Fox <[email protected]> * Add daemonset labels Signed-off-by: Kevin Fox <[email protected]> * Add temporary upgrade hook Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix include Signed-off-by: Kevin Fox <[email protected]> * Add missing values Signed-off-by: Kevin Fox <[email protected]> * Fix perms, add upgrade note Signed-off-by: Kevin Fox <[email protected]> * Fix hardcoded nodeAttestor and keyManager in spire-agent Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220 Signed-off-by: Kevin Fox <[email protected]> * Fix merge issues Signed-off-by: Kevin Fox <[email protected]> * Fix unit tests Signed-off-by: Kevin Fox <[email protected]> * Pass the agent's securityContext on to Kubernetes Currently its ignored. Signed-off-by: Kevin Fox <[email protected]> * Update example to be usable Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Update example Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict issue Signed-off-by: Kevin Fox <[email protected]> * Update to the newest release Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix version numbers in docs Signed-off-by: Kevin Fox <[email protected]> * Remove merge conflicted extra code Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Change production example to be an integration test (#237) * Change production example to be an integration test The documentation is a better example then the test now. Separate the two. Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Fix job name reference Signed-off-by: Kevin Fox <[email protected]> * Update postgresql example Signed-off-by: Kevin Fox <[email protected]> * Update mysql example Signed-off-by: Kevin Fox <[email protected]> * Update nested and mysql Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Fix split issue Signed-off-by: Kevin Fox <[email protected]> * Try folding example your values into bash so that its not laying around in an fs for a user to accidently use. Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Remove production values reference Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/templates/pre-delete-hook.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Update examples/stateless-server/run-tests.sh Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: aniket patel <[email protected]> * Bump spire Helm Chart version from 0.18.2 to 0.19.0 * 72768ec Support hybrid nodes with different attestors or config (#218) * 5299642 Bump test chart dependencies * 36e9315 Add external k8s bundler (#270) * ef610df Complete Server K8S PSAT support (#242) * d96271c Bump test chart dependencies (#282) Signed-off-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Fix production test (#297) Signed-off-by: aniket patel <[email protected]> * Bump test chart dependencies (#299) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <[email protected]> Signed-off-by: aniket patel <[email protected]> * Bump github.com/onsi/ginkgo/v2 from 2.17.0 to 2.17.1 in /tests (#298) Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.17.0 to 2.17.1. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](https://github.com/onsi/ginkgo/compare/v2.17.0...v2.17.1) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kfox1111 <[email protected]> Signed-off-by: aniket patel <[email protected]> * Fix documentation issue (#300) Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> * Move statefulset and deployment to server-resource Signed-off-by: aniket patel <[email protected]> * Change deploymentType to kind Signed-off-by: aniket patel <[email protected]> --------- Signed-off-by: Faisal Memon <[email protected]> Signed-off-by: aniket patel <[email protected]> Signed-off-by: aniket patel <[email protected]> Signed-off-by: anhpatel <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: aniket patel <[email protected]> Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: kfox1111 <[email protected]>
2024-03-26 22:53:52 -07:00
parent c8211265d3
commit a15e44588a
12 changed files with 154 additions and 10 deletions
@@ -55,6 +55,7 @@ print_spire_workload_status () {
 | Namespace | Workload                                       | Status |
 | --------- | ---------------------------------------------- | ------ |
 | ${ns1}    | ${release_name}-server                         | <pre>$(k_rollout_status "${ns1}" statefulset "${release_name}-server")</pre> |
+| ${ns1}    | ${release_name}-server                         | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-server")</pre> |
 | ${ns2}    | ${release_name}-spiffe-csi-driver              | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-spiffe-csi-driver")</pre> |
 | ${ns2}    | ${release_name}-agent                          | <pre>$(k_rollout_status "${ns2}" daemonset "${release_name}-agent")</pre> |
 | ${ns1}    | ${release_name}-spiffe-oidc-discovery-provider | <pre>$(k_rollout_status "${ns1}" deployments.apps "${release_name}-spiffe-oidc-discovery-provider")</pre> |
@@ -245,9 +245,10 @@ Now you can interact with the Spire agent socket from your own application. The
 ### Spire server parameters

 | Name                                     | Description                                                               | Value         |
-| ---------------------------------------- | --------------------------------------------- | -------- |
+| ---------------------------------------- | ------------------------------------------------------------------------- | ------------- |
 | `spire-server.enabled`                   | Flag to enable Spire server                                               | `true`        |
 | `spire-server.nameOverride`              | Overrides the name of Spire server pods                                   | `server`      |
+| `spire-server.kind`                      | Run spire server as deployment/statefulset. This feature is experimental. | `statefulset` |
 | `spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's                             | `true`        |

 ### Spire agent parameters
@@ -86,6 +86,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `image.repository`                                                                           | The repository within the registry                                                                                                                                                                                                                                                                                                                                   | `spiffe/spire-server`                                                                          |
 | `image.pullPolicy`                                                                           | The image pull policy                                                                                                                                                                                                                                                                                                                                                | `IfNotPresent`                                                                                 |
 | `image.tag`                                                                                  | Overrides the image tag whose default is the chart appVersion                                                                                                                                                                                                                                                                                                        | `""`                                                                                           |
+| `kind`                                                                                       | Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.                                                                                                                                                                                                                                | `statefulset`                                                                                  |
 | `imagePullSecrets`                                                                           | Pull secrets for images                                                                                                                                                                                                                                                                                                                                              | `[]`                                                                                           |
 | `nameOverride`                                                                               | Name override                                                                                                                                                                                                                                                                                                                                                        | `""`                                                                                           |
 | `crNameOverride`                                                                             | Name override for any custom resources                                                                                                                                                                                                                                                                                                                               | `""`                                                                                           |
@@ -5,6 +5,17 @@ Expand the name of the chart.
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}

+{{/*
+Spire Server deployment/statefulset
+*/}}
+{{- define "spire-server.kind" -}}
+{{- if not (has .Values.kind (list "statefulset" "deployment")) -}}
+  {{- fail "Unsupported deployment type" -}}
+{{- else -}}
+  {{- .Values.kind -}}
+{{- end -}}
+{{- end }}
+
 {{/*
 Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -9,7 +9,11 @@ metadata:
 spec:
  scaleTargetRef:
    apiVersion: apps/v1
+    {{- if eq .Values.kind "statefulset" }}
    kind: StatefulSet
+    {{- else if eq .Values.kind "deployment" }}
+    kind: Deployment
+    {{- end }}
    name: {{ include "spire-server.fullname" . }}
  minReplicas: {{ .Values.autoscaling.minReplicas }}
  {{- if and (eq .Values.dataStore.sql.databaseType "sqlite3") .Values.autoscaling.enabled (gt (int .Values.autoscaling.maxReplicas) 1) }}
@@ -21,7 +21,7 @@ metadata:
    "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
 rules:
  - apiGroups: ["apps"]
-    resources: ["statefulsets"]
+    resources: ["{{ include "spire-server.kind" . }}s"]
    resourceNames: [{{ include "spire-server.fullname" . | quote }}]
    verbs: ["get", "delete"]
  - apiGroups: [""]
@@ -73,7 +73,7 @@ spec:
          - delete
          - -n
          - {{ include "spire-server.namespace" . }}
-          - statefulset
+          - {{ include "spire-server.kind" . }}
          - {{ include "spire-server.fullname" . }}
          - --wait
      - name: pre-delete-check
@@ -3,11 +3,30 @@
 {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
 {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
+
+{{- if eq .Values.kind "statefulset" }}
 {{-   if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }}
 {{-     fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }}
 {{-   end }}
+{{- else if eq .Values.kind "deployment" }}
+{{-   if (has .Values.persistence.type (list "pvc" "hostPath")) }}
+{{-     fail "When running as deployment, persistence can't be set. 'persistence.type' must be [\"emptyDir\"]" }}
+{{-   end }}
+{{-   if (eq .Values.dataStore.sql.databaseType "sqlite3") }}
+{{-     fail "When running as deployment, sqlite3 can't be used." }}
+{{-   end }}
+{{-   if (eq (.Values.keyManager.disk.enabled | toString) "true") }}
+{{-     fail "When running as deployment, disk keymanager can't be used. 'keyManager.disk.enabled' must be false." }}
+{{-   end }}
+{{- else }}
+{{-   fail "Unsupported kind." }}
+{{- end }}
 apiVersion: apps/v1
+{{- if eq .Values.kind "statefulset" }}
 kind: StatefulSet
+{{- else if eq .Values.kind "deployment" }}
+kind: Deployment
+{{- end }}
 metadata:
  name: {{ include "spire-server.fullname" . }}
  namespace: {{ include "spire-server.namespace" . }}
@@ -21,7 +40,9 @@ spec:
  {{- end }}
  replicas: {{ .Values.replicaCount }}
  {{- end }}
+  {{- if eq .Values.kind "statefulset" }}
  serviceName: {{ include "spire-server.fullname" . }}
+  {{- end }}
  selector:
    matchLabels:
      {{- include "spire-server.selectorLabels" . | nindent 6 }}
@@ -20,6 +20,9 @@ image:
  pullPolicy: IfNotPresent
  tag: ""

+## @param kind Define SPIRE server deployment type. Can be statefulset/deployment. Defaults to statefulset if not set. This feature is experimental.
+kind: statefulset
+
 ## @param imagePullSecrets [array] Pull secrets for images
 imagePullSecrets: []

@@ -108,6 +108,8 @@ spire-server:
  enabled: true
  ## @param spire-server.nameOverride Overrides the name of Spire server pods
  nameOverride: server
+  ## @param spire-server.kind Run spire server as deployment/statefulset. This feature is experimental.
+  kind: statefulset
  controllerManager:
    ## @param spire-server.controllerManager.enabled Enable controller manager and provision CRD's
    enabled: true
@@ -0,0 +1,23 @@
+# Example stateless server
+
+To install Spire Server as a deployment(stateless), you need to use an external database. This runs spire-server as stateless microservice enabling HA.
+
+### WARNING
+The following configurations are not supported for running spire-server as deployment.
+1. spire-server.persistence.type
+2. spire-server.dataStore.sql.databaseType: "sqlite3"
+3. spire-server.keyManager.disk
+4. spire-server.tornjak
+
+If manually deploying for testing, you can create an incluster or use an external database and put the database password into an environment variable.
+
+Next, edit your-values.yaml with your settings as described in the [production install instructions](https://artifacthub.io/packages/helm/spiffe/spire#production). Check it into your git repo if using one.
+
+Then, deploy the chart pointing at your mysql instance like so:
+
+```shell
+helm upgrade --install --namespace spire-mgmt spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f examples/stateless-server/values.yaml --set "spire-server.dataStore.sql.password=${DBPW}" -f your-values.yaml
+```
+
+See the [production install instructions](https://artifacthub.io/packages/helm/spiffe/spire#production) for production recommendations.
+See [values.yaml](./values.yaml) for more details on the chart configurations to achieve this setup.
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+set -xe
+
+SCRIPT="$(readlink -f "$0")"
+SCRIPTPATH="$(dirname "${SCRIPT}")"
+TESTDIR="${SCRIPTPATH}/../../.github/tests"
+DEPS="${TESTDIR}/dependencies"
+
+# shellcheck source=/dev/null
+source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
+# shellcheck source=/dev/null
+source "${TESTDIR}/common.sh"
+
+CLEANUP=1
+
+for i in "$@"; do
+  case $i in
+    -c)
+      CLEANUP=0
+      shift # past argument=value
+      ;;
+  esac
+done
+
+teardown() {
+  print_helm_releases
+  print_spire_workload_status spire-server
+  print_spire_workload_status spire-system
+
+  if [[ "$1" -ne 0 ]]; then
+    get_namespace_details spire-server
+    get_namespace_details spire-system
+  fi
+
+  if [ "${CLEANUP}" -eq 1 ]; then
+    helm uninstall --namespace "spire-server" spire 2>/dev/null || true
+    helm uninstall --namespace mysql mysql 2>/dev/null || true
+    kubectl delete ns spire-server 2>/dev/null || true
+    kubectl delete ns spire-system 2>/dev/null || true
+  fi
+}
+
+trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
+
+kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f -
+kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
+kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f -
+kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true
+
+helm upgrade --install mysql mysql --version "$VERSION_MYSQL" --repo "$HELM_REPO_MYSQL" \
+  --namespace spire-server \
+  --values "${DEPS}/mysql.yaml" \
+  --wait
+
+helm upgrade --install --namespace "spire-server" \
+  --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
+  --set 'spire-server.dataStore.sql.password=sp1ff3Test' --wait spire charts/spire
+helm test --namespace "spire-server" spire
@@ -0,0 +1,18 @@
+spire-server:
+  deploymentType: deployment
+  replicaCount: 2
+  persistence:
+    type: emptyDir
+  keyManager:
+    disk:
+      enabled: false
+    memory:
+      enabled: true
+  dataStore:
+    sql:
+      databaseType: mysql
+      databaseName: spire-server
+      host: mysql
+      port: 3306
+      username: spire
+      # password: CHANGE_ME