Add support for enabling the spire-agent admin socket (#234)
* Add support for enabling the spire-agent admin socket Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Fix template Signed-off-by: Kevin Fox <[email protected]> * Update upstream agent too Signed-off-by: Kevin Fox <[email protected]> * Fix init issue Signed-off-by: Kevin Fox <[email protected]> * Refactor a bit to make things more automatic Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -109,3 +109,6 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||||
|
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||||
|
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||||
|
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||||
|
|||||||
@@ -18,8 +18,14 @@
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }}
|
||||||
|
{{- fail "The sockets.hostBasePath can not be located under the socketPath direcotry" }}
|
||||||
|
{{- end }}
|
||||||
{{- define "spire-agent.yaml-config" -}}
|
{{- define "spire-agent.yaml-config" -}}
|
||||||
agent:
|
agent:
|
||||||
|
{{- if .Values.sockets.admin.enabled }}
|
||||||
|
admin_socket_dir: /tmp/spire-agent/private/admin.sock
|
||||||
|
{{- end }}
|
||||||
data_dir: "/run/spire"
|
data_dir: "/run/spire"
|
||||||
log_level: {{ .Values.logLevel | quote }}
|
log_level: {{ .Values.logLevel | quote }}
|
||||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||||
|
|||||||
@@ -83,12 +83,14 @@ spec:
|
|||||||
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
|
||||||
command: ["bash", "-c"]
|
command: ["bash", "-c"]
|
||||||
args:
|
args:
|
||||||
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}"
|
- "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }} /tmp/spire-agent/private"
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
|
{{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: spire-agent-socket-dir
|
- name: spire-agent-socket-dir
|
||||||
mountPath: {{ $socketPath | dir }}
|
mountPath: {{ $socketPath | dir }}
|
||||||
|
- name: spire-agent-admin-socket-dir
|
||||||
|
mountPath: /tmp/spire-agent/private
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsUser: 0
|
runAsUser: 0
|
||||||
runAsGroup: 0
|
runAsGroup: 0
|
||||||
@@ -126,6 +128,11 @@ spec:
|
|||||||
- name: spire-config
|
- name: spire-config
|
||||||
mountPath: /opt/spire/conf/agent
|
mountPath: /opt/spire/conf/agent
|
||||||
readOnly: true
|
readOnly: true
|
||||||
|
{{- if .Values.sockets.admin.enabled }}
|
||||||
|
- name: spire-agent-admin-socket-dir
|
||||||
|
mountPath: /tmp/spire-agent/private
|
||||||
|
readOnly: false
|
||||||
|
{{- end }}
|
||||||
{{- if eq (len .Values.trustBundleURL) 0 }}
|
{{- if eq (len .Values.trustBundleURL) 0 }}
|
||||||
- name: spire-bundle
|
- name: spire-bundle
|
||||||
mountPath: /run/spire/bundle
|
mountPath: /run/spire/bundle
|
||||||
@@ -170,6 +177,15 @@ spec:
|
|||||||
- name: spire-config
|
- name: spire-config
|
||||||
configMap:
|
configMap:
|
||||||
name: {{ include "spire-agent.fullname" . }}
|
name: {{ include "spire-agent.fullname" . }}
|
||||||
|
{{- if .Values.sockets.admin.mountOnHost }}
|
||||||
|
- name: spire-agent-admin-socket-dir
|
||||||
|
hostPath:
|
||||||
|
hostPath: {{ .Values.sockets.hostBasePath }}/{{ if .Values.upstream }}upstream.csi.spiffe.io{{ else }}csi.spiffe.io{{ end }}/admin
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
{{- else }}
|
||||||
|
- name: spire-agent-admin-socket-dir
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
{{- if eq (len .Values.trustBundleURL) 0 }}
|
{{- if eq (len .Values.trustBundleURL) 0 }}
|
||||||
- name: spire-bundle
|
- name: spire-bundle
|
||||||
configMap:
|
configMap:
|
||||||
|
|||||||
@@ -281,3 +281,12 @@ experimental:
|
|||||||
syncInterval: 5s
|
syncInterval: 5s
|
||||||
## @param experimental.featureFlags [array] List of developer feature flags
|
## @param experimental.featureFlags [array] List of developer feature flags
|
||||||
featureFlags: []
|
featureFlags: []
|
||||||
|
|
||||||
|
sockets:
|
||||||
|
## @param sockets.hostBasePath Path on which the agent socket is made available when admin.mountOnHost is true
|
||||||
|
hostBasePath: /run/spire/agent/sockets
|
||||||
|
## @param sockets.admin.enabled Enable the admin socket. Useful for admin tasks or the Delegated Identity API.
|
||||||
|
## @param sockets.admin.mountOnHost Enable the admin socket to be visible on the host.
|
||||||
|
admin:
|
||||||
|
enabled: false
|
||||||
|
mountOnHost: false
|
||||||
|
|||||||
Reference in New Issue
Block a user