panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a template to build the image string

Browse Source 
This also allows to use image digest as a version

Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:03 +01:00
committed by Marco Franssen
parent 4e5dd65aad
commit a5afe8979e
6 changed files with 80 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+26 -15
View File
@@ -50,8 +50,9 @@ Kubernetes: `>=1.21.0-0`
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| agent.image.pullPolicy | string | `"IfNotPresent"` | |
| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | |
| agent.image.tag | string | `""` | |
| agent.image.registry | string | `"gcr.io"` | |
| agent.image.repository | string | `"spiffe-io/spire-agent"` | |
| agent.image.version | string | `""` | |
| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| agent.resources | object | `{}` | |
| autoscaling.enabled | bool | `false` | |
@@ -59,15 +60,17 @@ Kubernetes: `>=1.21.0-0`
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | |
| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | |
| csiDriver.image.tag | string | `"0.2.0"` | |
| csiDriver.image.registry | string | `"ghcr.io"` | |
| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | |
| csiDriver.image.version | string | `"0.2.0"` | |
| csiDriver.resources | object | `{}` | |
| fullnameOverride | string | `""` | |
| imagePullSecrets | list | `[]` | |
| nameOverride | string | `""` | |
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
| nodeDriverRegistrar.image.repository | string | `"quay.io/k8scsi/csi-node-driver-registrar"` | |
| nodeDriverRegistrar.image.tag | string | `"v2.0.1"` | |
| nodeDriverRegistrar.image.registry | string | `"quay.io"` | |
| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | |
| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | |
| nodeDriverRegistrar.resources | object | `{}` | |
| oidc.acme.cacheDir | string | `"/run/spire"` | |
| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
@@ -79,12 +82,14 @@ Kubernetes: `>=1.21.0-0`
| oidc.domains[3] | string | `"oidc-discovery.example.org"` | |
| oidc.enabled | bool | `false` | |
| oidc.image.pullPolicy | string | `"IfNotPresent"` | |
| oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | |
| oidc.image.tag | string | `""` | |
| oidc.image.registry | string | `"gcr.io"` | |
| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | |
| oidc.image.version | string | `""` | |
| oidc.insecureScheme.enabled | bool | `false` | |
| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` | |
| oidc.insecureScheme.nginx.repository | string | `"nginx"` | |
| oidc.insecureScheme.nginx.tag | string | `"alpine"` | |
| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | |
| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | |
| oidc.insecureScheme.nginx.image.version | string | `"alpine"` | |
| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | |
| oidc.logLevel | string | `"INFO"` | |
| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
@@ -101,8 +106,9 @@ Kubernetes: `>=1.21.0-0`
| server.dataStorage.size | string | `"1Gi"` | |
| server.dataStorage.storageClass | string | `nil` | |
| server.image.pullPolicy | string | `"IfNotPresent"` | |
| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | |
| server.image.tag | string | `""` | |
| server.image.registry | string | `"gcr.io"` | |
| server.image.repository | string | `"spiffe-io/spire-server"` | |
| server.image.version | string | `""` | |
| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| server.resources | object | `{}` | |
| server.service.port | int | `8081` | |
@@ -115,9 +121,14 @@ Kubernetes: `>=1.21.0-0`
| spire.server.logLevel | string | `"INFO"` | |
| spire.trustDomain | string | `"example.org"` | |
| tolerations | list | `[]` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
| waitForIt.image.registry | string | `"gcr.io"` | |
| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | |
| waitForIt.image.version | string | `""` | |
| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | |
| workloadRegistrar.image.tag | string | `""` | |
| workloadRegistrar.image.registry | string | `"gcr.io"` | |
| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | |
| workloadRegistrar.image.version | string | `""` | |
| workloadRegistrar.resources | object | `{}` | |
----------------------------------------------
charts/spire/templates/_helpers.tpl
+12
View File
@@ -120,3 +120,15 @@ Create the name of the service account to use
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "spire.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
charts/spire/templates/agent-daemonset.yaml
+7 -5
View File
@@ -25,7 +25,8 @@ spec:
# This is a small image with wait-for-it, choose whatever image
# you prefer that waits for a service to be up. This image is built
# from https://github.com/lqhl/wait-for-it
image: gcr.io/spiffe-io/wait-for-it:latest
image: {{ template "spire.image" .Values.waitForIt }}
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
{{- with .Values.agent.nodeSelector }}
nodeSelector:
@@ -33,7 +34,8 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}-agent
image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"]
volumeMounts:
- name: spire-config
@@ -63,8 +65,8 @@ spec:
{{- toYaml .Values.agent.resources | nindent 12 }}
# This is the container which runs the SPIFFE CSI driver.
- name: spiffe-csi-driver
image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}}
imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}}
image: {{ template "spire.image" .Values.csiDriver }}
imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
args: [
"-workload-api-socket-dir", "/spire-agent-socket",
"-csi-socket-path", "/spiffe-csi/csi.sock",
@@ -98,7 +100,7 @@ spec:
# of all the little details required to register a CSI driver with
# the kubelet.
- name: node-driver-registrar
image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }}
image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
args: [
"-csi-address", "/spiffe-csi/csi.sock",
charts/spire/templates/oidc-deployment.yaml
+3 -3
View File
@@ -35,7 +35,7 @@ spec:
- name: spire-oidc
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }}
imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
args:
- -config
@@ -71,8 +71,8 @@ spec:
- name: nginx
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}"
imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }}
image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }}
imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }}
ports:
- containerPort: 80
name: http
charts/spire/templates/server-statefulset.yaml
+2 -2
View File
@@ -40,7 +40,7 @@ spec:
- name: {{ .Chart.Name }}-server
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}"
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }}
imagePullPolicy: {{ .Values.server.image.pullPolicy }}
args:
- -config
@@ -80,7 +80,7 @@ spec:
- name: {{ .Chart.Name }}-workload-registrar
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}"
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
args:
- -config
charts/spire/values.yaml
+30 -15
View File
@@ -4,12 +4,20 @@
replicaCount: 1
waitForIt:
image:
registry: gcr.io
repository: spiffe-io/wait-for-it
pullPolicy: IfNotPresent
version: ""
workloadRegistrar:
image:
repository: gcr.io/spiffe-io/k8s-workload-registrar
registry: gcr.io
repository: spiffe-io/k8s-workload-registrar
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: ""
version: ""
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -25,10 +33,11 @@ workloadRegistrar:
server:
image:
repository: gcr.io/spiffe-io/spire-server
registry: gcr.io
repository: spiffe-io/spire-server
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: ""
version: ""
nodeSelector:
kubernetes.io/arch: amd64
@@ -57,9 +66,10 @@ server:
csiDriver:
image:
repository: ghcr.io/spiffe/spiffe-csi-driver
registry: ghcr.io
repository: spiffe/spiffe-csi-driver
pullPolicy: IfNotPresent
tag: 0.2.0
version: 0.2.0
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -74,9 +84,10 @@ csiDriver:
nodeDriverRegistrar:
image:
repository: quay.io/k8scsi/csi-node-driver-registrar
registry: quay.io
repository: k8scsi/csi-node-driver-registrar
pullPolicy: IfNotPresent
tag: v2.0.1
version: v2.0.1
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
@@ -93,9 +104,10 @@ oidc:
enabled: false
image:
repository: gcr.io/spiffe-io/oidc-discovery-provider
registry: gcr.io
repository: spiffe-io/oidc-discovery-provider
pullPolicy: IfNotPresent
tag: ""
version: ""
nodeSelector:
kubernetes.io/arch: amd64
@@ -132,9 +144,11 @@ oidc:
enabled: false
nginx:
repository: nginx
pullPolicy: IfNotPresent
tag: "alpine"
image:
registry: docker.io
repository: nginx
pullPolicy: IfNotPresent
version: alpine
acme:
tosAccepted: false
@@ -144,10 +158,11 @@ oidc:
agent:
image:
repository: gcr.io/spiffe-io/spire-agent
registry: gcr.io
repository: spiffe-io/spire-agent
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: ""
version: ""
nodeSelector:
kubernetes.io/arch: amd64