panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

disable hostNetwork on spire-agent daemonset if connect by hostname is true (#705)

Browse Source 
* disable hostNetwork on spire-agent daemonset if connect by hostname is true

Signed-off-by: Daniel Schlatter <[email protected]>

* allow spire-agent daemonset dnsPolicy to be configured

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-01-26 12:40:57 -08:00
committed by GitHub
co-authored by Faisal Memon
parent 3c724632ee
commit a7abf7d7ec
3 changed files with 139 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+2 -1
View File
@@ -26,7 +26,7 @@ A Helm chart to install the SPIRE agent.
### Chart parameters
| Name | Description | Value |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -118,6 +118,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
| `dnsPolicy` | dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+9 -1
View File
@@ -29,6 +29,10 @@
{{- end }}
{{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }}
{{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }}
{{- $dnsPolicy := .Values.dnsPolicy }}
{{- if (and (eq $dnsPolicy "") (not $cbh)) }}
{{- $dnsPolicy = "ClusterFirstWithHostNet" }}
{{- end }}
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
{{- $socketPath := include "spire-agent.socket-path" . }}
---
@@ -76,8 +80,12 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
hostPID: true
{{- if not $cbh }}
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
{{- end }}
{{- if ne $dnsPolicy "" }}
dnsPolicy: {{ $dnsPolicy }}
{{- end }}
serviceAccountName: {{ include "spire-agent.serviceAccountName" . | quote }}
securityContext:
{{- toYaml $podSecurityContext | nindent 8 }}
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -294,6 +294,8 @@ kubeletAddress:
## provided at runtime or SPIRE agent will fail to start.
mode: auto
## @param dnsPolicy [string] dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used.
dnsPolicy: ""
## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock