Move k8s-workload-registrar to sub chart

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/server-cluster-role.yaml

@@ -1,34 +0,0 @@
-# ClusterRole to allow spire-server node attestor to query Token Review API
-# and to be able to push certificate bundles to a configmap
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-cluster-role
-rules:
-    # allow TokenReview requests (to verify service account tokens for PSAT
-    # attestation)
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["get", "create"]
-  - apiGroups: [""]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["create", "update", "delete", "get", "list", "watch"]
-
----
-# Binds above cluster role to spire-server service account
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-cluster-role-binding
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire.serviceAccountName" . }}-server
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "spire.fullname" . }}-server-cluster-role
-  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-role.yaml

@@ -1,43 +0,0 @@
-# ClusterRole to allow spire-server node attestor to query Token Review API
-# and to be able to push certificate bundles to a configmap
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-role
-  namespace: {{ .Release.Namespace }}
-rules:
-  # allow "get" access to pods (to resolve selectors for PSAT attestation)
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get"]
-    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
-    # agent bootstrapping, see the spire-bundle ConfigMap below)
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
-    verbs: ["get", "patch"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["spire-k8s-registrar-leader-election"]
-    verbs: ["update", "get"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create"]
-
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-role-binding
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire.serviceAccountName" . }}-server
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: {{ include "spire.fullname" . }}-server-role
-  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-roles.yaml

@@ -0,0 +1,68 @@
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+rules:
+  # allow "get" access to pods (to resolve selectors for PSAT attestation)
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get]
+    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
+    # agent bootstrapping, see the spire-bundle ConfigMap below)
+  - apiGroups: [""]
+    resources: [configmaps]
+    resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
+    verbs:
+      - get
+      - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "spire.fullname" . }}-server
+  apiGroup: rbac.authorization.k8s.io
+---
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+rules:
+    # allow TokenReview requests (to verify service account tokens for PSAT
+    # attestation)
+  - apiGroups: [authentication.k8s.io]
+    resources: [tokenreviews]
+    verbs:
+      - get
+      - create
+  - apiGroups: [""]
+    resources: [nodes]
+    verbs:
+      - get
+---
+# Binds above cluster role to spire-server service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire.fullname" . }}-server
+  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-statefulset.yaml

@@ -80,26 +80,6 @@ spec:
             periodSeconds: 5
           resources:
             {{- toYaml .Values.server.resources | nindent 12 }}
-        - name: {{ .Chart.Name }}-workload-registrar
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
-          imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
-          args:
-            - -config
-            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
-          ports:
-            - containerPort: 8443
-              name: registrar-port
-          volumeMounts:
-            - name: spire-server-socket
-              mountPath: /run/spire/server-sockets
-              readOnly: true
-            - name: spire-workload-registrar-config
-              mountPath: /run/spire/k8s-workload-registrar/config
-              readOnly: true
-          resources:
-            {{- toYaml .Values.workloadRegistrar.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -117,9 +97,6 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-        - name: spire-workload-registrar-config
-          configMap:
-            name: {{ include "spire.fullname" . }}-workload-registrar
         - name: spire-config
           configMap:
             name: {{ include "spire.fullname" . }}-server

charts/spire/templates/workload-registrar-configmap.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire.fullname" . }}-workload-registrar
-  namespace: {{ .Release.Namespace }}
-data:
-  workload-registrar.conf: |
-    log_level       = "debug"
-    mode            = "reconcile"
-    trust_domain    = {{ .Values.spire.trustDomain | quote }}
-    cluster         = {{ .Values.spire.clusterName | quote }}
-    server_address  = "unix://{{ .Values.server.config.socketPath }}"
-    leader_election = true
-    metrics_addr    = "0.0.0.0:18080"

charts/spire/templates/workload-registrar-service.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "spire.fullname" . }}-k8s-workload-registrar
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.workloadRegistrar.service.annotations }}
-  annotations:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  labels:
-    {{- include "spire.server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.server.service.type }}
-  ports:
-    - name: https
-      port: 443
-      targetPort: registrar-port
-      protocol: TCP
-  selector:
-    {{- include "spire.server.selectorLabels" . | nindent 4 }}