Move k8s-workload-registrar to sub chart

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/Chart.yaml

@@ -46,3 +46,7 @@ dependencies:
     condition: spiffe-oidc-discovery-provider.enabled
     repository: file://./charts/spiffe-oidc-discovery-provider
     version: 0.1.0
+  - name: k8s-workload-registrar
+    condition: k8s-workload-registrar.enabled
+    repository: file://./charts/k8s-workload-registrar
+    version: 0.1.0

charts/spire/README.md

@@ -46,6 +46,7 @@ Kubernetes: `>=1.21.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
+| file://./charts/k8s-workload-registrar | k8s-workload-registrar | 0.1.0 |
 | file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
 | file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
 
@@ -64,6 +65,7 @@ Kubernetes: `>=1.21.0-0`
 | agent.service.annotations | object | `{}` |  |
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
+| k8s-workload-registrar.enabled | bool | `true` |  |
 | nameOverride | string | `""` |  |
 | server.config.ca_subject.common_name | string | `"example.org"` |  |
 | server.config.ca_subject.country | string | `"NL"` |  |
@@ -104,12 +106,6 @@ Kubernetes: `>=1.21.0-0`
 | waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
 | waitForIt.image.version | string | `"latest-20221223"` |  |
 | waitForIt.resources | object | `{}` |  |
-| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| workloadRegistrar.image.registry | string | `"gcr.io"` |  |
-| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` |  |
-| workloadRegistrar.image.version | string | `""` |  |
-| workloadRegistrar.resources | object | `{}` |  |
-| workloadRegistrar.service.annotations | object | `{}` |  |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

charts/spire/charts/k8s-workload-registrar/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spire/charts/k8s-workload-registrar/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: k8s-workload-registrar
+description: A Helm chart to install the SPIRE k8s workload registrator.
+type: application
+version: 0.1.0
+appVersion: "1.5.3"

charts/spire/charts/k8s-workload-registrar/templates/NOTES.txt

@@ -0,0 +1 @@
+Installed {{ include "k8s-workload-registrar.fullname" . }}…

charts/spire/charts/k8s-workload-registrar/templates/_helpers.tpl

@@ -0,0 +1,74 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "k8s-workload-registrar.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "k8s-workload-registrar.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "k8s-workload-registrar.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "k8s-workload-registrar.labels" -}}
+helm.sh/chart: {{ include "k8s-workload-registrar.chart" . }}
+{{ include "k8s-workload-registrar.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "k8s-workload-registrar.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "k8s-workload-registrar.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "k8s-workload-registrar.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "k8s-workload-registrar.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "k8s-workload-registrar.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}

charts/spire/charts/k8s-workload-registrar/templates/configmap.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  workload-registrar.conf: |
+    log_level       = "{{ .Values.logLevel }}"
+    mode            = "reconcile"
+    trust_domain    = {{ .Values.trustDomain | quote }}
+    cluster         = {{ .Values.clusterName | quote }}
+    server_address  = "unix://{{ .Values.server.socketPath }}"
+    leader_election = true
+    metrics_addr    = "0.0.0.0:18080"

charts/spire/charts/k8s-workload-registrar/templates/deployment.yaml

@@ -0,0 +1,77 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  labels:
+    {{- include "k8s-workload-registrar.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "k8s-workload-registrar.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "k8s-workload-registrar.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "k8s-workload-registrar.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      initContainers:
+        - name: init
+          # This is a small image with wait-for-it, choose whatever image
+          # you prefer that waits for a service to be up. This image is built
+          # from https://github.com/vishnubob/wait-for-it
+          image: {{ template "k8s-workload-registrar.image" .Values.waitForIt }}
+          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
+          args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}]
+          resources:
+            {{- toYaml .Values.waitForIt.resources | nindent 12 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: {{ template "k8s-workload-registrar.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - -config
+            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: spire-server-socket
+              mountPath: /run/spire/server-sockets
+              readOnly: true
+            - name: k8s-workload-registrar-config
+              mountPath: /run/spire/k8s-workload-registrar/config
+              readOnly: true
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      volumes:
+        - name: k8s-workload-registrar-config
+          configMap:
+            name: {{ include "k8s-workload-registrar.fullname" . }}
+        - name: spire-server-socket
+          hostPath:
+            path: /run/spire/server-sockets
+            type: DirectoryOrCreate

charts/spire/charts/k8s-workload-registrar/templates/hpa.yaml

@@ -0,0 +1,28 @@
+{{- if .Values.autoscaling.enabled }}
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  labels:
+    {{- include "k8s-workload-registrar.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "k8s-workload-registrar.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: cpu
+        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+    {{- end }}
+    {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    - type: Resource
+      resource:
+        name: memory
+        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+    {{- end }}
+{{- end }}

charts/spire/charts/k8s-workload-registrar/templates/roles.yaml

@@ -0,0 +1,73 @@
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    verbs: [create]
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    resourceNames: [spire-k8s-registrar-leader-election]
+    verbs:
+      - get
+      - update
+  # - apiGroups: [""]
+  #   resources: [configmaps]
+  #   verbs: [create]
+  # - apiGroups: [""]
+  #   resources: [configmaps]
+  #   resourceNames: [k8s-workload-registrar-leader-election]
+  #   verbs:
+  #     - get
+  #     - update
+  - apiGroups: [""]
+    resources: [events]
+    verbs: [create]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "k8s-workload-registrar.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+rules:
+  - apiGroups: [""]
+    resources: [pods, nodes, endpoints]
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups: [coordination.k8s.io]
+    resources: [leases]
+    verbs:
+      - create
+      - get
+      - list
+      - update
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "k8s-workload-registrar.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire.fullname" . }}
+  apiGroup: rbac.authorization.k8s.io

charts/spire/charts/k8s-workload-registrar/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "k8s-workload-registrar.serviceAccountName" . }}
+  labels:
+    {{- include "k8s-workload-registrar.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/spire/charts/k8s-workload-registrar/values.yaml

@@ -0,0 +1,80 @@
+# Default values for k8s-workload-registrar.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  registry: gcr.io
+  repository: spiffe-io/k8s-workload-registrar
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+  # requests:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 5
+  targetCPUUtilizationPercentage: 80
+  targetMemoryUtilizationPercentage: 80
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+tolerations: []
+
+affinity: {}
+
+server:
+  socketPath: /run/spire/server-sockets/spire-server.sock
+  host: spire-server
+  port: 8081
+clusterName: "example-cluster"
+trustDomain: "example.org"
+logLevel: info
+
+waitForIt:
+  image:
+    registry: cgr.dev
+    repository: chainguard/wait-for-it
+    pullPolicy: IfNotPresent
+    version: latest-20221215
+  resources: {}

charts/spire/charts/spiffe-csi-driver/README.md

@@ -1,7 +1,5 @@
 # spiffe-csi-driver
 
-<!-- This README.md is generated. -->
-
 ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.2.1](https://img.shields.io/badge/AppVersion-0.2.1-informational?style=flat-square)
 
 A Helm chart to install the SPIFFE CSI driver.
@@ -33,3 +31,6 @@ A Helm chart to install the SPIFFE CSI driver.
 | serviceAccount.annotations | object | `{}` |  |
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

charts/spire/charts/spiffe-oidc-discovery-provider/README.md

@@ -1,7 +1,5 @@
 # spiffe-oidc-discovery-provider
 
-<!-- This README.md is generated. -->
-
 ![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square)
 
 A Helm chart to install the SPIFFE OIDC discovery provider.
@@ -51,3 +49,6 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
 | serviceAccount.name | string | `""` |  |
 | tolerations | list | `[]` |  |
 | trustDomain | string | `"example.org"` |  |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

charts/spire/templates/server-cluster-role.yaml

@@ -1,34 +0,0 @@
-# ClusterRole to allow spire-server node attestor to query Token Review API
-# and to be able to push certificate bundles to a configmap
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-cluster-role
-rules:
-    # allow TokenReview requests (to verify service account tokens for PSAT
-    # attestation)
-  - apiGroups: ["authentication.k8s.io"]
-    resources: ["tokenreviews"]
-    verbs: ["get", "create"]
-  - apiGroups: [""]
-    resources: ["pods", "nodes"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["create", "update", "delete", "get", "list", "watch"]
-
----
-# Binds above cluster role to spire-server service account
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-cluster-role-binding
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire.serviceAccountName" . }}-server
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "spire.fullname" . }}-server-cluster-role
-  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-role.yaml

@@ -1,43 +0,0 @@
-# ClusterRole to allow spire-server node attestor to query Token Review API
-# and to be able to push certificate bundles to a configmap
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-role
-  namespace: {{ .Release.Namespace }}
-rules:
-  # allow "get" access to pods (to resolve selectors for PSAT attestation)
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get"]
-    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
-    # agent bootstrapping, see the spire-bundle ConfigMap below)
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
-    verbs: ["get", "patch"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["spire-k8s-registrar-leader-election"]
-    verbs: ["update", "get"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create"]
-
----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-server-role-binding
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire.serviceAccountName" . }}-server
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: {{ include "spire.fullname" . }}-server-role
-  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-roles.yaml

@@ -0,0 +1,68 @@
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+rules:
+  # allow "get" access to pods (to resolve selectors for PSAT attestation)
+  - apiGroups: [""]
+    resources: [pods]
+    verbs: [get]
+    # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
+    # agent bootstrapping, see the spire-bundle ConfigMap below)
+  - apiGroups: [""]
+    resources: [configmaps]
+    resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
+    verbs:
+      - get
+      - patch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: {{ include "spire.fullname" . }}-server
+  apiGroup: rbac.authorization.k8s.io
+---
+# ClusterRole to allow spire-server node attestor to query Token Review API
+# and to be able to push certificate bundles to a configmap
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+rules:
+    # allow TokenReview requests (to verify service account tokens for PSAT
+    # attestation)
+  - apiGroups: [authentication.k8s.io]
+    resources: [tokenreviews]
+    verbs:
+      - get
+      - create
+  - apiGroups: [""]
+    resources: [nodes]
+    verbs:
+      - get
+---
+# Binds above cluster role to spire-server service account
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: {{ include "spire.fullname" . }}-server
+  namespace: {{ .Release.Namespace }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "spire.serviceAccountName" . }}-server
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "spire.fullname" . }}-server
+  apiGroup: rbac.authorization.k8s.io

charts/spire/templates/server-statefulset.yaml

@@ -80,26 +80,6 @@ spec:
             periodSeconds: 5
           resources:
             {{- toYaml .Values.server.resources | nindent 12 }}
-        - name: {{ .Chart.Name }}-workload-registrar
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
-          imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
-          args:
-            - -config
-            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
-          ports:
-            - containerPort: 8443
-              name: registrar-port
-          volumeMounts:
-            - name: spire-server-socket
-              mountPath: /run/spire/server-sockets
-              readOnly: true
-            - name: spire-workload-registrar-config
-              mountPath: /run/spire/k8s-workload-registrar/config
-              readOnly: true
-          resources:
-            {{- toYaml .Values.workloadRegistrar.resources | nindent 12 }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -117,9 +97,6 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       volumes:
-        - name: spire-workload-registrar-config
-          configMap:
-            name: {{ include "spire.fullname" . }}-workload-registrar
         - name: spire-config
           configMap:
             name: {{ include "spire.fullname" . }}-server

charts/spire/templates/workload-registrar-configmap.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire.fullname" . }}-workload-registrar
-  namespace: {{ .Release.Namespace }}
-data:
-  workload-registrar.conf: |
-    log_level       = "debug"
-    mode            = "reconcile"
-    trust_domain    = {{ .Values.spire.trustDomain | quote }}
-    cluster         = {{ .Values.spire.clusterName | quote }}
-    server_address  = "unix://{{ .Values.server.config.socketPath }}"
-    leader_election = true
-    metrics_addr    = "0.0.0.0:18080"

charts/spire/templates/workload-registrar-service.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "spire.fullname" . }}-k8s-workload-registrar
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.workloadRegistrar.service.annotations }}
-  annotations:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  labels:
-    {{- include "spire.server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.server.service.type }}
-  ports:
-    - name: https
-      port: 443
-      targetPort: registrar-port
-      protocol: TCP
-  selector:
-    {{- include "spire.server.selectorLabels" . | nindent 4 }}

charts/spire/values.yaml

@@ -9,28 +9,8 @@ waitForIt:
     version: latest-20221223
   resources: {}
 
-workloadRegistrar:
-  image:
-    registry: gcr.io
-    repository: spiffe-io/k8s-workload-registrar
-    pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    version: ""
-
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # requests:
-    #   cpu: 50m
-    #   memory: 32Mi
-    # limits:
-    #   cpu: 100m
-    #   memory: 64Mi
-
-  service:
-    annotations: {}
+k8s-workload-registrar:
+  enabled: true
 
 server:
   replicaCount: 1