diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8650943..3afd7b3 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -47,14 +47,6 @@ A Helm chart to install the SPIRE server. | image.version | string | `""` | | | imagePullSecrets | list | `[]` | | | jwtIssuer | string | `"oidc-discovery.example.org"` | | -| k8sWorkloadRegistrar.enabled | bool | `true` | The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` A next release will switch to use the `spire-controller-manager` by default. | -| k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | | -| k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` | | -| k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | | -| k8sWorkloadRegistrar.image.version | string | `""` | | -| k8sWorkloadRegistrar.logLevel | string | `"info"` | | -| k8sWorkloadRegistrar.resources | object | `{}` | | -| k8sWorkloadRegistrar.securityContext | object | `{}` | | | logLevel | string | `"info"` | | | nameOverride | string | `""` | | | nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml deleted file mode 100644 index 5cdcc86..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -data: - workload-registrar.conf: | - log_level = "{{ .Values.k8sWorkloadRegistrar.logLevel }}" - mode = "reconcile" - trust_domain = {{ .Values.trustDomain | quote }} - cluster = {{ .Values.clusterName | quote }} - server_address = "unix://{{ .Values.socketPath }}" - leader_election = true - metrics_addr = "0.0.0.0:18080" -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml deleted file mode 100644 index ec35eab..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml +++ /dev/null @@ -1,59 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree. -# These roles are needed for the k8s registrar to work properly in reconciling mode. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -rules: - - apiGroups: [""] - resources: ["pods", "nodes", "endpoints"] - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ include "spire-k8s-workload-registrar.fullname" . }} -subjects: - - kind: ServiceAccount - name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -rules: - - apiGroups: [""] - resources: ["configmaps"] - verbs: ["create"] - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["controller-leader-election-helper"] - verbs: ["update", "get"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} -roleRef: - kind: Role - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - apiGroup: rbac.authorization.k8s.io -subjects: - - kind: ServiceAccount - name: {{ include "spire-server.serviceAccountName" . }} - namespace: {{ .Release.Namespace }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml b/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml deleted file mode 100644 index 1fd54b7..0000000 --- a/charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - namespace: {{ .Release.Namespace }} - {{- with .Values.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "spire-server.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - name: https - port: 443 - targetPort: k8s-registrar - protocol: TCP - selector: - {{- include "spire-server.selectorLabels" . | nindent 4 }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index dc2b978..3d71059 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -76,29 +76,6 @@ spec: mountPath: /run/spire/upstream_ca readOnly: false {{ end }} - {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} - - name: spire-k8s-workload-registrar - securityContext: - {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }} - image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }} - imagePullPolicy: {{ .Values.k8sWorkloadRegistrar.image.pullPolicy }} - args: - - -config - - /run/spire/k8s-workload-registrar/config/workload-registrar.conf - ports: - - name: k8s-registrar - containerPort: 9443 - protocol: TCP - resources: - {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }} - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: true - - name: k8s-workload-registrar-config - mountPath: /run/spire/k8s-workload-registrar/config - readOnly: true - {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: spire-controller-manager securityContext: @@ -160,11 +137,6 @@ spec: secret: secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} - {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }} - - name: k8s-workload-registrar-config - configMap: - name: {{ include "spire-k8s-workload-registrar.fullname" . }} - {{- end }} {{- if eq (.Values.controllerManager.enabled | toString) "true" }} - name: controller-manager-config configMap: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9176fac..9efa2c0 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -159,37 +159,3 @@ controllerManager: # spiffe.io/spiffe-id: "true" dnsNameTemplates: [] # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local' - -k8sWorkloadRegistrar: - # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` - # A next release will switch to use the `spire-controller-manager` by default. - enabled: true - - image: - registry: gcr.io - repository: spiffe-io/k8s-workload-registrar - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - logLevel: info