Remove deprecated k8s workload registrar support

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml

@@ -1,16 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  workload-registrar.conf: |
-    log_level       = "{{ .Values.k8sWorkloadRegistrar.logLevel }}"
-    mode            = "reconcile"
-    trust_domain    = {{ .Values.trustDomain | quote }}
-    cluster         = {{ .Values.clusterName | quote }}
-    server_address  = "unix://{{ .Values.socketPath }}"
-    leader_election = true
-    metrics_addr    = "0.0.0.0:18080"
-{{- end }}

charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml

@@ -1,59 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree.
-# These roles are needed for the k8s registrar to work properly in reconciling mode.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "endpoints"]
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["controller-leader-election-helper"]
-    verbs: ["update", "get"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end }}

charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml

@@ -1,22 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.service.annotations }}
-  annotations:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  labels:
-    {{- include "spire-server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - name: https
-      port: 443
-      targetPort: k8s-registrar
-      protocol: TCP
-  selector:
-    {{- include "spire-server.selectorLabels" . | nindent 4 }}
-{{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -76,29 +76,6 @@ spec:
               mountPath: /run/spire/upstream_ca
               readOnly: false
             {{ end }}
-        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-        - name: spire-k8s-workload-registrar
-          securityContext:
-            {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }}
-          imagePullPolicy: {{ .Values.k8sWorkloadRegistrar.image.pullPolicy }}
-          args:
-            - -config
-            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
-          ports:
-            - name: k8s-registrar
-              containerPort: 9443
-              protocol: TCP
-          resources:
-            {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }}
-          volumeMounts:
-            - name: spire-server-socket
-              mountPath: /run/spire/server-sockets
-              readOnly: true
-            - name: k8s-workload-registrar-config
-              mountPath: /run/spire/k8s-workload-registrar/config
-              readOnly: true
-        {{- end }}
         {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
         - name: spire-controller-manager
           securityContext:
@@ -160,11 +137,6 @@ spec:
           secret:
             secretName: {{ include "spire-server.upstream-ca-secret" . }}
         {{- end }}
-        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-        - name: k8s-workload-registrar-config
-          configMap:
-            name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-        {{- end }}
         {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
         - name: controller-manager-config
           configMap: