Remove deprecated k8s workload registrar support

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/README.md

@@ -47,14 +47,6 @@ A Helm chart to install the SPIRE server.
 | image.version | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | jwtIssuer | string | `"oidc-discovery.example.org"` |  |
-| k8sWorkloadRegistrar.enabled | bool | `true` | The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager` A next release will switch to use the `spire-controller-manager` by default. |
-| k8sWorkloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` |  |
-| k8sWorkloadRegistrar.image.registry | string | `"gcr.io"` |  |
-| k8sWorkloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` |  |
-| k8sWorkloadRegistrar.image.version | string | `""` |  |
-| k8sWorkloadRegistrar.logLevel | string | `"info"` |  |
-| k8sWorkloadRegistrar.resources | object | `{}` |  |
-| k8sWorkloadRegistrar.securityContext | object | `{}` |  |
 | logLevel | string | `"info"` |  |
 | nameOverride | string | `""` |  |
 | nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |

charts/spire/charts/spire-server/templates/k8s-workload-registrar-configmap.yaml

@@ -1,16 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  workload-registrar.conf: |
-    log_level       = "{{ .Values.k8sWorkloadRegistrar.logLevel }}"
-    mode            = "reconcile"
-    trust_domain    = {{ .Values.trustDomain | quote }}
-    cluster         = {{ .Values.clusterName | quote }}
-    server_address  = "unix://{{ .Values.socketPath }}"
-    leader_election = true
-    metrics_addr    = "0.0.0.0:18080"
-{{- end }}

charts/spire/charts/spire-server/templates/k8s-workload-registrar-roles.yaml

@@ -1,59 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-# This is copied directly from the spire/support/k8s/k8s-workload-registrar tree.
-# These roles are needed for the k8s registrar to work properly in reconciling mode.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "endpoints"]
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["create"]
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    resourceNames: ["controller-leader-election-helper"]
-    verbs: ["update", "get"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create"]
-  - apiGroups: ["coordination.k8s.io"]
-    resources: ["leases"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: Role
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  apiGroup: rbac.authorization.k8s.io
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire-server.serviceAccountName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end }}

charts/spire/charts/spire-server/templates/k8s-workload-registrar-service.yaml

@@ -1,22 +0,0 @@
-{{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.service.annotations }}
-  annotations:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  labels:
-    {{- include "spire-server.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - name: https
-      port: 443
-      targetPort: k8s-registrar
-      protocol: TCP
-  selector:
-    {{- include "spire-server.selectorLabels" . | nindent 4 }}
-{{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -76,29 +76,6 @@ spec:
               mountPath: /run/spire/upstream_ca
               readOnly: false
             {{ end }}
-        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-        - name: spire-k8s-workload-registrar
-          securityContext:
-            {{- toYaml .Values.k8sWorkloadRegistrar.securityContext | nindent 12 }}
-          image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.k8sWorkloadRegistrar.image) }}
-          imagePullPolicy: {{ .Values.k8sWorkloadRegistrar.image.pullPolicy }}
-          args:
-            - -config
-            - /run/spire/k8s-workload-registrar/config/workload-registrar.conf
-          ports:
-            - name: k8s-registrar
-              containerPort: 9443
-              protocol: TCP
-          resources:
-            {{- toYaml .Values.k8sWorkloadRegistrar.resources | nindent 12 }}
-          volumeMounts:
-            - name: spire-server-socket
-              mountPath: /run/spire/server-sockets
-              readOnly: true
-            - name: k8s-workload-registrar-config
-              mountPath: /run/spire/k8s-workload-registrar/config
-              readOnly: true
-        {{- end }}
         {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
         - name: spire-controller-manager
           securityContext:
@@ -160,11 +137,6 @@ spec:
           secret:
             secretName: {{ include "spire-server.upstream-ca-secret" . }}
         {{- end }}
-        {{- if eq (.Values.k8sWorkloadRegistrar.enabled | toString) "true" }}
-        - name: k8s-workload-registrar-config
-          configMap:
-            name: {{ include "spire-k8s-workload-registrar.fullname" . }}
-        {{- end }}
         {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
         - name: controller-manager-config
           configMap:

charts/spire/charts/spire-server/values.yaml

@@ -159,37 +159,3 @@ controllerManager:
       #   spiffe.io/spiffe-id: "true"
     dnsNameTemplates: []
       # - '{{ index .PodMeta.Labels "app.kubernetes.io/name" }}.{{ .PodMeta.Namespace }}.svc.cluster.local'
-
-k8sWorkloadRegistrar:
-  # -- The `k8s-workload-registrar` is deprecated in favor of the `spire-controller-manager`
-  # A next release will switch to use the `spire-controller-manager` by default.
-  enabled: true
-
-  image:
-    registry: gcr.io
-    repository: spiffe-io/k8s-workload-registrar
-    pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    version: ""
-
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # limits:
-    #   cpu: 100m
-    #   memory: 128Mi
-    # requests:
-    #   cpu: 100m
-    #   memory: 128Mi
-
-  securityContext: {}
-    # capabilities:
-    #   drop:
-    #   - ALL
-    # readOnlyRootFilesystem: true
-    # runAsNonRoot: true
-    # runAsUser: 1000
-
-  logLevel: info