diff --git a/charts/spire/README.md b/charts/spire/README.md index 0089e98..7e98f7b 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -58,39 +58,14 @@ Kubernetes: `>=1.21.0-0` | imagePullSecrets | list | `[]` | | | k8s-workload-registrar.enabled | bool | `true` | | | nameOverride | string | `""` | | -| server.config.ca_subject.common_name | string | `"example.org"` | | -| server.config.ca_subject.country | string | `"NL"` | | -| server.config.ca_subject.organization | string | `"Example"` | | -| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | -| server.config.logLevel | string | `"info"` | | -| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | -| server.config.upstreamAuthority.disk.enabled | bool | `false` | | -| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | -| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | -| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | -| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | -| server.dataStorage.enabled | bool | `true` | | -| server.dataStorage.size | string | `"1Gi"` | | -| server.dataStorage.storageClass | string | `nil` | | -| server.image.pullPolicy | string | `"IfNotPresent"` | | -| server.image.registry | string | `"ghcr.io"` | | -| server.image.repository | string | `"spiffe/spire-server"` | | -| server.image.version | string | `""` | | -| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | -| server.podAnnotations | object | `{}` | | -| server.podSecurityContext | object | `{}` | | -| server.replicaCount | int | `1` | | -| server.resources | object | `{}` | | -| server.securityContext | object | `{}` | | -| server.service.annotations | object | `{}` | | -| server.service.port | int | `8081` | | -| server.service.type | string | `"ClusterIP"` | | -| server.topologySpreadConstraints | list | `[]` | | | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | | spire-agent.nameOverride | string | `"agent"` | | +| spire-server.bundleConfigMap | string | `"spire-bundle"` | | +| spire-server.nameOverride | string | `"server"` | | | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 714e557..0f41f31 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -10,6 +10,7 @@ A Helm chart to install the SPIRE agent. | Key | Type | Default | Description | |-----|------|---------|-------------| +| bundleConfigMap | string | `"spire-bundle"` | | | clusterName | string | `"example-cluster"` | | | fullnameOverride | string | `""` | | | image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 4aa7443..0614690 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -79,7 +79,7 @@ spec: name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: spire-bundle + name: {{ .Values.bundleConfigMap }} - name: spire-token projected: sources: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index cf7ba0f..5b0a05d 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -57,6 +57,8 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock clusterName: example-cluster trustDomain: example.org +bundleConfigMap: spire-bundle + server: host: spire-server port: 8081 diff --git a/charts/spire/charts/spire-server/.helmignore b/charts/spire/charts/spire-server/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-server/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml new file mode 100644 index 0000000..cee16b7 --- /dev/null +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-server +description: A Helm chart to install the SPIRE server. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md new file mode 100644 index 0000000..860f0c4 --- /dev/null +++ b/charts/spire/charts/spire-server/README.md @@ -0,0 +1,55 @@ +# spire-server + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) + +A Helm chart to install the SPIRE server. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| affinity | object | `{}` | | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| bundleConfigMap | string | `"spire-server"` | | +| ca_subject.common_name | string | `"example.org"` | | +| ca_subject.country | string | `"NL"` | | +| ca_subject.organization | string | `"Example"` | | +| clusterName | string | `"example-cluster"` | | +| dataStorage.accessMode | string | `"ReadWriteOnce"` | | +| dataStorage.enabled | bool | `true` | | +| dataStorage.size | string | `"1Gi"` | | +| dataStorage.storageClass | string | `nil` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-server"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| jwtIssuer | string | `"oidc-discovery.example.org"` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| replicaCount | int | `1` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| service.annotations | object | `{}` | | +| service.port | int | `8081` | | +| service.type | string | `"ClusterIP"` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | | +| tolerations | list | `[]` | | +| topologySpreadConstraints | list | `[]` | | +| trustDomain | string | `"example.org"` | | +| upstreamAuthority.disk.enabled | bool | `false` | | +| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. | +| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info | +| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. | diff --git a/charts/spire/charts/spire-server/templates/NOTES.txt b/charts/spire/charts/spire-server/templates/NOTES.txt new file mode 100644 index 0000000..69e0da7 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/NOTES.txt @@ -0,0 +1,6 @@ +Installed {{ .Chart.Name }}… + +1. Get the currently registered SPIFFE entries from the server: + + kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \ + bin/spire-server entry show -socketPath {{ .Values.socketPath }} diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl new file mode 100644 index 0000000..c6de080 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -0,0 +1,86 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-server.labels" -}} +helm.sh/chart: {{ include "spire-server.chart" . }} +{{ include "spire-server.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-server.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-server.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} + + +{{- define "spire-server.upstream-ca-secret" -}} +{{- $root := . }} +{{- with .Values.upstreamAuthority.disk -}} +{{- if eq (.secret.create | toString) "true" -}} +{{ include "spire.fullname" $root }}-upstream-ca +{{- else -}} +{{ default (include "spire.fullname" $root) .secret.name }} +{{- end -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/spire-bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml similarity index 62% rename from charts/spire/templates/spire-bundle-configmap.yaml rename to charts/spire/charts/spire-server/templates/bundle-configmap.yaml index 017dd54..ae55ad4 100644 --- a/charts/spire/templates/spire-bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -1,5 +1,5 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-bundle + name: {{ .Values.bundleConfigMap }} namespace: {{ .Release.Namespace }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml similarity index 71% rename from charts/spire/templates/server-configmap.yaml rename to charts/spire/charts/spire-server/templates/configmap.yaml index f505289..1b69148 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -1,27 +1,26 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} data: server.conf: | server { bind_address = "0.0.0.0" bind_port = "8081" - socket_path = {{ .Values.server.config.socketPath | quote }} - trust_domain = {{ .Values.spire.trustDomain | quote }} + socket_path = {{ .Values.socketPath | quote }} + trust_domain = {{ .Values.trustDomain | quote }} data_dir = "/run/spire/data" - log_level = "{{ .Values.server.config.logLevel }}" + log_level = "{{ .Values.logLevel }}" # AWS requires the use of RSA. EC cryptography is not supported ca_key_type = "rsa-2048" - {{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }} - jwt_issuer = "{{ .Values.server.config.jwtIssuer }}" - {{ end }} + jwt_issuer = "{{ .Values.jwtIssuer }}" + default_x509_svid_ttl = "1h" default_jwt_svid_ttl = "1h" ca_subject = { - {{- with .Values.server.config.ca_subject }} + {{- with .Values.ca_subject }} country = [{{ .country | quote }}], organization = [{{ .organization | quote }}], common_name = {{ .common_name | quote }}, @@ -40,8 +39,8 @@ data: NodeAttestor "k8s_psat" { plugin_data { clusters = { - {{ .Values.spire.clusterName | quote }} = { - service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"] + {{ .Values.clusterName | quote }} = { + service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"] } } } @@ -56,11 +55,11 @@ data: Notifier "k8sbundle" { plugin_data { namespace = "{{ .Release.Namespace }}" - config_map = "{{ include "spire.fullname" . }}-bundle" + config_map = {{ .Values.bundleConfigMap | quote }} } } - {{- with .Values.server.config.upstreamAuthority.disk }} + {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} UpstreamAuthority "disk" { plugin_data { diff --git a/charts/spire/charts/spire-server/templates/hpa.yaml b/charts/spire/charts/spire-server/templates/hpa.yaml new file mode 100644 index 0000000..5121749 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/hpa.yaml @@ -0,0 +1,28 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2beta1 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "spire-server.fullname" . }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "spire-server.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/spire/templates/server-roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml similarity index 77% rename from charts/spire/templates/server-roles.yaml rename to charts/spire/charts/spire-server/templates/roles.yaml index 0a74adb..5d4c946 100644 --- a/charts/spire/templates/server-roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -3,7 +3,7 @@ kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} rules: # allow "get" access to pods (to resolve selectors for PSAT attestation) @@ -14,7 +14,7 @@ rules: # agent bootstrapping, see the spire-bundle ConfigMap below) - apiGroups: [""] resources: [configmaps] - resourceNames: ["{{ include "spire.fullname" . }}-bundle"] + resourceNames: [{{ .Values.bundleConfigMap }}] verbs: - get - patch @@ -22,15 +22,15 @@ rules: kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server + name: {{ include "spire-server.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: Role - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} apiGroup: rbac.authorization.k8s.io --- # ClusterRole to allow spire-server node attestor to query Token Review API @@ -38,7 +38,7 @@ roleRef: kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} rules: # allow TokenReview requests (to verify service account tokens for PSAT # attestation) @@ -56,13 +56,13 @@ rules: kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.serviceAccountName" . }}-server + name: {{ include "spire-server.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/charts/spire-server/templates/service.yaml b/charts/spire/charts/spire-server/templates/service.yaml new file mode 100644 index 0000000..ba42c07 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "spire-server.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire-server.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - name: grpc + port: {{ .Values.service.port }} + targetPort: grpc + protocol: TCP + selector: + {{- include "spire-server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/templates/server-serviceaccount.yaml b/charts/spire/charts/spire-server/templates/serviceaccount.yaml similarity index 58% rename from charts/spire/templates/server-serviceaccount.yaml rename to charts/spire/charts/spire-server/templates/serviceaccount.yaml index d3e9d3a..48d513b 100644 --- a/charts/spire/templates/server-serviceaccount.yaml +++ b/charts/spire/charts/spire-server/templates/serviceaccount.yaml @@ -2,10 +2,9 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "spire.serviceAccountName" . }}-server - namespace: {{ .Release.Namespace }} + name: {{ include "spire-server.serviceAccountName" . }} labels: - {{- include "spire.server.labels" . | nindent 4 }} + {{- include "spire-server.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml similarity index 56% rename from charts/spire/templates/server-statefulset.yaml rename to charts/spire/charts/spire-server/templates/statefulset.yaml index 8ad50d0..507978d 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -1,45 +1,41 @@ -{{- $fullname := include "spire.fullname" . }} +{{- $fullname := include "spire-server.fullname" . }} apiVersion: apps/v1 kind: StatefulSet metadata: - name: {{ $fullname }}-server + name: {{ include "spire-server.fullname" . }} labels: - {{- include "spire.server.labels" . | nindent 4 }} + {{- include "spire-server.labels" . | nindent 4 }} spec: - replicas: {{ .Values.server.replicaCount }} - serviceName: {{ include "spire.fullname" . }}-server + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + serviceName: {{ include "spire-server.fullname" . }} selector: matchLabels: - {{- include "spire.server.selectorLabels" . | nindent 6 }} + {{- include "spire-server.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.server.podAnnotations }} + {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- include "spire.server.selectorLabels" . | nindent 8 }} + {{- include "spire-server.selectorLabels" . | nindent 8 }} spec: {{- with .Values.imagePullSecrets }} imagePullSecrets: - {{- range . }} - - name: {{ printf "%s-%s" $fullname .name }} - {{- end }} - {{- end }} - serviceAccountName: {{ include "spire.serviceAccountName" . }}-server - shareProcessNamespace: true - securityContext: - {{- toYaml .Values.server.podSecurityContext | nindent 8 }} - {{- with .Values.server.nodeSelector }} - nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} + serviceAccountName: {{ include "spire-server.serviceAccountName" . }} + shareProcessNamespace: true + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: - - name: {{ .Chart.Name }}-server + - name: {{ .Chart.Name }} securityContext: {{- toYaml .Values.securityContext | nindent 12 }} - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }} - imagePullPolicy: {{ .Values.server.image.pullPolicy }} + image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} args: - -config - /run/spire/config/server.conf @@ -47,23 +43,6 @@ spec: - name: grpc containerPort: 8081 protocol: TCP - volumeMounts: - - name: spire-server-socket - mountPath: /run/spire/server-sockets - readOnly: false - - name: spire-config - mountPath: /run/spire/config - readOnly: true - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} - - name: spire-data - mountPath: /run/spire/data - readOnly: false - {{ end }} - {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} - - name: upstream-ca - mountPath: /run/spire/upstream_ca - readOnly: false - {{- end }} livenessProbe: httpGet: path: /live @@ -79,47 +58,64 @@ spec: initialDelaySeconds: 5 periodSeconds: 5 resources: - {{- toYaml .Values.server.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: spire-server-socket + mountPath: /run/spire/server-sockets + readOnly: false + - name: spire-config + mountPath: /run/spire/config + readOnly: true + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} + - name: spire-data + mountPath: /run/spire/data + readOnly: false + {{- end }} + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} + - name: upstream-ca + mountPath: /run/spire/upstream_ca + readOnly: false + {{ end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.affinity }} + {{- with .Values.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.tolerations }} + {{- with .Values.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.server.topologySpreadConstraints }} + {{- with .Values.topologySpreadConstraints }} topologySpreadConstraints: {{- toYaml . | nindent 8 }} {{- end }} volumes: - name: spire-config configMap: - name: {{ include "spire.fullname" . }}-server + name: {{ include "spire-server.fullname" . }} - name: spire-server-socket hostPath: path: /run/spire/server-sockets type: DirectoryOrCreate - {{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} + {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} - name: upstream-ca secret: - secretName: {{ include "spire.server-upstream-ca-secret" . }} + secretName: {{ include "spire-server.upstream-ca-secret" . }} {{- end }} volumeClaimTemplates: - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} + {{- if eq (.Values.dataStorage.enabled | toString) "true" }} - metadata: name: spire-data spec: accessModes: - - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} + - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }} resources: requests: - storage: {{ .Values.server.dataStorage.size }} - {{- if .Values.server.dataStorage.storageClass }} - storageClassName: {{ .Values.server.dataStorage.storageClass }} + storage: {{ .Values.dataStorage.size }} + {{- if .Values.dataStorage.storageClass }} + storageClassName: {{ .Values.dataStorage.storageClass }} {{- end }} {{ end }} diff --git a/charts/spire/charts/spire-server/templates/tests/test-connection.yaml b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml new file mode 100644 index 0000000..60f83f3 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/tests/test-connection.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "spire-server.fullname" . }}-test-connection" + labels: + {{- include "spire-server.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['nc'] + args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}'] + restartPolicy: Never diff --git a/charts/spire/templates/upstream-ca-secret.yaml b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml similarity index 69% rename from charts/spire/templates/upstream-ca-secret.yaml rename to charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml index 36a2c21..3d62360 100644 --- a/charts/spire/templates/upstream-ca-secret.yaml +++ b/charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml @@ -1,13 +1,13 @@ {{- $root := . }} -{{- with .Values.server.config.upstreamAuthority.disk }} +{{- with .Values.upstreamAuthority.disk }} {{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }} apiVersion: v1 kind: Secret metadata: - name: {{ include "spire.server-upstream-ca-secret" $root }} + name: {{ include "spire-server.upstream-ca-secret" $root }} namespace: {{ $root.Release.Namespace }} labels: - {{- include "spire.server.labels" $root | nindent 4 }} + {{- include "spire-server.labels" $root | nindent 4 }} data: {{- with .secret.data }} tls.crt: {{ .certificate | b64enc }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml new file mode 100644 index 0000000..a025d65 --- /dev/null +++ b/charts/spire/charts/spire-server/values.yaml @@ -0,0 +1,107 @@ +# Default values for spire-server. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +image: + # registry: gcr.io + # repository: spiffe-io/spire-server + registry: ghcr.io + repository: spiffe/spire-server + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8081 + annotations: {} + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 200m + # memory: 256Mi + # limits: + # cpu: 200m + # memory: 256Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: + kubernetes.io/arch: amd64 + +tolerations: [] + +affinity: {} + +topologySpreadConstraints: [] + +dataStorage: + enabled: true + size: 1Gi + accessMode: ReadWriteOnce + storageClass: null + +logLevel: info +socketPath: /run/spire/server-sockets/spire-server.sock +jwtIssuer: oidc-discovery.example.org + +clusterName: example-cluster +trustDomain: example.org + +bundleConfigMap: spire-server + +ca_subject: + country: NL + organization: Example + common_name: example.org + +upstreamAuthority: + disk: + enabled: false + secret: + # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. + create: true + # -- If secret creation is disabled, the secret with this name will be used. + name: "spiffe-upstream-ca" + # -- If secret creation is enabled, will create a secret with following certificate info + data: + certificate: "" + key: "" + bundle: "" diff --git a/charts/spire/templates/NOTES.txt b/charts/spire/templates/NOTES.txt index 65e935f..dfe3e24 100644 --- a/charts/spire/templates/NOTES.txt +++ b/charts/spire/templates/NOTES.txt @@ -1,4 +1 @@ -1. Get the currently registered SPIFFE entries from the server: - - kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \ - bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }} +Installed {{ .Chart.Name }}… diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index dbbbea3..bf3542c 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -50,26 +50,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{/* -Common server labels -*/}} -{{- define "spire.server.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.server.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector server labels -*/}} -{{- define "spire.server.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }}-server -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - {{/* Common oidc labels */}} @@ -112,14 +92,3 @@ Create the name of the service account to use {{- printf "%s/%s" .image.registry .image.repository -}} {{- end -}} {{- end }} - -{{- define "spire.server-upstream-ca-secret" -}} -{{- $root := . }} -{{- with .Values.server.config.upstreamAuthority.disk -}} -{{- if eq (.secret.create | toString) "true" -}} -{{ include "spire.fullname" $root }}-upstream-ca -{{- else -}} -{{ default (include "spire.fullname" $root) .secret.name }} -{{- end -}} -{{- end -}} -{{- end }} diff --git a/charts/spire/templates/server-service.yaml b/charts/spire/templates/server-service.yaml deleted file mode 100644 index 006bfc0..0000000 --- a/charts/spire/templates/server-service.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "spire.fullname" . }}-server - namespace: {{ .Release.Namespace }} - {{- with .Values.server.service.annotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "spire.server.labels" . | nindent 4 }} -spec: - type: {{ .Values.server.service.type }} - ports: - - name: grpc - port: {{ .Values.server.service.port }} - targetPort: grpc - protocol: TCP - selector: - {{- include "spire.server.selectorLabels" . | nindent 4 }} diff --git a/charts/spire/templates/tests/server-test-connection.yaml b/charts/spire/templates/tests/server-test-connection.yaml deleted file mode 100644 index 2f15a90..0000000 --- a/charts/spire/templates/tests/server-test-connection.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "spire.fullname" . }}-server-test-connection" - labels: - {{- include "spire.server.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: check-port - image: busybox - command: ['nc'] - args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}'] - restartPolicy: Never diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 67e71b1..a4c9646 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -12,84 +12,13 @@ waitForIt: k8s-workload-registrar: enabled: true -server: - replicaCount: 1 - image: - # registry: gcr.io - # repository: spiffe-io/spire-server - registry: ghcr.io - repository: spiffe/spire-server - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 200m - # memory: 256Mi - # limits: - # cpu: 200m - # memory: 256Mi - - dataStorage: - enabled: true - size: 1Gi - accessMode: ReadWriteOnce - storageClass: null - - service: - type: ClusterIP - port: 8081 - annotations: {} - - podAnnotations: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - - topologySpreadConstraints: [] - - config: - logLevel: info - socketPath: /run/spire/server-sockets/spire-server.sock - jwtIssuer: oidc-discovery.example.org - - ca_subject: - country: NL - organization: Example - common_name: example.org - - upstreamAuthority: - disk: - enabled: false - secret: - # -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. - create: true - # -- If secret creation is disabled, the secret with this name will be used. - name: "spiffe-upstream-ca" - # -- If secret creation is enabled, will create a secret with following certificate info - data: - certificate: "" - key: "" - bundle: "" +spire-server: + nameOverride: server + bundleConfigMap: &bundleConfigMap spire-bundle spire-agent: nameOverride: agent + bundleConfigMap: *bundleConfigMap spiffe-oidc-discovery-provider: enabled: false