panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move spire-server to dedicated subchart

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:10 +01:00
committed by Marco Franssen
parent e312d42350
commit ce9b58e725
24 changed files with 430 additions and 252 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+3 -28
View File
@@ -58,39 +58,14 @@ Kubernetes: `>=1.21.0-0`
| imagePullSecrets | list | `[]` | | | imagePullSecrets | list | `[]` | |
| k8s-workload-registrar.enabled | bool | `true` | | | k8s-workload-registrar.enabled | bool | `true` | |
| nameOverride | string | `""` | | | nameOverride | string | `""` | |
| server.config.ca_subject.common_name | string | `"example.org"` | |
| server.config.ca_subject.country | string | `"NL"` | |
| server.config.ca_subject.organization | string | `"Example"` | |
| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | |
| server.config.logLevel | string | `"info"` | |
| server.config.socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
| server.config.upstreamAuthority.disk.enabled | bool | `false` | |
| server.config.upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
| server.config.upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
| server.config.upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| server.dataStorage.enabled | bool | `true` | |
| server.dataStorage.size | string | `"1Gi"` | |
| server.dataStorage.storageClass | string | `nil` | |
| server.image.pullPolicy | string | `"IfNotPresent"` | |
| server.image.registry | string | `"ghcr.io"` | |
| server.image.repository | string | `"spiffe/spire-server"` | |
| server.image.version | string | `""` | |
| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| server.podAnnotations | object | `{}` | |
| server.podSecurityContext | object | `{}` | |
| server.replicaCount | int | `1` | |
| server.resources | object | `{}` | |
| server.securityContext | object | `{}` | |
| server.service.annotations | object | `{}` | |
| server.service.port | int | `8081` | |
| server.service.type | string | `"ClusterIP"` | |
| server.topologySpreadConstraints | list | `[]` | |
| serviceAccount.annotations | object | `{}` | | | serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | | | serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | | | serviceAccount.name | string | `""` | |
| spiffe-oidc-discovery-provider.enabled | bool | `false` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | |
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
| spire-agent.nameOverride | string | `"agent"` | | | spire-agent.nameOverride | string | `"agent"` | |
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
| spire-server.nameOverride | string | `"server"` | |
| spire.clusterName | string | `"example-cluster"` | | | spire.clusterName | string | `"example-cluster"` | |
| spire.trustDomain | string | `"example.org"` | | | spire.trustDomain | string | `"example.org"` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
charts/spire/charts/spire-agent/README.md
+1
View File
@@ -10,6 +10,7 @@ A Helm chart to install the SPIRE agent.
| Key | Type | Default | Description | | Key | Type | Default | Description |
|-----|------|---------|-------------| |-----|------|---------|-------------|
| bundleConfigMap | string | `"spire-bundle"` | |
| clusterName | string | `"example-cluster"` | | | clusterName | string | `"example-cluster"` | |
| fullnameOverride | string | `""` | | | fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | | | image.pullPolicy | string | `"IfNotPresent"` | |
charts/spire/charts/spire-agent/templates/daemonset.yaml
+1 -1
View File
@@ -79,7 +79,7 @@ spec:
name: {{ include "spire-agent.fullname" . }} name: {{ include "spire-agent.fullname" . }}
- name: spire-bundle - name: spire-bundle
configMap: configMap:
name: spire-bundle name: {{ .Values.bundleConfigMap }}
- name: spire-token - name: spire-token
projected: projected:
sources: sources:
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -57,6 +57,8 @@ socketPath: /run/spire/agent-sockets/spire-agent.sock
clusterName: example-cluster clusterName: example-cluster
trustDomain: example.org trustDomain: example.org
bundleConfigMap: spire-bundle
server: server:
host: spire-server host: spire-server
port: 8081 port: 8081
charts/spire/charts/spire-server/.helmignore
+23
View File
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
charts/spire/charts/spire-server/Chart.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: v2
name: spire-server
description: A Helm chart to install the SPIRE server.
type: application
version: 0.1.0
appVersion: "1.5.3"
charts/spire/charts/spire-server/README.md
+55
View File
@@ -0,0 +1,55 @@
# spire-server
<!-- This README.md is generated. -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square)
A Helm chart to install the SPIRE server.
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| affinity | object | `{}` | |
| autoscaling.enabled | bool | `false` | |
| autoscaling.maxReplicas | int | `100` | |
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| bundleConfigMap | string | `"spire-server"` | |
| ca_subject.common_name | string | `"example.org"` | |
| ca_subject.country | string | `"NL"` | |
| ca_subject.organization | string | `"Example"` | |
| clusterName | string | `"example-cluster"` | |
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| dataStorage.enabled | bool | `true` | |
| dataStorage.size | string | `"1Gi"` | |
| dataStorage.storageClass | string | `nil` | |
| fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/spire-server"` | |
| image.version | string | `""` | |
| imagePullSecrets | list | `[]` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | |
| logLevel | string | `"info"` | |
| nameOverride | string | `""` | |
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| replicaCount | int | `1` | |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| service.annotations | object | `{}` | |
| service.port | int | `8081` | |
| service.type | string | `"ClusterIP"` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| socketPath | string | `"/run/spire/server-sockets/spire-server.sock"` | |
| tolerations | list | `[]` | |
| topologySpreadConstraints | list | `[]` | |
| trustDomain | string | `"example.org"` | |
| upstreamAuthority.disk.enabled | bool | `false` | |
| upstreamAuthority.disk.secret.create | bool | `true` | If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself. |
| upstreamAuthority.disk.secret.data | object | `{"bundle":"","certificate":"","key":""}` | If secret creation is enabled, will create a secret with following certificate info |
| upstreamAuthority.disk.secret.name | string | `"spiffe-upstream-ca"` | If secret creation is disabled, the secret with this name will be used. |
charts/spire/charts/spire-server/templates/NOTES.txt
+6
View File
@@ -0,0 +1,6 @@
Installed {{ .Chart.Name }}…
1. Get the currently registered SPIFFE entries from the server:
kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
bin/spire-server entry show -socketPath {{ .Values.socketPath }}
charts/spire/charts/spire-server/templates/_helpers.tpl
+86
View File
@@ -0,0 +1,86 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "spire-server.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "spire-server.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "spire-server.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "spire-server.labels" -}}
helm.sh/chart: {{ include "spire-server.chart" . }}
{{ include "spire-server.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "spire-server.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire-server.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "spire-server.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "spire-server.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-server.upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire.fullname" $root }}-upstream-ca
{{- else -}}
{{ default (include "spire.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
charts/spire/templates/spire-bundle-configmap.yaml → charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+1 -1
View File
@@ -1,5 +1,5 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: {{ include "spire.fullname" . }}-bundle name: {{ .Values.bundleConfigMap }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
charts/spire/templates/server-configmap.yaml → charts/spire/charts/spire-server/templates/configmap.yaml
+11 -12
View File
@@ -1,27 +1,26 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
data: data:
server.conf: | server.conf: |
server { server {
bind_address = "0.0.0.0" bind_address = "0.0.0.0"
bind_port = "8081" bind_port = "8081"
socket_path = {{ .Values.server.config.socketPath | quote }} socket_path = {{ .Values.socketPath | quote }}
trust_domain = {{ .Values.spire.trustDomain | quote }} trust_domain = {{ .Values.trustDomain | quote }}
data_dir = "/run/spire/data" data_dir = "/run/spire/data"
log_level = "{{ .Values.server.config.logLevel }}" log_level = "{{ .Values.logLevel }}"
# AWS requires the use of RSA. EC cryptography is not supported # AWS requires the use of RSA. EC cryptography is not supported
ca_key_type = "rsa-2048" ca_key_type = "rsa-2048"
{{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }} jwt_issuer = "{{ .Values.jwtIssuer }}"
jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
{{ end }}
default_x509_svid_ttl = "1h" default_x509_svid_ttl = "1h"
default_jwt_svid_ttl = "1h" default_jwt_svid_ttl = "1h"
ca_subject = { ca_subject = {
{{- with .Values.server.config.ca_subject }} {{- with .Values.ca_subject }}
country = [{{ .country | quote }}], country = [{{ .country | quote }}],
organization = [{{ .organization | quote }}], organization = [{{ .organization | quote }}],
common_name = {{ .common_name | quote }}, common_name = {{ .common_name | quote }},
@@ -40,8 +39,8 @@ data:
NodeAttestor "k8s_psat" { NodeAttestor "k8s_psat" {
plugin_data { plugin_data {
clusters = { clusters = {
{{ .Values.spire.clusterName | quote }} = { {{ .Values.clusterName | quote }} = {
service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"] service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"]
} }
} }
} }
@@ -56,11 +55,11 @@ data:
Notifier "k8sbundle" { Notifier "k8sbundle" {
plugin_data { plugin_data {
namespace = "{{ .Release.Namespace }}" namespace = "{{ .Release.Namespace }}"
config_map = "{{ include "spire.fullname" . }}-bundle" config_map = {{ .Values.bundleConfigMap | quote }}
} }
} }
{{- with .Values.server.config.upstreamAuthority.disk }} {{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
UpstreamAuthority "disk" { UpstreamAuthority "disk" {
plugin_data { plugin_data {
charts/spire/charts/spire-server/templates/hpa.yaml
+28
View File
@@ -0,0 +1,28 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "spire-server.fullname" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "spire-server.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}
charts/spire/templates/server-roles.yaml → charts/spire/charts/spire-server/templates/roles.yaml
+9 -9
View File
@@ -3,7 +3,7 @@
kind: Role kind: Role
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
rules: rules:
# allow "get" access to pods (to resolve selectors for PSAT attestation) # allow "get" access to pods (to resolve selectors for PSAT attestation)
@@ -14,7 +14,7 @@ rules:
# agent bootstrapping, see the spire-bundle ConfigMap below) # agent bootstrapping, see the spire-bundle ConfigMap below)
- apiGroups: [""] - apiGroups: [""]
resources: [configmaps] resources: [configmaps]
resourceNames: ["{{ include "spire.fullname" . }}-bundle"] resourceNames: [{{ .Values.bundleConfigMap }}]
verbs: verbs:
- get - get
- patch - patch
@@ -22,15 +22,15 @@ rules:
kind: RoleBinding kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: {{ include "spire.serviceAccountName" . }}-server name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
roleRef: roleRef:
kind: Role kind: Role
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
--- ---
# ClusterRole to allow spire-server node attestor to query Token Review API # ClusterRole to allow spire-server node attestor to query Token Review API
@@ -38,7 +38,7 @@ roleRef:
kind: ClusterRole kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
rules: rules:
# allow TokenReview requests (to verify service account tokens for PSAT # allow TokenReview requests (to verify service account tokens for PSAT
# attestation) # attestation)
@@ -56,13 +56,13 @@ rules:
kind: ClusterRoleBinding kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
metadata: metadata:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
subjects: subjects:
- kind: ServiceAccount - kind: ServiceAccount
name: {{ include "spire.serviceAccountName" . }}-server name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
roleRef: roleRef:
kind: ClusterRole kind: ClusterRole
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
charts/spire/charts/spire-server/templates/service.yaml
+20
View File
@@ -0,0 +1,20 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
{{- with .Values.service.annotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- name: grpc
port: {{ .Values.service.port }}
targetPort: grpc
protocol: TCP
selector:
{{- include "spire-server.selectorLabels" . | nindent 4 }}
charts/spire/templates/server-serviceaccount.yaml → charts/spire/charts/spire-server/templates/serviceaccount.yaml
+2 -3
View File
@@ -2,10 +2,9 @@
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
name: {{ include "spire.serviceAccountName" . }}-server name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels: labels:
{{- include "spire.server.labels" . | nindent 4 }} {{- include "spire-server.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }} {{- with .Values.serviceAccount.annotations }}
annotations: annotations:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
charts/spire/templates/server-statefulset.yaml → charts/spire/charts/spire-server/templates/statefulset.yaml
+46 -50
View File
@@ -1,45 +1,41 @@
{{- $fullname := include "spire.fullname" . }} {{- $fullname := include "spire-server.fullname" . }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: StatefulSet kind: StatefulSet
metadata: metadata:
name: {{ $fullname }}-server name: {{ include "spire-server.fullname" . }}
labels: labels:
{{- include "spire.server.labels" . | nindent 4 }} {{- include "spire-server.labels" . | nindent 4 }}
spec: spec:
replicas: {{ .Values.server.replicaCount }} {{- if not .Values.autoscaling.enabled }}
serviceName: {{ include "spire.fullname" . }}-server replicas: {{ .Values.replicaCount }}
{{- end }}
serviceName: {{ include "spire-server.fullname" . }}
selector: selector:
matchLabels: matchLabels:
{{- include "spire.server.selectorLabels" . | nindent 6 }} {{- include "spire-server.selectorLabels" . | nindent 6 }}
template: template:
metadata: metadata:
{{- with .Values.server.podAnnotations }} {{- with .Values.podAnnotations }}
annotations: annotations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
labels: labels:
{{- include "spire.server.selectorLabels" . | nindent 8 }} {{- include "spire-server.selectorLabels" . | nindent 8 }}
spec: spec:
{{- with .Values.imagePullSecrets }} {{- with .Values.imagePullSecrets }}
imagePullSecrets: imagePullSecrets:
{{- range . }}
- name: {{ printf "%s-%s" $fullname .name }}
{{- end }}
{{- end }}
serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.server.podSecurityContext | nindent 8 }}
{{- with .Values.server.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers: containers:
- name: {{ .Chart.Name }}-server - name: {{ .Chart.Name }}
securityContext: securityContext:
{{- toYaml .Values.securityContext | nindent 12 }} {{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }} image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.server.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: args:
- -config - -config
- /run/spire/config/server.conf - /run/spire/config/server.conf
@@ -47,23 +43,6 @@ spec:
- name: grpc - name: grpc
containerPort: 8081 containerPort: 8081
protocol: TCP protocol: TCP
volumeMounts:
- name: spire-server-socket
mountPath: /run/spire/server-sockets
readOnly: false
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
- name: spire-data
mountPath: /run/spire/data
readOnly: false
{{ end }}
{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
mountPath: /run/spire/upstream_ca
readOnly: false
{{- end }}
livenessProbe: livenessProbe:
httpGet: httpGet:
path: /live path: /live
@@ -79,47 +58,64 @@ spec:
initialDelaySeconds: 5 initialDelaySeconds: 5
periodSeconds: 5 periodSeconds: 5
resources: resources:
{{- toYaml .Values.server.resources | nindent 12 }} {{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- name: spire-server-socket
mountPath: /run/spire/server-sockets
readOnly: false
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- name: spire-data
mountPath: /run/spire/data
readOnly: false
{{- end }}
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
mountPath: /run/spire/upstream_ca
readOnly: false
{{ end }}
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- with .Values.server.affinity }} {{- with .Values.affinity }}
affinity: affinity:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- with .Values.server.tolerations }} {{- with .Values.tolerations }}
tolerations: tolerations:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
{{- with .Values.server.topologySpreadConstraints }} {{- with .Values.topologySpreadConstraints }}
topologySpreadConstraints: topologySpreadConstraints:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
{{- end }} {{- end }}
volumes: volumes:
- name: spire-config - name: spire-config
configMap: configMap:
name: {{ include "spire.fullname" . }}-server name: {{ include "spire-server.fullname" . }}
- name: spire-server-socket - name: spire-server-socket
hostPath: hostPath:
path: /run/spire/server-sockets path: /run/spire/server-sockets
type: DirectoryOrCreate type: DirectoryOrCreate
{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca - name: upstream-ca
secret: secret:
secretName: {{ include "spire.server-upstream-ca-secret" . }} secretName: {{ include "spire-server.upstream-ca-secret" . }}
{{- end }} {{- end }}
volumeClaimTemplates: volumeClaimTemplates:
{{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- metadata: - metadata:
name: spire-data name: spire-data
spec: spec:
accessModes: accessModes:
- {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }} - {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
resources: resources:
requests: requests:
storage: {{ .Values.server.dataStorage.size }} storage: {{ .Values.dataStorage.size }}
{{- if .Values.server.dataStorage.storageClass }} {{- if .Values.dataStorage.storageClass }}
storageClassName: {{ .Values.server.dataStorage.storageClass }} storageClassName: {{ .Values.dataStorage.storageClass }}
{{- end }} {{- end }}
{{ end }} {{ end }}
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ include "spire-server.fullname" . }}-test-connection"
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": test
spec:
containers:
- name: wget
image: busybox
command: ['nc']
args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
restartPolicy: Never
charts/spire/templates/upstream-ca-secret.yaml → charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml
+3 -3
View File
@@ -1,13 +1,13 @@
{{- $root := . }} {{- $root := . }}
{{- with .Values.server.config.upstreamAuthority.disk }} {{- with .Values.upstreamAuthority.disk }}
{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }} {{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ include "spire.server-upstream-ca-secret" $root }} name: {{ include "spire-server.upstream-ca-secret" $root }}
namespace: {{ $root.Release.Namespace }} namespace: {{ $root.Release.Namespace }}
labels: labels:
{{- include "spire.server.labels" $root | nindent 4 }} {{- include "spire-server.labels" $root | nindent 4 }}
data: data:
{{- with .secret.data }} {{- with .secret.data }}
tls.crt: {{ .certificate | b64enc }} tls.crt: {{ .certificate | b64enc }}
charts/spire/charts/spire-server/values.yaml
+107
View File
@@ -0,0 +1,107 @@
# Default values for spire-server.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
replicaCount: 1
image:
# registry: gcr.io
# repository: spiffe-io/spire-server
registry: ghcr.io
repository: spiffe/spire-server
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
podAnnotations: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
service:
type: ClusterIP
port: 8081
annotations: {}
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 200m
# memory: 256Mi
# limits:
# cpu: 200m
# memory: 256Mi
autoscaling:
enabled: false
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
# targetMemoryUtilizationPercentage: 80
nodeSelector:
kubernetes.io/arch: amd64
tolerations: []
affinity: {}
topologySpreadConstraints: []
dataStorage:
enabled: true
size: 1Gi
accessMode: ReadWriteOnce
storageClass: null
logLevel: info
socketPath: /run/spire/server-sockets/spire-server.sock
jwtIssuer: oidc-discovery.example.org
clusterName: example-cluster
trustDomain: example.org
bundleConfigMap: spire-server
ca_subject:
country: NL
organization: Example
common_name: example.org
upstreamAuthority:
disk:
enabled: false
secret:
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
create: true
# -- If secret creation is disabled, the secret with this name will be used.
name: "spiffe-upstream-ca"
# -- If secret creation is enabled, will create a secret with following certificate info
data:
certificate: ""
key: ""
bundle: ""
charts/spire/templates/NOTES.txt
+1 -4
View File
@@ -1,4 +1 @@
1. Get the currently registered SPIFFE entries from the server: Installed {{ .Chart.Name }}…
kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }}
charts/spire/templates/_helpers.tpl
-31
View File
@@ -50,26 +50,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }} {{- end }}
{{/*
Common server labels
*/}}
{{- define "spire.server.labels" -}}
helm.sh/chart: {{ include "spire.chart" . }}
{{ include "spire.server.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector server labels
*/}}
{{- define "spire.server.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire.name" . }}-server
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/* {{/*
Common oidc labels Common oidc labels
*/}} */}}
@@ -112,14 +92,3 @@ Create the name of the service account to use
{{- printf "%s/%s" .image.registry .image.repository -}} {{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}} {{- end -}}
{{- end }} {{- end }}
{{- define "spire.server-upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.server.config.upstreamAuthority.disk -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire.fullname" $root }}-upstream-ca
{{- else -}}
{{ default (include "spire.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
charts/spire/templates/server-service.yaml
-20
View File
@@ -1,20 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
{{- with .Values.server.service.annotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire.server.labels" . | nindent 4 }}
spec:
type: {{ .Values.server.service.type }}
ports:
- name: grpc
port: {{ .Values.server.service.port }}
targetPort: grpc
protocol: TCP
selector:
{{- include "spire.server.selectorLabels" . | nindent 4 }}
charts/spire/templates/tests/server-test-connection.yaml
-15
View File
@@ -1,15 +0,0 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ include "spire.fullname" . }}-server-test-connection"
labels:
{{- include "spire.server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": test
spec:
containers:
- name: check-port
image: busybox
command: ['nc']
args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}']
restartPolicy: Never
charts/spire/values.yaml
+4 -75
View File
@@ -12,84 +12,13 @@ waitForIt:
k8s-workload-registrar: k8s-workload-registrar:
enabled: true enabled: true
server: spire-server:
replicaCount: 1 nameOverride: server
image: bundleConfigMap: &bundleConfigMap spire-bundle
# registry: gcr.io
# repository: spiffe-io/spire-server
registry: ghcr.io
repository: spiffe/spire-server
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 200m
# memory: 256Mi
# limits:
# cpu: 200m
# memory: 256Mi
dataStorage:
enabled: true
size: 1Gi
accessMode: ReadWriteOnce
storageClass: null
service:
type: ClusterIP
port: 8081
annotations: {}
podAnnotations: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
topologySpreadConstraints: []
config:
logLevel: info
socketPath: /run/spire/server-sockets/spire-server.sock
jwtIssuer: oidc-discovery.example.org
ca_subject:
country: NL
organization: Example
common_name: example.org
upstreamAuthority:
disk:
enabled: false
secret:
# -- If disabled requires you to create a secret with the given keys (certificate, key and optional bundle) yourself.
create: true
# -- If secret creation is disabled, the secret with this name will be used.
name: "spiffe-upstream-ca"
# -- If secret creation is enabled, will create a secret with following certificate info
data:
certificate: ""
key: ""
bundle: ""
spire-agent: spire-agent:
nameOverride: agent nameOverride: agent
bundleConfigMap: *bundleConfigMap
spiffe-oidc-discovery-provider: spiffe-oidc-discovery-provider:
enabled: false enabled: false