External database configuration (#225)
This patch makes all the database settings configurable. fixes: https://github.com/spiffe/helm-charts/issues/37 --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Faisal Memon
Marco Franssen
Faisal Memon
Marco Franssen
parent
ce78bea121
commit
d3da3eed55
@@ -53,10 +53,14 @@ A Helm chart to install the SPIRE server.
|
||||
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.registry | string | `"cgr.dev"` | |
|
||||
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.repository | string | `"chainguard/kubectl"` | |
|
||||
| controllerManager.validatingWebhookConfiguration.upgradeHook.image.version | string | `"latest"` | |
|
||||
| dataStorage.accessMode | string | `"ReadWriteOnce"` | |
|
||||
| dataStorage.enabled | bool | `true` | |
|
||||
| dataStorage.size | string | `"1Gi"` | |
|
||||
| dataStorage.storageClass | string | `nil` | |
|
||||
| dataStore.sql.databaseName | string | `"spire"` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.databaseType | string | `"sqlite3"` | Other supported databases are "postgres" and "mysql" |
|
||||
| dataStore.sql.host | string | `""` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.options | list | `[]` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.password | string | `""` | Only used by "postgres" or "mysql" |
|
||||
| dataStore.sql.plugin_data | object | `{}` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section |
|
||||
| dataStore.sql.port | int | `0` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. |
|
||||
| dataStore.sql.username | string | `"spire"` | Only used by "postgres" or "mysql" |
|
||||
| defaultJwtSvidTTL | string | `"1h"` | |
|
||||
| defaultX509SvidTTL | string | `"4h"` | |
|
||||
| extraContainers | list | `[]` | |
|
||||
@@ -80,6 +84,10 @@ A Helm chart to install the SPIRE server.
|
||||
| nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | |
|
||||
| nodeSelector | object | `{}` | |
|
||||
| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace |
|
||||
| persistence.accessMode | string | `"ReadWriteOnce"` | |
|
||||
| persistence.enabled | bool | `true` | Enable persistence used by sqlite3 for spire-server, by the disk KeyStore, and/or by Tornjak. |
|
||||
| persistence.size | string | `"1Gi"` | |
|
||||
| persistence.storageClass | string | `nil` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. |
|
||||
|
||||
@@ -105,3 +105,51 @@ Create the name of the service account to use
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.config-mysql-query" }}
|
||||
{{- $lst := list }}
|
||||
{{- range . }}
|
||||
{{- range $key, $value := . }}
|
||||
{{- $eValue := toString $value }}
|
||||
{{- $entry := printf "%s=%s" (urlquery $key) (urlquery $eValue) }}
|
||||
{{- $lst = append $lst $entry }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if gt (len $lst) 0 }}
|
||||
{{- printf "?%s" (join "&" $lst) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.config-postgresql-options" }}
|
||||
{{- $lst := list }}
|
||||
{{- range . }}
|
||||
{{- range $key, $value := . }}
|
||||
{{- $eValue := toString $value }}
|
||||
{{- $entry := printf "%s=%s" $key $eValue }}
|
||||
{{- $lst = append $lst $entry }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if gt (len $lst) 0 }}
|
||||
{{- printf " %s" (join " " $lst) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.datastore-config" }}
|
||||
{{- $config := deepCopy .Values.dataStore.sql.plugin_data }}
|
||||
{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||
{{- $_ := set $config "database_type" "sqlite3" }}
|
||||
{{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }}
|
||||
{{- else if eq .Values.dataStore.sql.databaseType "mysql" }}
|
||||
{{- $_ := set $config "database_type" "mysql" }}
|
||||
{{- $port := int .Values.dataStore.sql.port | default 3306 }}
|
||||
{{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
|
||||
{{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
|
||||
{{- else if eq .Values.dataStore.sql.databaseType "postgres" }}
|
||||
{{- $_ := set $config "database_type" "postgres" }}
|
||||
{{- $port := int .Values.dataStore.sql.port | default 5432 }}
|
||||
{{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
|
||||
{{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }}
|
||||
{{- else }}
|
||||
{{- fail "Unsupported database type" }}
|
||||
{{- end }}
|
||||
{{- $config | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
@@ -33,8 +33,7 @@ plugins:
|
||||
DataStore:
|
||||
- sql:
|
||||
plugin_data:
|
||||
database_type: "sqlite3"
|
||||
connection_string: "/run/spire/data/datastore.sqlite3"
|
||||
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
||||
|
||||
{{- with .Values.nodeAttestor.k8sPsat }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" . }}-dbpw
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
data:
|
||||
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
|
||||
{{- end }}
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
{{- $configSum2 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
|
||||
{{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
|
||||
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
|
||||
{{- $fullname := include "spire-server.fullname" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
@@ -21,6 +22,7 @@ spec:
|
||||
annotations:
|
||||
checksum/config: {{ $configSum }}
|
||||
checksum/config2: {{ $configSum2 }}
|
||||
checksum/config3: {{ $configSum3 }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -46,11 +48,19 @@ spec:
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -expandEnv
|
||||
- -config
|
||||
- /run/spire/config/server.conf
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/opt/spire/bin:/bin"
|
||||
{{- if ne .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||
- name: DBPW
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-dbpw
|
||||
key: DBPW
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 8081
|
||||
@@ -91,7 +101,7 @@ spec:
|
||||
- name: spire-config
|
||||
mountPath: /run/spire/config
|
||||
readOnly: true
|
||||
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||
{{- if eq (.Values.persistence.enabled | toString) "true" }}
|
||||
- name: spire-data
|
||||
mountPath: /run/spire/data
|
||||
readOnly: false
|
||||
@@ -185,16 +195,16 @@ spec:
|
||||
{{- toYaml .Values.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
volumeClaimTemplates:
|
||||
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
|
||||
{{- if eq (.Values.persistence.enabled | toString) "true" }}
|
||||
- metadata:
|
||||
name: spire-data
|
||||
spec:
|
||||
accessModes:
|
||||
- {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
|
||||
- {{ .Values.persistence.accessMode | default "ReadWriteOnce" }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.dataStorage.size }}
|
||||
{{- if .Values.dataStorage.storageClass }}
|
||||
storageClassName: {{ .Values.dataStorage.storageClass }}
|
||||
storage: {{ .Values.persistence.size }}
|
||||
{{- if .Values.persistence.storageClass }}
|
||||
storageClassName: {{ .Values.persistence.storageClass }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
|
||||
@@ -73,12 +73,33 @@ affinity: {}
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
dataStorage:
|
||||
persistence:
|
||||
# -- Enable persistence used by sqlite3 for spire-server, by the disk KeyStore, and/or by Tornjak.
|
||||
enabled: true
|
||||
size: 1Gi
|
||||
accessMode: ReadWriteOnce
|
||||
storageClass: null
|
||||
|
||||
dataStore:
|
||||
sql:
|
||||
# -- Other supported databases are "postgres" and "mysql"
|
||||
databaseType: sqlite3
|
||||
# -- Only used by "postgres" or "mysql"
|
||||
databaseName: spire
|
||||
# -- Only used by "postgres" or "mysql"
|
||||
host: ""
|
||||
# -- If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
||||
port: 0
|
||||
# -- Only used by "postgres" or "mysql"
|
||||
username: spire
|
||||
# -- Only used by "postgres" or "mysql"
|
||||
password: ""
|
||||
# -- Only used by "postgres" or "mysql"
|
||||
options: []
|
||||
|
||||
# -- Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
||||
plugin_data: {}
|
||||
|
||||
logLevel: info
|
||||
jwtIssuer: oidc-discovery.example.org
|
||||
|
||||
|
||||
Reference in New Issue
Block a user