From d418ee16f8e30f271ca4fc1c7f0c102faaba78d9 Mon Sep 17 00:00:00 2001 From: Faisal Memon Date: Wed, 27 Mar 2024 11:55:22 -0700 Subject: [PATCH] Update to SPIRE 1.9.2, use retry_bootstrap, remove wait for it (#301) * Update to SPIRE 1.9.2, use retry_bootstrap, remove wait for it Signed-off-by: Faisal Memon * Remove waitfor it in values.yaml Signed-off-by: Faisal Memon * Update docs Signed-off-by: Faisal Memon * Remove wait for it from images.json Signed-off-by: Faisal Memon --------- Signed-off-by: Faisal Memon --- .github/tests/images.json | 5 ----- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 5 ----- .../charts/spire-agent/templates/configmap.yaml | 1 + .../charts/spire-agent/templates/daemonset.yaml | 11 ----------- charts/spire/charts/spire-agent/values.yaml | 15 --------------- charts/spire/charts/spire-server/Chart.yaml | 2 +- 9 files changed, 5 insertions(+), 40 deletions(-) diff --git a/.github/tests/images.json b/.github/tests/images.json index 12863b5..3baf2e1 100644 --- a/.github/tests/images.json +++ b/.github/tests/images.json @@ -7,11 +7,6 @@ } ], "spire-agent/values.yaml": [ - { - "query": "waitForIt.image", - "filter": "LATESTSHA", - "sort-flags": [] - }, { "query": "socketAlternate.image", "filter": "LATESTSHA", diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index f1bb437..2945c75 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.19.0 -appVersion: "1.9.1" +appVersion: "1.9.2" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index be050e8..2bdfce6 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.1](https://img.shields.io/badge/AppVersion-1.9.1-informational?style=flat-square) +![Version: 0.19.0](https://img.shields.io/badge/Version-0.19.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.9.2](https://img.shields.io/badge/AppVersion-1.9.2-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 98cf207..c1b7811 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.9.1" +appVersion: "1.9.2" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 7affe9e..1fff201 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -66,11 +66,6 @@ A Helm chart to install the SPIRE agent. | `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | | `readinessProbe.periodSeconds` | Period seconds for probe | `30` | -| `waitForIt.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `waitForIt.image.repository` | The repository within the registry | `chainguard/wait-for-it` | -| `waitForIt.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `waitForIt.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:69602d705d17142dd4524da6929e80a8e33c61709ce9e7e8e4e0b1fcd14a1467` | -| `waitForIt.resources` | Resource requests and limits | `{}` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 4de965b..215bee6 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -37,6 +37,7 @@ agent: {{- end }} data_dir: "/run/spire" log_level: {{ .Values.logLevel | quote }} + retry_bootstrap: true server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_port: {{ .Values.server.port | quote }} socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index db8fe9d..3a78554 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -115,17 +115,6 @@ spec: mountPath: /tpm imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.plugin.image.pullPolicy }} {{- end }} - - name: init - # This is a small image with wait-for-it, choose whatever image - # you prefer that waits for a service to be up. This image is built - # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }} - imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}] - resources: - {{- toYaml .Values.waitForIt.resources | nindent 12 }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} {{- if gt (len $socketAlternateNames) 0 }} - name: ensure-alternate-names image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 81f7556..9253e7a 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -140,21 +140,6 @@ readinessProbe: initialDelaySeconds: 10 periodSeconds: 30 -waitForIt: - ## @param waitForIt.image.registry The OCI registry to pull the image from - ## @param waitForIt.image.repository The repository within the registry - ## @param waitForIt.image.pullPolicy The image pull policy - ## @param waitForIt.image.tag Overrides the image tag whose default is the chart appVersion - ## - image: - registry: cgr.dev - repository: chainguard/wait-for-it - pullPolicy: IfNotPresent - tag: latest@sha256:69602d705d17142dd4524da6929e80a8e33c61709ce9e7e8e4e0b1fcd14a1467 - - ## @param waitForIt.resources [object] Resource requests and limits - resources: {} - # When running as non root, needed to ensure the socket path has the correct permissions. # Set runAsUser to a non-zero value in podSecurityContext to run as non-root user. fsGroupFix: diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 8cdb056..ec9c217 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.9.1" +appVersion: "1.9.2" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: