panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable agent to kubelet connection to use hostname (#112)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
kfox1111
2023-11-28 08:43:09 +01:00
committed by GitHub
co-authored by Marco Franssen
parent e68f6170a6
commit d936293d50
5 changed files with 104 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+2 -1
View File
@@ -26,7 +26,7 @@ A Helm chart to install the SPIRE agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -86,6 +86,7 @@ A Helm chart to install the SPIRE agent.
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `kubeletConnectByHostname` | If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` | | `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+13
View File
@@ -104,3 +104,16 @@ Create the name of the service account to use
{{- print .Values.socketPath }} {{- print .Values.socketPath }}
{{- end }} {{- end }}
{{- define "spire-agent.connect-by-hostname" -}}
{{- if ne .Values.kubeletConnectByHostname "" }}
{{- if eq (.Values.kubeletConnectByHostname | toString) "true" }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- else if (dig "openshift" false .Values.global) }}
{{- printf "true" }}
{{- else }}
{{- printf "false" }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+11 -2
View File
@@ -1,4 +1,5 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
@@ -71,9 +72,17 @@ spec:
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.image.pullPolicy }} imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"] args: ["-config", "/run/spire/config/agent.conf"]
{{- if gt (len .Values.extraEnvVars) 0 }} {{- if or (gt (len .Values.extraEnvVars) 0) $cbh }}
env: env:
{{- toYaml .Values.extraEnvVars | nindent 12 }} {{- if $cbh }}
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- end }}
{{- with .Values.extraEnvVars }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }} {{- end }}
ports: ports:
- containerPort: {{ .Values.healthChecks.port }} - containerPort: {{ .Values.healthChecks.port }}
charts/spire/charts/spire-agent/values.yaml
+3
View File
@@ -198,6 +198,9 @@ telemetry:
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring ## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {} labels: {}
## @param kubeletConnectByHostname If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise.
kubeletConnectByHostname: ""
## @param socketPath The unix socket path to the spire-agent ## @param socketPath The unix socket path to the spire-agent
socketPath: /run/spire/agent-sockets/spire-agent.sock socketPath: /run/spire/agent-sockets/spire-agent.sock
examples/openshift/openshift-values.yaml
-6
View File
@@ -27,12 +27,6 @@ spire-agent:
runAsUser: null runAsUser: null
runAsGroup: null runAsGroup: null
fsGroup: null fsGroup: null
# Talk from the agent to kubelet based on hostname instead of localhost
extraEnvVars:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
upstream-spire-agent: upstream-spire-agent:
podSecurityContext: podSecurityContext: