From de59147fc5f84d5fd1146e56278b8d42cd84335a Mon Sep 17 00:00:00 2001 From: Daniel Schlatter Date: Sun, 29 Mar 2026 09:13:20 -0700 Subject: [PATCH] fix gather hostcert edge case issues (#775) * Check each conditional of gather host cert in case a command to create the host cert fails Signed-off-by: Daniel Schlatter * Change curl command to use --cacert in gather-host-cert init container --capath is for directories. --cacert is the correct option for a single cert. Signed-off-by: Daniel Schlatter --------- Signed-off-by: Daniel Schlatter --- charts/spire/charts/spire-agent/templates/daemonset.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 83a194b..b1455d8 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -114,9 +114,11 @@ spec: {{- else }} if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt - elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then + fi + if [ ! -f /hostCert/kubelet.crt ] && [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt - else + fi + if [ ! -f /hostCert/kubelet.crt ]; then {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} {{- if $cbh }} URL="https://$KUBELET_ADDR:10250/spec/" @@ -129,7 +131,7 @@ spec: {{- else }} URL="https://localhost:10250/spec/" {{- end }} - curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" + curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" if [ $? -eq 0 ]; then echo Mode detected as apiServerCA. ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt