panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix gather hostcert edge case issues (#775)

Browse Source 
* Check each conditional of gather host cert in case a command to create the host cert fails

Signed-off-by: Daniel Schlatter <[email protected]>

* Change curl command to use --cacert in gather-host-cert init container

--capath is for directories. --cacert is the correct option for a single cert.

Signed-off-by: Daniel Schlatter <[email protected]>

---------

Signed-off-by: Daniel Schlatter <[email protected]>
This commit is contained in:
Daniel Schlatter
2026-03-29 16:13:20 +00:00
committed by GitHub
parent 9960e106eb
commit de59147fc5
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/templates/daemonset.yaml
+5 -3
View File
@@ -114,9 +114,11 @@ spec:
{{- else }}
if [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet-server-current.pem" ]; then
openssl x509 -in {{ printf "%s/kubelet-server-current.pem" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
fi
if [ ! -f /hostCert/kubelet.crt ] && [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
openssl x509 -in {{ printf "%s/kubelet.crt" .Values.workloadAttestors.k8s.verification.hostCert.basePath | quote }} -out /hostCert/kubelet.crt
else
fi
if [ ! -f /hostCert/kubelet.crt ]; then
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
{{- if $cbh }}
URL="https://$KUBELET_ADDR:10250/spec/"
@@ -129,7 +131,7 @@ spec:
{{- else }}
URL="https://localhost:10250/spec/"
{{- end }}
curl --capath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
curl --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
if [ $? -eq 0 ]; then
echo Mode detected as apiServerCA.
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt