diff --git a/charts/spire/README.md b/charts/spire/README.md index b54bace..0089e98 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -54,15 +54,6 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| -| agent.config.logLevel | string | `"info"` | | -| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | -| agent.image.pullPolicy | string | `"IfNotPresent"` | | -| agent.image.registry | string | `"ghcr.io"` | | -| agent.image.repository | string | `"spiffe/spire-agent"` | | -| agent.image.version | string | `""` | | -| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | -| agent.resources | object | `{}` | | -| agent.service.annotations | object | `{}` | | | fullnameOverride | string | `""` | | | imagePullSecrets | list | `[]` | | | k8s-workload-registrar.enabled | bool | `true` | | @@ -99,6 +90,7 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | +| spire-agent.nameOverride | string | `"agent"` | | | spire.clusterName | string | `"example-cluster"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/spire/charts/spire-agent/.helmignore b/charts/spire/charts/spire-agent/.helmignore new file mode 100644 index 0000000..0e8a0eb --- /dev/null +++ b/charts/spire/charts/spire-agent/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml new file mode 100644 index 0000000..c15c5f5 --- /dev/null +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: spire-agent +description: A Helm chart to install the SPIRE agent. +type: application +version: 0.1.0 +appVersion: "1.5.3" diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md new file mode 100644 index 0000000..714e557 --- /dev/null +++ b/charts/spire/charts/spire-agent/README.md @@ -0,0 +1,38 @@ +# spire-agent + + + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square) + +A Helm chart to install the SPIRE agent. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| clusterName | string | `"example-cluster"` | | +| fullnameOverride | string | `""` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.registry | string | `"ghcr.io"` | | +| image.repository | string | `"spiffe/spire-agent"` | | +| image.version | string | `""` | | +| imagePullSecrets | list | `[]` | | +| logLevel | string | `"info"` | | +| nameOverride | string | `""` | | +| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | +| podAnnotations | object | `{}` | | +| podSecurityContext | object | `{}` | | +| resources | object | `{}` | | +| securityContext | object | `{}` | | +| server.host | string | `"spire-server"` | | +| server.port | int | `8081` | | +| serviceAccount.annotations | object | `{}` | | +| serviceAccount.create | bool | `true` | | +| serviceAccount.name | string | `""` | | +| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | | +| trustDomain | string | `"example.org"` | | +| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | +| waitForIt.image.registry | string | `"cgr.dev"` | | +| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | | +| waitForIt.image.version | string | `"latest-20221215"` | | +| waitForIt.resources | object | `{}` | | diff --git a/charts/spire/charts/spire-agent/templates/NOTES.txt b/charts/spire/charts/spire-agent/templates/NOTES.txt new file mode 100644 index 0000000..dfe3e24 --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/NOTES.txt @@ -0,0 +1 @@ +Installed {{ .Chart.Name }}… diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl new file mode 100644 index 0000000..5bb2ffe --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -0,0 +1,74 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "spire-agent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "spire-agent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "spire-agent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "spire-agent.labels" -}} +helm.sh/chart: {{ include "spire-agent.chart" . }} +{{ include "spire-agent.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "spire-agent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire-agent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "spire-agent.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "spire-agent.image" -}} +{{- if eq (substr 0 7 .image.version) "sha256:" -}} +{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}} +{{- else if .appVersion -}} +{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}} +{{- else if .image.version -}} +{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}} +{{- else -}} +{{- printf "%s/%s" .image.registry .image.repository -}} +{{- end -}} +{{- end }} diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml similarity index 68% rename from charts/spire/templates/agent-configmap.yaml rename to charts/spire/charts/spire-agent/templates/configmap.yaml index 7b348bb..54b2dfa 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -1,24 +1,24 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} data: agent.conf: | agent { data_dir = "/run/spire" - log_level = {{ .Values.agent.config.logLevel | quote }} - server_address = "{{ include "spire.fullname" . }}-server" - server_port = {{ .Values.server.service.port | quote }} - socket_path = {{ .Values.agent.config.socketPath | quote }} + log_level = {{ .Values.logLevel | quote }} + server_address = {{ .Values.server.host | quote }} + server_port = {{ .Values.server.port | quote }} + socket_path = {{ .Values.socketPath | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" - trust_domain = {{ .Values.spire.trustDomain | quote }} + trust_domain = {{ .Values.trustDomain | quote }} } plugins { NodeAttestor "k8s_psat" { plugin_data { - cluster = {{ .Values.spire.clusterName | quote }} + cluster = {{ .Values.clusterName | quote }} } } diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml similarity index 61% rename from charts/spire/templates/agent-daemonset.yaml rename to charts/spire/charts/spire-agent/templates/daemonset.yaml index 176e910..4aa7443 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -1,47 +1,47 @@ apiVersion: apps/v1 kind: DaemonSet metadata: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} labels: - {{- include "spire.agent.labels" . | nindent 4 }} + {{- include "spire-agent.labels" . | nindent 4 }} spec: selector: matchLabels: - {{- include "spire.agent.selectorLabels" . | nindent 6 }} - updateStrategy: - type: RollingUpdate + {{- include "spire-agent.selectorLabels" . | nindent 6 }} template: metadata: - {{- with .Values.agent.service.annotations }} + {{- with .Values.podAnnotations }} annotations: {{- toYaml . | nindent 8 }} {{- end }} labels: - {{- include "spire.agent.selectorLabels" . | nindent 8 }} + {{- include "spire-agent.selectorLabels" . | nindent 8 }} spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} hostPID: true hostNetwork: true dnsPolicy: ClusterFirstWithHostNet - serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + serviceAccountName: {{ include "spire-agent.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} initContainers: - name: init # This is a small image with wait-for-it, choose whatever image # you prefer that waits for a service to be up. This image is built # from https://github.com/vishnubob/wait-for-it - image: {{ template "spire.image" .Values.waitForIt }} + image: {{ template "spire-agent.image" .Values.waitForIt }} imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }} - args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"] + args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}] resources: {{- toYaml .Values.waitForIt.resources | nindent 12 }} - {{- with .Values.agent.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} containers: - - name: {{ .Chart.Name }}-agent - image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }} - imagePullPolicy: {{ .Values.agent.image.pullPolicy }} + - name: {{ .Chart.Name }} + image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }} + imagePullPolicy: {{ .Values.image.pullPolicy }} args: ["-config", "/run/spire/config/agent.conf"] volumeMounts: - name: spire-config @@ -51,7 +51,7 @@ spec: mountPath: /run/spire/bundle readOnly: true - name: spire-agent-socket-dir - mountPath: {{ dir .Values.agent.config.socketPath }} + mountPath: {{ dir .Values.socketPath }} readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens @@ -68,18 +68,18 @@ spec: initialDelaySeconds: 15 periodSeconds: 60 resources: - {{- toYaml .Values.agent.resources | nindent 12 }} + {{- toYaml .Values.resources | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} volumes: - name: spire-config configMap: - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: {{ include "spire.fullname" . }}-bundle - - name: spire-agent-sockets - hostPath: - path: {{ dir .Values.agent.config.socketPath }} - type: DirectoryOrCreate + name: spire-bundle - name: spire-token projected: sources: @@ -89,5 +89,5 @@ spec: audience: spire-server - name: spire-agent-socket-dir hostPath: - path: {{ dir .Values.agent.config.socketPath }} + path: {{ dir .Values.socketPath }} type: DirectoryOrCreate diff --git a/charts/spire/templates/agent-cluster-role.yaml b/charts/spire/charts/spire-agent/templates/roles.yaml similarity index 63% rename from charts/spire/templates/agent-cluster-role.yaml rename to charts/spire/charts/spire-agent/templates/roles.yaml index 298a655..8aa1c7e 100644 --- a/charts/spire/templates/agent-cluster-role.yaml +++ b/charts/spire/charts/spire-agent/templates/roles.yaml @@ -2,24 +2,26 @@ kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-agent-cluster-role + name: {{ include "spire-agent.fullname" . }} rules: - apiGroups: [""] - resources: ["pods", "nodes", "nodes/proxy"] + resources: + - pods + - nodes + - nodes/proxy verbs: ["get"] - --- # Binds above cluster role to spire-agent service account kind: ClusterRoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire.fullname" . }}-agent-cluster-role-binding + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount - name: {{ include "spire.fullname" . }}-agent + name: {{ include "spire-agent.fullname" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole - name: {{ include "spire.fullname" . }}-agent-cluster-role + name: {{ include "spire-agent.fullname" . }} apiGroup: rbac.authorization.k8s.io diff --git a/charts/spire/templates/agent-serviceaccount.yaml b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml similarity index 69% rename from charts/spire/templates/agent-serviceaccount.yaml rename to charts/spire/charts/spire-agent/templates/serviceaccount.yaml index 750f1da..8bbb3bb 100644 --- a/charts/spire/templates/agent-serviceaccount.yaml +++ b/charts/spire/charts/spire-agent/templates/serviceaccount.yaml @@ -2,10 +2,10 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "spire.serviceAccountName" . }}-agent + name: {{ include "spire-agent.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: - {{- include "spire.agent.labels" . | nindent 4 }} + {{- include "spire-agent.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml new file mode 100644 index 0000000..cf7ba0f --- /dev/null +++ b/charts/spire/charts/spire-agent/values.yaml @@ -0,0 +1,70 @@ +# Default values for spire-agent. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + # registry: gcr.io + # repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + +imagePullSecrets: [] +nameOverride: "" +fullnameOverride: "" + +serviceAccount: + # Specifies whether a service account should be created + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + +podAnnotations: {} + +podSecurityContext: {} + # fsGroup: 2000 + +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + +nodeSelector: + kubernetes.io/arch: amd64 + +logLevel: info +socketPath: /run/spire/agent-sockets/spire-agent.sock +clusterName: example-cluster +trustDomain: example.org + +server: + host: spire-server + port: 8081 + +waitForIt: + image: + registry: cgr.dev + repository: chainguard/wait-for-it + pullPolicy: IfNotPresent + version: latest-20221215 + resources: {} diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index 0fdd519..dbbbea3 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -70,26 +70,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-server app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} -{{/* -Common agent labels -*/}} -{{- define "spire.agent.labels" -}} -helm.sh/chart: {{ include "spire.chart" . }} -{{ include "spire.agent.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector agent labels -*/}} -{{- define "spire.agent.selectorLabels" -}} -app.kubernetes.io/name: {{ include "spire.name" . }}-agent -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - {{/* Common oidc labels */}} diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index c350e71..67e71b1 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -88,37 +88,8 @@ server: key: "" bundle: "" -agent: - image: - # registry: gcr.io - # repository: spiffe-io/spire-agent - registry: ghcr.io - repository: spiffe/spire-agent - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 64Mi - # limits: - # cpu: 100m - # memory: 128Mi - - service: - annotations: {} - - config: - logLevel: info - socketPath: /run/spire/agent-sockets/spire-agent.sock +spire-agent: + nameOverride: agent spiffe-oidc-discovery-provider: enabled: false