Move spire-agent to dedicated subchart
Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
@@ -54,15 +54,6 @@ Kubernetes: `>=1.21.0-0`
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| agent.config.logLevel | string | `"info"` | |
|
||||
| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
|
||||
| agent.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| agent.image.registry | string | `"ghcr.io"` | |
|
||||
| agent.image.repository | string | `"spiffe/spire-agent"` | |
|
||||
| agent.image.version | string | `""` | |
|
||||
| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| agent.resources | object | `{}` | |
|
||||
| agent.service.annotations | object | `{}` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| k8s-workload-registrar.enabled | bool | `true` | |
|
||||
@@ -99,6 +90,7 @@ Kubernetes: `>=1.21.0-0`
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
|
||||
| spire-agent.nameOverride | string | `"agent"` | |
|
||||
| spire.clusterName | string | `"example-cluster"` | |
|
||||
| spire.trustDomain | string | `"example.org"` | |
|
||||
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.5.3"
|
||||
@@ -0,0 +1,38 @@
|
||||
# spire-agent
|
||||
|
||||
<!-- This README.md is generated. -->
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE agent.
|
||||
|
||||
## Values
|
||||
|
||||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| clusterName | string | `"example-cluster"` | |
|
||||
| fullnameOverride | string | `""` | |
|
||||
| image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| image.registry | string | `"ghcr.io"` | |
|
||||
| image.repository | string | `"spiffe/spire-agent"` | |
|
||||
| image.version | string | `""` | |
|
||||
| imagePullSecrets | list | `[]` | |
|
||||
| logLevel | string | `"info"` | |
|
||||
| nameOverride | string | `""` | |
|
||||
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
|
||||
| podAnnotations | object | `{}` | |
|
||||
| podSecurityContext | object | `{}` | |
|
||||
| resources | object | `{}` | |
|
||||
| securityContext | object | `{}` | |
|
||||
| server.host | string | `"spire-server"` | |
|
||||
| server.port | int | `8081` | |
|
||||
| serviceAccount.annotations | object | `{}` | |
|
||||
| serviceAccount.create | bool | `true` | |
|
||||
| serviceAccount.name | string | `""` | |
|
||||
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
|
||||
| trustDomain | string | `"example.org"` | |
|
||||
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| waitForIt.image.registry | string | `"cgr.dev"` | |
|
||||
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | |
|
||||
| waitForIt.image.version | string | `"latest-20221215"` | |
|
||||
| waitForIt.resources | object | `{}` | |
|
||||
@@ -0,0 +1 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
@@ -0,0 +1,74 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-agent.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-agent.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-agent.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-agent.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-agent.chart" . }}
|
||||
{{ include "spire-agent.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-agent.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-agent.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-agent.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-agent.image" -}}
|
||||
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
|
||||
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else if .appVersion -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
|
||||
{{- else if .image.version -}}
|
||||
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s" .image.registry .image.repository -}}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
+7
-7
@@ -1,24 +1,24 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-agent
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
agent.conf: |
|
||||
agent {
|
||||
data_dir = "/run/spire"
|
||||
log_level = {{ .Values.agent.config.logLevel | quote }}
|
||||
server_address = "{{ include "spire.fullname" . }}-server"
|
||||
server_port = {{ .Values.server.service.port | quote }}
|
||||
socket_path = {{ .Values.agent.config.socketPath | quote }}
|
||||
log_level = {{ .Values.logLevel | quote }}
|
||||
server_address = {{ .Values.server.host | quote }}
|
||||
server_port = {{ .Values.server.port | quote }}
|
||||
socket_path = {{ .Values.socketPath | quote }}
|
||||
trust_bundle_path = "/run/spire/bundle/bundle.crt"
|
||||
trust_domain = {{ .Values.spire.trustDomain | quote }}
|
||||
trust_domain = {{ .Values.trustDomain | quote }}
|
||||
}
|
||||
|
||||
plugins {
|
||||
NodeAttestor "k8s_psat" {
|
||||
plugin_data {
|
||||
cluster = {{ .Values.spire.clusterName | quote }}
|
||||
cluster = {{ .Values.clusterName | quote }}
|
||||
}
|
||||
}
|
||||
|
||||
+26
-26
@@ -1,47 +1,47 @@
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-agent
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire.agent.labels" . | nindent 4 }}
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire.agent.selectorLabels" . | nindent 6 }}
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.agent.service.annotations }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire.agent.selectorLabels" . | nindent 8 }}
|
||||
{{- include "spire-agent.selectorLabels" . | nindent 8 }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostPID: true
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
|
||||
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: init
|
||||
# This is a small image with wait-for-it, choose whatever image
|
||||
# you prefer that waits for a service to be up. This image is built
|
||||
# from https://github.com/vishnubob/wait-for-it
|
||||
image: {{ template "spire.image" .Values.waitForIt }}
|
||||
image: {{ template "spire-agent.image" .Values.waitForIt }}
|
||||
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
|
||||
args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
|
||||
args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}]
|
||||
resources:
|
||||
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
||||
{{- with .Values.agent.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-agent
|
||||
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
|
||||
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
|
||||
- name: {{ .Chart.Name }}
|
||||
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args: ["-config", "/run/spire/config/agent.conf"]
|
||||
volumeMounts:
|
||||
- name: spire-config
|
||||
@@ -51,7 +51,7 @@ spec:
|
||||
mountPath: /run/spire/bundle
|
||||
readOnly: true
|
||||
- name: spire-agent-socket-dir
|
||||
mountPath: {{ dir .Values.agent.config.socketPath }}
|
||||
mountPath: {{ dir .Values.socketPath }}
|
||||
readOnly: false
|
||||
- name: spire-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
@@ -68,18 +68,18 @@ spec:
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 60
|
||||
resources:
|
||||
{{- toYaml .Values.agent.resources | nindent 12 }}
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: {{ include "spire.fullname" . }}-agent
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
- name: spire-bundle
|
||||
configMap:
|
||||
name: {{ include "spire.fullname" . }}-bundle
|
||||
- name: spire-agent-sockets
|
||||
hostPath:
|
||||
path: {{ dir .Values.agent.config.socketPath }}
|
||||
type: DirectoryOrCreate
|
||||
name: spire-bundle
|
||||
- name: spire-token
|
||||
projected:
|
||||
sources:
|
||||
@@ -89,5 +89,5 @@ spec:
|
||||
audience: spire-server
|
||||
- name: spire-agent-socket-dir
|
||||
hostPath:
|
||||
path: {{ dir .Values.agent.config.socketPath }}
|
||||
path: {{ dir .Values.socketPath }}
|
||||
type: DirectoryOrCreate
|
||||
+8
-6
@@ -2,24 +2,26 @@
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-agent-cluster-role
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes", "nodes/proxy"]
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
- nodes/proxy
|
||||
verbs: ["get"]
|
||||
|
||||
---
|
||||
# Binds above cluster role to spire-agent service account
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire.fullname" . }}-agent-cluster-role-binding
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire.fullname" . }}-agent
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire.fullname" . }}-agent-cluster-role
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
+2
-2
@@ -2,10 +2,10 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire.serviceAccountName" . }}-agent
|
||||
name: {{ include "spire-agent.serviceAccountName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "spire.agent.labels" . | nindent 4 }}
|
||||
{{- include "spire-agent.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
@@ -0,0 +1,70 @@
|
||||
# Default values for spire-agent.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
image:
|
||||
# registry: gcr.io
|
||||
# repository: spiffe-io/spire-agent
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-agent
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: ""
|
||||
|
||||
imagePullSecrets: []
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# Annotations to add to the service account
|
||||
annotations: {}
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
name: ""
|
||||
|
||||
podAnnotations: {}
|
||||
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
logLevel: info
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
clusterName: example-cluster
|
||||
trustDomain: example.org
|
||||
|
||||
server:
|
||||
host: spire-server
|
||||
port: 8081
|
||||
|
||||
waitForIt:
|
||||
image:
|
||||
registry: cgr.dev
|
||||
repository: chainguard/wait-for-it
|
||||
pullPolicy: IfNotPresent
|
||||
version: latest-20221215
|
||||
resources: {}
|
||||
@@ -70,26 +70,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-server
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common agent labels
|
||||
*/}}
|
||||
{{- define "spire.agent.labels" -}}
|
||||
helm.sh/chart: {{ include "spire.chart" . }}
|
||||
{{ include "spire.agent.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector agent labels
|
||||
*/}}
|
||||
{{- define "spire.agent.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire.name" . }}-agent
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common oidc labels
|
||||
*/}}
|
||||
|
||||
@@ -88,37 +88,8 @@ server:
|
||||
key: ""
|
||||
bundle: ""
|
||||
|
||||
agent:
|
||||
image:
|
||||
# registry: gcr.io
|
||||
# repository: spiffe-io/spire-agent
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-agent
|
||||
pullPolicy: IfNotPresent
|
||||
# Overrides the image tag whose default is the chart appVersion.
|
||||
version: ""
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/arch: amd64
|
||||
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 64Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
service:
|
||||
annotations: {}
|
||||
|
||||
config:
|
||||
logLevel: info
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
spire-agent:
|
||||
nameOverride: agent
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
|
||||
Reference in New Issue
Block a user