panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move spire-agent to dedicated subchart

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:09 +01:00
committed by Marco Franssen
parent ab2636ae98
commit e312d42350
13 changed files with 258 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/.helmignore
+23
View File
@@ -0,0 +1,23 @@
# Patterns to ignore when building packages.
# This supports shell glob matching, relative path matching, and
# negation (prefixed with !). Only one pattern per line.
.DS_Store
# Common VCS dirs
.git/
.gitignore
.bzr/
.bzrignore
.hg/
.hgignore
.svn/
# Common backup files
*.swp
*.bak
*.tmp
*.orig
*~
# Various IDEs
.project
.idea/
*.tmproj
.vscode/
charts/spire/charts/spire-agent/Chart.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: v2
name: spire-agent
description: A Helm chart to install the SPIRE agent.
type: application
version: 0.1.0
appVersion: "1.5.3"
charts/spire/charts/spire-agent/README.md
+38
View File
@@ -0,0 +1,38 @@
# spire-agent
<!-- This README.md is generated. -->
![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square)
A Helm chart to install the SPIRE agent.
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| clusterName | string | `"example-cluster"` | |
| fullnameOverride | string | `""` | |
| image.pullPolicy | string | `"IfNotPresent"` | |
| image.registry | string | `"ghcr.io"` | |
| image.repository | string | `"spiffe/spire-agent"` | |
| image.version | string | `""` | |
| imagePullSecrets | list | `[]` | |
| logLevel | string | `"info"` | |
| nameOverride | string | `""` | |
| nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| podAnnotations | object | `{}` | |
| podSecurityContext | object | `{}` | |
| resources | object | `{}` | |
| securityContext | object | `{}` | |
| server.host | string | `"spire-server"` | |
| server.port | int | `8081` | |
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` | |
| trustDomain | string | `"example.org"` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
| waitForIt.image.registry | string | `"cgr.dev"` | |
| waitForIt.image.repository | string | `"chainguard/wait-for-it"` | |
| waitForIt.image.version | string | `"latest-20221215"` | |
| waitForIt.resources | object | `{}` | |
charts/spire/charts/spire-agent/templates/NOTES.txt
+1
View File
@@ -0,0 +1 @@
Installed {{ .Chart.Name }}…
charts/spire/charts/spire-agent/templates/_helpers.tpl
+74
View File
@@ -0,0 +1,74 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "spire-agent.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "spire-agent.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "spire-agent.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "spire-agent.labels" -}}
helm.sh/chart: {{ include "spire-agent.chart" . }}
{{ include "spire-agent.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "spire-agent.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire-agent.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "spire-agent.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "spire-agent.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+51
View File
@@ -0,0 +1,51 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-agent.fullname" . }}
namespace: {{ .Release.Namespace }}
data:
agent.conf: |
agent {
data_dir = "/run/spire"
log_level = {{ .Values.logLevel | quote }}
server_address = {{ .Values.server.host | quote }}
server_port = {{ .Values.server.port | quote }}
socket_path = {{ .Values.socketPath | quote }}
trust_bundle_path = "/run/spire/bundle/bundle.crt"
trust_domain = {{ .Values.trustDomain | quote }}
}
plugins {
NodeAttestor "k8s_psat" {
plugin_data {
cluster = {{ .Values.clusterName | quote }}
}
}
KeyManager "memory" {
plugin_data {
}
}
WorkloadAttestor "k8s" {
plugin_data {
# Defaults to the secure kubelet port by default.
# Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification = true
}
}
WorkloadAttestor "unix" {
plugin_data {
}
}
}
health_checks {
listener_enabled = true
bind_address = "0.0.0.0"
bind_port = "8080"
live_path = "/live"
ready_path = "/ready"
}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+93
View File
@@ -0,0 +1,93 @@
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: {{ include "spire-agent.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "spire-agent.labels" . | nindent 4 }}
spec:
selector:
matchLabels:
{{- include "spire-agent.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire-agent.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
hostPID: true
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
initContainers:
- name: init
# This is a small image with wait-for-it, choose whatever image
# you prefer that waits for a service to be up. This image is built
# from https://github.com/vishnubob/wait-for-it
image: {{ template "spire-agent.image" .Values.waitForIt }}
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}]
resources:
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
containers:
- name: {{ .Chart.Name }}
image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args: ["-config", "/run/spire/config/agent.conf"]
volumeMounts:
- name: spire-config
mountPath: /run/spire/config
readOnly: true
- name: spire-bundle
mountPath: /run/spire/bundle
readOnly: true
- name: spire-agent-socket-dir
mountPath: {{ dir .Values.socketPath }}
readOnly: false
- name: spire-token
mountPath: /var/run/secrets/tokens
livenessProbe:
httpGet:
path: /live
port: 8080
initialDelaySeconds: 15
periodSeconds: 60
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 15
periodSeconds: 60
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: spire-config
configMap:
name: {{ include "spire-agent.fullname" . }}
- name: spire-bundle
configMap:
name: spire-bundle
- name: spire-token
projected:
sources:
- serviceAccountToken:
path: spire-agent
expirationSeconds: 7200
audience: spire-server
- name: spire-agent-socket-dir
hostPath:
path: {{ dir .Values.socketPath }}
type: DirectoryOrCreate
charts/spire/charts/spire-agent/templates/roles.yaml
+27
View File
@@ -0,0 +1,27 @@
# Required cluster role to allow spire-agent to query k8s API server
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-agent.fullname" . }}
rules:
- apiGroups: [""]
resources:
- pods
- nodes
- nodes/proxy
verbs: ["get"]
---
# Binds above cluster role to spire-agent service account
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-agent.fullname" . }}
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire-agent.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ include "spire-agent.fullname" . }}
apiGroup: rbac.authorization.k8s.io
charts/spire/charts/spire-agent/templates/serviceaccount.yaml
+13
View File
@@ -0,0 +1,13 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-agent.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "spire-agent.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/values.yaml
+70
View File
@@ -0,0 +1,70 @@
# Default values for spire-agent.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
image:
# registry: gcr.io
# repository: spiffe-io/spire-agent
registry: ghcr.io
repository: spiffe/spire-agent
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
# Specifies whether a service account should be created
create: true
# Annotations to add to the service account
annotations: {}
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
podAnnotations: {}
podSecurityContext: {}
# fsGroup: 2000
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 64Mi
# limits:
# cpu: 100m
# memory: 128Mi
nodeSelector:
kubernetes.io/arch: amd64
logLevel: info
socketPath: /run/spire/agent-sockets/spire-agent.sock
clusterName: example-cluster
trustDomain: example.org
server:
host: spire-server
port: 8081
waitForIt:
image:
registry: cgr.dev
repository: chainguard/wait-for-it
pullPolicy: IfNotPresent
version: latest-20221215
resources: {}