Move spire-agent to dedicated subchart

Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
2023-02-18 13:04:09 +01:00
parent ab2636ae98
commit e312d42350
13 changed files with 258 additions and 101 deletions
@@ -70,26 +70,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-server
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}

-{{/*
-Common agent labels
-*/}}
-{{- define "spire.agent.labels" -}}
-helm.sh/chart: {{ include "spire.chart" . }}
-{{ include "spire.agent.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector agent labels
-*/}}
-{{- define "spire.agent.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "spire.name" . }}-agent
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
 {{/*
 Common oidc labels
 */}}
@@ -1,25 +0,0 @@
-# Required cluster role to allow spire-agent to query k8s API server
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-agent-cluster-role
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "nodes", "nodes/proxy"]
-    verbs: ["get"]
-
---
-# Binds above cluster role to spire-agent service account
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: {{ include "spire.fullname" . }}-agent-cluster-role-binding
-  namespace: {{ .Release.Namespace }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "spire.fullname" . }}-agent
-    namespace: {{ .Release.Namespace }}
-roleRef:
-  kind: ClusterRole
-  name: {{ include "spire.fullname" . }}-agent-cluster-role
-  apiGroup: rbac.authorization.k8s.io
@@ -1,51 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "spire.fullname" . }}-agent
-  namespace: {{ .Release.Namespace }}
-data:
-  agent.conf: |
-    agent {
-      data_dir = "/run/spire"
-      log_level = {{ .Values.agent.config.logLevel | quote }}
-      server_address = "{{ include "spire.fullname" . }}-server"
-      server_port = {{ .Values.server.service.port | quote }}
-      socket_path = {{ .Values.agent.config.socketPath | quote }}
-      trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ .Values.spire.trustDomain | quote }}
-    }
-
-    plugins {
-      NodeAttestor "k8s_psat" {
-        plugin_data {
-          cluster = {{ .Values.spire.clusterName | quote }}
-        }
-      }
-
-      KeyManager "memory" {
-        plugin_data {
-        }
-      }
-
-      WorkloadAttestor "k8s" {
-        plugin_data {
-          # Defaults to the secure kubelet port by default.
-          # Minikube does not have a cert in the cluster CA bundle that
-          # can authenticate the kubelet cert, so skip validation.
-          skip_kubelet_verification = true
-        }
-      }
-
-      WorkloadAttestor "unix" {
-          plugin_data {
-          }
-      }
-    }
-
-    health_checks {
-      listener_enabled = true
-      bind_address = "0.0.0.0"
-      bind_port = "8080"
-      live_path = "/live"
-      ready_path = "/ready"
-    }
@@ -1,93 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: {{ include "spire.fullname" . }}-agent
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "spire.agent.labels" . | nindent 4 }}
-spec:
-  selector:
-    matchLabels:
-      {{- include "spire.agent.selectorLabels" . | nindent 6 }}
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      {{- with .Values.agent.service.annotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "spire.agent.selectorLabels" . | nindent 8 }}
-    spec:
-      hostPID: true
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
-      initContainers:
-        - name: init
-          # This is a small image with wait-for-it, choose whatever image
-          # you prefer that waits for a service to be up. This image is built
-          # from https://github.com/vishnubob/wait-for-it
-          image: {{ template "spire.image" .Values.waitForIt }}
-          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
-          args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
-          resources:
-            {{- toYaml .Values.waitForIt.resources | nindent 12 }}
-      {{- with .Values.agent.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: {{ .Chart.Name }}-agent
-          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
-          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
-          args: ["-config", "/run/spire/config/agent.conf"]
-          volumeMounts:
-            - name: spire-config
-              mountPath: /run/spire/config
-              readOnly: true
-            - name: spire-bundle
-              mountPath: /run/spire/bundle
-              readOnly: true
-            - name: spire-agent-socket-dir
-              mountPath: {{ dir .Values.agent.config.socketPath }}
-              readOnly: false
-            - name: spire-token
-              mountPath: /var/run/secrets/tokens
-          livenessProbe:
-            httpGet:
-              path: /live
-              port: 8080
-            initialDelaySeconds: 15
-            periodSeconds: 60
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8080
-            initialDelaySeconds: 15
-            periodSeconds: 60
-          resources:
-            {{- toYaml .Values.agent.resources | nindent 12 }}
-      volumes:
-        - name: spire-config
-          configMap:
-            name: {{ include "spire.fullname" . }}-agent
-        - name: spire-bundle
-          configMap:
-            name: {{ include "spire.fullname" . }}-bundle
-        - name: spire-agent-sockets
-          hostPath:
-            path: {{ dir .Values.agent.config.socketPath }}
-            type: DirectoryOrCreate
-        - name: spire-token
-          projected:
-            sources:
-            - serviceAccountToken:
-                path: spire-agent
-                expirationSeconds: 7200
-                audience: spire-server
-        - name: spire-agent-socket-dir
-          hostPath:
-            path: {{ dir .Values.agent.config.socketPath }}
-            type: DirectoryOrCreate
@@ -1,13 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "spire.serviceAccountName" . }}-agent
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "spire.agent.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}