Move spire-agent to dedicated subchart

Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>

charts/spire/README.md

@@ -54,15 +54,6 @@ Kubernetes: `>=1.21.0-0`
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
-| agent.config.logLevel | string | `"info"` |  |
-| agent.config.socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
-| agent.image.pullPolicy | string | `"IfNotPresent"` |  |
-| agent.image.registry | string | `"ghcr.io"` |  |
-| agent.image.repository | string | `"spiffe/spire-agent"` |  |
-| agent.image.version | string | `""` |  |
-| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
-| agent.resources | object | `{}` |  |
-| agent.service.annotations | object | `{}` |  |
 | fullnameOverride | string | `""` |  |
 | imagePullSecrets | list | `[]` |  |
 | k8s-workload-registrar.enabled | bool | `true` |  |
@@ -99,6 +90,7 @@ Kubernetes: `>=1.21.0-0`
 | serviceAccount.create | bool | `true` |  |
 | serviceAccount.name | string | `""` |  |
 | spiffe-oidc-discovery-provider.enabled | bool | `false` |  |
+| spire-agent.nameOverride | string | `"agent"` |  |
 | spire.clusterName | string | `"example-cluster"` |  |
 | spire.trustDomain | string | `"example.org"` |  |
 | waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |

charts/spire/charts/spire-agent/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/spire/charts/spire-agent/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: spire-agent
+description: A Helm chart to install the SPIRE agent.
+type: application
+version: 0.1.0
+appVersion: "1.5.3"

charts/spire/charts/spire-agent/README.md

@@ -0,0 +1,38 @@
+# spire-agent
+
+<!-- This README.md is generated. -->
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.3](https://img.shields.io/badge/AppVersion-1.5.3-informational?style=flat-square)
+
+A Helm chart to install the SPIRE agent.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| clusterName | string | `"example-cluster"` |  |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.registry | string | `"ghcr.io"` |  |
+| image.repository | string | `"spiffe/spire-agent"` |  |
+| image.version | string | `""` |  |
+| imagePullSecrets | list | `[]` |  |
+| logLevel | string | `"info"` |  |
+| nameOverride | string | `""` |  |
+| nodeSelector."kubernetes.io/arch" | string | `"amd64"` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext | object | `{}` |  |
+| resources | object | `{}` |  |
+| securityContext | object | `{}` |  |
+| server.host | string | `"spire-server"` |  |
+| server.port | int | `8081` |  |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| socketPath | string | `"/run/spire/agent-sockets/spire-agent.sock"` |  |
+| trustDomain | string | `"example.org"` |  |
+| waitForIt.image.pullPolicy | string | `"IfNotPresent"` |  |
+| waitForIt.image.registry | string | `"cgr.dev"` |  |
+| waitForIt.image.repository | string | `"chainguard/wait-for-it"` |  |
+| waitForIt.image.version | string | `"latest-20221215"` |  |
+| waitForIt.resources | object | `{}` |  |

charts/spire/charts/spire-agent/templates/NOTES.txt

@@ -0,0 +1 @@
+Installed {{ .Chart.Name }}…

charts/spire/charts/spire-agent/templates/_helpers.tpl

@@ -0,0 +1,74 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "spire-agent.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "spire-agent.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "spire-agent.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "spire-agent.labels" -}}
+helm.sh/chart: {{ include "spire-agent.chart" . }}
+{{ include "spire-agent.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "spire-agent.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "spire-agent.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "spire-agent.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "spire-agent.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "spire-agent.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}

charts/spire/charts/spire-agent/templates/configmap.yaml

@@ -1,24 +1,24 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "spire.fullname" . }}-agent
+  name: {{ include "spire-agent.fullname" . }}
   namespace: {{ .Release.Namespace }}
 data:
   agent.conf: |
     agent {
       data_dir = "/run/spire"
-      log_level = {{ .Values.agent.config.logLevel | quote }}
+      log_level = {{ .Values.logLevel | quote }}
-      server_address = "{{ include "spire.fullname" . }}-server"
+      server_address = {{ .Values.server.host | quote }}
-      server_port = {{ .Values.server.service.port | quote }}
+      server_port = {{ .Values.server.port | quote }}
-      socket_path = {{ .Values.agent.config.socketPath | quote }}
+      socket_path = {{ .Values.socketPath | quote }}
       trust_bundle_path = "/run/spire/bundle/bundle.crt"
-      trust_domain = {{ .Values.spire.trustDomain | quote }}
+      trust_domain = {{ .Values.trustDomain | quote }}
     }
 
     plugins {
       NodeAttestor "k8s_psat" {
         plugin_data {
-          cluster = {{ .Values.spire.clusterName | quote }}
+          cluster = {{ .Values.clusterName | quote }}
         }
       }
 

charts/spire/charts/spire-agent/templates/daemonset.yaml

@@ -1,47 +1,47 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: {{ include "spire.fullname" . }}-agent
+  name: {{ include "spire-agent.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    {{- include "spire.agent.labels" . | nindent 4 }}
+    {{- include "spire-agent.labels" . | nindent 4 }}
 spec:
   selector:
     matchLabels:
-      {{- include "spire.agent.selectorLabels" . | nindent 6 }}
+      {{- include "spire-agent.selectorLabels" . | nindent 6 }}
-  updateStrategy:
-    type: RollingUpdate
   template:
     metadata:
-      {{- with .Values.agent.service.annotations }}
+      {{- with .Values.podAnnotations }}
       annotations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       labels:
-        {{- include "spire.agent.selectorLabels" . | nindent 8 }}
+        {{- include "spire-agent.selectorLabels" . | nindent 8 }}
     spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       hostPID: true
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
-      serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
+      serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
       initContainers:
         - name: init
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/vishnubob/wait-for-it
-          image: {{ template "spire.image" .Values.waitForIt }}
+          image: {{ template "spire-agent.image" .Values.waitForIt }}
           imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
-          args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
+          args: ["-t", "30", "-h", {{ .Values.server.host | quote }}, "-p", {{ .Values.server.port | quote }}]
           resources:
             {{- toYaml .Values.waitForIt.resources | nindent 12 }}
-      {{- with .Values.agent.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
-        - name: {{ .Chart.Name }}-agent
+        - name: {{ .Chart.Name }}
-          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
+          image: {{ template "spire-agent.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
-          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           volumeMounts:
             - name: spire-config
@@ -51,7 +51,7 @@ spec:
               mountPath: /run/spire/bundle
               readOnly: true
             - name: spire-agent-socket-dir
-              mountPath: {{ dir .Values.agent.config.socketPath }}
+              mountPath: {{ dir .Values.socketPath }}
               readOnly: false
             - name: spire-token
               mountPath: /var/run/secrets/tokens
@@ -68,18 +68,18 @@ spec:
             initialDelaySeconds: 15
             periodSeconds: 60
           resources:
-            {{- toYaml .Values.agent.resources | nindent 12 }}
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       volumes:
         - name: spire-config
           configMap:
-            name: {{ include "spire.fullname" . }}-agent
+            name: {{ include "spire-agent.fullname" . }}
         - name: spire-bundle
           configMap:
-            name: {{ include "spire.fullname" . }}-bundle
+            name: spire-bundle
-        - name: spire-agent-sockets
-          hostPath:
-            path: {{ dir .Values.agent.config.socketPath }}
-            type: DirectoryOrCreate
         - name: spire-token
           projected:
             sources:
@@ -89,5 +89,5 @@ spec:
                 audience: spire-server
         - name: spire-agent-socket-dir
           hostPath:
-            path: {{ dir .Values.agent.config.socketPath }}
+            path: {{ dir .Values.socketPath }}
             type: DirectoryOrCreate

charts/spire/charts/spire-agent/templates/roles.yaml

@@ -2,24 +2,26 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "spire.fullname" . }}-agent-cluster-role
+  name: {{ include "spire-agent.fullname" . }}
 rules:
   - apiGroups: [""]
-    resources: ["pods", "nodes", "nodes/proxy"]
+    resources:
+      - pods
+      - nodes
+      - nodes/proxy
     verbs: ["get"]
-
 ---
 # Binds above cluster role to spire-agent service account
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: {{ include "spire.fullname" . }}-agent-cluster-role-binding
+  name: {{ include "spire-agent.fullname" . }}
   namespace: {{ .Release.Namespace }}
 subjects:
   - kind: ServiceAccount
-    name: {{ include "spire.fullname" . }}-agent
+    name: {{ include "spire-agent.fullname" . }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: {{ include "spire.fullname" . }}-agent-cluster-role
+  name: {{ include "spire-agent.fullname" . }}
   apiGroup: rbac.authorization.k8s.io

charts/spire/charts/spire-agent/templates/serviceaccount.yaml

@@ -2,10 +2,10 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "spire.serviceAccountName" . }}-agent
+  name: {{ include "spire-agent.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
-    {{- include "spire.agent.labels" . | nindent 4 }}
+    {{- include "spire-agent.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/spire/charts/spire-agent/values.yaml

@@ -0,0 +1,70 @@
+# Default values for spire-agent.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+image:
+  # registry: gcr.io
+  # repository: spiffe-io/spire-agent
+  registry: ghcr.io
+  repository: spiffe/spire-agent
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  version: ""
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+  # fsGroup: 2000
+
+securityContext: {}
+  # capabilities:
+  #   drop:
+  #   - ALL
+  # readOnlyRootFilesystem: true
+  # runAsNonRoot: true
+  # runAsUser: 1000
+
+resources: {}
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  # requests:
+  #   cpu: 50m
+  #   memory: 64Mi
+  # limits:
+  #   cpu: 100m
+  #   memory: 128Mi
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+logLevel: info
+socketPath: /run/spire/agent-sockets/spire-agent.sock
+clusterName: example-cluster
+trustDomain: example.org
+
+server:
+  host: spire-server
+  port: 8081
+
+waitForIt:
+  image:
+    registry: cgr.dev
+    repository: chainguard/wait-for-it
+    pullPolicy: IfNotPresent
+    version: latest-20221215
+  resources: {}

charts/spire/templates/_helpers.tpl

@@ -70,26 +70,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-server
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
-{{/*
-Common agent labels
-*/}}
-{{- define "spire.agent.labels" -}}
-helm.sh/chart: {{ include "spire.chart" . }}
-{{ include "spire.agent.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector agent labels
-*/}}
-{{- define "spire.agent.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "spire.name" . }}-agent
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
 {{/*
 Common oidc labels
 */}}

charts/spire/values.yaml

@@ -88,37 +88,8 @@ server:
             key: ""
             bundle: ""
 
-agent:
+spire-agent:
-  image:
+  nameOverride: agent
-    # registry: gcr.io
-    # repository: spiffe-io/spire-agent
-    registry: ghcr.io
-    repository: spiffe/spire-agent
-    pullPolicy: IfNotPresent
-    # Overrides the image tag whose default is the chart appVersion.
-    version: ""
-
-  nodeSelector:
-    kubernetes.io/arch: amd64
-
-  resources: {}
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    # requests:
-    #   cpu: 50m
-    #   memory: 64Mi
-    # limits:
-    #   cpu: 100m
-    #   memory: 128Mi
-
-  service:
-    annotations: {}
-
-  config:
-    logLevel: info
-    socketPath: /run/spire/agent-sockets/spire-agent.sock
 
 spiffe-oidc-discovery-provider:
   enabled: false