Add configurable hostNetwork parameter for spire-agent (#749)
* Add configurable hostNetwork parameter for spire-agent Adds `hostNetwork` as a configurable parameter in the spire-agent chart. We can now explicitly control whether the spire-agent daemonset uses host networking. Changes: * Updated daemonset template * Changed `dnsPolicy` logic to follow the computed `hostNetwork` instead of kubelet mode directly * Updated documentation Behaviour: If you leave `hostNetwork` empty (the default), it behaves like PR #705: * automatically disables when using hostname or hostip kubelet modes * automatically enables for localhost If you set it explicitly to `true` or `false`, that overrides the automatic behaviour. When `hostNetwork` is enabled and you haven't set a custom `dnsPolicy`, it defaults to `ClusterFirstWithHostNet`. Fixes #704 Signed-off-by: Rowan Ruseler <[email protected]> * Fix merge conflict, different default value for fsGroupFix.image.tag Signed-off-by: Rowan Ruseler <[email protected]> --------- Signed-off-by: Rowan Ruseler <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Rowan Ruseler
co-authored by
kfox1111
kfox1111
parent
982d53c200
commit
e849a1fbd6
@@ -26,7 +26,7 @@ A Helm chart to install the SPIRE agent.
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -118,7 +118,8 @@ A Helm chart to install the SPIRE agent.
|
||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
|
||||
| `dnsPolicy` | dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used. | `""` |
|
||||
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
|
||||
| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
|
||||
@@ -29,8 +29,12 @@
|
||||
{{- end }}
|
||||
{{- $resolvedMode := include "spire-agent.kubelet-address-mode-resolved" . }}
|
||||
{{- $cbh := or (eq $resolvedMode "hostname") (eq $resolvedMode "hostip") }}
|
||||
{{- $hostNetwork := not $cbh }}
|
||||
{{- if ne (.Values.hostNetwork | toString) "" }}
|
||||
{{- $hostNetwork = eq (.Values.hostNetwork | toString) "true" }}
|
||||
{{- end }}
|
||||
{{- $dnsPolicy := .Values.dnsPolicy }}
|
||||
{{- if (and (eq $dnsPolicy "") (not $cbh)) }}
|
||||
{{- if (and (eq $dnsPolicy "") $hostNetwork) }}
|
||||
{{- $dnsPolicy = "ClusterFirstWithHostNet" }}
|
||||
{{- end }}
|
||||
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||
@@ -80,7 +84,7 @@ spec:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
hostPID: true
|
||||
{{- if not $cbh }}
|
||||
{{- if $hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
{{- if ne $dnsPolicy "" }}
|
||||
|
||||
@@ -294,7 +294,9 @@ kubeletAddress:
|
||||
## provided at runtime or SPIRE agent will fail to start.
|
||||
mode: auto
|
||||
|
||||
## @param dnsPolicy [string] dnsPolicy to assign to the DaemonSet. See valid values here: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy. If left empty, ClusterFirstWithHostNet will be used if kubeletAddress.mode does not resolve to hostip or hostname, otherwise, the default dnsPolicy will be used.
|
||||
## @param hostNetwork [string] Enable hostNetwork for the DaemonSet. If empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override.
|
||||
hostNetwork: ""
|
||||
## @param dnsPolicy [string] DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy
|
||||
dnsPolicy: ""
|
||||
## @param socketPath The unix socket path to the spire-agent
|
||||
socketPath: /run/spire/agent-sockets/spire-agent.sock
|
||||
|
||||
Reference in New Issue
Block a user