From e9912ba39a5099f1d4ef60dbeba791227e85f7dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Batuhan=20Apayd=C4=B1n?= Date: Mon, 24 Oct 2022 20:54:56 +0300 Subject: [PATCH] Add spiffe-csi driver support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Batuhan Apaydın Co-authored-by: Furkan Türkal Signed-off-by: Batuhan Apaydın Signed-off-by: Marco Franssen --- charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 2 +- charts/spire/templates/agent-daemonset.yaml | 71 ++++++++++++++++++- .../spire/templates/server-cluster-role.yaml | 3 + charts/spire/templates/spiffe-csi-driver.yaml | 20 ++++++ 5 files changed, 95 insertions(+), 3 deletions(-) create mode 100644 charts/spire/templates/spiffe-csi-driver.yaml diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 9101842..0cddbf1 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -28,7 +28,7 @@ description: | ``` type: application version: 0.1.0 -appVersion: "1.0.2" +appVersion: "1.4.4" keywords: ["spiffe", "spire", "spire-server", "spire-agent"] home: https://github.com/philips-labs/helm-charts/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index f96aeac..84bd0a7 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.2](https://img.shields.io/badge/AppVersion-1.0.2-informational?style=flat-square) +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.4](https://img.shields.io/badge/AppVersion-1.4.4-informational?style=flat-square) A Helm chart for deploying spire-server and spire-agent. diff --git a/charts/spire/templates/agent-daemonset.yaml b/charts/spire/templates/agent-daemonset.yaml index ffa8616..ee3a443 100644 --- a/charts/spire/templates/agent-daemonset.yaml +++ b/charts/spire/templates/agent-daemonset.yaml @@ -38,7 +38,7 @@ spec: - name: spire-bundle mountPath: /run/spire/bundle readOnly: true - - name: spire-agent-sockets + - name: spire-agent-socket-dir mountPath: /run/spire/agent-sockets readOnly: false - name: spire-token @@ -55,6 +55,55 @@ spec: port: 8080 initialDelaySeconds: 15 periodSeconds: 60 + # This is the container which runs the SPIFFE CSI driver. + - name: spiffe-csi-driver + image: ghcr.io/spiffe/spiffe-csi-driver:nightly + imagePullPolicy: IfNotPresent + args: [ + "-workload-api-socket-dir", "/spire-agent-socket", + "-csi-socket-path", "/spiffe-csi/csi.sock", + ] + env: + # The CSI driver needs a unique node ID. The node name can be + # used for this purpose. + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + volumeMounts: + # The volume containing the SPIRE agent socket. The SPIFFE CSI + # driver will mount this directory into containers. + - mountPath: /spire-agent-socket + name: spire-agent-socket-dir + readOnly: true + # The volume that will contain the CSI driver socket shared + # with the kubelet and the driver registrar. + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The volume containing mount points for containers. + - mountPath: /var/lib/kubelet/pods + mountPropagation: Bidirectional + name: mountpoint-dir + securityContext: + privileged: true + # This container runs the CSI Node Driver Registrar which takes care + # of all the little details required to register a CSI driver with + # the kubelet. + - name: node-driver-registrar + image: quay.io/k8scsi/csi-node-driver-registrar:v2.0.1 + imagePullPolicy: IfNotPresent + args: [ + "-csi-address", "/spiffe-csi/csi.sock", + "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock", + ] + volumeMounts: + # The registrar needs access to the SPIFFE CSI driver socket + - mountPath: /spiffe-csi + name: spiffe-csi-socket-dir + # The registrar needs access to the Kubelet plugin registration + # directory + - name: kubelet-plugin-registration-dir + mountPath: /registration volumes: - name: spire-config configMap: @@ -73,3 +122,23 @@ spec: path: spire-agent expirationSeconds: 7200 audience: spire-server + - name: spire-agent-socket-dir + hostPath: + path: /run/spire/agent-sockets + type: DirectoryOrCreate + # This volume is where the socket for kubelet->driver communication lives + - name: spiffe-csi-socket-dir + hostPath: + path: /var/lib/kubelet/plugins/csi.spiffe.io + type: DirectoryOrCreate + # This volume is where the SPIFFE CSI driver mounts volumes + - name: mountpoint-dir + hostPath: + path: /var/lib/kubelet/pods + type: Directory + # This volume is where the node-driver-registrar registers the plugin + # with kubelet + - name: kubelet-plugin-registration-dir + hostPath: + path: /var/lib/kubelet/plugins_registry + type: Directory diff --git a/charts/spire/templates/server-cluster-role.yaml b/charts/spire/templates/server-cluster-role.yaml index 22b4996..db5793c 100644 --- a/charts/spire/templates/server-cluster-role.yaml +++ b/charts/spire/templates/server-cluster-role.yaml @@ -13,6 +13,9 @@ rules: - apiGroups: [""] resources: ["pods", "nodes"] verbs: ["get", "list", "watch"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create", "update", "delete", "get", "list", "watch"] --- # Binds above cluster role to spire-server service account diff --git a/charts/spire/templates/spiffe-csi-driver.yaml b/charts/spire/templates/spiffe-csi-driver.yaml new file mode 100644 index 0000000..e9d07bc --- /dev/null +++ b/charts/spire/templates/spiffe-csi-driver.yaml @@ -0,0 +1,20 @@ +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: "csi.spiffe.io" +spec: + # Only ephemeral, inline volumes are supported. There is no need for a + # controller to provision and attach volumes. + attachRequired: false + + # Request the pod information which the CSI driver uses to verify that an + # ephemeral mount was requested. + podInfoOnMount: true + + # Don't change ownership on the contents of the mount since the Workload API + # Unix Domain Socket is typically open to all (i.e. 0777). + fsGroupPolicy: None + + # Declare support for ephemeral volumes only. + volumeLifecycleModes: + - Ephemeral