From f2d7aa1f62159ca6ac04371d8f3c379ed5c555f7 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Mon, 26 Jul 2021 10:33:51 +0200 Subject: [PATCH] Run oidc discovery provider as separate pod using workload api Signed-off-by: Marco Franssen --- charts/spire/templates/_helpers.tpl | 20 +++++ charts/spire/templates/oidc-deployment.yaml | 86 +++++++++++++++++++ charts/spire/templates/oidc-dp-configmap.yaml | 5 +- charts/spire/templates/oidc-service.yaml | 6 +- .../spire/templates/server-statefulset.yaml | 35 -------- 5 files changed, 112 insertions(+), 40 deletions(-) create mode 100644 charts/spire/templates/oidc-deployment.yaml diff --git a/charts/spire/templates/_helpers.tpl b/charts/spire/templates/_helpers.tpl index c80282a..97fcee0 100644 --- a/charts/spire/templates/_helpers.tpl +++ b/charts/spire/templates/_helpers.tpl @@ -90,6 +90,26 @@ app.kubernetes.io/name: {{ include "spire.name" . }}-agent app.kubernetes.io/instance: {{ .Release.Name }} {{- end }} +{{/* +Common oidc labels +*/}} +{{- define "spire.oidc.labels" -}} +helm.sh/chart: {{ include "spire.chart" . }} +{{ include "spire.oidc.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector oidc labels +*/}} +{{- define "spire.oidc.selectorLabels" -}} +app.kubernetes.io/name: {{ include "spire.name" . }}-oidc +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + {{/* Create the name of the service account to use */}} diff --git a/charts/spire/templates/oidc-deployment.yaml b/charts/spire/templates/oidc-deployment.yaml new file mode 100644 index 0000000..97f8bfb --- /dev/null +++ b/charts/spire/templates/oidc-deployment.yaml @@ -0,0 +1,86 @@ +{{- if eq (.Values.oidc.enabled | toString) "true" }} +{{- $fullname := include "spire.fullname" . }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ printf "%s-oidc" $fullname }} + labels: + {{- include "spire.oidc.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "spire.oidc.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "spire.oidc.selectorLabels" . | nindent 8 }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- range . }} + - name: {{ printf "%s-%s" $fullname .name }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: spire-oidc + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} + args: + - -config + - /run/spire/oidc/config/oidc-discovery-provider.conf + ports: + - containerPort: {{ .Values.oidc.service.port }} + name: http + - containerPort: 443 + name: https + volumeMounts: + - name: spire-agent-socket + mountPath: {{ include "spire.sockets" . }} + readOnly: true + - name: spire-oidc-config + mountPath: /run/spire/oidc/config/ + readOnly: true + readinessProbe: + exec: + command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] + initialDelaySeconds: 5 + periodSeconds: 5 + livenessProbe: + httpGet: + path: /.well-known/openid-configuration + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumes: + - name: spire-agent-socket + hostPath: + path: /run/spire/sockets + type: DirectoryOrCreate + - name: spire-oidc-config + configMap: + name: {{ include "spire.fullname" . }}-oidc-discovery-provider + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{ end }} diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index 0323909..215ab35 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -17,7 +17,8 @@ data: tos_accepted = {{ .Values.oidc.acme.tosAccepted }} email = "{{ .Values.oidc.acme.emailAddress }}" } - server_api { - address = "unix://{{ include "spire.sockets" . }}/registration.sock" + workload_api { + socket_path = "{{ include "spire.sockets" . }}/agent.sock" + trust_domain = "{{ .Values.spire.trustDomain }}" } {{ end }} diff --git a/charts/spire/templates/oidc-service.yaml b/charts/spire/templates/oidc-service.yaml index 4ac9afd..d1bd83d 100644 --- a/charts/spire/templates/oidc-service.yaml +++ b/charts/spire/templates/oidc-service.yaml @@ -13,10 +13,10 @@ spec: ports: - name: http port: {{ .Values.oidc.service.port }} - targetPort: oidc-http + targetPort: http - name: https port: 443 - targetPort: oidc-https + targetPort: https selector: - {{- include "spire.server.selectorLabels" . | nindent 4 }} + {{- include "spire.oidc.selectorLabels" . | nindent 4 }} {{ end }} diff --git a/charts/spire/templates/server-statefulset.yaml b/charts/spire/templates/server-statefulset.yaml index ffa6cf7..2f08a95 100644 --- a/charts/spire/templates/server-statefulset.yaml +++ b/charts/spire/templates/server-statefulset.yaml @@ -91,36 +91,6 @@ spec: - name: spire-workload-registrar-config mountPath: /run/spire/k8s-workload-registrar/config readOnly: true - {{- if eq (.Values.oidc.enabled | toString) "true" }} - - name: spire-oidc - image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.oidc.image.pullPolicy }} - args: - - -config - - /run/spire/oidc/config/oidc-discovery-provider.conf - ports: - - containerPort: {{ .Values.oidc.service.port }} - name: oidc-http - - containerPort: 443 - name: oidc-https - volumeMounts: - - name: spire-server-socket - mountPath: {{ include "spire.sockets" . }} - readOnly: true - - name: spire-oidc-config - mountPath: /run/spire/oidc/config/ - readOnly: true - {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }} - - name: spire-data - mountPath: /run/spire/data - readOnly: false - {{ end }} - readinessProbe: - exec: - command: ["/bin/ps", "aux", " ||", "grep", "oidc-discovery-provider -config /run/spire/oidc/config/oidc-discovery-provider.conf"] - initialDelaySeconds: 5 - periodSeconds: 5 - {{ end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} @@ -140,11 +110,6 @@ spec: - name: spire-config configMap: name: {{ include "spire.fullname" . }}-server - {{- if eq (.Values.oidc.enabled | toString) "true" }} - - name: spire-oidc-config - configMap: - name: {{ include "spire.fullname" . }}-oidc-discovery-provider - {{ end }} - name: spire-server-socket hostPath: path: /run/spire/server-sockets