Add broker suport to the spire-ha-agent (#884)
* Add broker suport to the spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -3,7 +3,7 @@ name: spire-ha-agent
|
||||
description: A Helm chart to install the SPIRE HA agent.
|
||||
type: application
|
||||
version: 0.2.0
|
||||
appVersion: "0.0.17"
|
||||
appVersion: "0.2.0"
|
||||
keywords: ["spiffe", "spire-ha-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
|
||||
sources:
|
||||
|
||||
@@ -30,10 +30,17 @@ A Helm chart to install the SPIRE HA agent.
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
||||
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
||||
| `sockets.single.admin.hostPath` | Where the sockets are on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||
| `sockets.a.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||
| `sockets.b.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
||||
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||
| `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
||||
| `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` |
|
||||
| `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` |
|
||||
| `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` |
|
||||
| `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` |
|
||||
| `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` |
|
||||
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
||||
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
||||
| `port` | Port number to listen on | `999` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
|
||||
@@ -119,6 +119,9 @@ spec:
|
||||
- name: {{ .Chart.Name | quote }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
args:
|
||||
- "-mode"
|
||||
- {{ .Values.mode | quote }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
#FIXME read permission to api socket
|
||||
@@ -131,13 +134,31 @@ spec:
|
||||
{{- if .Values.singleSocket }}
|
||||
- name: SPIRE_HA_AGENT_SINGLE
|
||||
value: enabled
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
- name: SPIRE_HA_AGENT_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_BROKER_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
- name: SPIRE_HA_AGENT_VSOCK
|
||||
@@ -161,11 +182,24 @@ spec:
|
||||
mountPath: /tmp/spire-ha-agent/public
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
{{- if not .Values.singleSocket }}
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker
|
||||
- name: spire-ha-workload-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker
|
||||
- name: spire-ha-workload-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
@@ -196,15 +230,36 @@ spec:
|
||||
path: {{ $socketPath | dir }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.admin.hostPath }}{{ else }}{{ .Values.sockets.a.admin.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.admin.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.broker.hostPath }}{{ else }}{{ .Values.sockets.a.broker.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-ha-workload-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.workload.hostPath }}{{ else }}{{ .Values.sockets.a.workload.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.broker.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-ha-workload-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.workload.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
|
||||
@@ -17,22 +17,43 @@ image:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param mode If the spire-ha-agent will run in delegated or broker mode
|
||||
mode: delegated
|
||||
|
||||
## @param singleSocket If in singleSocket mode, only one driver is used
|
||||
singleSocket: false
|
||||
|
||||
## @param sockets.single.admin.hostPath Where the sockets are on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.b.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.single.admin.hostPath Where the admin socket is on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the a admin socket is on disk
|
||||
## @param sockets.b.admin.hostPath Where the b admin sockets is on disk
|
||||
## @param sockets.single.broker.hostPath Where the broker socket is on disk when in single socket mode
|
||||
## @param sockets.a.broker.hostPath Where the a broker socket is on disk
|
||||
## @param sockets.b.broker.hostPath Where the b broker socket is on disk
|
||||
## @param sockets.single.workload.hostPath Where the broker socket is on disk when in single socket mode
|
||||
## @param sockets.a.workload.hostPath Where the a workload socket is on disk
|
||||
## @param sockets.b.workload.hostPath Where the b workload socket is on disk
|
||||
sockets:
|
||||
single:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent-sockets
|
||||
a:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public
|
||||
b:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||
|
||||
## @param vsock Use a vsockets to expose the service rather then a unix socket
|
||||
vsock: false
|
||||
|
||||
@@ -466,6 +466,9 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-server-b-bundle` |
|
||||
@@ -485,6 +488,9 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.enabled` | Enable admin socket | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.sockets.admin.mountOnHost` | Mount admin socket on host | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates` | List of workloads able to use the delegation api | `["/spire-ha-agent"]` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy` | The default accessPolicy | `permissive` |
|
||||
| `downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent by default | `true` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream-a` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-a.pluginName` | The name of the plugin instance | `a.csi.spiffe.io` |
|
||||
|
||||
@@ -680,6 +680,20 @@ downstream-spire-agent-bottom-turtle-ha-a:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-a.authorizedDelegates List of workloads able to use the delegation api
|
||||
authorizedDelegates:
|
||||
- /spire-ha-agent
|
||||
brokerAPI:
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-a.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
||||
enabled: true
|
||||
workloadAttestors:
|
||||
k8s:
|
||||
brokerAPI:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
|
||||
accessPolicy: permissive
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-a.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
||||
enabled: true
|
||||
|
||||
# Used with tags [bottomTurtleHAB]
|
||||
downstream-spire-agent-bottom-turtle-ha-b:
|
||||
@@ -737,6 +751,20 @@ downstream-spire-agent-bottom-turtle-ha-b:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-b.authorizedDelegates List of workloads able to use the delegation api
|
||||
authorizedDelegates:
|
||||
- /spire-ha-agent
|
||||
brokerAPI:
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-b.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
||||
enabled: true
|
||||
workloadAttestors:
|
||||
k8s:
|
||||
brokerAPI:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.accessPolicy The default accessPolicy
|
||||
accessPolicy: permissive
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param downstream-spire-agent-bottom-turtle-ha-b.workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent by default
|
||||
enabled: true
|
||||
|
||||
# Used with tags [bottomTurtleHAA]
|
||||
downstream-spiffe-csi-driver-bottom-turtle-ha-a:
|
||||
|
||||
Reference in New Issue
Block a user