Add broker suport to the spire-ha-agent (#884)
* Add broker suport to the spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -3,7 +3,7 @@ name: spire-ha-agent
|
||||
description: A Helm chart to install the SPIRE HA agent.
|
||||
type: application
|
||||
version: 0.2.0
|
||||
appVersion: "0.0.17"
|
||||
appVersion: "0.2.0"
|
||||
keywords: ["spiffe", "spire-ha-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
|
||||
sources:
|
||||
|
||||
@@ -30,10 +30,17 @@ A Helm chart to install the SPIRE HA agent.
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
||||
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
||||
| `sockets.single.admin.hostPath` | Where the sockets are on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||
| `sockets.a.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||
| `sockets.b.admin.hostPath` | Where the sockets are on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
||||
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||
| `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
||||
| `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` |
|
||||
| `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` |
|
||||
| `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` |
|
||||
| `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` |
|
||||
| `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` |
|
||||
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
||||
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
||||
| `port` | Port number to listen on | `999` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
|
||||
@@ -119,6 +119,9 @@ spec:
|
||||
- name: {{ .Chart.Name | quote }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
||||
args:
|
||||
- "-mode"
|
||||
- {{ .Values.mode | quote }}
|
||||
securityContext:
|
||||
privileged: true
|
||||
#FIXME read permission to api socket
|
||||
@@ -131,13 +134,31 @@ spec:
|
||||
{{- if .Values.singleSocket }}
|
||||
- name: SPIRE_HA_AGENT_SINGLE
|
||||
value: enabled
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: SPIRE_HA_AGENT_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||
- name: SPIRE_HA_AGENT_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
||||
{{- else }}
|
||||
- name: SPIRE_HA_AGENT_BROKER_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_BROKER_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_A
|
||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_B
|
||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.vsock }}
|
||||
- name: SPIRE_HA_AGENT_VSOCK
|
||||
@@ -161,11 +182,24 @@ spec:
|
||||
mountPath: /tmp/spire-ha-agent/public
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
{{- if not .Values.singleSocket }}
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker
|
||||
- name: spire-ha-workload-socket-dir-upstream-a
|
||||
mountPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker
|
||||
- name: spire-ha-workload-socket-dir-upstream-b
|
||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
mountPath: /dev
|
||||
@@ -196,15 +230,36 @@ spec:
|
||||
path: {{ $socketPath | dir }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- if eq .Values.mode "delegated" }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.admin.hostPath }}{{ else }}{{ .Values.sockets.a.admin.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-admin-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.admin.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.broker.hostPath }}{{ else }}{{ .Values.sockets.a.broker.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-ha-workload-socket-dir-upstream-a
|
||||
hostPath:
|
||||
path: {{ if .Values.singleSocket }}{{ .Values.sockets.single.workload.hostPath }}{{ else }}{{ .Values.sockets.a.workload.hostPath }}{{ end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- if not .Values.singleSocket }}
|
||||
- name: spire-ha-broker-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.broker.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
- name: spire-ha-workload-socket-dir-upstream-b
|
||||
hostPath:
|
||||
path: {{ .Values.sockets.b.workload.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: dev
|
||||
hostPath:
|
||||
|
||||
@@ -17,22 +17,43 @@ image:
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
## @param mode If the spire-ha-agent will run in delegated or broker mode
|
||||
mode: delegated
|
||||
|
||||
## @param singleSocket If in singleSocket mode, only one driver is used
|
||||
singleSocket: false
|
||||
|
||||
## @param sockets.single.admin.hostPath Where the sockets are on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.b.admin.hostPath Where the sockets are on disk
|
||||
## @param sockets.single.admin.hostPath Where the admin socket is on disk when in single socket mode
|
||||
## @param sockets.a.admin.hostPath Where the a admin socket is on disk
|
||||
## @param sockets.b.admin.hostPath Where the b admin sockets is on disk
|
||||
## @param sockets.single.broker.hostPath Where the broker socket is on disk when in single socket mode
|
||||
## @param sockets.a.broker.hostPath Where the a broker socket is on disk
|
||||
## @param sockets.b.broker.hostPath Where the b broker socket is on disk
|
||||
## @param sockets.single.workload.hostPath Where the broker socket is on disk when in single socket mode
|
||||
## @param sockets.a.workload.hostPath Where the a workload socket is on disk
|
||||
## @param sockets.b.workload.hostPath Where the b workload socket is on disk
|
||||
sockets:
|
||||
single:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/main/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent-sockets
|
||||
a:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent/sockets/a/csi.spiffe.io/public
|
||||
b:
|
||||
admin:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/admin
|
||||
broker:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/broker
|
||||
workload:
|
||||
hostPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||
|
||||
## @param vsock Use a vsockets to expose the service rather then a unix socket
|
||||
vsock: false
|
||||
|
||||
Reference in New Issue
Block a user