* Fix duplicate port names in controller-manager containers
Multiple controller-manager containers were using the same "heathz" port
name, causing Kubernetes warnings about duplicate ports in the
StatefulSet. This also affected the prometheus port "prom-cm".
Changes:
* Renamed healthz port to hp-cm (health port - controller manager)
* Renamed prom-cm to pm-cm for consistency
* Addedd {{ .portSuffix }} variable to differentiate external controller
ports
* Implemented port suffix logic
The suffix logic handles cluster names by:
1. Names <9 chars: use full name as suffic
* e.g.: child01 -> -child01
2. Names with trailing numbers: preserve the number format users chose
* Detects 1-2 digit numbers with optional hyphen
* Truncates base name to fit within 15 chars
* e.g.: verlongcluster-01 -> -verylo-01
3. Names without numbers: use SHA-256 hash for uniqueness
* Trunactes name to 5 chars and appends 3-char hash
* e.g.: verlongclustername -> -veryl-a3f
The logic separates container suffix (full name) from port suffix
(truncated) so container names remain descriptive while port names stay
compliant.
Fixes#525#655
Signed-off-by: Rowan Ruseler <[email protected]>
* Add optional port name overrides for ext. controller
The auto-generated port name suffixes for external controller manager
can collide when cluster names are similar, as the 3-character has
provides only 4,096 possibilities. With the optional healthPortName and
prometheusPortName fields to cluster configuration, allows users to
explicity set port names when automatica generation creates collisions.
Signed-off-by: Rowan Ruseler <[email protected]>
* Fix portSuffix generation
Changed from "and" to "or", so portSuffic is calculated when either
healthPortName or prometheusPortName is unset.
Signed-off-by: Rowan Ruseler <[email protected]>
---------
Signed-off-by: Rowan Ruseler <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Add configurable hostNetwork parameter for spire-agent
Adds `hostNetwork` as a configurable parameter in the spire-agent chart.
We can now explicitly control whether the spire-agent daemonset uses
host networking.
Changes:
* Updated daemonset template
* Changed `dnsPolicy` logic to follow the computed `hostNetwork` instead
of kubelet mode directly
* Updated documentation
Behaviour:
If you leave `hostNetwork` empty (the default), it behaves like PR #705:
* automatically disables when using hostname or hostip kubelet modes
* automatically enables for localhost
If you set it explicitly to `true` or `false`, that overrides the
automatic behaviour. When `hostNetwork` is enabled and you haven't set a
custom `dnsPolicy`, it defaults to `ClusterFirstWithHostNet`.
Fixes#704
Signed-off-by: Rowan Ruseler <[email protected]>
* Fix merge conflict, different default value for fsGroupFix.image.tag
Signed-off-by: Rowan Ruseler <[email protected]>
---------
Signed-off-by: Rowan Ruseler <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Add ContainerResource scaling to spire-server HPA
Signed-off-by: Jayme Howard <[email protected]>
* Amend flag name to address feedback
Signed-off-by: Jayme Howard <[email protected]>
---------
Signed-off-by: Jayme Howard <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
spiffe-csi-driver and spiffe-oidc-discovery provider are now brought in
line with spire-server and spire-agent, which already support podLabels.
Changes:
* Add podLabels parameter
Fixes#719
Signed-off-by: Rowan Ruseler <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Applies the tolerations in the spire-server chart to the pods created
by the hooks. Previously they were only applied to the pods of the
server itself.
Signed-off-by: Alec Wilson <[email protected]>
Adds unsupported built-in plugins (built-in plugins that do not have
direct toggles in the helm chart) to the check that exactly one
key manager plugin is enabled - the previous check only allowed usage
of key manager plugins with explicit values in the helm chart.
This still doesn't allow usage of custom key manager plugins - as they
will not be present in the count that is checked.
Signed-off-by: Alec Wilson <[email protected]>
* Add logFormat support to spire-server chart
Adds the ability to configure SPIRE server log format (text or json)
via the logFormat helm value. When set, it renders as log_format in
the server configuration.
Signed-off-by: Shubham Hibare <[email protected]>
* add default value
Signed-off-by: Shubham Hibare <[email protected]>
* fix
Signed-off-by: Shubham Hibare <[email protected]>
* fix
Signed-off-by: Shubham Hibare <[email protected]>
---------
Signed-off-by: Shubham Hibare <[email protected]>
* disable hostNetwork on spire-agent daemonset if connect by hostname is true
Signed-off-by: Daniel Schlatter <[email protected]>
* allow spire-agent daemonset dnsPolicy to be configured
Signed-off-by: Daniel Schlatter <[email protected]>
---------
Signed-off-by: Daniel Schlatter <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* 6f2c71b0 Update spire to 1.14.1 (#729)
* f8f1e21f CSI driver: Support setting podSecurityContext and securityContext (#642)
* 813203a4 Update spike to the newest version (#665)
* 97c383b1 Add Configurable Kubelet Address for SPIRE Agent (#709)
* 8555efc6 Bump test chart dependencies
* e6c9d975 Bump test chart dependencies
* 87da80a8 Add support for AWS KMS key tagging (#721)
* db8f1352 Bump test chart dependencies (#720)
* b1f902b6 Bump test chart dependencies
* 198cdb60 Bump test chart dependencies
* dfbbecf0 Add guard to the validating admission policy to stop errors when there are no volumes in the spec. This fixes errors with HTTP solver pods in cert manager. (#706)
* 1e1e8daa Add support for attested node pruning configuration (#713)
* a2130ff7 Bump test chart dependencies (#712)
* adc5f3e8 Bump test chart dependencies
* 4e0cdb13 Bump test chart dependencies
* 95fa0deb Allow configuring spire-agent prometheus listening address (#701)
Signed-off-by: Faisal Memon <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
* Allow for both the pod security context and container security contexts to be overriden through the spiffe-csi-driver values file
Signed-off-by: Alec Holmes <[email protected]>
* newline
Signed-off-by: Alec Holmes <[email protected]>
* fix space
Signed-off-by: Alec Holmes <[email protected]>
* Update docs
Signed-off-by: Kevin Fox <[email protected]>
---------
Signed-off-by: Alec Holmes <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Update spike bits
Signed-off-by: Kevin Fox <[email protected]>
* Update
Signed-off-by: Kevin Fox <[email protected]>
* Update
Signed-off-by: Kevin Fox <[email protected]>
* Add trust roots.
SPIKE SDK uses the appropriate trust root from the environment which makes SDK usage easier, but it requires additional env vars on the pod meta.
Signed-off-by: Volkan Özçelik <[email protected]>
* Chart updates to make it work with the new SDK changes of SPIKE.
Signed-off-by: Volkan Özçelik <[email protected]>
* Making the self-reference more evident.
Signed-off-by: Volkan Özçelik <[email protected]>
* Documentation update.
Signed-off-by: Volkan Özçelik <[email protected]>
* Documentation update.
Signed-off-by: Volkan Özçelik <[email protected]>
* updates to align with recent SPIKE.
* SPIKE assumes all trust roots can be arrays (for distributed setups), modified values accordingly.
* Added cross-references between bootstrap and keeper job/statefulsets for PoP validation to work.
* other possible minor updates.
Signed-off-by: Volkan Özçelik <[email protected]>
* minor changes.
Signed-off-by: Volkan Özçelik <[email protected]>
* Update docs
---------
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: Volkan Özçelik <[email protected]>
Co-authored-by: Volkan Özçelik <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
* Add kubeletAddress.mode configuration to spire-agent
Introduces new enum-based configuration for kubelet connection modes:
- auto (default): hostname for OpenShift, localhost otherwise
- localhost: SPIRE default behavior (127.0.0.1:10250)
- hostname: Connect via node hostname
- hostip: Connect via node IP
- custom: User-provided configuration
Deprecates kubeletConnectByHostname but maintains backward compatibility.
Signed-off-by: Oliver Bassett <[email protected]>
* Replace connect-by-hostname helper with mode resolution
Adds three new helpers:
- spire-agent.kubelet-address-mode: Determine mode with backward compat
- spire-agent.kubelet-address-mode-resolved: Resolve auto to actual mode
- spire-agent.should-set-node-name-env: Determine if node_name_env needed
Includes validation of enum values and maintains backward compatibility
by keeping the old connect-by-hostname helper as deprecated.
Signed-off-by: Oliver Bassett <[email protected]>
* Update daemonset to use KUBELET_ADDR env variable
- Sets KUBELET_ADDR from downward API for hostname/hostip modes
- Maintains MY_NODE_NAME for backward compatibility
- No env var set for localhost mode (SPIRE default)
- Custom mode allows user control via extraEnvVars
- Updates init container env to support both hostname and hostip modes
Signed-off-by: Oliver Bassett <[email protected]>
* Update workload attestor config and add validation
- Changes node_name_env from MY_NODE_NAME to KUBELET_ADDR
- Adds validation for kubeletAddress.mode enum
- Prevents using both old and new config simultaneously
Signed-off-by: Oliver Bassett <[email protected]>
* Improve documentation for custom mode
Clarifies that custom mode does not validate KUBELET_ADDR presence,
allowing for external secret injection and other advanced configuration
methods.
Signed-off-by: Oliver Bassett <[email protected]>
* Fix backward compatibility for kubeletConnectByHostname
Two critical fixes for backward compatibility:
1. Helper template priority: Reorder kubelet-address-mode helper to
prioritize kubeletConnectByHostname when kubeletAddress.mode is
'auto' or empty. This ensures deprecated config still works.
2. Type-safe validation: Convert kubeletConnectByHostname to string
in validation and helper to handle both boolean and string types
consistently. Original chart required string type.
3. Smart dual-config validation: Only fail when both configs are
explicitly set to non-default values. Allow kubeletConnectByHostname
with mode='auto' for backward compatibility.
Tested scenarios:
- kubeletConnectByHostname='true' maps to hostname mode
- kubeletConnectByHostname='false' maps to localhost mode
- Both set with mode='auto' allows backward compat to take priority
- Both set with different non-defaults triggers validation error
- OpenShift auto mode correctly resolves to hostname mode
Signed-off-by: Oliver Bassett <[email protected]>
* Use parentheses for DEPRECATED tag in values.yaml
Change [DEPRECATED] to (DEPRECATED) to avoid conflicts with automated
README generator which uses square brackets for special tags.
Signed-off-by: Oliver Bassett <[email protected]>
* Update generated README documentation
Regenerate README.md from values.yaml using documentation generator.
Includes new kubeletAddress.mode configuration and deprecation notice
for kubeletConnectByHostname.
Signed-off-by: Oliver Bassett <[email protected]>
* Remove MY_NODE_NAME environment variable
Remove MY_NODE_NAME as it is not used within the spire-agent chart.
Initially kept for backwards compatibility concerns, but confirmed
unnecessary after review.
The KUBELET_ADDR environment variable is sufficient for the workload
attestor configuration via node_name_env setting.
Addresses PR feedback: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869
Signed-off-by: Oliver Bassett <[email protected]>
* Fix init container for custom kubelet address mode
Address PR #709 feedback by standardizing on KUBELET_ADDR environment
variable and passing extraEnvVars to init containers.
Changes:
1. Init container env variable:
- Renamed NODE_NAME to KUBELET_ADDR for consistency
- Made hostip check explicit with 'else if'
- Passes extraEnvVars to init container for custom mode support
2. Init container script:
- Updated URL construction to use KUBELET_ADDR for all modes
- Added validation for custom mode: fails with clear error if
KUBELET_ADDR is not set via extraEnvVars
- hostname/hostip modes: Use KUBELET_ADDR from downward API
- custom mode: Use KUBELET_ADDR from extraEnvVars with validation
- localhost mode: Use hardcoded 'localhost'
3. Documentation updates:
- Updated custom mode docs to explain extraEnvVars is passed to
both main and init containers
- Noted init container validation behavior
- Updated extraEnvVars param docs to mention init containers
Testing verified:
- Template rendering for all modes (hostname, hostip, custom, localhost)
- Runtime validation: deployed custom mode without KUBELET_ADDR to kind
cluster, init container correctly failed with clear error message
Addresses: https://github.com/spiffe/helm-charts-hardened/pull/709#discussion_r1909855869
Signed-off-by: Oliver Bassett <[email protected]>
* Update generated README for init container changes
Regenerate README.md to reflect that extraEnvVars is now passed
to both the main container and init containers.
Signed-off-by: Oliver Bassett <[email protected]>
---------
Signed-off-by: Oliver Bassett <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
Expose SPIRE server's prune_attested_nodes_expired_for and prune_tofu_nodes
configuration through new Helm values: pruneAttestedNodesExpiredFor and
pruneTOFUNodes.
This prevents database bloat from expired attested nodes in long-running
deployments with node churn.
Signed-off-by: pratik-lotia <[email protected]>
