{{- define "spire-agent.check-config-values" -}} {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}} {{- $trustDomain := include "spire-lib.trust-domain" . }} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}} {{- range $type, $tvals := .Values.customPlugins }} {{- if not (has $type (list "keyManager" "nodeAttestor" "svidStore" "workloadAttestor")) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }} {{- end }} {{- range $name, $nval := $tvals }} {{- if not (hasKey $nval "plugin_cmd") }} {{- fail (printf "plugin_cmd is a required field. %s" $name) }} {{- end }} {{- if not (hasKey $nval "plugin_checksum") }} {{- fail (printf "plugin_checksum is a required field.") }} {{- end }} {{- range $sname, $svals := $nval }} {{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data" "image")) }} {{- fail (printf "Unknown plugin setting specified: %s" $sname) }} {{- end }} {{- end }} {{- end }} {{- end }} {{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") (eq .Values.keyManager.disk.mode "hostPath") }} {{- fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }} {{- end }} {{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }} {{- fail "The sockets.hostBasePath can not be located under the socketPath directory" }} {{- end }} {{- /* Validate kubeletAddress.mode */ -}} {{- if and (hasKey .Values "kubeletAddress") (ne .Values.kubeletAddress.mode "") }} {{- if not (has .Values.kubeletAddress.mode (list "auto" "localhost" "hostname" "hostip" "custom")) }} {{- fail (printf "kubeletAddress.mode must be one of [auto, localhost, hostname, hostip, custom], got: %s" .Values.kubeletAddress.mode) }} {{- end }} {{- end }} {{- /* Prevent using both old and new config */ -}} {{- if and (ne (.Values.kubeletConnectByHostname | toString) "") (and (hasKey .Values "kubeletAddress") (ne .Values.kubeletAddress.mode "") (ne .Values.kubeletAddress.mode "auto")) }} {{- fail "Both kubeletConnectByHostname (deprecated) and kubeletAddress.mode are set. Please use only kubeletAddress.mode." }} {{- end }} {{- end }} {{- define "spire-agent.yaml-config" -}} {{- $trustDomain := include "spire-lib.trust-domain" . }} agent: {{- if .Values.sockets.admin.enabled }} admin_socket_path: /tmp/spire-agent/private/admin.sock {{- end }} {{- with .Values.authorizedDelegates }} authorized_delegates: {{- range . }} {{- if hasPrefix "/" . }} - spiffe://{{ $trustDomain }}{{ . }} {{- else }} - {{ . }} {{- end }} {{- end }} {{- end }} data_dir: "/var/lib/spire" log_level: {{ .Values.logLevel | quote }} log_format: {{ .Values.logFormat | quote }} rebootstrap_mode: {{ .Values.rebootstrapMode | quote }} rebootstrap_delay: {{ .Values.rebootstrapDelay | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_port: {{ .Values.server.port | quote }} socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }} trust_bundle_format: {{ .Values.trustBundleFormat | quote }} {{- if ne (len .Values.trustBundleURL) 0 }} trust_bundle_url: {{ .Values.trustBundleURL | quote }} {{- else if ne (len .Values.trustBundleHostPath) 0 }} trust_bundle_path: {{ .Values.trustBundleHostPath | quote }} {{- else }} trust_bundle_path: {{ printf "/run/spire/bundle/bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" .Values.trustBundleFormat)) | quote }} {{- end }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }} {{- with .Values.availabilityTarget }} availability_target: {{ . | quote }} {{- end }} {{- if .Values.sds.enabled }} sds: default_svid_name: {{ .Values.sds.defaultSVIDName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }} {{- end }} {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }} experimental: {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} broker: {{- if .Values.sockets.broker.enabled }} socket_path: "/tmp/spire-agent/broker/broker.sock" {{- end }} {{- if .Values.brokerAPI.tcp.enabled }} bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }} {{- end }} brokers: {{- range .Values.brokerAPI.brokers }} {{- if .enabled }} - broker: - id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }} allowed_reference_types: {{- range .allowedReferenceTypes }} - allowed_reference_types: type_url: {{ .typeURL | quote }} allow_over_tcp: {{ .allowOverTCP }} {{- end }} {{- end }} {{- end }} {{- end }} {{- with .Values.experimental }} {{- if eq (.enabled | toString) "true" }} sync_interval: {{ .syncInterval | quote }} require_pq_kem: {{ .requirePQKEM }} {{- if gt (len .featureFlags) 0 }} feature_flags: {{- range .featureFlags }} - {{ . | quote }} {{- end }} {{- end }} {{- end }} {{- end }} {{- end }} {{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }} {{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} plugins: NodeAttestor: {{- if .Values.nodeAttestor.k8sPSAT.enabled }} k8s_psat: plugin_data: cluster: {{ include "spire-lib.cluster-name" . | quote }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- with .Values.nodeAttestor.httpChallenge }} {{- if eq (.enabled | toString) "true" }} http_challenge: plugin_data: agentname: {{ .agentname | quote }} {{- if ne (int .port) 0 }} port: {{ .port }} {{- end }} {{- if ne (int .advertisedPort) 0 }} advertisedPort: {{ .advertisedPort }} {{- end }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} {{- with .Values.nodeAttestor.tpmDirect }} {{- if eq (.enabled | toString) "true" }} tpm: plugin_cmd: "/tpm/tpm_attestor_agent" plugin_checksum: {{ .plugin.checksum | quote }} plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} {{- with .Values.nodeAttestor.x509POP }} {{- if eq (.enabled | toString) "true" }} x509pop: plugin_data: spiffe_endpoint_socket: unix://{{ .spiffeEndpointSocket }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} {{- with .Values.nodeAttestor.awsIID }} {{- if eq (.enabled | toString) "true" }} aws_iid: plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} {{- with .Values.nodeAttestor.gcpIIT }} {{- if eq (.enabled | toString) "true" }} gcp_iit: plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} {{- if ne $nodeAttestorUsed 1 }} {{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} {{- end }} KeyManager: {{- if .Values.keyManager.memory.enabled }} memory: plugin_data: {{- $keyManagerUsed = add1 $keyManagerUsed }} {{- end }} {{- if .Values.keyManager.disk.enabled }} disk: plugin_data: {{- if eq .Values.keyManager.disk.mode "hostPath" }} directory: {{ .Values.persistence.hostPath }} {{- else if eq .Values.keyManager.disk.mode "emptyDir" }} directory: /key-manager {{- end }} {{- $keyManagerUsed = add1 $keyManagerUsed }} {{- end }} {{- if ne $keyManagerUsed 1 }} {{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} {{- end }} WorkloadAttestor: {{- if .Values.workloadAttestors.k8s.enabled }} k8s: plugin_data: {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }} kubelet_ca_path: /hostCert/kubelet.crt {{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }} kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt {{- end }} skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }} disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}} use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }} verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }} {{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }} node_name_env: "KUBELET_ADDR" {{- end }} {{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} experimental: broker: access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }} brokers: {{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }} {{- if or (not (hasKey $value "enabled")) $value.enabled }} {{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }} {{- if hasKey $value "idTemplate" }} {{- $idTemplate = $value.idTemplate }} {{- end }} - broker: - id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }} {{- with $value.podReferenceScope }} pod_reference_scope: {{ . | quote }} {{- end }} {{- end }} {{- end }} {{- end }} {{- end }} {{- if .Values.workloadAttestors.unix.enabled }} unix: plugin_data: {{- end }} health_checks: listener_enabled: true bind_address: "0.0.0.0" bind_port: {{ .Values.healthChecks.port | quote }} live_path: "/live" ready_path: "/ready" {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} telemetry: - Prometheus: - host: {{ .Values.telemetry.prometheus.host }} port: {{ .Values.telemetry.prometheus.port }} {{- end }} {{- if .Values.telemetry.datadog.enabled }} telemetry: - DogStatsd: - address: "{{ .Values.telemetry.datadog.address }}:{{ .Values.telemetry.datadog.port }}" {{- end }} {{- end }} {{- $root := . }} {{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} {{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} {{- $nameSuffix := "" }} {{- if ne $name "default" }} {{- $nameSuffix = printf "-%s" $name }} {{- end }} {{- if hasKey $root.Values.agents $name }} {{- $_ := set . "Values" (mergeOverwrite .Values (index $root.Values.agents $name)) }} {{- end }} {{- include "spire-agent.check-config-values" . }} --- apiVersion: v1 kind: ConfigMap metadata: name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }} namespace: {{ include "spire-agent.namespace" . | quote }} {{- with .Values.configMap.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} data: agent.conf: | {{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-agent.yaml-config" .) "root" .) | nindent 4 }} {{- end }} {{- end }}