kfox1111
2a8c1b63c4
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
91 lines
17 KiB
Markdown
91 lines
17 KiB
Markdown
# spire-ha-agent
|
|
|
|
  
|
|
|
|
A Helm chart to install the SPIRE HA agent.
|
|
|
|
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
|
|
|
## Maintainers
|
|
|
|
| Name | Email | Url |
|
|
| ---- | ------ | --- |
|
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
|
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
|
| faisal-memon | <fymemon@yahoo.com> | |
|
|
|
|
## Source Code
|
|
|
|
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent>
|
|
|
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
|
|
|
## Parameters
|
|
|
|
### Chart parameters
|
|
|
|
| Name | Description | Value |
|
|
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
|
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
|
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
|
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
|
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
|
| `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
|
| `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` |
|
|
| `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` |
|
|
| `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` |
|
|
| `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` |
|
|
| `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` |
|
|
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
|
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
|
| `port` | Port number to listen on | `999` |
|
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
|
| `nameOverride` | Name override | `""` |
|
|
| `namespaceOverride` | Namespace override | `""` |
|
|
| `fullnameOverride` | Fullname override | `""` |
|
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
|
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
|
| `podLabels` | Labels to add to pods | `{}` |
|
|
| `podSecurityContext` | Pod security context | `{}` |
|
|
| `securityContext` | Security context | `{}` |
|
|
| `resources` | Resource requests and limits | `{}` |
|
|
| `nodeSelector` | Node selector | `{}` |
|
|
| `tolerations` | List of tolerations | `[]` |
|
|
| `affinity` | Node affinity | `{}` |
|
|
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
|
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
|
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
|
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
|
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
|
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` |
|
|
| `cid2PID.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` |
|
|
| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
|
| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` |
|
|
| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
|
| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
|
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
|
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
|
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
|
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
|
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
|
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
|
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
|
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
|
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
|
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
|
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|