Marco Franssen
35b8ad3c00
Signed-off-by: Marco Franssen <[email protected]> Signed-off-by: Marco Franssen <[email protected]>
94 lines
3.3 KiB
YAML
94 lines
3.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: {{ include "spire.fullname" . }}-agent
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "spire.agent.labels" . | nindent 4 }}
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
{{- include "spire.agent.selectorLabels" . | nindent 6 }}
|
|
updateStrategy:
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
{{- with .Values.agent.service.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "spire.agent.selectorLabels" . | nindent 8 }}
|
|
spec:
|
|
hostPID: true
|
|
hostNetwork: true
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
|
|
initContainers:
|
|
- name: init
|
|
# This is a small image with wait-for-it, choose whatever image
|
|
# you prefer that waits for a service to be up. This image is built
|
|
# from https://github.com/vishnubob/wait-for-it
|
|
image: {{ template "spire.image" .Values.waitForIt }}
|
|
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
|
|
args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
|
|
resources:
|
|
{{- toYaml .Values.waitForIt.resources | nindent 12 }}
|
|
{{- with .Values.agent.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}-agent
|
|
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
|
|
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
|
|
args: ["-config", "/run/spire/config/agent.conf"]
|
|
volumeMounts:
|
|
- name: spire-config
|
|
mountPath: /run/spire/config
|
|
readOnly: true
|
|
- name: spire-bundle
|
|
mountPath: /run/spire/bundle
|
|
readOnly: true
|
|
- name: spire-agent-socket-dir
|
|
mountPath: {{ dir .Values.agent.config.socketPath }}
|
|
readOnly: false
|
|
- name: spire-token
|
|
mountPath: /var/run/secrets/tokens
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /live
|
|
port: 8080
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 60
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /ready
|
|
port: 8080
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 60
|
|
resources:
|
|
{{- toYaml .Values.agent.resources | nindent 12 }}
|
|
volumes:
|
|
- name: spire-config
|
|
configMap:
|
|
name: {{ include "spire.fullname" . }}-agent
|
|
- name: spire-bundle
|
|
configMap:
|
|
name: {{ include "spire.fullname" . }}-bundle
|
|
- name: spire-agent-sockets
|
|
hostPath:
|
|
path: {{ dir .Values.agent.config.socketPath }}
|
|
type: DirectoryOrCreate
|
|
- name: spire-token
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
path: spire-agent
|
|
expirationSeconds: 7200
|
|
audience: spire-server
|
|
- name: spire-agent-socket-dir
|
|
hostPath:
|
|
path: {{ dir .Values.agent.config.socketPath }}
|
|
type: DirectoryOrCreate
|