Eric Cavalcantiandkfox1111
3ef5fe6c49
* Add Datadog as telemetry option Signed-off-by: Eric Cavalcanti <[email protected]> * Use correct local domain Signed-off-by: Eric Cavalcanti <[email protected]> * Change doc Signed-off-by: Eric Cavalcanti <[email protected]> * Add docs Signed-off-by: Eric Cavalcanti <[email protected]> * remove .cluster.local Signed-off-by: Eric Cavalcanti <[email protected]> * Remove cluster.local Signed-off-by: Eric Cavalcanti <[email protected]> * Fix doc Signed-off-by: Eric Cavalcanti <[email protected]> --------- Signed-off-by: Eric Cavalcanti <[email protected]> Co-authored-by: kfox1111 <[email protected]>
207 lines
8.2 KiB
YAML
207 lines
8.2 KiB
YAML
{{- define "spire-agent.check-config-values" -}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
|
{{- range $type, $tvals := .Values.customPlugins }}
|
|
{{- if not (has $type (list "keyManager" "nodeAttestor" "svidStore" "workloadAttestor")) }}
|
|
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
|
{{- end }}
|
|
{{- range $name, $nval := $tvals }}
|
|
{{- if not (hasKey $nval "plugin_cmd") }}
|
|
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
|
{{- end }}
|
|
{{- if not (hasKey $nval "plugin_checksum") }}
|
|
{{- fail (printf "plugin_checksum is a required field.") }}
|
|
{{- end }}
|
|
{{- range $sname, $svals := $nval }}
|
|
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
|
|
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") }}
|
|
{{- fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
|
|
{{- end }}
|
|
{{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }}
|
|
{{- fail "The sockets.hostBasePath can not be located under the socketPath directory" }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- define "spire-agent.yaml-config" -}}
|
|
agent:
|
|
{{- if .Values.sockets.admin.enabled }}
|
|
admin_socket_path: /tmp/spire-agent/private/admin.sock
|
|
{{- end }}
|
|
{{- with .Values.authorizedDelegates }}
|
|
authorized_delegates:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data_dir: "/var/lib/spire"
|
|
log_level: {{ .Values.logLevel | quote }}
|
|
retry_bootstrap: true
|
|
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
|
server_port: {{ .Values.server.port | quote }}
|
|
socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
|
|
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
|
|
{{- if ne (len .Values.trustBundleURL) 0 }}
|
|
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
|
|
{{- else if ne (len .Values.trustBundleHostPath) 0 }}
|
|
trust_bundle_path: {{ .Values.trustBundleHostPath | quote }}
|
|
{{- else }}
|
|
trust_bundle_path: {{ printf "/run/spire/bundle/bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" .Values.trustBundleFormat)) | quote }}
|
|
{{- end }}
|
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
|
{{- with .Values.availabilityTarget }}
|
|
availability_target: {{ . | quote }}
|
|
{{- end }}
|
|
{{- if .Values.sds.enabled }}
|
|
sds:
|
|
default_svid_name: {{ .Values.sds.defaultSVIDName | quote }}
|
|
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
|
|
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
|
|
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.experimental }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
experimental:
|
|
sync_interval: {{ .syncInterval | quote }}
|
|
{{- if gt (len .featureFlags) 0 }}
|
|
feature_flags:
|
|
{{- range .featureFlags }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }}
|
|
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
|
|
plugins:
|
|
NodeAttestor:
|
|
{{- if .Values.nodeAttestor.k8sPSAT.enabled }}
|
|
k8s_psat:
|
|
plugin_data:
|
|
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.httpChallenge }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
http_challenge:
|
|
plugin_data:
|
|
agentname: {{ .agentname | quote }}
|
|
{{- if ne (int .port) 0 }}
|
|
port: {{ .port }}
|
|
{{- end }}
|
|
{{- if ne (int .advertisedPort) 0 }}
|
|
advertisedPort: {{ .advertisedPort }}
|
|
{{- end }}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.tpmDirect }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
tpm:
|
|
plugin_cmd: "/tpm/tpm_attestor_agent"
|
|
plugin_checksum: {{ .plugin.checksum | quote }}
|
|
plugin_data: {}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.awsIID }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
aws_iid:
|
|
plugin_data: {}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if ne $nodeAttestorUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
|
{{- end }}
|
|
|
|
KeyManager:
|
|
{{- if .Values.keyManager.memory.enabled }}
|
|
memory:
|
|
plugin_data:
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
{{- end }}
|
|
{{- if .Values.keyManager.disk.enabled }}
|
|
disk:
|
|
plugin_data:
|
|
directory: {{ .Values.persistence.hostPath }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
{{- end }}
|
|
{{- if ne $keyManagerUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
|
{{- end }}
|
|
|
|
WorkloadAttestor:
|
|
{{- if .Values.workloadAttestors.k8s.enabled }}
|
|
k8s:
|
|
plugin_data:
|
|
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
|
kubelet_ca_path: /hostCert/kubelet.crt
|
|
{{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
|
|
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
{{- end }}
|
|
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
|
|
disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}}
|
|
use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }}
|
|
verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }}
|
|
{{- if eq (include "spire-agent.connect-by-hostname" .) "true" }}
|
|
node_name_env: "MY_NODE_NAME"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.workloadAttestors.unix.enabled }}
|
|
unix:
|
|
plugin_data:
|
|
{{- end }}
|
|
|
|
health_checks:
|
|
listener_enabled: true
|
|
bind_address: "0.0.0.0"
|
|
bind_port: {{ .Values.healthChecks.port | quote }}
|
|
live_path: "/live"
|
|
ready_path: "/ready"
|
|
|
|
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
|
|
telemetry:
|
|
- Prometheus:
|
|
- host: "0.0.0.0"
|
|
port: {{ .Values.telemetry.prometheus.port }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.telemetry.datadog.enabled }}
|
|
telemetry:
|
|
- DogStatsd:
|
|
- address: "{{ .Values.telemetry.datadog.address }}:{{ .Values.telemetry.datadog.port }}"
|
|
{{- end }}
|
|
|
|
{{- end }}
|
|
{{- $root := . }}
|
|
{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
|
|
{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
|
|
{{- $nameSuffix := "" }}
|
|
{{- if ne $name "default" }}
|
|
{{- $nameSuffix = printf "-%s" $name }}
|
|
{{- end }}
|
|
{{- if hasKey $root.Values.agents $name }}
|
|
{{- $_ := set . "Values" (mergeOverwrite .Values (index $root.Values.agents $name)) }}
|
|
{{- end }}
|
|
{{- include "spire-agent.check-config-values" . }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
|
|
namespace: {{ include "spire-agent.namespace" . | quote }}
|
|
{{- with .Values.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
agent.conf: |
|
|
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-agent.yaml-config" .) "root" .) | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|