helm-charts-hardened/charts/spire/charts/spire-agent/templates/daemonset.yaml

{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $podSecurityContext := fromYaml (include "spire-lib.podsecuritycontext" .) }}
{{- $cbh := eq (include "spire-agent.connect-by-hostname" .) "true" }}
{{- $socketAlternateNames := index (include "spire-agent.socket-alternate-names" . | fromYaml) "names" }}
{{- $socketPath := include "spire-agent.socket-path" . }}
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ include "spire-agent.fullname" . }}
  namespace: {{ include "spire-agent.namespace" . }}
  labels:
    {{- include "spire-agent.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
      {{- include "spire-agent.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        kubectl.kubernetes.io/default-container: spire-agent
        checksum/config: {{ $configSum }}
        {{- with .Values.podAnnotations }}
          {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "spire-agent.selectorLabels" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      hostPID: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      serviceAccountName: {{ include "spire-agent.serviceAccountName" . }}
      securityContext:
        {{- toYaml $podSecurityContext | nindent 8 }}
      {{- include "spire-lib.default_node_priority_class_name" . | nindent 6 }}
      {{- if ne (len .Values.hostAliases) 0 }}
      hostAliases:
        {{- toYaml .Values.hostAliases | nindent 8 }}
      {{- end }}
      initContainers:
        - name: init
          # This is a small image with wait-for-it, choose whatever image
          # you prefer that waits for a service to be up. This image is built
          # from https://github.com/vishnubob/wait-for-it
          image: {{ template "spire-lib.image" (dict "image" .Values.waitForIt.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
          args: ["-t", "30", "-h", "{{ include "spire-agent.server-address" . | trim }}", "-p", {{ .Values.server.port | quote }}]
          resources:
            {{- toYaml .Values.waitForIt.resources | nindent 12 }}
          securityContext:
            {{ toYaml .Values.securityContext | nindent 12 }}
        {{- if gt (len $socketAlternateNames) 0 }}
        - name: ensure-alternate-names
          image: {{ template "spire-lib.image" (dict "image" .Values.socketAlternate.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.socketAlternate.image.pullPolicy }}
          command: ["bash", "-xc"]
          {{/* 1. Look for symlinks pointing at the wrong place and remove them. 2. Make symlinks that don't exist. 3. If new socket is pointing at an existing symlink, remove old symlink. */}}
          args:
            - |
              cd {{ $socketPath | dir }}
              {{- range $socketAlternateNames }}
              L=`readlink {{ . }}`
              [ "x$L" != "x{{ $socketPath | base}}" ] && rm -f {{ . }}
              [ ! -L {{ . }} ] && ln -s {{ $socketPath | base }} {{ . }}
              {{- end }}
              [ -L {{ $socketPath | base }} ] && rm -f {{ $socketPath | base }}
              exit 0
          resources:
            {{- toYaml .Values.socketAlternate.resources | nindent 12 }}
          volumeMounts:
            - name: spire-agent-socket-dir
              mountPath: {{ $socketPath | dir }}
          securityContext:
            runAsUser: 0
            runAsGroup: 0
        {{- end }}
        {{- if gt (int (dig "fsGroup" 0 $podSecurityContext)) 0 }}
        - name: fsgroupfix
          image: {{ template "spire-lib.image" (dict "image" .Values.fsGroupFix.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.fsGroupFix.image.pullPolicy }}
          command: ["bash", "-c"]
          args:
            - "chown -R {{ $podSecurityContext.runAsUser }}:{{ $podSecurityContext.fsGroup }} {{ $socketPath | dir }}"
          resources:
            {{- toYaml .Values.fsGroupFix.resources | nindent 12 }}
          volumeMounts:
            - name: spire-agent-socket-dir
              mountPath: {{ $socketPath | dir }}
          securityContext:
            runAsUser: 0
            runAsGroup: 0
        {{- end }}
        {{- if gt (len .Values.initContainers) 0 }}
        {{- toYaml .Values.initContainers | nindent 8 }}
        {{- end }}
      containers:
        - name: {{ .Chart.Name }}
          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["-config", "/opt/spire/conf/agent/agent.conf"]
          securityContext:
            {{ toYaml .Values.securityContext | nindent 12 }}
          env:
            - name: PATH
              value: "/opt/spire/bin:/bin"
          {{- if $cbh }}
            - name: MY_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          {{- end }}
          {{- with .Values.extraEnvVars }}
          {{- toYaml . | nindent 12 }}
          {{- end }}
          ports:
            - containerPort: {{ .Values.healthChecks.port }}
              name: healthz
            {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
            - containerPort: {{ .Values.telemetry.prometheus.port }}
              name: prom
            {{- end }}
          volumeMounts:
            - name: spire-config
              mountPath: /opt/spire/conf/agent
              readOnly: true
            {{- if eq (len .Values.trustBundleURL) 0 }}
            - name: spire-bundle
              mountPath: /run/spire/bundle
              readOnly: true
            {{- end }}
            - name: spire-agent-socket-dir
              mountPath: /tmp/spire-agent/public
              readOnly: false
            - name: spire-token
              mountPath: /var/run/secrets/tokens
            {{- if gt (len .Values.extraVolumeMounts) 0 }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
          livenessProbe:
            httpGet:
              path: /live
              port: healthz
            {{- toYaml .Values.livenessProbe | nindent 12 }}
          readinessProbe:
            httpGet:
              path: /ready
              port: healthz
            {{- toYaml .Values.readinessProbe | nindent 12 }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
        {{- if gt (len .Values.extraContainers) 0 }}
        {{- toYaml .Values.extraContainers | nindent 8 }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: spire-config
          configMap:
            name: {{ include "spire-agent.fullname" . }}
        {{- if eq (len .Values.trustBundleURL) 0 }}
        - name: spire-bundle
          configMap:
            name: {{ include "spire-lib.bundle-configmap" . }}
        {{- end }}
        - name: spire-token
          projected:
            sources:
            - serviceAccountToken:
                path: spire-agent
                expirationSeconds: 7200
                audience: spire-server
        - name: spire-agent-socket-dir
          hostPath:
            path: {{ $socketPath | dir }}
            type: DirectoryOrCreate
        {{- if gt (len .Values.extraVolumes) 0 }}
        {{- toYaml .Values.extraVolumes | nindent 8 }}
        {{- end }}