kfox1111andFaisal Memon
90e3518dca
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
110 lines
35 KiB
Markdown
110 lines
35 KiB
Markdown
# spire-ha-agent
|
|
|
|
  
|
|
|
|
A Helm chart to install the SPIRE HA agent.
|
|
|
|
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
|
|
|
## Maintainers
|
|
|
|
| Name | Email | Url |
|
|
| ---- | ------ | --- |
|
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
|
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
|
| faisal-memon | <fymemon@yahoo.com> | |
|
|
|
|
## Source Code
|
|
|
|
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent>
|
|
|
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
|
|
|
## Parameters
|
|
|
|
### Chart parameters
|
|
|
|
| Name | Description | Value |
|
|
| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- |
|
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
|
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
|
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
|
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
|
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
|
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
|
| `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
|
|
| `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` |
|
|
| `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` |
|
|
| `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` |
|
|
| `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` |
|
|
| `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` |
|
|
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
|
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
|
| `port` | Port number to listen on | `999` |
|
|
| `brokerAPI.enabled` | Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker. | `false` |
|
|
| `brokerAPI.socket.enabled` | Serve the broker api on a unix socket | `true` |
|
|
| `brokerAPI.socket.mountOnHost` | Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod. | `true` |
|
|
| `brokerAPI.socket.hostPath` | Where the served broker socket is made available on the host when mountOnHost is true | `/run/spire/agent/sockets/csi.spiffe.io/broker` |
|
|
| `brokerAPI.tcp.enabled` | Serve the broker api over tcp | `false` |
|
|
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
|
| `brokerAPI.brokers.spiffefs.enabled` | Enable spiffefs as a broker. This feature is experimental. | `false` |
|
|
| `brokerAPI.brokers.spiffefs.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spiffefs` |
|
|
| `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
|
| `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
|
| `upstreamKeepalive.time` | How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection. | `5m` |
|
|
| `upstreamKeepalive.timeout` | How long to wait for a keepalive ping response before considering the connection dead | `20s` |
|
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
|
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
|
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent | `""` |
|
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
|
| `nameOverride` | Name override | `""` |
|
|
| `namespaceOverride` | Namespace override | `""` |
|
|
| `fullnameOverride` | Fullname override | `""` |
|
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
|
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
|
| `podAnnotations` | Annotations to add to pods | `{}` |
|
|
| `podLabels` | Labels to add to pods | `{}` |
|
|
| `podSecurityContext` | Pod security context | `{}` |
|
|
| `securityContext` | Security context | `{}` |
|
|
| `resources` | Resource requests and limits | `{}` |
|
|
| `nodeSelector` | Node selector | `{}` |
|
|
| `tolerations` | List of tolerations | `[]` |
|
|
| `affinity` | Node affinity | `{}` |
|
|
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
|
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
|
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
|
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
|
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
|
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` |
|
|
| `cid2PID.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` |
|
|
| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
|
| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` |
|
|
| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
|
|
| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
|
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
|
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
|
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
|
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
|
|
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
|
|
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
|
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
|
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
|
|
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
|
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
|
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
|
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
|
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|