kfox1111andFaisal Memon
90e3518dca
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
95 lines
4.0 KiB
YAML
95 lines
4.0 KiB
YAML
{{- define "spire-ha-agent.check-config-values" -}}
|
|
{{- if not (has .Values.mode (list "delegated" "broker")) }}
|
|
{{- fail (printf "mode must be one of [delegated, broker], got: %s" .Values.mode) }}
|
|
{{- end }}
|
|
{{- if .Values.brokerAPI.enabled }}
|
|
{{- if ne .Values.mode "broker" }}
|
|
{{- fail "brokerAPI.enabled is true but mode is not broker. The served broker api is only available in broker mode." }}
|
|
{{- end }}
|
|
{{- if and (not .Values.brokerAPI.socket.enabled) (not .Values.brokerAPI.tcp.enabled) }}
|
|
{{- fail "brokerAPI.enabled is true but neither brokerAPI.socket.enabled nor brokerAPI.tcp.enabled is set. At least one listener is required." }}
|
|
{{- end }}
|
|
{{- $enabledBrokers := 0 }}
|
|
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
|
{{- $enabledBrokers = add1 $enabledBrokers }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if eq $enabledBrokers 0 }}
|
|
{{- fail "brokerAPI.enabled is true but no entry in brokerAPI.brokers is enabled. Only listed brokers may connect, so at least one is required." }}
|
|
{{- end }}
|
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set when brokerAPI is enabled, as broker ids are derived from it" (eq (include "spire-lib.trust-domain" .) "example.org")) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{/*
|
|
The agent reads this config as YAML, so it is emitted directly rather than
|
|
going through spire-lib.reformat-and-yaml2json. That helper exists to hand
|
|
spire an HCL-compatible JSON document and to reshape its plugins dict into
|
|
lists; neither applies here.
|
|
*/}}
|
|
{{- define "spire-ha-agent.yaml-config" -}}
|
|
{{- $trustDomain := include "spire-lib.trust-domain" . | trim -}}
|
|
single: {{ eq .Values.singleSocket true }}
|
|
{{- if .Values.vsock }}
|
|
vsock:
|
|
enabled: true
|
|
port: {{ .Values.port }}
|
|
{{- else }}
|
|
socket: /tmp/spire-ha-agent/public/spire-agent.sock
|
|
{{- end }}
|
|
upstream_a:
|
|
broker_address: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
|
workload_socket: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
|
{{- if not .Values.singleSocket }}
|
|
upstream_b:
|
|
broker_address: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
|
workload_socket: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
|
{{- end }}
|
|
upstream_keepalive:
|
|
time: {{ .Values.upstreamKeepalive.time | quote }}
|
|
timeout: {{ .Values.upstreamKeepalive.timeout | quote }}
|
|
{{- if include "spire-ha-agent.prometheus-enabled" . }}
|
|
metrics:
|
|
bind_address: {{ printf "%s:%v" .Values.telemetry.prometheus.host .Values.telemetry.prometheus.port | quote }}
|
|
{{- end }}
|
|
{{- if .Values.brokerAPI.enabled }}
|
|
broker_endpoint:
|
|
{{- /* Deliberately not under the workload api socket directory: the agent
|
|
rejects a socket_path that shares a directory with it. */}}
|
|
{{- if .Values.brokerAPI.socket.enabled }}
|
|
socket_path: /tmp/spire-ha-agent/broker/broker.sock
|
|
{{- end }}
|
|
{{- if .Values.brokerAPI.tcp.enabled }}
|
|
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
|
{{- end }}
|
|
brokers:
|
|
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
|
- id: {{ tpl $value.idTemplate (dict "TrustDomain" $trustDomain) | quote }}
|
|
allowed_reference_types:
|
|
{{- range $value.allowedReferenceTypes }}
|
|
- type_url: {{ .typeURL | quote }}
|
|
allow_over_tcp: {{ eq .allowOverTCP true }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- /* Validation runs for every mode: two of its checks exist precisely to
|
|
catch a mode that is not broker. */}}
|
|
{{- include "spire-ha-agent.check-config-values" . }}
|
|
{{- if eq .Values.mode "broker" }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
|
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
|
|
labels:
|
|
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
|
data:
|
|
config.yaml: |
|
|
{{- include "spire-ha-agent.yaml-config" . | nindent 4 }}
|
|
{{- end }}
|