helm-charts-hardened/charts/spire/templates/agent-daemonset.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: {{ include "spire.fullname" . }}-agent
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "spire.agent.labels" . | nindent 4 }}
spec:
  selector:
    matchLabels:
      {{- include "spire.agent.selectorLabels" . | nindent 6 }}
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      {{- with .Values.agent.service.annotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "spire.agent.selectorLabels" . | nindent 8 }}
    spec:
      hostPID: true
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
      initContainers:
        - name: init
          # This is a small image with wait-for-it, choose whatever image
          # you prefer that waits for a service to be up. This image is built
          # from https://github.com/vishnubob/wait-for-it
          image: {{ template "spire.image" .Values.waitForIt }}
          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
          args: ["-t", "30", "-h", "{{ include "spire.fullname" . }}-server", "-p", "8081"]
          resources:
            {{- toYaml .Values.waitForIt.resources | nindent 12 }}
      {{- with .Values.agent.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: {{ .Chart.Name }}-agent
          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
          args: ["-config", "/run/spire/config/agent.conf"]
          volumeMounts:
            - name: spire-config
              mountPath: /run/spire/config
              readOnly: true
            - name: spire-bundle
              mountPath: /run/spire/bundle
              readOnly: true
            - name: spire-agent-socket-dir
              mountPath: {{ dir .Values.agent.config.socketPath }}
              readOnly: false
            - name: spire-token
              mountPath: /var/run/secrets/tokens
          livenessProbe:
            httpGet:
              path: /live
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 60
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 15
            periodSeconds: 60
          resources:
            {{- toYaml .Values.agent.resources | nindent 12 }}
        # This is the container which runs the SPIFFE CSI driver.
        - name: spiffe-csi-driver
          image: {{ template "spire.image" .Values.csiDriver }}
          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
          args: [
            "-workload-api-socket-dir", "/spire-agent-socket",
            "-csi-socket-path", "/spiffe-csi/csi.sock",
          ]
          env:
            # The CSI driver needs a unique node ID. The node name can be
            # used for this purpose.
            - name: MY_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
          volumeMounts:
            # The volume containing the SPIRE agent socket. The SPIFFE CSI
            # driver will mount this directory into containers.
            - mountPath: /spire-agent-socket
              name: spire-agent-socket-dir
              readOnly: true
            # The volume that will contain the CSI driver socket shared
            # with the kubelet and the driver registrar.
            - mountPath: /spiffe-csi
              name: spiffe-csi-socket-dir
            # The volume containing mount points for containers.
            - mountPath: /var/lib/kubelet/pods
              mountPropagation: Bidirectional
              name: mountpoint-dir
          securityContext:
            privileged: true
          resources:
            {{- toYaml .Values.csiDriver.resources | nindent 12 }}
        # This container runs the CSI Node Driver Registrar which takes care
        # of all the little details required to register a CSI driver with
        # the kubelet.
        - name: node-driver-registrar
          image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
          imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
          args: [
            "-csi-address", "/spiffe-csi/csi.sock",
            "-kubelet-registration-path", "/var/lib/kubelet/plugins/csi.spiffe.io/csi.sock",
            "-health-port", "9809"
          ]
          volumeMounts:
            # The registrar needs access to the SPIFFE CSI driver socket
            - mountPath: /spiffe-csi
              name: spiffe-csi-socket-dir
            # The registrar needs access to the Kubelet plugin registration
            # directory
            - name: kubelet-plugin-registration-dir
              mountPath: /registration
          ports:
            - containerPort: 9809
              name: healthz
          livenessProbe:
            httpGet:
              path: /healthz
              port: healthz
            initialDelaySeconds: 5
            timeoutSeconds: 5
          resources:
            {{- toYaml .Values.nodeDriverRegistrar.resources | nindent 12 }}
      volumes:
        - name: spire-config
          configMap:
            name: {{ include "spire.fullname" . }}-agent
        - name: spire-bundle
          configMap:
            name: {{ include "spire.fullname" . }}-bundle
        - name: spire-agent-sockets
          hostPath:
            path: {{ dir .Values.agent.config.socketPath }}
            type: DirectoryOrCreate
        - name: spire-token
          projected:
            sources:
            - serviceAccountToken:
                path: spire-agent
                expirationSeconds: 7200
                audience: spire-server
        - name: spire-agent-socket-dir
          hostPath:
            path: {{ dir .Values.agent.config.socketPath }}
            type: DirectoryOrCreate
        # This volume is where the socket for kubelet->driver communication lives
        - name: spiffe-csi-socket-dir
          hostPath:
            path: /var/lib/kubelet/plugins/csi.spiffe.io
            type: DirectoryOrCreate
        # This volume is where the SPIFFE CSI driver mounts volumes
        - name: mountpoint-dir
          hostPath:
            path: /var/lib/kubelet/pods
            type: Directory
        # This volume is where the node-driver-registrar registers the plugin
        # with kubelet
        - name: kubelet-plugin-registration-dir
          hostPath:
            path: /var/lib/kubelet/plugins_registry
            type: Directory