80 lines
2.0 KiB
Go Template
80 lines
2.0 KiB
Go Template
{{ template "chart.header" . }}
|
|
|
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
|
|
{{ template "chart.deprecationWarning" . }}
|
|
|
|
{{ template "chart.badgesSection" . }}
|
|
|
|
{{ template "chart.description" . }}
|
|
|
|
{{ template "chart.homepageLine" . }}
|
|
|
|
> **Warning**: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
|
|
|
|
> **Note**: Minimum Spire version is `v1.5.3`.
|
|
|
|
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following
|
|
command to SSH into the Docker Desktop K8s VM.
|
|
|
|
```bash
|
|
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
|
|
```
|
|
|
|
Then add the following to `/etc/kubernetes/manifests/kube-apiserver.yaml`
|
|
|
|
```yaml
|
|
spec:
|
|
containers:
|
|
- command:
|
|
- kube-apiserver
|
|
- --api-audiences=api,spire-server
|
|
- --service-account-issuer=api,spire-agent
|
|
- --service-account-key-file=/run/config/pki/sa.pub
|
|
- --service-account-signing-key-file=/run/config/pki/sa.key
|
|
```
|
|
|
|
## Usage
|
|
|
|
To utilize Spire in your own workloads you should add the following to your workload:
|
|
|
|
```diff
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: my-app
|
|
spec:
|
|
containers:
|
|
- name: my-app
|
|
image: "my-app:latest"
|
|
imagePullPolicy: Always
|
|
+ volumeMounts:
|
|
+ - name: spiffe-workload-api
|
|
+ mountPath: /spiffe-workload-api
|
|
+ readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 200m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 64Mi
|
|
+ volumes:
|
|
+ - name: spiffe-workload-api
|
|
+ csi:
|
|
+ driver: "csi.spiffe.io"
|
|
+ readOnly: true
|
|
```
|
|
|
|
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
|
|
|
|
{{ template "chart.maintainersSection" . }}
|
|
|
|
{{ template "chart.sourcesSection" . }}
|
|
|
|
{{ template "chart.requirementsSection" . }}
|
|
|
|
{{ template "chart.valuesSection" . }}
|
|
|
|
----------------------------------------------
|