-
Notifications
You must be signed in to change notification settings - Fork 25
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Stabilization Improvement for the Helm Charts (for Resource-Limited E…
…nvironments) (#933) * attempt 2 Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * add priorityclassname Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * add health check to spire agent Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * increase wait timeout Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * add probes to spire-server Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * add controller manager health checks Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * attempt 2 Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * attemp 3 Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * BundleEndpoint update Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * add notifier Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * whitespace Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * updated agent and server versions Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * 1.9.4 Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * version change Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * update spire controller manager Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> * spiffe csi driver update Signed-off-by: Volkan Özçelik <ovolkan@vmware.com> --------- Signed-off-by: Volkan Özçelik <ovolkan@vmware.com>
- Loading branch information
Showing
32 changed files
with
879 additions
and
436 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 23 additions & 0 deletions
23
helm-charts/0.24.5/charts/spire/templates/spire-agent-cluster-role-binding.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
# /* | ||
# | Protect your secrets, protect your sensitive data. | ||
# : Explore VMware Secrets Manager docs at https://vsecm.com/ | ||
# </ | ||
# <>/ keep your secrets... secret | ||
# >/ | ||
# <>/' Copyright 2023-present VMware Secrets Manager contributors. | ||
# >/' SPDX-License-Identifier: BSD-2-Clause | ||
# */ | ||
|
||
# Binds above cluster role to spire-agent service account | ||
kind: ClusterRoleBinding | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
metadata: | ||
name: spire-agent-cluster-role-binding | ||
subjects: | ||
- kind: ServiceAccount | ||
name: spire-agent | ||
namespace: {{ .Values.global.spire.namespace }} | ||
roleRef: | ||
kind: ClusterRole | ||
name: spire-agent-cluster-role | ||
apiGroup: rbac.authorization.k8s.io |
19 changes: 19 additions & 0 deletions
19
helm-charts/0.24.5/charts/spire/templates/spire-agent-cluster-role.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
# /* | ||
# | Protect your secrets, protect your sensitive data. | ||
# : Explore VMware Secrets Manager docs at https://vsecm.com/ | ||
# </ | ||
# <>/ keep your secrets... secret | ||
# >/ | ||
# <>/' Copyright 2023-present VMware Secrets Manager contributors. | ||
# >/' SPDX-License-Identifier: BSD-2-Clause | ||
# */ | ||
|
||
# Required cluster role to allow spire-agent to query k8s API server | ||
kind: ClusterRole | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
metadata: | ||
name: spire-agent-cluster-role | ||
rules: | ||
- apiGroups: [""] | ||
resources: ["pods","nodes","nodes/proxy"] | ||
verbs: ["get"] |
56 changes: 56 additions & 0 deletions
56
helm-charts/0.24.5/charts/spire/templates/spire-agent-config-map.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,56 @@ | ||
# /* | ||
# | Protect your secrets, protect your sensitive data. | ||
# : Explore VMware Secrets Manager docs at https://vsecm.com/ | ||
# </ | ||
# <>/ keep your secrets... secret | ||
# >/ | ||
# <>/' Copyright 2023-present VMware Secrets Manager contributors. | ||
# >/' SPDX-License-Identifier: BSD-2-Clause | ||
# */ | ||
|
||
# ConfigMap for the SPIRE agent featuring: | ||
# 1) PSAT node attestation | ||
# 2) K8S Workload Attestation over the secure kubelet port | ||
apiVersion: v1 | ||
kind: ConfigMap | ||
metadata: | ||
name: spire-agent | ||
namespace: {{ .Values.global.spire.namespace }} | ||
data: | ||
agent.conf: | | ||
agent { | ||
data_dir = "/run/spire" | ||
log_level = {{ .Values.global.spire.logLevel | quote }} | ||
server_address = "spire-server" | ||
server_port = {{ .Values.global.spire.serverPort | quote }} | ||
socket_path = "/run/spire/sockets/agent.sock" | ||
trust_bundle_path = "/run/spire/bundle/bundle.crt" | ||
trust_domain = {{ .Values.global.spire.trustDomain | quote }} | ||
} | ||
health_checks { | ||
bind_address = "0.0.0.0" | ||
bind_port = "9982" | ||
listener_enabled = true | ||
live_path = "/live" | ||
ready_path = "/ready" | ||
} | ||
plugins { | ||
NodeAttestor "k8s_psat" { | ||
plugin_data { | ||
cluster = "vsecm-cluster" | ||
} | ||
} | ||
KeyManager "memory" { | ||
plugin_data { | ||
} | ||
} | ||
WorkloadAttestor "k8s" { | ||
plugin_data { | ||
skip_kubelet_verification = true | ||
} | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
16 changes: 16 additions & 0 deletions
16
helm-charts/0.24.5/charts/spire/templates/spire-agent-service-account.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,16 @@ | ||
# /* | ||
# | Protect your secrets, protect your sensitive data. | ||
# : Explore VMware Secrets Manager docs at https://vsecm.com/ | ||
# </ | ||
# <>/ keep your secrets... secret | ||
# >/ | ||
# <>/' Copyright 2023-present VMware Secrets Manager contributors. | ||
# >/' SPDX-License-Identifier: BSD-2-Clause | ||
# */ | ||
|
||
# ServiceAccount for the SPIRE agent | ||
apiVersion: v1 | ||
kind: ServiceAccount | ||
metadata: | ||
name: spire-agent | ||
namespace: {{ .Values.global.spire.namespace }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.