Skip to content

Commit 9718190

Browse files
marcofranssenmarcofranssen
committed
Merge branch 'values-cleanup'
2 parents 911598c + 925f3e5 commit 9718190

9 files changed

Lines changed: 140 additions & 164 deletions

File tree

‎charts/spire/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ description: |
2727
- --service-account-signing-key-file=/run/config/pki/sa.key
2828
```
2929
type: application
30-
version: 0.5.6
30+
version: 0.6.0
3131
appVersion: "1.5.0"
3232
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc"]
3333
home: https://github.com/philips-labs/helm-charts/charts/spire

‎charts/spire/README.md‎

Lines changed: 26 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<!-- This README.md is generated. -->
44

5-
![Version: 0.5.6](https://img.shields.io/badge/Version-0.5.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
5+
![Version: 0.6.0](https://img.shields.io/badge/Version-0.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.5.0](https://img.shields.io/badge/AppVersion-1.5.0-informational?style=flat-square)
66

77
A Helm chart for deploying spire-server and spire-agent.
88

@@ -50,17 +50,13 @@ Kubernetes: `>=1.21.0-0`
5050

5151
| Key | Type | Default | Description |
5252
|-----|------|---------|-------------|
53-
| affinity | object | `{}` | |
53+
| agent.config.logLevel | string | `"info"` | |
5454
| agent.image.pullPolicy | string | `"IfNotPresent"` | |
5555
| agent.image.registry | string | `"ghcr.io"` | |
5656
| agent.image.repository | string | `"spiffe/spire-agent"` | |
5757
| agent.image.version | string | `""` | |
5858
| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
5959
| agent.resources | object | `{}` | |
60-
| autoscaling.enabled | bool | `false` | |
61-
| autoscaling.maxReplicas | int | `100` | |
62-
| autoscaling.minReplicas | int | `1` | |
63-
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
6460
| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | |
6561
| csiDriver.image.registry | string | `"ghcr.io"` | |
6662
| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | |
@@ -74,35 +70,39 @@ Kubernetes: `>=1.21.0-0`
7470
| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | |
7571
| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | |
7672
| nodeDriverRegistrar.resources | object | `{}` | |
77-
| oidc.acme.cacheDir | string | `"/run/spire"` | |
78-
| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
79-
| oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | |
80-
| oidc.acme.tosAccepted | bool | `false` | |
81-
| oidc.domains[0] | string | `"localhost"` | |
82-
| oidc.domains[1] | string | `"spire-oidc.spire"` | |
83-
| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | |
84-
| oidc.domains[3] | string | `"oidc-discovery.example.org"` | |
73+
| oidc.affinity | object | `{}` | |
74+
| oidc.config.acme.cacheDir | string | `"/run/spire"` | |
75+
| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
76+
| oidc.config.acme.emailAddress | string | `"letsencrypt@example.org"` | |
77+
| oidc.config.acme.tosAccepted | bool | `false` | |
78+
| oidc.config.domains[0] | string | `"localhost"` | |
79+
| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` | |
80+
| oidc.config.logLevel | string | `"info"` | |
8581
| oidc.enabled | bool | `false` | |
8682
| oidc.image.pullPolicy | string | `"IfNotPresent"` | |
8783
| oidc.image.registry | string | `"ghcr.io"` | |
8884
| oidc.image.repository | string | `"spiffe/spire-oidc-provider"` | |
8985
| oidc.image.version | string | `""` | |
9086
| oidc.insecureScheme.enabled | bool | `false` | |
9187
| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
92-
| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | |
93-
| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | |
94-
| oidc.insecureScheme.nginx.image.version | string | `"alpine"` | |
95-
| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | |
96-
| oidc.logLevel | string | `"INFO"` | |
88+
| oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | |
89+
| oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | |
90+
| oidc.insecureScheme.nginx.image.version | float | `1.23` | |
9791
| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
92+
| oidc.podAnnotations | object | `{}` | |
93+
| oidc.podSecurityContext | object | `{}` | |
94+
| oidc.replicaCount | int | `1` | |
9895
| oidc.resources | object | `{}` | |
96+
| oidc.securityContext | object | `{}` | |
9997
| oidc.service.annotations | object | `{}` | |
10098
| oidc.service.port | int | `80` | |
10199
| oidc.service.type | string | `"NodePort"` | |
102-
| podAnnotations | object | `{}` | |
103-
| podSecurityContext | object | `{}` | |
104-
| replicaCount | int | `1` | |
105-
| securityContext | object | `{}` | |
100+
| oidc.tolerations | list | `[]` | |
101+
| server.config.ca_subject.common_name | string | `"example.org"` | |
102+
| server.config.ca_subject.country | string | `"NL"` | |
103+
| server.config.ca_subject.organization | string | `"Example"` | |
104+
| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | |
105+
| server.config.logLevel | string | `"info"` | |
106106
| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | |
107107
| server.dataStorage.enabled | bool | `true` | |
108108
| server.dataStorage.size | string | `"1Gi"` | |
@@ -112,17 +112,17 @@ Kubernetes: `>=1.21.0-0`
112112
| server.image.repository | string | `"spiffe/spire-server"` | |
113113
| server.image.version | string | `""` | |
114114
| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
115+
| server.podSecurityContext | object | `{}` | |
116+
| server.replicaCount | int | `1` | |
115117
| server.resources | object | `{}` | |
118+
| server.securityContext | object | `{}` | |
116119
| server.service.port | int | `8081` | |
117120
| server.service.type | string | `"ClusterIP"` | |
118121
| serviceAccount.annotations | object | `{}` | |
119122
| serviceAccount.create | bool | `true` | |
120123
| serviceAccount.name | string | `""` | |
121-
| spire.agent.logLevel | string | `"info"` | |
122124
| spire.clusterName | string | `"example-cluster"` | |
123-
| spire.server.logLevel | string | `"info"` | |
124125
| spire.trustDomain | string | `"example.org"` | |
125-
| tolerations | list | `[]` | |
126126
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
127127
| waitForIt.image.registry | string | `"gcr.io"` | |
128128
| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | |

‎charts/spire/templates/agent-configmap.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ data:
77
agent.conf: |
88
agent {
99
data_dir = "/run/spire"
10-
log_level = "{{ .Values.spire.agent.logLevel }}"
10+
log_level = "{{ .Values.agent.config.logLevel }}"
1111
server_address = "{{ include "spire.fullname" . }}-server"
1212
server_port = "{{ .Values.server.service.port }}"
1313
socket_path = "/run/spire/agent-sockets/agent.sock"

‎charts/spire/templates/hpa.yaml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎charts/spire/templates/oidc-deployment.yaml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,15 +7,13 @@ metadata:
77
labels:
88
{{- include "spire.oidc.labels" . | nindent 4 }}
99
spec:
10-
{{- if not .Values.autoscaling.enabled }}
11-
replicas: {{ .Values.replicaCount }}
12-
{{- end }}
10+
replicas: {{ .Values.oidc.replicaCount }}
1311
selector:
1412
matchLabels:
1513
{{- include "spire.oidc.selectorLabels" . | nindent 6 }}
1614
template:
1715
metadata:
18-
{{- with .Values.podAnnotations }}
16+
{{- with .Values.oidc.podAnnotations }}
1917
annotations:
2018
{{- toYaml . | nindent 8 }}
2119
{{- end }}
@@ -30,7 +28,7 @@ spec:
3028
{{- end }}
3129
serviceAccountName: {{ include "spire.serviceAccountName" . }}-agent
3230
securityContext:
33-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
31+
{{- toYaml .Values.oidc.podSecurityContext | nindent 8 }}
3432
containers:
3533
- name: spire-oidc
3634
securityContext:
@@ -102,15 +100,15 @@ spec:
102100
- name: spire-oidc-config
103101
configMap:
104102
name: {{ include "spire.fullname" . }}-oidc-discovery-provider
105-
{{- with .Values.nodeSelector }}
103+
{{- with .Values.oidc.nodeSelector }}
106104
nodeSelector:
107105
{{- toYaml . | nindent 8 }}
108106
{{- end }}
109-
{{- with .Values.affinity }}
107+
{{- with .Values.oidc.affinity }}
110108
affinity:
111109
{{- toYaml . | nindent 8 }}
112110
{{- end }}
113-
{{- with .Values.tolerations }}
111+
{{- with .Values.oidc.tolerations }}
114112
tolerations:
115113
{{- toYaml . | nindent 8 }}
116114
{{- end }}

‎charts/spire/templates/oidc-dp-configmap.yaml‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,21 +6,25 @@ metadata:
66
namespace: {{ .Release.Namespace }}
77
data:
88
oidc-discovery-provider.conf: |
9-
log_level = "{{ .Values.oidc.logLevel }}"
10-
{{ if gt (len .Values.oidc.domains) 0 }}
11-
domains = ["{{- join "\", \"" .Values.oidc.domains }}"]
12-
{{ else }}
13-
domains = []
14-
{{ end }}
9+
log_level = "{{ .Values.oidc.config.logLevel }}"
10+
11+
domains = [
12+
"spire-oidc.{{ .Release.Namespace }}",
13+
"spire-oidc.{{ .Release.Namespace }}.svc.cluster.local",
14+
{{- if gt (len .Values.oidc.config.domains) 0 }}
15+
"{{- join "\",\n \"" .Values.oidc.config.domains }}"
16+
{{- end }}
17+
]
18+
1519
{{- if .Values.oidc.insecureScheme.enabled }}
1620
allow_insecure_scheme = {{ .Values.oidc.insecureScheme.enabled }}
1721
listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
1822
{{- else }}
1923
acme {
20-
directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
21-
cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
22-
tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
23-
email = "{{ .Values.oidc.acme.emailAddress }}"
24+
directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
25+
cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}"
26+
tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }}
27+
email = "{{ .Values.oidc.config.acme.emailAddress }}"
2428
}
2529
{{- end }}
2630

‎charts/spire/templates/server-configmap.yaml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,19 +11,21 @@ data:
1111
socket_path = "/run/spire/server-sockets/registration.sock"
1212
trust_domain = {{ .Values.spire.trustDomain | quote }}
1313
data_dir = "/run/spire/data"
14-
log_level = "{{ .Values.spire.server.logLevel }}"
15-
#AWS requires the use of RSA. EC cryptography is not supported
14+
log_level = "{{ .Values.server.config.logLevel }}"
15+
# AWS requires the use of RSA. EC cryptography is not supported
1616
ca_key_type = "rsa-2048"
1717
1818
{{- if eq (.Values.oidc.enabled | toString) "true" }}
19-
jwt_issuer = "{{ .Values.oidc.jwtIssuer }}"
19+
jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
2020
{{ end }}
2121
default_x509_svid_ttl = "1h"
2222
default_jwt_svid_ttl = "1h"
2323
ca_subject = {
24-
country = ["NL"],
25-
organization = ["EXAMPLE"],
26-
common_name = "",
24+
{{- with .Values.server.config.ca_subject }}
25+
country = [{{ .country | quote }}],
26+
organization = [{{ .organization | quote }}],
27+
common_name = {{ .common_name | quote }},
28+
{{- end }}
2729
}
2830
}
2931

‎charts/spire/templates/server-statefulset.yaml‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,14 @@ metadata:
66
labels:
77
{{- include "spire.server.labels" . | nindent 4 }}
88
spec:
9-
{{- if not .Values.autoscaling.enabled }}
10-
replicas: {{ .Values.replicaCount }}
11-
{{- end }}
9+
replicas: {{ .Values.server.replicaCount }}
1210
serviceName: {{ include "spire.fullname" . }}-server
1311
selector:
1412
matchLabels:
1513
{{- include "spire.server.selectorLabels" . | nindent 6 }}
1614
template:
1715
metadata:
18-
{{- with .Values.podAnnotations }}
16+
{{- with .Values.oidc.podAnnotations }}
1917
annotations:
2018
{{- toYaml . | nindent 8 }}
2119
{{- end }}
@@ -31,7 +29,7 @@ spec:
3129
serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
3230
shareProcessNamespace: true
3331
securityContext:
34-
{{- toYaml .Values.podSecurityContext | nindent 8 }}
32+
{{- toYaml .Values.server.podSecurityContext | nindent 8 }}
3533
{{- with .Values.server.nodeSelector }}
3634
nodeSelector:
3735
{{- toYaml . | nindent 8 }}
@@ -99,11 +97,11 @@ spec:
9997
nodeSelector:
10098
{{- toYaml . | nindent 8 }}
10199
{{- end }}
102-
{{- with .Values.affinity }}
100+
{{- with .Values.server.affinity }}
103101
affinity:
104102
{{- toYaml . | nindent 8 }}
105103
{{- end }}
106-
{{- with .Values.tolerations }}
104+
{{- with .Values.server.tolerations }}
107105
tolerations:
108106
{{- toYaml . | nindent 8 }}
109107
{{- end }}

0 commit comments

Comments
 (0)