Skip to content

Commit d577247

Browse files
marcofranssenmarcofranssen
committed
Add a template to build the image string
This also allows to use image digest as a version
1 parent aaeb702 commit d577247

6 files changed

Lines changed: 80 additions & 40 deletions

File tree

‎charts/spire/README.md‎

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -52,24 +52,27 @@ Kubernetes: `>=1.21.0-0`
5252
|-----|------|---------|-------------|
5353
| affinity | object | `{}` | |
5454
| agent.image.pullPolicy | string | `"IfNotPresent"` | |
55-
| agent.image.repository | string | `"gcr.io/spiffe-io/spire-agent"` | |
56-
| agent.image.tag | string | `""` | |
55+
| agent.image.registry | string | `"gcr.io"` | |
56+
| agent.image.repository | string | `"spiffe-io/spire-agent"` | |
57+
| agent.image.version | string | `""` | |
5758
| agent.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
5859
| agent.resources | object | `{}` | |
5960
| autoscaling.enabled | bool | `false` | |
6061
| autoscaling.maxReplicas | int | `100` | |
6162
| autoscaling.minReplicas | int | `1` | |
6263
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
6364
| csiDriver.image.pullPolicy | string | `"IfNotPresent"` | |
64-
| csiDriver.image.repository | string | `"ghcr.io/spiffe/spiffe-csi-driver"` | |
65-
| csiDriver.image.tag | string | `"0.2.0"` | |
65+
| csiDriver.image.registry | string | `"ghcr.io"` | |
66+
| csiDriver.image.repository | string | `"spiffe/spiffe-csi-driver"` | |
67+
| csiDriver.image.version | string | `"0.2.0"` | |
6668
| csiDriver.resources | object | `{}` | |
6769
| fullnameOverride | string | `""` | |
6870
| imagePullSecrets | list | `[]` | |
6971
| nameOverride | string | `""` | |
7072
| nodeDriverRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
71-
| nodeDriverRegistrar.image.repository | string | `"quay.io/k8scsi/csi-node-driver-registrar"` | |
72-
| nodeDriverRegistrar.image.tag | string | `"v2.0.1"` | |
73+
| nodeDriverRegistrar.image.registry | string | `"quay.io"` | |
74+
| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | |
75+
| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | |
7376
| nodeDriverRegistrar.resources | object | `{}` | |
7477
| oidc.acme.cacheDir | string | `"/run/spire"` | |
7578
| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
@@ -81,12 +84,14 @@ Kubernetes: `>=1.21.0-0`
8184
| oidc.domains[3] | string | `"oidc-discovery.example.org"` | |
8285
| oidc.enabled | bool | `false` | |
8386
| oidc.image.pullPolicy | string | `"IfNotPresent"` | |
84-
| oidc.image.repository | string | `"gcr.io/spiffe-io/oidc-discovery-provider"` | |
85-
| oidc.image.tag | string | `""` | |
87+
| oidc.image.registry | string | `"gcr.io"` | |
88+
| oidc.image.repository | string | `"spiffe-io/oidc-discovery-provider"` | |
89+
| oidc.image.version | string | `""` | |
8690
| oidc.insecureScheme.enabled | bool | `false` | |
87-
| oidc.insecureScheme.nginx.pullPolicy | string | `"IfNotPresent"` | |
88-
| oidc.insecureScheme.nginx.repository | string | `"nginx"` | |
89-
| oidc.insecureScheme.nginx.tag | string | `"alpine"` | |
91+
| oidc.insecureScheme.nginx.image.pullPolicy | string | `"IfNotPresent"` | |
92+
| oidc.insecureScheme.nginx.image.registry | string | `"docker.io"` | |
93+
| oidc.insecureScheme.nginx.image.repository | string | `"nginx"` | |
94+
| oidc.insecureScheme.nginx.image.version | string | `"alpine"` | |
9095
| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | |
9196
| oidc.logLevel | string | `"INFO"` | |
9297
| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
@@ -103,8 +108,9 @@ Kubernetes: `>=1.21.0-0`
103108
| server.dataStorage.size | string | `"1Gi"` | |
104109
| server.dataStorage.storageClass | string | `nil` | |
105110
| server.image.pullPolicy | string | `"IfNotPresent"` | |
106-
| server.image.repository | string | `"gcr.io/spiffe-io/spire-server"` | |
107-
| server.image.tag | string | `""` | |
111+
| server.image.registry | string | `"gcr.io"` | |
112+
| server.image.repository | string | `"spiffe-io/spire-server"` | |
113+
| server.image.version | string | `""` | |
108114
| server.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
109115
| server.resources | object | `{}` | |
110116
| server.service.port | int | `8081` | |
@@ -117,7 +123,12 @@ Kubernetes: `>=1.21.0-0`
117123
| spire.server.logLevel | string | `"INFO"` | |
118124
| spire.trustDomain | string | `"example.org"` | |
119125
| tolerations | list | `[]` | |
126+
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
127+
| waitForIt.image.registry | string | `"gcr.io"` | |
128+
| waitForIt.image.repository | string | `"spiffe-io/wait-for-it"` | |
129+
| waitForIt.image.version | string | `""` | |
120130
| workloadRegistrar.image.pullPolicy | string | `"IfNotPresent"` | |
121-
| workloadRegistrar.image.repository | string | `"gcr.io/spiffe-io/k8s-workload-registrar"` | |
122-
| workloadRegistrar.image.tag | string | `""` | |
131+
| workloadRegistrar.image.registry | string | `"gcr.io"` | |
132+
| workloadRegistrar.image.repository | string | `"spiffe-io/k8s-workload-registrar"` | |
133+
| workloadRegistrar.image.version | string | `""` | |
123134
| workloadRegistrar.resources | object | `{}` | |

‎charts/spire/templates/_helpers.tpl‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,3 +120,15 @@ Create the name of the service account to use
120120
{{- default "default" .Values.serviceAccount.name }}
121121
{{- end }}
122122
{{- end }}
123+
124+
{{- define "spire.image" -}}
125+
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
126+
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
127+
{{- else if .appVersion -}}
128+
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
129+
{{- else if .image.version -}}
130+
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
131+
{{- else -}}
132+
{{- printf "%s/%s" .image.registry .image.repository -}}
133+
{{- end -}}
134+
{{- end }}

‎charts/spire/templates/agent-daemonset.yaml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,17 @@ spec:
2525
# This is a small image with wait-for-it, choose whatever image
2626
# you prefer that waits for a service to be up. This image is built
2727
# from https://github.com/lqhl/wait-for-it
28-
image: gcr.io/spiffe-io/wait-for-it:latest
28+
image: {{ template "spire.image" .Values.waitForIt }}
29+
imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
2930
args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
3031
{{- with .Values.agent.nodeSelector }}
3132
nodeSelector:
3233
{{- toYaml . | nindent 8 }}
3334
{{- end }}
3435
containers:
3536
- name: {{ .Chart.Name }}-agent
36-
image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
37+
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
38+
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
3739
args: ["-config", "/run/spire/config/agent.conf"]
3840
volumeMounts:
3941
- name: spire-config
@@ -63,8 +65,8 @@ spec:
6365
{{- toYaml .Values.agent.resources | nindent 12 }}
6466
# This is the container which runs the SPIFFE CSI driver.
6567
- name: spiffe-csi-driver
66-
image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}}
67-
imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}}
68+
image: {{ template "spire.image" .Values.csiDriver }}
69+
imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
6870
args: [
6971
"-workload-api-socket-dir", "/spire-agent-socket",
7072
"-csi-socket-path", "/spiffe-csi/csi.sock",
@@ -98,7 +100,7 @@ spec:
98100
# of all the little details required to register a CSI driver with
99101
# the kubelet.
100102
- name: node-driver-registrar
101-
image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }}
103+
image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
102104
imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
103105
args: [
104106
"-csi-address", "/spiffe-csi/csi.sock",

‎charts/spire/templates/oidc-deployment.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ spec:
3535
- name: spire-oidc
3636
securityContext:
3737
{{- toYaml .Values.securityContext | nindent 12 }}
38-
image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
38+
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }}
3939
imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
4040
args:
4141
- -config
@@ -71,8 +71,8 @@ spec:
7171
- name: nginx
7272
securityContext:
7373
{{- toYaml .Values.securityContext | nindent 12 }}
74-
image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}"
75-
imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }}
74+
image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }}
75+
imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }}
7676
ports:
7777
- containerPort: 80
7878
name: http

‎charts/spire/templates/server-statefulset.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ spec:
4040
- name: {{ .Chart.Name }}-server
4141
securityContext:
4242
{{- toYaml .Values.securityContext | nindent 12 }}
43-
image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}"
43+
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }}
4444
imagePullPolicy: {{ .Values.server.image.pullPolicy }}
4545
args:
4646
- -config
@@ -80,7 +80,7 @@ spec:
8080
- name: {{ .Chart.Name }}-workload-registrar
8181
securityContext:
8282
{{- toYaml .Values.securityContext | nindent 12 }}
83-
image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}"
83+
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
8484
imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
8585
args:
8686
- -config

‎charts/spire/values.yaml‎

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,20 @@
44

55
replicaCount: 1
66

7+
waitForIt:
8+
image:
9+
registry: gcr.io
10+
repository: spiffe-io/wait-for-it
11+
pullPolicy: IfNotPresent
12+
version: ""
13+
714
workloadRegistrar:
815
image:
9-
repository: gcr.io/spiffe-io/k8s-workload-registrar
16+
registry: gcr.io
17+
repository: spiffe-io/k8s-workload-registrar
1018
pullPolicy: IfNotPresent
1119
# Overrides the image tag whose default is the chart appVersion.
12-
tag: ""
20+
version: ""
1321

1422
resources: {}
1523
# We usually recommend not to specify default resources and to leave this as a conscious
@@ -25,10 +33,11 @@ workloadRegistrar:
2533

2634
server:
2735
image:
28-
repository: gcr.io/spiffe-io/spire-server
36+
registry: gcr.io
37+
repository: spiffe-io/spire-server
2938
pullPolicy: IfNotPresent
3039
# Overrides the image tag whose default is the chart appVersion.
31-
tag: ""
40+
version: ""
3241

3342
nodeSelector:
3443
kubernetes.io/arch: amd64
@@ -57,9 +66,10 @@ server:
5766

5867
csiDriver:
5968
image:
60-
repository: ghcr.io/spiffe/spiffe-csi-driver
69+
registry: ghcr.io
70+
repository: spiffe/spiffe-csi-driver
6171
pullPolicy: IfNotPresent
62-
tag: 0.2.0
72+
version: 0.2.0
6373
resources: {}
6474
# We usually recommend not to specify default resources and to leave this as a conscious
6575
# choice for the user. This also increases chances charts run on environments with little
@@ -74,9 +84,10 @@ csiDriver:
7484

7585
nodeDriverRegistrar:
7686
image:
77-
repository: quay.io/k8scsi/csi-node-driver-registrar
87+
registry: quay.io
88+
repository: k8scsi/csi-node-driver-registrar
7889
pullPolicy: IfNotPresent
79-
tag: v2.0.1
90+
version: v2.0.1
8091
resources: {}
8192
# We usually recommend not to specify default resources and to leave this as a conscious
8293
# choice for the user. This also increases chances charts run on environments with little
@@ -93,9 +104,10 @@ oidc:
93104
enabled: false
94105

95106
image:
96-
repository: gcr.io/spiffe-io/oidc-discovery-provider
107+
registry: gcr.io
108+
repository: spiffe-io/oidc-discovery-provider
97109
pullPolicy: IfNotPresent
98-
tag: ""
110+
version: ""
99111

100112
nodeSelector:
101113
kubernetes.io/arch: amd64
@@ -132,9 +144,11 @@ oidc:
132144
enabled: false
133145

134146
nginx:
135-
repository: nginx
136-
pullPolicy: IfNotPresent
137-
tag: "alpine"
147+
image:
148+
registry: docker.io
149+
repository: nginx
150+
pullPolicy: IfNotPresent
151+
version: alpine
138152

139153
acme:
140154
tosAccepted: false
@@ -144,10 +158,11 @@ oidc:
144158

145159
agent:
146160
image:
147-
repository: gcr.io/spiffe-io/spire-agent
161+
registry: gcr.io
162+
repository: spiffe-io/spire-agent
148163
pullPolicy: IfNotPresent
149164
# Overrides the image tag whose default is the chart appVersion.
150-
tag: ""
165+
version: ""
151166

152167
nodeSelector:
153168
kubernetes.io/arch: amd64

0 commit comments

Comments
 (0)