Skip to content

Commit aee2686

Browse files
TessaIOTessaIO
committed
deploy: add spire manifests in helm and kustomize
Signed-off-by: TessaIO <[email protected]>
1 parent d6d2ecf commit aee2686

33 files changed

+754
-57
lines changed

‎deployment/components/master-config/nfd-master.conf.example

+1
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
# enableTaints: false
77
# labelWhiteList: "foo"
88
# resyncPeriod: "2h"
9+
# enableSpiffe: true
910
# klog:
1011
# addDirHeader: false
1112
# alsologtostderr: false

‎deployment/components/worker-config/nfd-worker.conf.example

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# labelWhiteList:
33
# noPublish: false
44
# sleepInterval: 60s
5+
# enableSpiffe: true
56
# featureSources: [all]
67
# labelSources: [all]
78
# klog:

‎deployment/helm/node-feature-discovery/templates/master.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -115,12 +115,20 @@ spec:
115115
- "-feature-gates={{ $key }}={{ $value }}"
116116
{{- end }}
117117
- "-metrics={{ .Values.master.metricsPort | default "8081" }}"
118+
{{- if .Values.spiffe.enable }}
119+
- "-enable-spiffe"
120+
{{- end }}
118121
volumeMounts:
119122
{{- if .Values.tls.enable }}
120123
- name: nfd-master-cert
121124
mountPath: "/etc/kubernetes/node-feature-discovery/certs"
122125
readOnly: true
123126
{{- end }}
127+
{{- if .Values.spiffe.enable }}
128+
- name: spire-agent-socket
129+
mountPath: /run/spire/sockets
130+
readOnly: true
131+
{{- end }}
124132
- name: nfd-master-conf
125133
mountPath: "/etc/kubernetes/node-feature-discovery"
126134
readOnly: true
@@ -130,6 +138,12 @@ spec:
130138
secret:
131139
secretName: nfd-master-cert
132140
{{- end }}
141+
{{- if .Values.spiffe.enable }}
142+
- name: spire-agent-socket
143+
hostPath:
144+
path: /run/spire/sockets
145+
type: Directory
146+
{{- end }}
133147
- name: nfd-master-conf
134148
configMap:
135149
name: {{ include "node-feature-discovery.fullname" . }}-master-conf

‎deployment/helm/node-feature-discovery/templates/spire-agent-cluster-role.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{- if .Values.spiffe.enable }}
2+
# Required cluster role to allow spire-agent to query k8s API server
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: spire-agent-cluster-role
7+
rules:
8+
- apiGroups: [""]
9+
resources: ["pods","nodes","nodes/proxy"]
10+
verbs: ["get"]
11+
12+
---
13+
# Binds above cluster role to spire-agent service account
14+
kind: ClusterRoleBinding
15+
apiVersion: rbac.authorization.k8s.io/v1
16+
metadata:
17+
name: spire-agent-cluster-role-binding
18+
subjects:
19+
- kind: ServiceAccount
20+
name: spire-agent
21+
namespace: {{ include "node-feature-discovery.namespace" . }}
22+
roleRef:
23+
kind: ClusterRole
24+
name: spire-agent-cluster-role
25+
apiGroup: rbac.authorization.k8s.io
26+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-agent-configmap.yaml

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: spire-agent
6+
data:
7+
agent.conf: |
8+
agent {
9+
data_dir = "/run/spire"
10+
log_level = "DEBUG"
11+
server_address = "spire-server"
12+
server_port = "8081"
13+
socket_path = "/run/spire/sockets/agent.sock"
14+
trust_bundle_path = "/run/spire/bundle/bundle.crt"
15+
trust_domain = "nfd.com"
16+
}
17+
plugins {
18+
NodeAttestor "k8s_sat" {
19+
plugin_data {
20+
cluster = "nfd"
21+
}
22+
}
23+
KeyManager "memory" {
24+
plugin_data {
25+
}
26+
}
27+
WorkloadAttestor "k8s" {
28+
plugin_data {
29+
skip_kubelet_verification = true
30+
node_name_env = "MY_NODE_NAME"
31+
}
32+
}
33+
WorkloadAttestor "unix" {
34+
plugin_data {
35+
}
36+
}
37+
}
38+
health_checks {
39+
listener_enabled = true
40+
bind_address = "0.0.0.0"
41+
bind_port = "8080"
42+
live_path = "/live"
43+
ready_path = "/ready"
44+
}
45+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-agent-daemonset.yaml

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: apps/v1
3+
kind: DaemonSet
4+
metadata:
5+
name: spire-agent
6+
labels:
7+
app: spire-agent
8+
spec:
9+
selector:
10+
matchLabels:
11+
app: spire-agent
12+
template:
13+
metadata:
14+
labels:
15+
app: spire-agent
16+
spec:
17+
hostPID: true
18+
hostNetwork: true
19+
dnsPolicy: ClusterFirstWithHostNet
20+
serviceAccountName: spire-agent
21+
initContainers:
22+
- name: init
23+
# This is a small image with wait-for-it, choose whatever image
24+
# you prefer that waits for a service to be up. This image is built
25+
# from https://github.com/lqhl/wait-for-it
26+
image: cgr.dev/chainguard/wait-for-it
27+
args: ["-t", "30", "spire-server:8081"]
28+
containers:
29+
- name: spire-agent
30+
image: ghcr.io/spiffe/spire-agent:1.5.1
31+
args: ["-config", "/run/spire/config/agent.conf"]
32+
env:
33+
- name: MY_NODE_NAME
34+
valueFrom:
35+
fieldRef:
36+
fieldPath: status.podIP
37+
volumeMounts:
38+
- name: spire-config
39+
mountPath: /run/spire/config
40+
readOnly: true
41+
- name: spire-bundle
42+
mountPath: /run/spire/bundle
43+
- name: spire-agent-socket
44+
mountPath: /run/spire/sockets
45+
readOnly: false
46+
volumes:
47+
- name: spire-config
48+
configMap:
49+
name: spire-agent
50+
- name: spire-bundle
51+
configMap:
52+
name: spire-bundle
53+
- name: spire-agent-socket
54+
hostPath:
55+
path: /run/spire/sockets
56+
type: DirectoryOrCreate
57+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-agent-service-account.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: spire-agent
6+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-bundle-configmap.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: spire-bundle
6+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-server-cluster-role.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{{- if .Values.spiffe.enable }}
2+
# Role (namespace scoped) to be able to push certificate bundles to a configmap
3+
kind: Role
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: spire-server-configmap-role
7+
rules:
8+
- apiGroups: [""]
9+
resources: ["configmaps"]
10+
verbs: ["patch", "get", "list"]
11+
---
12+
# Binds above role to spire-server service account
13+
kind: RoleBinding
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
metadata:
16+
name: spire-server-configmap-role-binding
17+
namespace: {{ include "node-feature-discovery.namespace" . }}
18+
subjects:
19+
- kind: ServiceAccount
20+
name: spire-server
21+
namespace: {{ include "node-feature-discovery.namespace" . }}
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: Role
25+
name: spire-server-configmap-role
26+
---
27+
# ClusterRole to allow spire-server node attestor to query Token Review API
28+
kind: ClusterRole
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
metadata:
31+
name: spire-server-trust-role
32+
rules:
33+
- apiGroups: ["authentication.k8s.io"]
34+
resources: ["tokenreviews"]
35+
verbs: ["create"]
36+
---
37+
# Binds above cluster role to spire-server service account
38+
kind: ClusterRoleBinding
39+
apiVersion: rbac.authorization.k8s.io/v1
40+
metadata:
41+
name: spire-server-trust-role-binding
42+
subjects:
43+
- kind: ServiceAccount
44+
name: spire-server
45+
namespace: {{ include "node-feature-discovery.namespace" . }}
46+
roleRef:
47+
kind: ClusterRole
48+
name: spire-server-trust-role
49+
apiGroup: rbac.authorization.k8s.io
50+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-server-configmap.yaml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: spire-server
6+
data:
7+
server.conf: |
8+
server {
9+
bind_address = "0.0.0.0"
10+
bind_port = "8081"
11+
socket_path = "/tmp/spire-server/private/api.sock"
12+
trust_domain = "nfd.com"
13+
data_dir = "/run/spire/data"
14+
log_level = "DEBUG"
15+
#AWS requires the use of RSA. EC cryptography is not supported
16+
ca_key_type = "rsa-2048"
17+
ca_subject = {
18+
country = ["US"],
19+
organization = ["SPIFFE"],
20+
common_name = "nfd.com",
21+
}
22+
}
23+
plugins {
24+
DataStore "sql" {
25+
plugin_data {
26+
database_type = "sqlite3"
27+
connection_string = "/run/spire/data/datastore.sqlite3"
28+
}
29+
}
30+
NodeAttestor "k8s_sat" {
31+
plugin_data {
32+
clusters = {
33+
"nfd" = {
34+
use_token_review_api_validation = true
35+
service_account_allow_list = ["{{ include "node-feature-discovery.namespace" . }}:spire-agent"]
36+
}
37+
}
38+
}
39+
}
40+
KeyManager "disk" {
41+
plugin_data {
42+
keys_path = "/run/spire/data/keys.json"
43+
}
44+
}
45+
Notifier "k8sbundle" {
46+
plugin_data {
47+
namespace = "{{ include "node-feature-discovery.namespace" . }}"
48+
}
49+
}
50+
}
51+
health_checks {
52+
listener_enabled = true
53+
bind_address = "0.0.0.0"
54+
bind_port = "8080"
55+
live_path = "/live"
56+
ready_path = "/ready"
57+
}
58+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-server-service-account.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: spire-server
6+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-server-service.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: spire-server
6+
spec:
7+
type: NodePort
8+
ports:
9+
- name: grpc
10+
port: 8081
11+
targetPort: 8081
12+
protocol: TCP
13+
selector:
14+
app: spire-server
15+
{{- end }}

‎deployment/helm/node-feature-discovery/templates/spire-server-statefulset.yaml

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{- if .Values.spiffe.enable }}
2+
apiVersion: apps/v1
3+
kind: StatefulSet
4+
metadata:
5+
name: spire-server
6+
labels:
7+
app: spire-server
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: spire-server
13+
serviceName: spire-server
14+
template:
15+
metadata:
16+
labels:
17+
app: spire-server
18+
spec:
19+
serviceAccountName: spire-server
20+
containers:
21+
- name: spire-server
22+
image: ghcr.io/spiffe/spire-server:1.5.1
23+
args:
24+
- -config
25+
- /run/spire/config/server.conf
26+
ports:
27+
- containerPort: 8081
28+
volumeMounts:
29+
- name: spire-config
30+
mountPath: /run/spire/config
31+
readOnly: true
32+
- name: spire-data
33+
mountPath: /run/spire/data
34+
readOnly: false
35+
livenessProbe:
36+
httpGet:
37+
path: /live
38+
port: 8080
39+
failureThreshold: 2
40+
initialDelaySeconds: 15
41+
periodSeconds: 60
42+
timeoutSeconds: 3
43+
readinessProbe:
44+
httpGet:
45+
path: /ready
46+
port: 8080
47+
initialDelaySeconds: 5
48+
periodSeconds: 5
49+
volumes:
50+
- name: spire-config
51+
configMap:
52+
name: spire-server
53+
volumeClaimTemplates:
54+
- metadata:
55+
name: spire-data
56+
spec:
57+
accessModes:
58+
- ReadWriteOnce
59+
resources:
60+
requests:
61+
storage: 1Gi
62+
{{- end }}

0 commit comments

Comments
 (0)