Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Agent support for bundle on host path #478

Merged
merged 6 commits into from
Oct 17, 2024
Merged

Agent support for bundle on host path #478

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a9ea915
Agent support for bundle on host path
kfox1111 Oct 14, 2024
2f1ae11
Update charts/spire/charts/spire-agent/values.yaml
kfox1111 Oct 17, 2024
4b32ff5
Merge branch 'main' into hostbundle
kfox1111 Oct 17, 2024
b545e73
Merge branch 'main' into hostbundle
kfox1111 Oct 17, 2024
641aac7
Fix docs
kfox1111 Oct 17, 2024
31e5f7a
Merge branch 'main' into hostbundle
kfox1111 Oct 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions charts/spire/charts/spire-agent/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ A Helm chart to install the SPIRE agent.
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host | `""` |
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `server.address` | Address for Spire server | `""` |
Expand Down
2 changes: 2 additions & 0 deletions charts/spire/charts/spire-agent/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@ agent:
{{- if ne (len .Values.trustBundleURL) 0 }}
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
{{- else if ne (len .Values.trustBundleHostPath) 0 }}
trust_bundle_path: {{ .Values.trustBundleHostPath | quote }}
{{- else }}
trust_bundle_path: "/run/spire/bundle/bundle.crt"
{{- end }}
Expand Down
11 changes: 10 additions & 1 deletion charts/spire/charts/spire-agent/templates/daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,8 +265,12 @@ spec:
{{- end }}
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
mountPath: /run/spire/bundle
readOnly: true
{{- if ne (len .Values.trustBundleHostPath) 0 }}
mountPath: {{ .Values.trustBundleHostPath | dir | quote }}
{{- else }}
mountPath: /run/spire/bundle
{{- end }}
{{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: tpm-direct
Expand Down Expand Up @@ -348,9 +352,14 @@ spec:
{{- end }}
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
{{- if ne (len .Values.trustBundleHostPath) 0 }}
hostPath:
path: {{ .Values.trustBundleHostPath | dir | quote }}
{{- else }}
configMap:
name: {{ printf "%s%s" (include "spire-lib.bundle-configmap" .) $nameSuffix | quote }}
{{- end }}
{{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: tpm-direct
emptyDir: {}
Expand Down
2 changes: 2 additions & 0 deletions charts/spire/charts/spire-agent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,6 +95,8 @@ trustDomain: example.org
trustBundleURL: ""
## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
trustBundleFormat: pem
## @param trustBundleHostPath If set, obtain trust bundle from a file on the host
kfox1111 marked this conversation as resolved.
Show resolved Hide resolved
trustBundleHostPath: ""
## @param bundleConfigMap Configmap name for Spire bundle
bundleConfigMap: spire-bundle
## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.
Expand Down
Loading