Skip to content
This repository was archived by the owner on Mar 14, 2024. It is now read-only.

Commit 7acd0bf

Browse files
cygnuslyracygnuslyra
committed
Helm release - 1.3
1 parent 6f68327 commit 7acd0bf

18 files changed

+1092
-163
lines changed

‎helm-chart/Chart.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: nginx-service-mesh
33
description: NGINX Service Mesh
4-
version: 0.2.1
5-
appVersion: 1.2.1
6-
kubeVersion: "1.16-0 - 1.21-0"
4+
version: 0.3.0
5+
appVersion: 1.3.0
6+
kubeVersion: ">= 1.18-0"
77
icon: https://raw.githubusercontent.com/nginxinc/nginx-service-mesh/master/helm-chart/chart-icon.png

‎helm-chart/configs/k8s-workload-registrar.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ pod_controller = true
66
add_svc_dns_name = true
77
mode = "crd"
88
webhook_enabled = true
9-
webhook_cert_dir = "/tmp/k8s-webhook-server/serving-certs"
9+
identity_template_label = "spiffe.io/spiffeid"

‎helm-chart/configs/mesh-config.conf‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,19 @@
66
"port": 443
77
},
88
"autoInjectorPort": 9443,
9+
"environment": {{ quote .Values.environment }},
910
"injection": {
10-
"disabledNamespaces": {{ .Values.autoInjection.disabledNamespaces }},
11-
"enabledNamespaces": {{ .Values.autoInjection.enabledNamespaces }},
11+
"disabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.disabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
12+
"enabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.enabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
1213
"isAutoInjectEnabled": {{ not .Values.autoInjection.disable }}
1314
},
1415
"loadBalancingMethod": {{ quote .Values.nginxLBMethod }},
16+
"mtls": {
17+
"mode": {{ quote .Values.mtls.mode }},
18+
"caTTL": {{ quote .Values.mtls.caTTL }},
19+
"svidTTL": {{ quote .Values.mtls.svidTTL }},
20+
"caKeyType": {{ quote .Values.mtls.caKeyType }}
21+
},
1522
"mtlsMode": {{ quote .Values.mtls.mode }},
1623
"namespace": {{ quote .Release.Namespace }},
1724
"nginxErrorLogLevel": {{ quote .Values.nginxErrorLogLevel }},

‎helm-chart/configs/spire-server.conf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
server {
22
bind_address = "0.0.0.0"
33
bind_port = "8081"
4+
ca_key_type = {{ quote .Values.mtls.caKeyType }}
45
ca_ttl = {{ quote .Values.mtls.caTTL }}
56
data_dir = "/run/spire/data"
67
log_level = "DEBUG"
@@ -59,3 +60,10 @@ plugins {
5960
{{ end }}
6061

6162
}
63+
64+
health_checks {
65+
listener_enabled = true
66+
bind_address = "0.0.0.0"
67+
live_path = "/live"
68+
ready_path = "/ready"
69+
}

‎helm-chart/crds/spiffeid.spiffe.io_spiffeids.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
name: spiffeids.spiffeid.spiffe.io
6+
labels:
7+
app.kubernetes.io/part-of: nginx-service-mesh
8+
spec:
9+
group: spiffeid.spiffe.io
10+
names:
11+
kind: SpiffeID
12+
listKind: SpiffeIDList
13+
plural: spiffeids
14+
singular: spiffeid
15+
scope: Namespaced
16+
versions:
17+
- name: v1beta1
18+
served: true
19+
storage: true
20+
subresources:
21+
status: {}
22+
schema:
23+
openAPIV3Schema:
24+
description: SpiffeID is the Schema for the spiffeid API
25+
properties:
26+
apiVersion:
27+
description: 'APIVersion defines the versioned schema of this representation
28+
of an object. Servers should convert recognized schemas to the latest
29+
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
30+
type: string
31+
kind:
32+
description: 'Kind is a string value representing the REST resource this
33+
object represents. Servers may infer this from the endpoint the client
34+
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
35+
type: string
36+
metadata:
37+
type: object
38+
spec:
39+
description: SpiffeIDSpec defines the desired state of SpiffeID
40+
properties:
41+
dnsNames:
42+
items:
43+
type: string
44+
type: array
45+
federatesWith:
46+
items:
47+
type: string
48+
type: array
49+
parentId:
50+
type: string
51+
selector:
52+
properties:
53+
arbitrary:
54+
description: Arbitrary selectors
55+
items:
56+
type: string
57+
type: array
58+
containerImage:
59+
description: Container image to match for this spiffe ID
60+
type: string
61+
containerName:
62+
description: Container name to match for this spiffe ID
63+
type: string
64+
namespace:
65+
description: Namespace to match for this spiffe ID
66+
type: string
67+
nodeName:
68+
description: Node name to match for this spiffe ID
69+
type: string
70+
podLabel:
71+
additionalProperties:
72+
type: string
73+
description: Pod label name/value to match for this spiffe ID
74+
type: object
75+
podName:
76+
description: Pod name to match for this spiffe ID
77+
type: string
78+
podUid:
79+
description: Pod UID to match for this spiffe ID
80+
type: string
81+
serviceAccount:
82+
description: ServiceAccount to match for this spiffe ID
83+
type: string
84+
cluster:
85+
description: The k8s_psat cluster name
86+
type: string
87+
agent_node_uid:
88+
description: UID of the node
89+
type: string
90+
type: object
91+
spiffeId:
92+
type: string
93+
required:
94+
- parentId
95+
- selector
96+
- spiffeId
97+
type: object
98+
status:
99+
description: SpiffeIDStatus defines the observed state of SpiffeID
100+
properties:
101+
entryId:
102+
description: 'INSERT ADDITIONAL STATUS FIELD - define observed state
103+
of cluster Important: Run "make" to regenerate code after modifying
104+
this file'
105+
type: string
106+
type: object
107+
type: object

‎helm-chart/templates/_helpers.tpl‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,18 @@ prometheus.{{.Release.Namespace}}.svc.cluster.local:9090
4040
{{- if not .Values.registry.disablePublicImages }}gcr.io/spiffe-io{{ else }}{{ .Values.registry.server }}{{ end }}
4141
{{- end }}
4242

43+
{{- define "node-driver.image-server" -}}
44+
{{- if not .Values.registry.disablePublicImages }}quay.io/k8scsi{{ else }}{{ .Values.registry.server }}{{ end }}
45+
{{- end }}
46+
4347
{{- define "hook.image-server" -}}
4448
{{- if not .Values.registry.disablePublicImages }}bitnami{{ else }}{{ .Values.registry.server }}{{ end }}
4549
{{- end }}
4650

51+
{{- define "ubuntu.image-server" -}}
52+
{{- if not .Values.registry.disablePublicImages }}{{ else }}{{ .Values.registry.server }}/{{ end }}
53+
{{- end }}
54+
4755
{{- define "registry-key-name" -}}
4856
nginx-mesh-registry-key
4957
{{- end }}
@@ -75,8 +83,8 @@ nginx-mesh-registry-key
7583
Define the name of the key where the Upstream Authority secret data is stored.
7684
*/}}
7785
{{- define "ua-secret-name" -}}
78-
{{- if .Values.mtls.upstreamAuthority.awsPCA -}}
79-
credentials
86+
{{- if .Values.mtls.upstreamAuthority.awsPCA -}} {{- if .Values.mtls.upstreamAuthority.awsPCA.awsAccessKeyID -}}
87+
credentials {{- end }}
8088
{{- else if .Values.mtls.upstreamAuthority.disk -}}
8189
upstreamCA.key
8290
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
@@ -88,8 +96,8 @@ upstreamClient.key{{ end }}
8896
Define the name of the mount path where the Upstream Authority secret data is stored.
8997
*/}}
9098
{{- define "ua-secret-mountpath" -}}
91-
{{- if .Values.mtls.upstreamAuthority.awsPCA -}}
92-
/root/.aws
99+
{{- if and .Values.mtls.upstreamAuthority.awsPCA -}} {{- if .Values.mtls.upstreamAuthority.awsPCA.awsAccessKeyID -}}
100+
/root/.aws {{- end }}
93101
{{- else if .Values.mtls.upstreamAuthority.disk -}}
94102
/run/spire/secrets
95103
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}

‎helm-chart/templates/nats.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ spec:
5353
labels:
5454
app.kubernetes.io/name: nats-server
5555
app.kubernetes.io/part-of: nginx-service-mesh
56+
spiffe.io/spiffeid: "true"
5657
spec:
5758
serviceAccountName: nats
5859
volumes:
@@ -63,10 +64,16 @@ spec:
6364
emptyDir: {}
6465
- name: tls
6566
emptyDir: {}
66-
- hostPath:
67+
- name: spire-agent-socket
68+
{{ if eq .Values.environment "openshift" -}}
69+
csi:
70+
driver: wlapi-mounter.spire.nginx.com
71+
readOnly: true
72+
{{- else -}}
73+
hostPath:
6774
path: "/run/spire/sockets"
6875
type: DirectoryOrCreate
69-
name: spire-agent-socket
76+
{{- end }}
7077
shareProcessNamespace: true
7178
terminationGracePeriodSeconds: 60
7279
imagePullSecrets:

0 commit comments

Comments
 (0)