Skip to content

Commit 1be5343

Browse files
TessaIOTessaIO
committed
deploy: add spire manifests in helm and kustomize
Signed-off-by: TessaIO <[email protected]> Signed-off-by: AhmedGrati <[email protected]>
1 parent c77c370 commit 1be5343

File tree

15 files changed

+313
-119
lines changed

15 files changed

+313
-119
lines changed

‎cmd/nfd-worker/main.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"flag"
2121
"fmt"
2222
"os"
23+
"time"
2324

2425
"k8s.io/klog/v2"
2526

@@ -95,6 +96,8 @@ func parseArgs(flags *flag.FlagSet, osArgs ...string) *worker.Args {
9596
args.Overrides.NoOwnerRefs = overrides.NoOwnerRefs
9697
case "enable-spiffe":
9798
args.Overrides.EnableSpiffe = overrides.EnableSpiffe
99+
case "spiffe-svid-ttl":
100+
args.Overrides.SpiffeSVIDTTL = overrides.SpiffeSVIDTTL
98101
}
99102
})
100103

@@ -122,6 +125,7 @@ func initFlags(flagset *flag.FlagSet) (*worker.Args, *worker.ConfigOverrideArgs)
122125
overrides := &worker.ConfigOverrideArgs{
123126
FeatureSources: &utils.StringSliceVal{},
124127
LabelSources: &utils.StringSliceVal{},
128+
SpiffeSVIDTTL: &utils.DurationVal{Duration: time.Duration(4) * time.Hour},
125129
}
126130
overrides.NoPublish = flagset.Bool("no-publish", false,
127131
"Do not publish discovered features, disable connection to nfd-master and don't create NodeFeature object.")
@@ -133,6 +137,7 @@ func initFlags(flagset *flag.FlagSet) (*worker.Args, *worker.ConfigOverrideArgs)
133137
flagset.Var(overrides.LabelSources, "label-sources",
134138
"Comma separated list of label sources. Special value 'all' enables all sources. "+
135139
"Prefix the source name with '-' to disable it.")
140+
flagset.Var(overrides.SpiffeSVIDTTL, "spiffe-svid-ttl", "Specify the Time To Live (TTL) for Spiffe SVIDs. The default is 4 hours. This is still an EXPERIMENTAL feature.")
136141
overrides.EnableSpiffe = flagset.Bool("enable-spiffe", false,
137142
"Enables the Spiffe signature verification of created CRDs. This is still an EXPERIMENTAL feature.")
138143

‎deployment/helm/node-feature-discovery/Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: spire
3+
repository: https://spiffe.github.io/helm-charts-hardened/
4+
version: 0.24.1
5+
digest: sha256:f3b4dc973a59682bf3aa5ca9b53322f57935dd093081e82a37b8082e00becbe9
6+
generated: "2024-12-20T16:52:40.180416+01:00"

‎deployment/helm/node-feature-discovery/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,8 @@ keywords:
1313
- node-labels
1414
type: application
1515
version: 0.2.1
16+
dependencies:
17+
- name: spire
18+
version: 0.24.1
19+
repository: https://spiffe.github.io/helm-charts-hardened/
20+
condition: spire.enabled

‎deployment/helm/node-feature-discovery/charts/spire-0.24.1.tgz‎

205 KB
Binary file not shown.

‎deployment/helm/node-feature-discovery/templates/master.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,11 +145,25 @@ spec:
145145
{{- with .Values.master.extraArgs }}
146146
{{- toYaml . | nindent 12 }}
147147
{{- end }}
148+
{{- if .Values.spire.enabled }}
149+
- "-enable-spiffe"
150+
{{- end }}
148151
volumeMounts:
152+
{{- if .Values.spire.enabled }}
153+
- name: spire-agent-socket
154+
mountPath: /run/spire/agent-sockets/api.sock
155+
readOnly: true
156+
{{- end }}
149157
- name: nfd-master-conf
150158
mountPath: "/etc/kubernetes/node-feature-discovery"
151159
readOnly: true
152160
volumes:
161+
{{- if .Values.spire.enabled }}
162+
- name: spire-agent-socket
163+
hostPath:
164+
path: /run/spire/agent-sockets/api.sock
165+
type: Socket
166+
{{- end }}
153167
- name: nfd-master-conf
154168
configMap:
155169
name: {{ include "node-feature-discovery.fullname" . }}-master-conf

‎deployment/helm/node-feature-discovery/templates/worker.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,10 +110,21 @@ spec:
110110
{{- with .Values.worker.extraArgs }}
111111
{{- toYaml . | nindent 8 }}
112112
{{- end }}
113+
{{- if .Values.spire.enabled }}
114+
- "-enable-spiffe"
115+
{{- end }}
116+
{{- if .Values.spire.enabled }}
117+
- "-spiffe-svid-ttl={{ index .Values "spire" "spire-server" "defaultX509SvidTTL" }}"
118+
{{- end }}
113119
ports:
114120
- containerPort: {{ .Values.worker.port | default "8080"}}
115121
name: http
116122
volumeMounts:
123+
{{- if .Values.spire.enabled }}
124+
- name: spire-agent-socket
125+
mountPath: /run/spire/agent-sockets/api.sock
126+
readOnly: true
127+
{{- end }}
117128
- name: host-boot
118129
mountPath: "/host-boot"
119130
readOnly: true
@@ -144,6 +155,12 @@ spec:
144155
mountPath: "/etc/kubernetes/node-feature-discovery"
145156
readOnly: true
146157
volumes:
158+
{{- if .Values.spire.enabled }}
159+
- name: spire-agent-socket
160+
hostPath:
161+
path: /run/spire/agent-sockets/api.sock
162+
type: Socket
163+
{{- end }}
147164
- name: host-boot
148165
hostPath:
149166
path: "/boot"

‎deployment/helm/node-feature-discovery/values.yaml‎

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
image:
2-
repository: gcr.io/k8s-staging-nfd/node-feature-discovery
2+
repository: docker.io/ahmedgrati/node-feature-discovery
33
# This should be set to 'IfNotPresent' for released version
44
pullPolicy: Always
55
# tag, if defined will use the given image tag, else Chart.AppVersion will be used
6-
# tag
6+
tag: v0.18.0-devel-105-gb1d33c2b2-dirty
77
imagePullSecrets: []
88

99
nameOverride: ""
@@ -574,3 +574,57 @@ prometheus:
574574
enable: false
575575
scrapeInterval: 10s
576576
labels: {}
577+
578+
spire:
579+
enabled: true
580+
global:
581+
spire:
582+
clusterName: "nfd"
583+
trustDomain: "nfd.k8s-sigs.io"
584+
system:
585+
name: "spire-system"
586+
create: false
587+
server:
588+
name: "spire-server"
589+
create: false
590+
spire-agent:
591+
nameOverride: "spire-agent"
592+
kubeletConnectByHostname: "true"
593+
server:
594+
address: "nfd-spire-server.nfd"
595+
workloadAttestors:
596+
unix:
597+
enabled: true
598+
spire-server:
599+
nameOverride: "spire-server"
600+
controllerManager:
601+
enabled: true
602+
identities:
603+
clusterStaticEntries:
604+
node:
605+
parentID: spiffe://nfd.k8s-sigs.io/spire/server
606+
spiffeID: spiffe://nfd.k8s-sigs.io/root
607+
selectors:
608+
- k8s_psat:agent_ns:nfd
609+
- k8s_psat:agent_sa:nfd-agent
610+
- k8s_psat:cluster:nfd
611+
nfd:
612+
parentID: spiffe://nfd.k8s-sigs.io/root
613+
spiffeID: spiffe://nfd.k8s-sigs.io/worker
614+
selectors:
615+
- k8s:pod-label:app.kubernetes.io/name:node-feature-discovery
616+
617+
defaultX509SvidTTL: "4h"
618+
caSubject:
619+
commonName: "nfd.k8s-sigs.io"
620+
country: "US"
621+
organization: "SPIFFE"
622+
623+
upstream:
624+
enabled: false
625+
spiffe-csi-driver:
626+
enabled: false
627+
spiffe-oidc-discovery-provider:
628+
enabled: false
629+
tornjak-frontend:
630+
enabled: false

‎docs/reference/master-commandline-reference.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,3 +306,19 @@ Example:
306306
```bash
307307
nfd-master -resync-period=2h
308308
```
309+
310+
### -enable-spiffe
311+
312+
the `-enable-spiffe` flag enables SPIFFE verification for the created NodeFeature
313+
objects created by the worker. When enabled, master verifies the signature that
314+
is put on the annotations part of the NodeFeature object, and updates
315+
Kubernetes nodes if the signature is verified. The feature should be enabled,
316+
after deploying SPIFFE, and you can do it through the Helm chart.
317+
318+
Default: false.
319+
320+
Example:
321+
322+
```bash
323+
nfd-master -enable-spiffe
324+
```

‎docs/reference/worker-commandline-reference.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,3 +273,19 @@ Default: 0
273273
Comma-separated list of `pattern=N` settings for file-filtered logging.
274274

275275
Default: *empty*
276+
277+
### -enable-spiffe
278+
279+
the `-enable-spiffe` flag enables signing NodeFeature spec on the worker side
280+
and puts the signature in the annotations side of the NodeFeature object.
281+
The signature is verified afterwards by the master. The feature
282+
should be enabled, after deploying SPIFFE, and you can do it through
283+
the Helm chart.
284+
285+
Default: false.
286+
287+
Example:
288+
289+
```bash
290+
nfd-master -enable-spiffe
291+
```

‎go.mod‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ require (
1919
github.com/prometheus/client_golang v1.21.0
2020
github.com/smartystreets/goconvey v1.8.1
2121
github.com/spf13/cobra v1.9.1
22+
github.com/spiffe/go-spiffe/v2 v2.5.0
2223
github.com/stretchr/testify v1.10.0
2324
github.com/vektra/errors v0.0.0-20140903201135-c64d83aba85a
2425
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
@@ -71,6 +72,7 @@ require (
7172
github.com/euank/go-kmsg-parser v2.0.0+incompatible // indirect
7273
github.com/felixge/httpsnoop v1.0.4 // indirect
7374
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
75+
github.com/go-jose/go-jose/v4 v4.0.4 // indirect
7476
github.com/go-logr/logr v1.4.2 // indirect
7577
github.com/go-logr/stdr v1.2.2 // indirect
7678
github.com/go-ole/go-ole v1.2.6 // indirect
@@ -131,6 +133,7 @@ require (
131133
github.com/stoewer/go-strcase v1.3.0 // indirect
132134
github.com/stretchr/objx v0.5.2 // indirect
133135
github.com/x448/float16 v0.8.4 // indirect
136+
github.com/zeebo/errs v1.4.0 // indirect
134137
go.etcd.io/etcd/api/v3 v3.5.16 // indirect
135138
go.etcd.io/etcd/client/pkg/v3 v3.5.16 // indirect
136139
go.etcd.io/etcd/client/v3 v3.5.16 // indirect

0 commit comments

Comments
 (0)