Skip to content

Commit 42a3b9f

Browse files
TessaIOTessaIO
committed
chore: make spiffe optional
Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>
1 parent e8748c8 commit 42a3b9f

18 files changed

+107
-66
lines changed

‎Makefile

+6-6
Original file line numberDiff line numberDiff line change
@@ -120,21 +120,21 @@ deploy: yamls
120120
templates:
121121
@# Need to prepend each line in the sample config with spaces in order to
122122
@# fit correctly in the configmap spec.
123-
@sed s'/^/ /' deployment/components/worker-config/nfd-worker.conf.example > nfd-worker.conf.tmp
124-
@sed s'/^/ /' deployment/components/master-config/nfd-master.conf.example > nfd-master.conf.tmp
125-
@sed s'/^/ /' deployment/components/topology-updater-config/nfd-topology-updater.conf.example > nfd-topology-updater.conf.tmp
123+
@gsed s'/^/ /' deployment/components/worker-config/nfd-worker.conf.example > nfd-worker.conf.tmp
124+
@gsed s'/^/ /' deployment/components/master-config/nfd-master.conf.example > nfd-master.conf.tmp
125+
@gsed s'/^/ /' deployment/components/topology-updater-config/nfd-topology-updater.conf.example > nfd-topology-updater.conf.tmp
126126
@# The sed magic below replaces the block of text between the lines with start and end markers
127127
@start=NFD-MASTER-CONF-START-DO-NOT-REMOVE; \
128128
end=NFD-MASTER-CONF-END-DO-NOT-REMOVE; \
129-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-master.conf.tmp" \
129+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-master.conf.tmp" \
130130
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
131131
@start=NFD-WORKER-CONF-START-DO-NOT-REMOVE; \
132132
end=NFD-WORKER-CONF-END-DO-NOT-REMOVE; \
133-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-worker.conf.tmp" \
133+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-worker.conf.tmp" \
134134
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
135135
@start=NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE; \
136136
end=NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE; \
137-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-topology-updater.conf.tmp" \
137+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-topology-updater.conf.tmp" \
138138
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
139139
@rm nfd-master.conf.tmp
140140
@rm nfd-worker.conf.tmp

‎cmd/nfd-master/main.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ func main() {
7171
args.Overrides.ResyncPeriod = overrides.ResyncPeriod
7272
case "nfd-api-parallelism":
7373
args.Overrides.NfdApiParallelism = overrides.NfdApiParallelism
74+
case "enable-spiffe":
75+
args.Overrides.EnableSpiffe = overrides.EnableSpiffe
7476
case "enable-nodefeature-api":
7577
klog.InfoS("-enable-nodefeature-api is deprecated, will be removed in a future release along with the deprecated gRPC API")
7678
case "ca-file":
@@ -181,6 +183,7 @@ func initFlags(flagset *flag.FlagSet) (*master.Args, *master.ConfigOverrideArgs)
181183
"It has an effect when the NodeFeature API has been enabled (with -enable-nodefeature-api).")
182184
overrides.NfdApiParallelism = flagset.Int("nfd-api-parallelism", 10, "Defines the maximum number of goroutines responsible of updating nodes. "+
183185
"Can be used for the throttling mechanism. It has effect only when -enable-nodefeature-api has been set.")
184-
186+
overrides.EnableSpiffe = flagset.Bool("enable-spiffe", false,
187+
"Enables the Spiffe signature verification of created CRDs. This is still an EXPERIMENTAL feature.")
185188
return args, overrides
186189
}

‎cmd/nfd-worker/main.go

+4
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ func parseArgs(flags *flag.FlagSet, osArgs ...string) *worker.Args {
104104
args.Overrides.FeatureSources = overrides.FeatureSources
105105
case "label-sources":
106106
args.Overrides.LabelSources = overrides.LabelSources
107+
case "enable-spiffe":
108+
args.Overrides.EnableSpiffe = overrides.EnableSpiffe
107109
}
108110
})
109111

@@ -158,6 +160,8 @@ func initFlags(flagset *flag.FlagSet) (*worker.Args, *worker.ConfigOverrideArgs)
158160
flagset.Var(overrides.LabelSources, "label-sources",
159161
"Comma separated list of label sources. Special value 'all' enables all sources. "+
160162
"Prefix the source name with '-' to disable it.")
163+
overrides.EnableSpiffe = flagset.Bool("enable-spiffe", false,
164+
"Enables the Spiffe signature verification of created CRDs. This is still an EXPERIMENTAL feature.")
161165

162166
return args, overrides
163167
}

‎deployment/components/master-config/nfd-master.conf.example

+1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
44
# resourceLabels: ["vendor-1.com/feature-1","vendor-2.io/feature-2"]
55
# enableTaints: false
6+
# enableSpiffe: true
67
# labelWhiteList: "foo"
78
# resyncPeriod: "2h"
89
# klog:

‎deployment/components/worker-config/nfd-worker.conf.example

+1
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# labelWhiteList:
33
# noPublish: false
44
# sleepInterval: 60s
5+
# enableSpiffe: true
56
# featureSources: [all]
67
# labelSources: [all]
78
# klog:

‎deployment/helm/node-feature-discovery/templates/master.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -108,16 +108,21 @@ spec:
108108
- "-key-file=/etc/kubernetes/node-feature-discovery/certs/tls.key"
109109
- "-cert-file=/etc/kubernetes/node-feature-discovery/certs/tls.crt"
110110
{{- end }}
111+
{{- if .Values.spiffe.enable }}
112+
- "-enable-spiffe"
113+
{{- end }}
111114
- "-metrics={{ .Values.master.metricsPort | default "8081" }}"
112115
volumeMounts:
113116
{{- if .Values.tls.enable }}
114117
- name: nfd-master-cert
115118
mountPath: "/etc/kubernetes/node-feature-discovery/certs"
116119
readOnly: true
117120
{{- end }}
121+
{{- if .Values.spiffe.enable }}
118122
- name: spire-agent-socket
119123
mountPath: /run/spire/sockets
120124
readOnly: true
125+
{{- end }}
121126
- name: nfd-master-conf
122127
mountPath: "/etc/kubernetes/node-feature-discovery"
123128
readOnly: true
@@ -127,10 +132,12 @@ spec:
127132
secret:
128133
secretName: nfd-master-cert
129134
{{- end }}
135+
{{- if .Values.spiffe.enable }}
130136
- name: spire-agent-socket
131137
hostPath:
132138
path: /run/spire/sockets
133139
type: Directory
140+
{{- end }}
134141
- name: nfd-master-conf
135142
configMap:
136143
name: {{ include "node-feature-discovery.fullname" . }}-master-conf

‎deployment/helm/node-feature-discovery/templates/spire-agent-cluster-role.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ metadata:
1717
subjects:
1818
- kind: ServiceAccount
1919
name: spire-agent
20-
namespace: spire
20+
namespace: {{ include "node-feature-discovery.namespace" . }}
2121
roleRef:
2222
kind: ClusterRole
2323
name: spire-agent-cluster-role

‎deployment/helm/node-feature-discovery/templates/spire-server-cluster-role.yaml

+3-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ kind: Role
44
apiVersion: rbac.authorization.k8s.io/v1
55
metadata:
66
name: spire-server-configmap-role
7-
namespace: spire
87
rules:
98
- apiGroups: [""]
109
resources: ["configmaps"]
@@ -15,11 +14,11 @@ kind: RoleBinding
1514
apiVersion: rbac.authorization.k8s.io/v1
1615
metadata:
1716
name: spire-server-configmap-role-binding
18-
namespace: spire
17+
namespace: {{ include "node-feature-discovery.namespace" . }}
1918
subjects:
2019
- kind: ServiceAccount
2120
name: spire-server
22-
namespace: spire
21+
namespace: {{ include "node-feature-discovery.namespace" . }}
2322
roleRef:
2423
apiGroup: rbac.authorization.k8s.io
2524
kind: Role
@@ -43,7 +42,7 @@ metadata:
4342
subjects:
4443
- kind: ServiceAccount
4544
name: spire-server
46-
namespace: spire
45+
namespace: {{ include "node-feature-discovery.namespace" . }}
4746
roleRef:
4847
kind: ClusterRole
4948
name: spire-server-trust-role

‎deployment/helm/node-feature-discovery/templates/spire-server-configmap.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ data:
1818
ca_subject = {
1919
country = ["US"],
2020
organization = ["SPIFFE"],
21-
common_name = "",
21+
common_name = "nfd.com",
2222
}
2323
}
2424
@@ -35,7 +35,7 @@ data:
3535
clusters = {
3636
"nfd" = {
3737
use_token_review_api_validation = true
38-
service_account_allow_list = ["spire:spire-agent"]
38+
service_account_allow_list = ["{{ include "node-feature-discovery.namespace" . }}:spire-agent"]
3939
}
4040
}
4141
}
@@ -49,6 +49,7 @@ data:
4949
5050
Notifier "k8sbundle" {
5151
plugin_data {
52+
namespace = "{{ include "node-feature-discovery.namespace" . }}"
5253
}
5354
}
5455
}

‎deployment/helm/node-feature-discovery/templates/spire-server-statefulset.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ spec:
1313
serviceName: spire-server
1414
template:
1515
metadata:
16-
namespace: spire
1716
labels:
1817
app: spire-server
1918
spec:
@@ -54,7 +53,6 @@ spec:
5453
volumeClaimTemplates:
5554
- metadata:
5655
name: spire-data
57-
namespace: spire
5856
spec:
5957
accessModes:
6058
- ReadWriteOnce

‎deployment/helm/node-feature-discovery/templates/worker.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -59,14 +59,19 @@ spec:
5959
- "-key-file=/etc/kubernetes/node-feature-discovery/certs/tls.key"
6060
- "-cert-file=/etc/kubernetes/node-feature-discovery/certs/tls.crt"
6161
{{- end }}
62+
{{- if .Values.spiffe.enable }}
63+
- "-enable-spiffe"
64+
{{- end }}
6265
- "-metrics={{ .Values.worker.metricsPort | default "8081"}}"
6366
ports:
6467
- name: metrics
6568
containerPort: {{ .Values.worker.metricsPort | default "8081"}}
6669
volumeMounts:
70+
{{- if .Values.spiffe.enable }}
6771
- name: spire-agent-socket
6872
mountPath: /run/spire/sockets
6973
readOnly: true
74+
{{- end }}
7075
- name: host-boot
7176
mountPath: "/host-boot"
7277
readOnly: true
@@ -102,10 +107,12 @@ spec:
102107
readOnly: true
103108
{{- end }}
104109
volumes:
110+
{{- if .Values.spiffe.enable }}
105111
- name: spire-agent-socket
106112
hostPath:
107113
path: /run/spire/sockets
108114
type: Directory
115+
{{- end }}
109116
- name: host-boot
110117
hostPath:
111118
path: "/boot"

‎deployment/helm/node-feature-discovery/values.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
image:
22
repository: ahmedgrati/node-feature-discovery
3-
tag: b0290ef-dirty
3+
tag: a37590b
44
# This should be set to 'IfNotPresent' for released version
55
pullPolicy: Always
66
# tag, if defined will use the given image tag, else Chart.AppVersion will be used
@@ -24,8 +24,8 @@ master:
2424
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
2525
# resourceLabels: ["vendor-1.com/feature-1","vendor-2.io/feature-2"]
2626
# enableTaints: false
27-
# labelWhiteList: "foo"
2827
# enableSpiffe: true
28+
# labelWhiteList: "foo"
2929
# resyncPeriod: "2h"
3030
# klog:
3131
# addDirHeader: false
@@ -144,9 +144,9 @@ worker:
144144
# labelWhiteList:
145145
# noPublish: false
146146
# sleepInterval: 60s
147+
# enableSpiffe: true
147148
# featureSources: [all]
148149
# labelSources: [all]
149-
# enableSpiffe: true
150150
# klog:
151151
# addDirHeader: false
152152
# alsologtostderr: false

‎deployment/overlays/spiffe/spire-agent-cluster-role.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ metadata:
1818
subjects:
1919
- kind: ServiceAccount
2020
name: spire-agent
21-
namespace: spire
21+
namespace: {{ include "node-feature-discovery.namespace" . }}
2222
roleRef:
2323
kind: ClusterRole
2424
name: spire-agent-cluster-role

‎deployment/overlays/spiffe/spire-server-cluster-role.yaml

+3-4
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ kind: Role
33
apiVersion: rbac.authorization.k8s.io/v1
44
metadata:
55
name: spire-server-configmap-role
6-
namespace: spire
76
rules:
87
- apiGroups: [""]
98
resources: ["configmaps"]
@@ -14,11 +13,11 @@ kind: RoleBinding
1413
apiVersion: rbac.authorization.k8s.io/v1
1514
metadata:
1615
name: spire-server-configmap-role-binding
17-
namespace: spire
16+
namespace: {{ include "node-feature-discovery.namespace" . }}
1817
subjects:
1918
- kind: ServiceAccount
2019
name: spire-server
21-
namespace: spire
20+
namespace: {{ include "node-feature-discovery.namespace" . }}
2221
roleRef:
2322
apiGroup: rbac.authorization.k8s.io
2423
kind: Role
@@ -42,7 +41,7 @@ metadata:
4241
subjects:
4342
- kind: ServiceAccount
4443
name: spire-server
45-
namespace: spire
44+
namespace: {{ include "node-feature-discovery.namespace" . }}
4645
roleRef:
4746
kind: ClusterRole
4847
name: spire-server-trust-role

‎deployment/overlays/spiffe/spire-server-statefulset.yaml

-2
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ spec:
1212
serviceName: spire-server
1313
template:
1414
metadata:
15-
namespace: spire
1615
labels:
1716
app: spire-server
1817
spec:
@@ -53,7 +52,6 @@ spec:
5352
volumeClaimTemplates:
5453
- metadata:
5554
name: spire-data
56-
namespace: spire
5755
spec:
5856
accessModes:
5957
- ReadWriteOnce

0 commit comments

Comments
 (0)