Skip to content

Commit 7f2b4a7

Browse files
TessaIOTessaIO
committed
chore: make spiffe optional
Signed-off-by: AhmedGrati <ahmedgrati1999@gmail.com>
1 parent e8748c8 commit 7f2b4a7

File tree

20 files changed

+122
-82
lines changed

20 files changed

+122
-82
lines changed

‎Makefile‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -120,21 +120,21 @@ deploy: yamls
120120
templates:
121121
@# Need to prepend each line in the sample config with spaces in order to
122122
@# fit correctly in the configmap spec.
123-
@sed s'/^/ /' deployment/components/worker-config/nfd-worker.conf.example > nfd-worker.conf.tmp
124-
@sed s'/^/ /' deployment/components/master-config/nfd-master.conf.example > nfd-master.conf.tmp
125-
@sed s'/^/ /' deployment/components/topology-updater-config/nfd-topology-updater.conf.example > nfd-topology-updater.conf.tmp
123+
@gsed s'/^/ /' deployment/components/worker-config/nfd-worker.conf.example > nfd-worker.conf.tmp
124+
@gsed s'/^/ /' deployment/components/master-config/nfd-master.conf.example > nfd-master.conf.tmp
125+
@gsed s'/^/ /' deployment/components/topology-updater-config/nfd-topology-updater.conf.example > nfd-topology-updater.conf.tmp
126126
@# The sed magic below replaces the block of text between the lines with start and end markers
127127
@start=NFD-MASTER-CONF-START-DO-NOT-REMOVE; \
128128
end=NFD-MASTER-CONF-END-DO-NOT-REMOVE; \
129-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-master.conf.tmp" \
129+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-master.conf.tmp" \
130130
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
131131
@start=NFD-WORKER-CONF-START-DO-NOT-REMOVE; \
132132
end=NFD-WORKER-CONF-END-DO-NOT-REMOVE; \
133-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-worker.conf.tmp" \
133+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-worker.conf.tmp" \
134134
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
135135
@start=NFD-TOPOLOGY-UPDATER-CONF-START-DO-NOT-REMOVE; \
136136
end=NFD-TOPOLOGY-UPDATER-CONF-END-DO-NOT-REMOVE; \
137-
sed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-topology-updater.conf.tmp" \
137+
gsed -e "/$$start/,/$$end/{ /$$start/{ p; r nfd-topology-updater.conf.tmp" \
138138
-e "}; /$$end/p; d }" -i deployment/helm/node-feature-discovery/values.yaml
139139
@rm nfd-master.conf.tmp
140140
@rm nfd-worker.conf.tmp

‎cmd/nfd-master/main.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,8 @@ func main() {
7171
args.Overrides.ResyncPeriod = overrides.ResyncPeriod
7272
case "nfd-api-parallelism":
7373
args.Overrides.NfdApiParallelism = overrides.NfdApiParallelism
74+
case "enable-spiffe":
75+
args.Overrides.EnableSpiffe = overrides.EnableSpiffe
7476
case "enable-nodefeature-api":
7577
klog.InfoS("-enable-nodefeature-api is deprecated, will be removed in a future release along with the deprecated gRPC API")
7678
case "ca-file":
@@ -181,6 +183,7 @@ func initFlags(flagset *flag.FlagSet) (*master.Args, *master.ConfigOverrideArgs)
181183
"It has an effect when the NodeFeature API has been enabled (with -enable-nodefeature-api).")
182184
overrides.NfdApiParallelism = flagset.Int("nfd-api-parallelism", 10, "Defines the maximum number of goroutines responsible of updating nodes. "+
183185
"Can be used for the throttling mechanism. It has effect only when -enable-nodefeature-api has been set.")
184-
186+
overrides.EnableSpiffe = flagset.Bool("enable-spiffe", false,
187+
"Enables the Spiffe signature verification of created CRDs. This is still an EXPERIMENTAL feature.")
185188
return args, overrides
186189
}

‎cmd/nfd-worker/main.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,8 @@ func parseArgs(flags *flag.FlagSet, osArgs ...string) *worker.Args {
104104
args.Overrides.FeatureSources = overrides.FeatureSources
105105
case "label-sources":
106106
args.Overrides.LabelSources = overrides.LabelSources
107+
case "enable-spiffe":
108+
args.Overrides.EnableSpiffe = overrides.EnableSpiffe
107109
}
108110
})
109111

@@ -158,6 +160,8 @@ func initFlags(flagset *flag.FlagSet) (*worker.Args, *worker.ConfigOverrideArgs)
158160
flagset.Var(overrides.LabelSources, "label-sources",
159161
"Comma separated list of label sources. Special value 'all' enables all sources. "+
160162
"Prefix the source name with '-' to disable it.")
163+
overrides.EnableSpiffe = flagset.Bool("enable-spiffe", false,
164+
"Enables the Spiffe signature verification of created CRDs. This is still an EXPERIMENTAL feature.")
161165

162166
return args, overrides
163167
}

‎deployment/components/master-config/nfd-master.conf.example‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# denyLabelNs: ["denied.ns.io","denied.kubernetes.io"]
44
# resourceLabels: ["vendor-1.com/feature-1","vendor-2.io/feature-2"]
55
# enableTaints: false
6+
# enableSpiffe: true
67
# labelWhiteList: "foo"
78
# resyncPeriod: "2h"
89
# klog:

‎deployment/components/worker-config/nfd-worker.conf.example‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
# labelWhiteList:
33
# noPublish: false
44
# sleepInterval: 60s
5+
# enableSpiffe: true
56
# featureSources: [all]
67
# labelSources: [all]
78
# klog:

‎deployment/helm/node-feature-discovery/templates/master.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,16 +108,21 @@ spec:
108108
- "-key-file=/etc/kubernetes/node-feature-discovery/certs/tls.key"
109109
- "-cert-file=/etc/kubernetes/node-feature-discovery/certs/tls.crt"
110110
{{- end }}
111+
{{- if .Values.spiffe.enable }}
112+
- "-enable-spiffe"
113+
{{- end }}
111114
- "-metrics={{ .Values.master.metricsPort | default "8081" }}"
112115
volumeMounts:
113116
{{- if .Values.tls.enable }}
114117
- name: nfd-master-cert
115118
mountPath: "/etc/kubernetes/node-feature-discovery/certs"
116119
readOnly: true
117120
{{- end }}
121+
{{- if .Values.spiffe.enable }}
118122
- name: spire-agent-socket
119123
mountPath: /run/spire/sockets
120124
readOnly: true
125+
{{- end }}
121126
- name: nfd-master-conf
122127
mountPath: "/etc/kubernetes/node-feature-discovery"
123128
readOnly: true
@@ -127,10 +132,12 @@ spec:
127132
secret:
128133
secretName: nfd-master-cert
129134
{{- end }}
135+
{{- if .Values.spiffe.enable }}
130136
- name: spire-agent-socket
131137
hostPath:
132138
path: /run/spire/sockets
133139
type: Directory
140+
{{- end }}
134141
- name: nfd-master-conf
135142
configMap:
136143
name: {{ include "node-feature-discovery.fullname" . }}-master-conf

‎deployment/helm/node-feature-discovery/templates/spire-agent-cluster-role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ metadata:
1717
subjects:
1818
- kind: ServiceAccount
1919
name: spire-agent
20-
namespace: spire
20+
namespace: {{ include "node-feature-discovery.namespace" . }}
2121
roleRef:
2222
kind: ClusterRole
2323
name: spire-agent-cluster-role

‎deployment/helm/node-feature-discovery/templates/spire-agent-daemonset.yaml‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -43,20 +43,6 @@ spec:
4343
- name: spire-agent-socket
4444
mountPath: /run/spire/sockets
4545
readOnly: false
46-
livenessProbe:
47-
httpGet:
48-
path: /live
49-
port: 8080
50-
failureThreshold: 2
51-
initialDelaySeconds: 15
52-
periodSeconds: 60
53-
timeoutSeconds: 3
54-
readinessProbe:
55-
httpGet:
56-
path: /ready
57-
port: 8080
58-
initialDelaySeconds: 5
59-
periodSeconds: 5
6046
volumes:
6147
- name: spire-config
6248
configMap:

‎deployment/helm/node-feature-discovery/templates/spire-server-cluster-role.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ kind: Role
44
apiVersion: rbac.authorization.k8s.io/v1
55
metadata:
66
name: spire-server-configmap-role
7-
namespace: spire
87
rules:
98
- apiGroups: [""]
109
resources: ["configmaps"]
@@ -15,11 +14,11 @@ kind: RoleBinding
1514
apiVersion: rbac.authorization.k8s.io/v1
1615
metadata:
1716
name: spire-server-configmap-role-binding
18-
namespace: spire
17+
namespace: {{ include "node-feature-discovery.namespace" . }}
1918
subjects:
2019
- kind: ServiceAccount
2120
name: spire-server
22-
namespace: spire
21+
namespace: {{ include "node-feature-discovery.namespace" . }}
2322
roleRef:
2423
apiGroup: rbac.authorization.k8s.io
2524
kind: Role
@@ -43,7 +42,7 @@ metadata:
4342
subjects:
4443
- kind: ServiceAccount
4544
name: spire-server
46-
namespace: spire
45+
namespace: {{ include "node-feature-discovery.namespace" . }}
4746
roleRef:
4847
kind: ClusterRole
4948
name: spire-server-trust-role

‎deployment/helm/node-feature-discovery/templates/spire-server-configmap.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ data:
1818
ca_subject = {
1919
country = ["US"],
2020
organization = ["SPIFFE"],
21-
common_name = "",
21+
common_name = "nfd.com",
2222
}
2323
}
2424
@@ -35,7 +35,7 @@ data:
3535
clusters = {
3636
"nfd" = {
3737
use_token_review_api_validation = true
38-
service_account_allow_list = ["spire:spire-agent"]
38+
service_account_allow_list = ["{{ include "node-feature-discovery.namespace" . }}:spire-agent"]
3939
}
4040
}
4141
}
@@ -49,6 +49,7 @@ data:
4949
5050
Notifier "k8sbundle" {
5151
plugin_data {
52+
namespace = "{{ include "node-feature-discovery.namespace" . }}"
5253
}
5354
}
5455
}

0 commit comments

Comments
 (0)