Add a "developer mode", where pods start with a (long) sleep, instead…

… the

actual service.

Signed-off-by: Marcio Silva <[email protected]>

README.md

@@ -274,3 +274,22 @@ global:
       replicas: 3
       type: "LoadBalancer"    
 ```
+
+### Deploy in "developer mode"
+
+As a convenience during development, each individual service can be set to
+"developer mode", resulting in a `pod` with a long sleep time (7 days or
+604,800 seconds). The developer can then access the `pod` (via `kubectl exec
+-i`) and perform multiple iterations of code change followed by service
+(re)start (e.g., `keylime_verifier`)
+
+```
+global:
+  service:
+    registrar:
+      developer: false
+    verifier:
+      developer: true
+    agent:
+      developer: true
+```

build/helm/keylime/charts/keylime-agent/templates/_helpers.tpl

@@ -190,3 +190,25 @@ Decide on a privileged or unprivileged resources for a pod
 {{- toYaml .Values.unprivresources }}
 {{- end }}
 {{- end }}
+
+{{/*
+Decide which command to run
+*/}}
+{{- define "agent.command" -}}
+{{- if .Values.global.service.agent.developer }}
+{{- .Values.develcommand }}
+{{- else }}
+{{- .Values.operationcommand }}
+{{- end }}
+{{- end }}
+
+{{/*
+Decide args for command
+*/}}
+{{- define "agent.args" -}}
+{{- if .Values.global.service.agent.developer }}
+{{- .Values.develargs }}
+{{- else }}
+{{- .Values.operationargs }}
+{{- end }}
+{{- end }}

build/helm/keylime/charts/keylime-agent/templates/daemonset.yaml

@@ -92,7 +92,9 @@ spec:
           securityContext:
             {{- include "agent.secctx" . | nindent 12 }}
           image: '{{- include "agent.image.repository" . }}:{{- include "agent.image.tag" .}}'
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: {{ include "agent.command" . }}
+          args: {{ include "agent.args" . }}
+          imagePullPolicy: {{ include "agent.image.pullPolicy" . }}
           ports:
             - name: agent
               containerPort: {{ .Values.service.port }}

build/helm/keylime/charts/keylime-agent/values.yaml

@@ -31,6 +31,14 @@ serviceAccount:
 
 podAnnotations: {}
 
+# command (and args) for regular operation
+operationcommand: [ '"/bin/keylime_agent"']
+operationargs: [ "" ]
+
+# command (and args) for "developer mode"
+develcommand: [ '"/bin/sleep"' ]
+develargs: [ '"604800"' ]
+
 # security context for unprivileged containers (default)
 unprivsecurityContext:
   privileged: false

build/helm/keylime/charts/keylime-registrar/templates/_helpers.tpl

@@ -189,3 +189,25 @@ Define a custom image pullpolicy.
 {{- toYaml .Values.image.pullPolicy }}
 {{- end }}
 {{- end }}
+
+{{/*
+Decide which command to run
+*/}}
+{{- define "registrar.command" -}}
+{{- if .Values.global.service.registrar.developer }}
+{{- .Values.develcommand }}
+{{- else }}
+{{- .Values.operationcommand }}
+{{- end }}
+{{- end }}
+
+{{/*
+Decide args for command
+*/}}
+{{- define "registrar.args" -}}
+{{- if .Values.global.service.registrar.developer }}
+{{- .Values.develargs }}
+{{- else }}
+{{- .Values.operationargs }}
+{{- end }}
+{{- end }}

build/helm/keylime/charts/keylime-registrar/templates/deployment.yaml

@@ -33,6 +33,8 @@ spec:
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: '{{- include "registrar.image.repository" . }}:{{- include "registrar.image.tag" .}}'
+          command: {{ include "registrar.command" . }}
+          args: {{ include "registrar.args" . }}
           imagePullPolicy: {{ include "registrar.image.pullPolicy" . }}
           ports:
             - name: registrar

build/helm/keylime/charts/keylime-registrar/values.yaml

@@ -27,6 +27,14 @@ roleBinding:
 
 podAnnotations: {}
 
+# command (and args) for regular operation
+operationcommand: [ '"keylime_registrar"']
+operationargs: [ "" ]
+
+# command (and args) for "developer mode"
+develcommand: [ '"/bin/sleep"' ]
+develargs: [ '"604800"' ]
+
 podSecurityContext: {}
   # fsGroup: 2000
 

build/helm/keylime/charts/keylime-verifier/templates/_helpers.tpl

@@ -178,3 +178,25 @@ Define a custom image pullpolicy.
 {{- toYaml .Values.image.pullPolicy }}
 {{- end }}
 {{- end }}
+
+{{/*
+Decide which command to run
+*/}}
+{{- define "verifier.command" -}}
+{{- if .Values.global.service.verifier.developer }}
+{{- .Values.develcommand }}
+{{- else }}
+{{- .Values.operationcommand }}
+{{- end }}
+{{- end }}
+
+{{/*
+Decide args for command
+*/}}
+{{- define "verifier.args" -}}
+{{- if .Values.global.service.verifier.developer }}
+{{- .Values.develargs }}
+{{- else }}
+{{- .Values.operationargs }}
+{{- end }}
+{{- end }}

build/helm/keylime/charts/keylime-verifier/templates/statefulset.yaml

@@ -39,6 +39,8 @@ spec:
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
           image: '{{- include "verifier.image.repository" . }}:{{- include "verifier.image.tag" .}}'
+          command: {{ include "verifier.command" . }}
+          args: {{ include "verifier.args" . }}
           imagePullPolicy: {{ include "verifier.image.pullPolicy" . }}
           ports:
             - name: verifier

build/helm/keylime/charts/keylime-verifier/values.yaml

@@ -27,6 +27,14 @@ roleBinding:
 
 podAnnotations: {}
 
+# command (and args) for regular operation
+operationcommand: [ '"keylime_verifier"']
+operationargs: [ "" ]
+
+# command (and args) for "developer mode"
+develcommand: [ '"/bin/sleep"' ]
+develargs: [ '"604800"' ]
+
 podSecurityContext: {}
   # fsGroup: 2000
 

build/helm/keylime/values.yaml

@@ -177,6 +177,8 @@ global:
       type: "ClusterIP"
       # the load balancer IP to use if the type is "LoadBalancer"
       loadBalancerIP: ""
+      # If developer is set to true, the pod will start with a long sleep (7 days) instead starting the service
+      developer: false
     # verifier options
     verifier:
       # Default image is the from quay, default tag is tag the chart appVersion
@@ -189,6 +191,10 @@ global:
       # type of service, with "ClusterIP" as default. Switch to "NodePort" or "LoadBalancer" to allow
       # components external to the cluster to access the service
       type: "ClusterIP"
+      # the load balancer IP to use if the type is "LoadBalancer"
+      loadBalancerIP: ""
+      # If developer is set to true, the pod will start with a long sleep (7 days) instead starting the service
+      developer: false
     # agent options
     agent:
       # Default image is the from quay, default tag is tag the chart appVersion
@@ -205,6 +211,8 @@ global:
       # Set privileged to "false" in order to deploy unprivileged pods on the agent DaemonSet.
       # Unprivileged setting will require Kubernetes 1.26 (support for the device plugin API)
       privileged: true
+      # If developer is set to true, the pod will start with a long sleep (7 days) instead starting the service
+      developer: false
   # openshift allows specifying if running on openshift
   openshift: false
 mysql: