panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support to create a issuer and CA via cert-manager (#342)

Browse Source 
Co-authored-by: Kevin Fox <[email protected]>
This commit is contained in:
Drew Wells
2023-06-16 21:04:11 +00:00
committed by GitHub
co-authored by Kevin Fox
parent 9d504de05b
commit 020bde8561
13 changed files with 130 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/configmap.yaml
+1 -1
View File
@@ -78,7 +78,7 @@ plugins:
UpstreamAuthority:
- cert-manager:
plugin_data:
issuer_name: {{ .issuer_name | quote }}
issuer_name: {{ default .issuer_name (include "spire-server.fullname" $root) }}
issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }}
charts/spire/charts/spire-server/templates/issuer.yaml
+55
View File
@@ -0,0 +1,55 @@
{{- with .Values.upstreamAuthority.certManager }}
{{ if and .enabled .ca.create }}
{{/*
Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/
*/}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "spire-server.fullname" $ }}-selfsigned
namespace: {{ include "spire-server.namespace" $ }}
labels:
{{- include "spire-server.labels" $ | nindent 4}}
spec:
selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "spire-server.fullname" $ }}
namespace: {{ include "spire-server.namespace" $ }}
spec:
isCA: true
commonName: {{ $.Values.ca_subject.common_name }}
secretName: {{ include "spire-server.fullname" $ }}-ca-keys
duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }}
subject:
countries:
- {{ $.Values.ca_subject.country }}
organizations:
- {{ $.Values.ca_subject.organization }}
privateKey:
algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }}
size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }}
{{- with $.Values.upstreamAuthority.certManager.ca.privateKey.rotationPolicy }}
rotationPolicy: {{ . }}
{{- end }}
{{- with $.Values.upstreamAuthority.certManager.ca.renewBefore }}
renewBefore: {{ . }}
{{- end }}
issuerRef:
name: {{ include "spire-server.fullname" $ }}-selfsigned
kind: Issuer
group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "spire-server.fullname" $ }}
namespace: {{ include "spire-server.namespace" $ }}
spec:
ca:
secretName: {{ include "spire-server.fullname" $ }}-ca-keys
---
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/post-install-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
charts/spire/charts/spire-server/templates/post-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-upgrade-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
charts/spire/charts/spire-server/templates/pre-upgrade-hook.yaml
+1 -1
View File
@@ -63,7 +63,7 @@ spec:
- name: post-install-job
securityContext:
{{- toYaml .Values.securityContext | nindent 10 }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- patch
- validatingwebhookconfiguration
charts/spire/charts/spire-server/templates/roles.yaml
+1
View File
@@ -24,6 +24,7 @@ rules:
- apiGroups: ["cert-manager.io"]
resources:
- certificaterequests
- issuers
verbs:
- list
- get
charts/spire/charts/spire-server/templates/statefulset.yaml
+16 -1
View File
@@ -42,8 +42,23 @@ spec:
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
{{- if gt (len .Values.initContainers) 0 }}
initContainers:
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.createCA }}
- name: wait
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-server.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
args:
- wait
- --namespace
- {{ .Release.Namespace }}
- --timeout=3m
- --for=condition=ready
- issuer
- {{ include "spire-server.fullname" $ }}
imagePullPolicy: {{ .Values.controllerManager.validatingWebhookConfiguration.upgradeHook.image.pullPolicy }}
{{- end }}
{{- if gt (len .Values.initContainers) 0 }}
{{- toYaml .Values.initContainers | nindent 8 }}
{{- end }}
containers: