Update spire-identity-exchange for 0.4.0 (#900)
* Update spire-identity-exchange for 0.4.0 Signed-off-by: Kevin Fox <[email protected]> * Understand the plugin config Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update ip Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Update name Signed-off-by: Kevin Fox <[email protected]> * Fix broken socket path Signed-off-by: Kevin Fox <[email protected]> * Nope, it was right before Signed-off-by: Kevin Fox <[email protected]> * Try disabling the spiffe plugin for now Signed-off-by: Kevin Fox <[email protected]> * Try logging more Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Map non container behavior Signed-off-by: Kevin Fox <[email protected]> * Add missing csi driver settings Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Use local oidc discovery provider path by default Signed-off-by: Kevin Fox <[email protected]> * Enable spire-identity-exchange in shared infrastructure Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Test config Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump spire-ha-agent version to fix issue Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Update version bits to match what it should be, minus final bump Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -92,6 +92,64 @@ Create the name of the service account to use
|
||||
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Volume name for an extra SPIFFE CSI driver. Driver names are DNS subdomains and may
|
||||
contain dots, which a volume name (a DNS-1123 label) may not, so squash every run of
|
||||
non-alphanumeric characters down to a single dash.
|
||||
Args: the driver name as a string
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.csi-volume-name" -}}
|
||||
{{- printf "spiffe-workload-api-%s" (trimAll "-" (regexReplaceAll "[^a-z0-9]+" (lower .) "-")) | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Path to the SPIRE Agent workload socket one auth plugin should talk to. A plugin that
|
||||
names no driver of its own, or names the one the exchange itself uses, gets the socket
|
||||
already mounted for the pod; anything else gets its own mount under /spiffe-workload-apis.
|
||||
Args: dict "root" <root context> "driver" <csi driver name, may be empty>
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.plugin-workload-api-socket-path" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $driver := .driver | default "" }}
|
||||
{{- if or (eq $driver "") (eq $driver $root.Values.csiDriverName) }}
|
||||
{{- include "spire-identity-exchange.workload-api-socket-path" $root }}
|
||||
{{- else }}
|
||||
{{- printf "/spiffe-workload-apis/%s/%s" $driver $root.Values.agentSocketName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
The CSI drivers this release must mount in addition to the pod's own, collected from the
|
||||
enabled spiffe auth plugins. Deduplicated, so two plugins naming the same driver share one
|
||||
volume. Returns JSON of driver name -> volume name; callers pipe it through fromJson.
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.extra-csi-drivers" -}}
|
||||
{{- $root := . }}
|
||||
{{- $drivers := dict }}
|
||||
{{- $volumeNames := dict }}
|
||||
{{- range $name, $config := .Values.auth.plugins }}
|
||||
{{- $config = $config | default dict }}
|
||||
{{- if ne (dig "enabled" true $config) false }}
|
||||
{{- $pluginType := include "spire-identity-exchange.plugin-type" (dict "root" $root "name" $name "config" $config) }}
|
||||
{{- $driver := dig "csiDriverName" "" $config }}
|
||||
{{- if and (eq $pluginType "spiffe") (not (empty $driver)) }}
|
||||
{{- if not (kindIs "string" $driver) }}
|
||||
{{- fail (printf "auth.plugins.%s.csiDriverName: expected string, got %s" $name (kindOf $driver)) }}
|
||||
{{- end }}
|
||||
{{- if ne $driver $root.Values.csiDriverName }}
|
||||
{{- $volumeName := include "spire-identity-exchange.csi-volume-name" $driver }}
|
||||
{{- if and (hasKey $volumeNames $volumeName) (ne (index $volumeNames $volumeName) $driver) }}
|
||||
{{- fail (printf "auth.plugins.%s.csiDriverName: %q and %q both reduce to the volume name %q. Volume names allow only lowercase alphanumerics and dashes, so these two drivers cannot be told apart; rename one so they differ by more than punctuation." $name $driver (index $volumeNames $volumeName) $volumeName) }}
|
||||
{{- end }}
|
||||
{{- $_ := set $volumeNames $volumeName $driver }}
|
||||
{{- $_ := set $drivers $driver $volumeName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $drivers | toJson }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-identity-exchange.podSecurityContext" -}}
|
||||
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
|
||||
{{- $openshift := ((.Values).global).openshift | default false }}
|
||||
@@ -131,3 +189,57 @@ Create the name of the service account to use
|
||||
{{ .Release.Name }}-server.{{ include "spire-identity-exchange.server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-identity-exchange.plugin-type" }}
|
||||
{{- $type := .name }}
|
||||
{{- with .config.plugin }}
|
||||
{{- $type = . }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "k8s_psat" "spiffe" "github" "gitlab" )) }}
|
||||
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
||||
{{- end }}
|
||||
{{- printf "%s" $type }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Validate one plugin's config block against the option table for its type.
|
||||
Emits nothing; only fails.
|
||||
Args: dict "name" <instance name> "type" <plugin type> "config" <config map>
|
||||
"options" <dict of option name -> "string" | "[]string" | "bool">
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.check-plugin-options" }}
|
||||
{{- $ctx := . }}
|
||||
{{- $valid := keys $ctx.options | sortAlpha | join ", " }}
|
||||
{{- range $key, $val := $ctx.config }}
|
||||
{{- if not (hasKey $ctx.options $key) }}
|
||||
{{- fail (printf "auth.plugins.%s.config: %q is not a valid option for plugin type %q (valid options: %s). Use auth.unsupportedBuiltInPlugins to pass through options this chart does not model." $ctx.name $key $ctx.type $valid) }}
|
||||
{{- end }}
|
||||
{{- $want := index $ctx.options $key }}
|
||||
{{- if eq $want "[]string" }}
|
||||
{{- if not (kindIs "slice" $val) }}
|
||||
{{- fail (printf "auth.plugins.%s.config.%s: expected a list of strings, got %s" $ctx.name $key (kindOf $val)) }}
|
||||
{{- end }}
|
||||
{{- range $val }}
|
||||
{{- if not (kindIs "string" .) }}
|
||||
{{- fail (printf "auth.plugins.%s.config.%s: every entry must be a string, got %s" $ctx.name $key (kindOf .)) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if not (kindIs $want $val) }}
|
||||
{{- fail (printf "auth.plugins.%s.config.%s: expected %s, got %s" $ctx.name $key $want (kindOf $val)) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Fail if any of the named options is absent or empty. Emits nothing.
|
||||
Args: dict "name" <instance name> "type" <plugin type> "config" <config map>
|
||||
"required" <list of option names>
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.check-plugin-required" }}
|
||||
{{- $ctx := . }}
|
||||
{{- range $ctx.required }}
|
||||
{{- if empty (index $ctx.config .) }}
|
||||
{{- fail (printf "auth.plugins.%s.config.%s is required for plugin type %q" $ctx.name . $ctx.type) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
Reference in New Issue
Block a user