panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add plugin support to the spire agent (#22)

Browse Source 
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Update documentation

Signed-off-by: Kevin Fox <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
2023-10-10 08:09:11 +00:00
committed by GitHub
parent c5c5320097
commit 0fa43a507d
11 changed files with 185 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+5
View File
@@ -77,6 +77,7 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:5c943903c3f9159c58c4fdf9809f404ab9cfc39b7bfed12bac44563ce0fe7875` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
@@ -96,6 +97,10 @@ A Helm chart to install the SPIRE agent.
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |