panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add plugin support to the spire agent (#22)

Browse Source 
* Exit code from diff indicating changes should not block commit.

Signed-off-by: Kevin Fox <[email protected]>

* Push the changes that update-tags creates

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Add plugin support to the spire agent

This adapts the existing spire server plugin support to be usable by
the agent as well.

Signed-off-by: Kevin Fox <[email protected]>

* Fix notes

Signed-off-by: Kevin Fox <[email protected]>

* Update documentation

Signed-off-by: Kevin Fox <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
2023-10-10 08:09:11 +00:00
committed by GitHub
parent c5c5320097
commit 0fa43a507d
11 changed files with 185 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/templates/NOTES.txt
+13 -2
View File
@@ -1,6 +1,17 @@
Installed {{ .Chart.Name }}…
{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }}
{{- $s := add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) }}
{{- $s := 0 }}
{{- if (index .Values "spire-server").enabled }}
{{- $up := (index .Values "spire-server").unsupportedBuiltInPlugins }}
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.upstreamAuthority) (len $up.notifier) $s }}
{{- end }}
{{- if (index .Values "spire-agent").enabled }}
{{- $up := (index .Values "spire-agent").unsupportedBuiltInPlugins }}
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.svidStore) (len $up.workloadAttestor) $s }}
{{- end }}
{{- if (index .Values "upstream-spire-agent").enabled }}
{{- $up := (index .Values "upstream-spire-agent").unsupportedBuiltInPlugins }}
{{- $s = add (len $up.keyManager) (len $up.nodeAttestor) (len $up.svidStore) (len $up.workloadAttestor) $s }}
{{- end }}
{{- if gt $s 0 }}
Warning: You're using an unsupported plugin. Functionality of this release and future upgrades aren't guaranteed to work smoothly.
charts/spire/templates/_spire-lib.tpl
+57
View File
@@ -122,3 +122,60 @@ if strictMode is enabled and the boolean is true
{{- end }}
{{- end }}
{{- end }}
{{/*
Take a copy of the config and merge in .Values.customPlugins and .Values.unsupportedBuiltInPlugins passed through as root.
*/}}
{{- define "spire-lib.config_merge" }}
{{- $pluginsToMerge := dict "plugins" dict }}
{{- range $type, $val := .root.Values.customPlugins }}
{{- if . }}
{{- if eq $type "svidstore" }}
{{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }}
{{- else }}
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
{{- end }}
{{- end }}
{{- end }}
{{- range $type, $val := .root.Values.unsupportedBuiltInPlugins }}
{{- if . }}
{{- if eq $type "svidstore" }}
{{- $_ := set $pluginsToMerge.plugins "SVIDStore" (deepCopy $val) }}
{{- else }}
{{- $nt := printf "%s%s" (substr 0 1 $type | upper) (substr 1 -1 $type) }}
{{- $_ := set $pluginsToMerge.plugins $nt (deepCopy $val) }}
{{- end }}
{{- end }}
{{- end }}
{{- $newConfig := .config | fromYaml | mustMerge $pluginsToMerge }}
{{- $newConfig | toYaml }}
{{- end }}
{{/*
Take a copy of the plugin section and return a yaml string based version
reformatted from a dict of dicts to a dict of lists of dicts
*/}}
{{- define "spire-lib.plugins_reformat" }}
{{- range $type, $v := . }}
{{ $type }}:
{{- range $name, $v2 := $v }}
- {{ $name }}: {{ $v2 | toYaml | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Take a copy of the config as a yaml config and root var.
Merge in .root.Values.customPlugins and .Values.unsupportedBuiltInPlugins into config,
Reformat the plugin section from a dict of dicts to a dict of lists of dicts,
and export it back as as json string.
This makes it much easier for users to merge in plugin configs, as dicts are easier
to merge in values, but spire needs arrays.
*/}}
{{- define "spire-lib.reformat-and-yaml2json" -}}
{{- $config := include "spire-lib.config_merge" . | fromYaml }}
{{- $plugins := include "spire-lib.plugins_reformat" $config.plugins | fromYaml }}
{{- $_ := set $config "plugins" $plugins }}
{{- $config | toPrettyJson }}
{{- end }}