SPIFFE OIDC Discovery Provider Rework (#152)
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -8,13 +8,23 @@ spire-server:
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
default:
|
||||
type: raw
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
namespaceSelector:
|
||||
kubernetes.io/metadata.name: spire-server
|
||||
matchExpressions:
|
||||
- key: "kubernetes.io/metadata.name"
|
||||
operator: In
|
||||
values: [spire-server]
|
||||
podSelector:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: spire
|
||||
app.kubernetes.io/name: server
|
||||
matchLabels:
|
||||
release: spire
|
||||
release-namespace: spire-server
|
||||
component: server
|
||||
downstream: true
|
||||
oidc-discovery-provider:
|
||||
enabled: false
|
||||
test-keys:
|
||||
enabled: false
|
||||
nodeAttestor:
|
||||
k8sPsat:
|
||||
serviceAccountAllowList:
|
||||
@@ -24,6 +34,9 @@ spire-server:
|
||||
k8sbundle:
|
||||
namespace: spire-system
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
|
||||
spire-agent:
|
||||
enabled: false
|
||||
|
||||
|
||||
@@ -28,6 +28,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
| `replicaCount` | Replica count | `1` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `annotations` | Annotations for the deployment | `{}` |
|
||||
@@ -38,7 +39,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `service.type` | Service type | `ClusterIP` |
|
||||
| `service.port` | Service port | `80` |
|
||||
| `service.ports.http` | Insecure port for the service | `80` |
|
||||
| `service.ports.https` | Secure port for the service | `443` |
|
||||
| `service.annotations` | Annotations for service resource | `{}` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
||||
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
||||
@@ -48,20 +50,26 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
||||
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
|
||||
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.3-alpine` |
|
||||
| `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` |
|
||||
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||
| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||
| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||
| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
|
||||
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
|
||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
|
||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.25.3-alpine` |
|
||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
||||
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
|
||||
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
|
||||
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `fullnameOverride` | Full name override | `""` |
|
||||
|
||||
@@ -91,3 +91,11 @@ Create the name of the service account to use
|
||||
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
|
||||
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spiffe-oidc-discovery-provider.tls-enabled" -}}
|
||||
{{- if and .Values.enabled (or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled) }}
|
||||
{{- true }}
|
||||
{{- else }}
|
||||
{{- false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-cert" }}
|
||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
dnsNames:
|
||||
{{- if ne (len .Values.tls.certManager.certificate.dnsNames) 0 }}
|
||||
{{- toYaml .Values.tls.certManager.certificate.dnsNames | nindent 4 }}
|
||||
{{- else }}
|
||||
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.ingress "Values" .Values) }}
|
||||
{{- end }}
|
||||
issuerRef:
|
||||
{{- with .Values.tls.certManager.certificate.issuerRef.group }}
|
||||
group: {{ . }}
|
||||
{{- end }}
|
||||
kind: {{ default "Issuer" .Values.tls.certManager.certificate.issuerRef.kind }}
|
||||
name: {{ default $fullName .Values.tls.certManager.certificate.issuerRef.name }}
|
||||
secretName: {{ $fullName }}-cert
|
||||
{{- end }}
|
||||
{{- if .Values.tls.certManager.enabled }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
spec:
|
||||
{{ merge (include "spiffe-oidc-discovery-provider.cert-manager-default-cert" . | fromYaml) .Values.tls.certManager.certificate | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -1,3 +1,17 @@
|
||||
{{- $tlsCount := 0 }}
|
||||
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
||||
{{- fail "Built in SPIRE support is not yet supported." }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.enabled .Values.tls.externalSecret.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.enabled .Values.tls.certManager.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if gt $tlsCount 1 }}
|
||||
{{- fail "You can only have one TLS configuration enabled" }}
|
||||
{{- end }}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||
@@ -14,15 +28,14 @@ domains:
|
||||
{{- $jwtIssuer := (default $uri.path $uri.host) }}
|
||||
{{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }}
|
||||
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
allow_insecure_scheme: true
|
||||
listen_socket_path: {{ $oidcSocket | quote }}
|
||||
{{- else }}
|
||||
acme:
|
||||
directory_url: {{ .Values.config.acme.directoryUrl | quote }}
|
||||
cache_dir: {{ .Values.config.acme.cacheDir | quote }}
|
||||
tos_accepted: {{ .Values.config.acme.tosAccepted }}
|
||||
email: {{ .Values.config.acme.emailAddress | quote }}
|
||||
serving_cert_file:
|
||||
cert_file_path: /certs/tls.crt
|
||||
key_file_path: /certs/tls.key
|
||||
addr: ':8443'
|
||||
{{- end }}
|
||||
|
||||
workload_api:
|
||||
@@ -47,7 +60,7 @@ metadata:
|
||||
data:
|
||||
oidc-discovery-provider.conf: |
|
||||
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
default.conf: |
|
||||
upstream oidc {
|
||||
server unix:{{ $oidcSocket }};
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -26,6 +27,9 @@ spec:
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: oidc-discovery-provider
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
@@ -46,8 +50,8 @@ spec:
|
||||
ports:
|
||||
- containerPort: 8008
|
||||
name: healthz
|
||||
{{- if not .Values.insecureScheme.enabled }}
|
||||
- containerPort: 443
|
||||
{{- if $tlsEnabled }}
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
@@ -61,6 +65,9 @@ spec:
|
||||
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||
subPath: oidc-discovery-provider.conf
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
@@ -73,7 +80,7 @@ spec:
|
||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
{{- if not $tlsEnabled }}
|
||||
- name: nginx
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
@@ -113,7 +120,7 @@ spec:
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "csi.spiffe.io"
|
||||
driver: "{{ .Values.csiDriverName }}"
|
||||
readOnly: true
|
||||
- name: spire-oidc-sockets
|
||||
emptyDir: {}
|
||||
@@ -122,6 +129,16 @@ spec:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
- name: nginx-tmp
|
||||
emptyDir: {}
|
||||
- name: certdir
|
||||
{{- if .Values.tls.externalSecret.enabled }}
|
||||
secret:
|
||||
secretName: {{ .Values.tls.externalSecret.secretName }}
|
||||
{{- else if .Values.tls.certManager.enabled }}
|
||||
secret:
|
||||
secretName: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-cert
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
|
||||
@@ -1,13 +1,36 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
|
||||
{{- $port := .Values.service.ports.https }}
|
||||
{{- if not $tlsEnabled }}
|
||||
{{- $port = .Values.service.ports.http }}
|
||||
{{- end }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- if $tlsEnabled }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not (and .Values.ingress.enabled .Values.ingress.tlsSecret) }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if not $tlsEnabled }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||
{{- else }}
|
||||
{{- if and .Values.ingress.enabled .Values.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
@@ -22,5 +45,5 @@ metadata:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-issuer" }}
|
||||
{{- if not .Values.tls.certManager.issuer.acme.email }}
|
||||
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
|
||||
{{- end }}
|
||||
email: {{ .Values.tls.certManager.issuer.acme.email | quote}}
|
||||
server: {{ .Values.tls.certManager.issuer.acme.server | quote}}
|
||||
privateKeySecretRef:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-issuer
|
||||
solvers:
|
||||
- http01:
|
||||
ingress: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.certManager.enabled .Values.tls.certManager.issuer.create }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
spec:
|
||||
acme:
|
||||
{{ mergeOverwrite (include "spiffe-oidc-discovery-provider.cert-manager-default-issuer" . | fromYaml) .Values.tls.certManager.issuer.acme | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
|
||||
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
|
||||
|
||||
@@ -10,14 +10,14 @@ metadata:
|
||||
spec:
|
||||
type: {{ .Values.service.type }}
|
||||
ports:
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
- name: http
|
||||
port: {{ .Values.service.port }}
|
||||
port: {{ .Values.service.ports.http }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
{{- else }}
|
||||
- name: https
|
||||
port: 443
|
||||
port: {{ .Values.service.ports.https }}
|
||||
targetPort: https
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
|
||||
+9
-3
@@ -1,5 +1,11 @@
|
||||
{{- $values := merge .Values }}
|
||||
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
|
||||
{{- $protocol := "https" }}
|
||||
{{- $port := .Values.service.ports.https }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
{{- $protocol = "http" }}
|
||||
{{- $port = .Values.service.ports.http }}
|
||||
{{- end }}
|
||||
{{- if gt (len .Values.ingress.hosts) 0 }}
|
||||
{{- $host = (index .Values.ingress.hosts 0).host }}
|
||||
{{- end }}
|
||||
@@ -19,19 +25,19 @@ spec:
|
||||
- name: curl-service-name
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||
command: ['curl']
|
||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
- name: curl-service-name-namespace
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||
command: ['curl']
|
||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
- name: curl-service-name-namespace-svc-cluster-local
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||
command: ['curl']
|
||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
||||
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
|
||||
@@ -1,3 +1,9 @@
|
||||
{{- $protocol := "https" }}
|
||||
{{- $port := .Values.service.ports.https }}
|
||||
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||
{{- $protocol = "http" }}
|
||||
{{- $port = .Values.service.ports.http }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
@@ -5,6 +11,9 @@ metadata:
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
labels:
|
||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: test-keys
|
||||
annotations:
|
||||
"helm.sh/hook": test
|
||||
spec:
|
||||
@@ -70,7 +79,7 @@ spec:
|
||||
args:
|
||||
- -cx
|
||||
- |
|
||||
URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}
|
||||
URL={{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}
|
||||
|
||||
cat /data/token.svid
|
||||
JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs)
|
||||
|
||||
@@ -8,6 +8,8 @@ global: {}
|
||||
##
|
||||
## @param agentSocketName The name of the spire-agent unix socket
|
||||
agentSocketName: spire-agent.sock
|
||||
## @param csiDriverName The csi driver to use
|
||||
csiDriverName: csi.spiffe.io
|
||||
|
||||
## @param replicaCount Replica count
|
||||
replicaCount: 1
|
||||
@@ -45,12 +47,15 @@ resources: {}
|
||||
# memory: 64Mi
|
||||
|
||||
## @param service.type Service type
|
||||
## @param service.port Service port
|
||||
## @param service.ports.http Insecure port for the service
|
||||
## @param service.ports.https Secure port for the service
|
||||
## @param service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 80
|
||||
ports:
|
||||
http: 80
|
||||
https: 443
|
||||
annotations: {}
|
||||
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
||||
|
||||
@@ -88,16 +93,53 @@ livenessProbe:
|
||||
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
|
||||
podAnnotations: {}
|
||||
|
||||
insecureScheme:
|
||||
## @param insecureScheme.enabled Flag to enable insecure schema
|
||||
enabled: false
|
||||
# Select from one of the options below to be the source of certificates for OIDC Discovery Provider.
|
||||
# If none are enabled, connections won't be TLS encrypted.
|
||||
tls:
|
||||
spire:
|
||||
## @param tls.spire.enabled Use spire to secure the oidc-discovery-provider
|
||||
enabled: true
|
||||
|
||||
externalSecret:
|
||||
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
|
||||
enabled: false
|
||||
## @param tls.externalSecret.secretName Specify which Secret to use
|
||||
secretName: ""
|
||||
|
||||
certManager:
|
||||
## @param tls.certManager.enabled Use certificateManager to create the certificate
|
||||
enabled: false
|
||||
issuer:
|
||||
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
|
||||
create: true
|
||||
acme:
|
||||
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
|
||||
email: ""
|
||||
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
|
||||
solvers: {}
|
||||
# - http01:
|
||||
# ingress:
|
||||
# ingressClassName: nginx
|
||||
certificate:
|
||||
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
|
||||
dnsNames: []
|
||||
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
|
||||
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
|
||||
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
|
||||
issuerRef:
|
||||
group: ""
|
||||
kind: Issuer
|
||||
name: ""
|
||||
|
||||
insecureScheme:
|
||||
nginx:
|
||||
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from
|
||||
## @param insecureScheme.nginx.image.repository The repository within the registry
|
||||
## @param insecureScheme.nginx.image.pullPolicy The image pull policy
|
||||
## @param insecureScheme.nginx.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
||||
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from. Only used when TLS is disabled.
|
||||
## @param insecureScheme.nginx.image.repository The repository within the registry. Only used when TLS is disabled.
|
||||
## @param insecureScheme.nginx.image.pullPolicy The image pull policy. Only used when TLS is disabled.
|
||||
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled.
|
||||
## Example:
|
||||
## chainguard image does not support the templates feature
|
||||
## https://github.com/chainguard-images/nginx/issues/43
|
||||
@@ -110,7 +152,6 @@ insecureScheme:
|
||||
registry: docker.io
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
version: ""
|
||||
tag: 1.25.3-alpine
|
||||
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||
resources: {}
|
||||
@@ -135,16 +176,6 @@ config:
|
||||
additionalDomains: []
|
||||
# - localhost
|
||||
|
||||
acme:
|
||||
## @param config.acme.tosAccepted Flag for Terms of Service acceptance
|
||||
tosAccepted: false
|
||||
## @param config.acme.cacheDir Path for cache directory
|
||||
cacheDir: /run/spire
|
||||
## @param config.acme.directoryUrl URL for acme directory
|
||||
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
||||
## @param config.acme.emailAddress Email address for registration
|
||||
emailAddress: [email protected]
|
||||
|
||||
## @param imagePullSecrets [array] Image pull secret names
|
||||
imagePullSecrets: []
|
||||
|
||||
|
||||
@@ -80,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
@@ -237,6 +237,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
|
||||
@@ -1,17 +1,50 @@
|
||||
{{- define "spire-controller-manager-identity-nsselector" }}
|
||||
key: "kubernetes.io/metadata.name"
|
||||
{{- if eq .type "base" }}
|
||||
operator: NotIn
|
||||
{{- else }}
|
||||
operator: In
|
||||
{{- end }}
|
||||
values:
|
||||
{{ .namespaces | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- define "spire-controller-manager-identity-podselector" }}
|
||||
{{- if eq .type "oidc-discovery-provider" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: oidc-discovery-provider
|
||||
{{- else if eq .type "test-keys" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: test-keys
|
||||
{{- else }}
|
||||
{}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $root := . }}
|
||||
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
|
||||
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
|
||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $rprop := list "spiffeIDTemplate" }}
|
||||
{{- if not (hasKey $value $rprop) }}
|
||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $type := dig "type" "base" $value }}
|
||||
{{- if not (has $type (list "base" "raw" "oidc-discovery-provider" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, oidc-discovery-provider, test-keys]" $type) }}
|
||||
{{- end }}
|
||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||
{{- if ne $type "raw" }}
|
||||
{{- $namespaceSelector := merge $namespaceSelector (dict "matchExpressions" (list)) }}
|
||||
{{- $namespaceSelectorToAdd := include "spire-controller-manager-identity-nsselector" (dict "type" $type "namespaces" $namespaces) | fromYaml }}
|
||||
{{- $_ := set $namespaceSelector "matchExpressions" (append $namespaceSelector.matchExpressions $namespaceSelectorToAdd) }}
|
||||
{{- end }}
|
||||
{{- $podSelector := deepCopy (dig "podSelector" (dict) $value) }}
|
||||
{{- $podSelector := merge $podSelector (include "spire-controller-manager-identity-podselector" (dict "type" $type "Release" $root.Release) | fromYaml ) }}
|
||||
---
|
||||
apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterSPIFFEID
|
||||
@@ -27,16 +60,20 @@ metadata:
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
||||
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
||||
{{- else }}
|
||||
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.podSelector }}
|
||||
{{- with $podSelector }}
|
||||
podSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with $value.namespaceSelector }}
|
||||
{{- with $namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -39,6 +39,9 @@ spec:
|
||||
labels:
|
||||
{{- include "spire-server.selectorLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: server
|
||||
component: server
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
|
||||
@@ -480,6 +480,23 @@ controllerManager:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
oidc-discovery-provider:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of rule this is.
|
||||
type: oidc-discovery-provider
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate DNS names to the discovery provider
|
||||
autoPopulateDNSNames: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates [array] DNS name template for issued identities
|
||||
dnsNameTemplates:
|
||||
- oidc-discovery.{{ .TrustDomain }}
|
||||
|
||||
test-keys:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.type The type of rule this is.
|
||||
type: test-keys
|
||||
|
||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||
# foo:
|
||||
# labels:
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
namespaceOverride: spire-server
|
||||
insecureScheme:
|
||||
enabled: true
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
spire-server:
|
||||
namespaceOverride: spire-server
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
spire-server:
|
||||
controllerManager:
|
||||
enabled: false
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
|
||||
@@ -21,8 +21,9 @@ spire-agent:
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
|
||||
insecureScheme:
|
||||
enabled: true
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
config:
|
||||
additionalDomains:
|
||||
|
||||
@@ -9,5 +9,6 @@ global:
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
insecureScheme:
|
||||
enabled: true
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
@@ -14,11 +14,14 @@ spire-server:
|
||||
clusterSPIFFEIDs:
|
||||
default:
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
oidc-discovery-provider:
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
insecureScheme:
|
||||
enabled: true
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
upstream:
|
||||
enabled: true
|
||||
|
||||
@@ -5,5 +5,6 @@ global:
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: true
|
||||
insecureScheme:
|
||||
enabled: true
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
Reference in New Issue
Block a user