SPIFFE OIDC Discovery Provider Rework (#152)
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -8,13 +8,23 @@ spire-server:
|
|||||||
identities:
|
identities:
|
||||||
clusterSPIFFEIDs:
|
clusterSPIFFEIDs:
|
||||||
default:
|
default:
|
||||||
|
type: raw
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
namespaceSelector:
|
namespaceSelector:
|
||||||
kubernetes.io/metadata.name: spire-server
|
matchExpressions:
|
||||||
|
- key: "kubernetes.io/metadata.name"
|
||||||
|
operator: In
|
||||||
|
values: [spire-server]
|
||||||
podSelector:
|
podSelector:
|
||||||
app.kubernetes.io/component: server
|
matchLabels:
|
||||||
app.kubernetes.io/instance: spire
|
release: spire
|
||||||
app.kubernetes.io/name: server
|
release-namespace: spire-server
|
||||||
|
component: server
|
||||||
downstream: true
|
downstream: true
|
||||||
|
oidc-discovery-provider:
|
||||||
|
enabled: false
|
||||||
|
test-keys:
|
||||||
|
enabled: false
|
||||||
nodeAttestor:
|
nodeAttestor:
|
||||||
k8sPsat:
|
k8sPsat:
|
||||||
serviceAccountAllowList:
|
serviceAccountAllowList:
|
||||||
@@ -24,6 +34,9 @@ spire-server:
|
|||||||
k8sbundle:
|
k8sbundle:
|
||||||
namespace: spire-system
|
namespace: spire-system
|
||||||
|
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
spire-agent:
|
spire-agent:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|
||||||
|
|||||||
@@ -28,6 +28,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
| `replicaCount` | Replica count | `1` |
|
| `replicaCount` | Replica count | `1` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `annotations` | Annotations for the deployment | `{}` |
|
| `annotations` | Annotations for the deployment | `{}` |
|
||||||
@@ -38,7 +39,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `service.type` | Service type | `ClusterIP` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `service.port` | Service port | `80` |
|
| `service.ports.http` | Insecure port for the service | `80` |
|
||||||
|
| `service.ports.https` | Secure port for the service | `443` |
|
||||||
| `service.annotations` | Annotations for service resource | `{}` |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
| `configMap.annotations` | Annotations to add to the SPIFFE OIDC Discovery Provider ConfigMap | `{}` |
|
||||||
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
| `podSecurityContext` | Pod security context for OIDC discovery provider pods | `{}` |
|
||||||
@@ -48,20 +50,26 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||||
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
| `podAnnotations` | Pod annotations for Spire OIDC discovery provider | `{}` |
|
||||||
| `insecureScheme.enabled` | Flag to enable insecure schema | `false` |
|
| `tls.spire.enabled` | Use spire to secure the oidc-discovery-provider | `true` |
|
||||||
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||||
| `insecureScheme.nginx.image.repository` | The repository within the registry | `nginxinc/nginx-unprivileged` |
|
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||||
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||||
| `insecureScheme.nginx.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||||
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.25.3-alpine` |
|
| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||||
|
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||||
|
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||||
|
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||||
|
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||||
|
| `insecureScheme.nginx.image.registry` | The OCI registry to pull the image from. Only used when TLS is disabled. | `docker.io` |
|
||||||
|
| `insecureScheme.nginx.image.repository` | The repository within the registry. Only used when TLS is disabled. | `nginxinc/nginx-unprivileged` |
|
||||||
|
| `insecureScheme.nginx.image.pullPolicy` | The image pull policy. Only used when TLS is disabled. | `IfNotPresent` |
|
||||||
|
| `insecureScheme.nginx.image.tag` | Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled. | `1.25.3-alpine` |
|
||||||
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
| `insecureScheme.nginx.resources` | Resource requests and limits | `{}` |
|
||||||
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
| `jwtIssuer` | Path to JWT issuer. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
| `config.additionalDomains` | Add additional domains that can be used for oidc discovery | `[]` |
|
||||||
| `config.acme.tosAccepted` | Flag for Terms of Service acceptance | `false` |
|
|
||||||
| `config.acme.cacheDir` | Path for cache directory | `/run/spire` |
|
|
||||||
| `config.acme.directoryUrl` | URL for acme directory | `https://acme-v02.api.letsencrypt.org/directory` |
|
|
||||||
| `config.acme.emailAddress` | Email address for registration | `[email protected]` |
|
|
||||||
| `imagePullSecrets` | Image pull secret names | `[]` |
|
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `fullnameOverride` | Full name override | `""` |
|
| `fullnameOverride` | Full name override | `""` |
|
||||||
|
|||||||
@@ -91,3 +91,11 @@ Create the name of the service account to use
|
|||||||
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
|
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
|
||||||
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- define "spiffe-oidc-discovery-provider.tls-enabled" -}}
|
||||||
|
{{- if and .Values.enabled (or .Values.tls.spire.enabled .Values.tls.externalSecret.enabled .Values.tls.certManager.enabled) }}
|
||||||
|
{{- true }}
|
||||||
|
{{- else }}
|
||||||
|
{{- false }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -0,0 +1,26 @@
|
|||||||
|
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-cert" }}
|
||||||
|
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
dnsNames:
|
||||||
|
{{- if ne (len .Values.tls.certManager.certificate.dnsNames) 0 }}
|
||||||
|
{{- toYaml .Values.tls.certManager.certificate.dnsNames | nindent 4 }}
|
||||||
|
{{- else }}
|
||||||
|
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.ingress "Values" .Values) }}
|
||||||
|
{{- end }}
|
||||||
|
issuerRef:
|
||||||
|
{{- with .Values.tls.certManager.certificate.issuerRef.group }}
|
||||||
|
group: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
kind: {{ default "Issuer" .Values.tls.certManager.certificate.issuerRef.kind }}
|
||||||
|
name: {{ default $fullName .Values.tls.certManager.certificate.issuerRef.name }}
|
||||||
|
secretName: {{ $fullName }}-cert
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.tls.certManager.enabled }}
|
||||||
|
---
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||||
|
spec:
|
||||||
|
{{ merge (include "spiffe-oidc-discovery-provider.cert-manager-default-cert" . | fromYaml) .Values.tls.certManager.certificate | toYaml | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
@@ -1,3 +1,17 @@
|
|||||||
|
{{- $tlsCount := 0 }}
|
||||||
|
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
||||||
|
{{- fail "Built in SPIRE support is not yet supported." }}
|
||||||
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.enabled .Values.tls.externalSecret.enabled }}
|
||||||
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.enabled .Values.tls.certManager.enabled }}
|
||||||
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if gt $tlsCount 1 }}
|
||||||
|
{{- fail "You can only have one TLS configuration enabled" }}
|
||||||
|
{{- end }}
|
||||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
|
||||||
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
|
||||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||||
@@ -14,15 +28,14 @@ domains:
|
|||||||
{{- $jwtIssuer := (default $uri.path $uri.host) }}
|
{{- $jwtIssuer := (default $uri.path $uri.host) }}
|
||||||
{{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }}
|
{{- uniq (concat (list $jwtIssuer) .Values.config.additionalDomains) | toYaml | nindent 2 }}
|
||||||
|
|
||||||
{{- if .Values.insecureScheme.enabled }}
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
|
allow_insecure_scheme: true
|
||||||
listen_socket_path: {{ $oidcSocket | quote }}
|
listen_socket_path: {{ $oidcSocket | quote }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
acme:
|
serving_cert_file:
|
||||||
directory_url: {{ .Values.config.acme.directoryUrl | quote }}
|
cert_file_path: /certs/tls.crt
|
||||||
cache_dir: {{ .Values.config.acme.cacheDir | quote }}
|
key_file_path: /certs/tls.key
|
||||||
tos_accepted: {{ .Values.config.acme.tosAccepted }}
|
addr: ':8443'
|
||||||
email: {{ .Values.config.acme.emailAddress | quote }}
|
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
workload_api:
|
workload_api:
|
||||||
@@ -47,7 +60,7 @@ metadata:
|
|||||||
data:
|
data:
|
||||||
oidc-discovery-provider.conf: |
|
oidc-discovery-provider.conf: |
|
||||||
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
|
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
|
||||||
{{- if .Values.insecureScheme.enabled }}
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
default.conf: |
|
default.conf: |
|
||||||
upstream oidc {
|
upstream oidc {
|
||||||
server unix:{{ $oidcSocket }};
|
server unix:{{ $oidcSocket }};
|
||||||
|
|||||||
@@ -1,3 +1,4 @@
|
|||||||
|
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
|
||||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
kind: Deployment
|
kind: Deployment
|
||||||
@@ -26,6 +27,9 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
labels:
|
labels:
|
||||||
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
|
{{- include "spiffe-oidc-discovery-provider.selectorLabels" . | nindent 8 }}
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: oidc-discovery-provider
|
||||||
spec:
|
spec:
|
||||||
{{- with .Values.imagePullSecrets }}
|
{{- with .Values.imagePullSecrets }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
@@ -46,8 +50,8 @@ spec:
|
|||||||
ports:
|
ports:
|
||||||
- containerPort: 8008
|
- containerPort: 8008
|
||||||
name: healthz
|
name: healthz
|
||||||
{{- if not .Values.insecureScheme.enabled }}
|
{{- if $tlsEnabled }}
|
||||||
- containerPort: 443
|
- containerPort: 8443
|
||||||
name: https
|
name: https
|
||||||
{{- end }}
|
{{- end }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
@@ -61,6 +65,9 @@ spec:
|
|||||||
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
|
mountPath: /run/spire/oidc/config/oidc-discovery-provider.conf
|
||||||
subPath: oidc-discovery-provider.conf
|
subPath: oidc-discovery-provider.conf
|
||||||
readOnly: true
|
readOnly: true
|
||||||
|
- name: certdir
|
||||||
|
mountPath: /certs
|
||||||
|
readOnly: true
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /ready
|
path: /ready
|
||||||
@@ -73,7 +80,7 @@ spec:
|
|||||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml .Values.resources | nindent 12 }}
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
{{- if .Values.insecureScheme.enabled }}
|
{{- if not $tlsEnabled }}
|
||||||
- name: nginx
|
- name: nginx
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
@@ -113,7 +120,7 @@ spec:
|
|||||||
volumes:
|
volumes:
|
||||||
- name: spiffe-workload-api
|
- name: spiffe-workload-api
|
||||||
csi:
|
csi:
|
||||||
driver: "csi.spiffe.io"
|
driver: "{{ .Values.csiDriverName }}"
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- name: spire-oidc-sockets
|
- name: spire-oidc-sockets
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
@@ -122,6 +129,16 @@ spec:
|
|||||||
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
- name: nginx-tmp
|
- name: nginx-tmp
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
|
- name: certdir
|
||||||
|
{{- if .Values.tls.externalSecret.enabled }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ .Values.tls.externalSecret.secretName }}
|
||||||
|
{{- else if .Values.tls.certManager.enabled }}
|
||||||
|
secret:
|
||||||
|
secretName: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-cert
|
||||||
|
{{- else }}
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.nodeSelector }}
|
{{- with .Values.nodeSelector }}
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
|
|||||||
@@ -1,13 +1,36 @@
|
|||||||
{{- if .Values.ingress.enabled -}}
|
{{- if .Values.ingress.enabled -}}
|
||||||
|
{{- $tlsEnabled := eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "true" }}
|
||||||
|
{{- $port := .Values.service.ports.https }}
|
||||||
|
{{- if not $tlsEnabled }}
|
||||||
|
{{- $port = .Values.service.ports.http }}
|
||||||
|
{{- end }}
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.ingress) }}
|
||||||
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
{{- $fullName := include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
{{- $path := "/" }}
|
||||||
|
{{- $pathType := "Prefix" }}
|
||||||
{{- $tlsSection := true }}
|
{{- $tlsSection := true }}
|
||||||
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
|
{{- if $tlsEnabled }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
|
{{- if not (and .Values.ingress.enabled .Values.ingress.tlsSecret) }}
|
||||||
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- else if eq $ingressControllerType "openshift" }}
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
|
{{- if not $tlsEnabled }}
|
||||||
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- if and .Values.ingress.enabled .Values.ingress.tlsSecret }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $path = "" }}
|
||||||
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
{{- $tlsSection = false }}
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
@@ -22,5 +45,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -0,0 +1,22 @@
|
|||||||
|
{{- define "spiffe-oidc-discovery-provider.cert-manager-default-issuer" }}
|
||||||
|
{{- if not .Values.tls.certManager.issuer.acme.email }}
|
||||||
|
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
|
||||||
|
{{- end }}
|
||||||
|
email: {{ .Values.tls.certManager.issuer.acme.email | quote}}
|
||||||
|
server: {{ .Values.tls.certManager.issuer.acme.server | quote}}
|
||||||
|
privateKeySecretRef:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}-issuer
|
||||||
|
solvers:
|
||||||
|
- http01:
|
||||||
|
ingress: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.tls.certManager.enabled .Values.tls.certManager.issuer.create }}
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
|
||||||
|
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||||
|
spec:
|
||||||
|
acme:
|
||||||
|
{{ mergeOverwrite (include "spiffe-oidc-discovery-provider.cert-manager-default-issuer" . | fromYaml) .Values.tls.certManager.issuer.acme | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
{{- if .Values.insecureScheme.enabled }}
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||||
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
|
{{- $namespace := include "spiffe-oidc-discovery-provider.podMonitor.namespace" . }}
|
||||||
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
|
{{- $podNamespace := ( include "spiffe-oidc-discovery-provider.namespace" . ) }}
|
||||||
|
|||||||
@@ -10,14 +10,14 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
type: {{ .Values.service.type }}
|
type: {{ .Values.service.type }}
|
||||||
ports:
|
ports:
|
||||||
{{- if .Values.insecureScheme.enabled }}
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
- name: http
|
- name: http
|
||||||
port: {{ .Values.service.port }}
|
port: {{ .Values.service.ports.http }}
|
||||||
targetPort: http
|
targetPort: http
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
{{- else }}
|
{{- else }}
|
||||||
- name: https
|
- name: https
|
||||||
port: 443
|
port: {{ .Values.service.ports.https }}
|
||||||
targetPort: https
|
targetPort: https
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
+9
-3
@@ -1,5 +1,11 @@
|
|||||||
{{- $values := merge .Values }}
|
{{- $values := merge .Values }}
|
||||||
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
|
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
|
||||||
|
{{- $protocol := "https" }}
|
||||||
|
{{- $port := .Values.service.ports.https }}
|
||||||
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
|
{{- $protocol = "http" }}
|
||||||
|
{{- $port = .Values.service.ports.http }}
|
||||||
|
{{- end }}
|
||||||
{{- if gt (len .Values.ingress.hosts) 0 }}
|
{{- if gt (len .Values.ingress.hosts) 0 }}
|
||||||
{{- $host = (index .Values.ingress.hosts 0).host }}
|
{{- $host = (index .Values.ingress.hosts 0).host }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -19,19 +25,19 @@ spec:
|
|||||||
- name: curl-service-name
|
- name: curl-service-name
|
||||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||||
command: ['curl']
|
command: ['curl']
|
||||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||||
- name: curl-service-name-namespace
|
- name: curl-service-name-namespace
|
||||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||||
command: ['curl']
|
command: ['curl']
|
||||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||||
- name: curl-service-name-namespace-svc-cluster-local
|
- name: curl-service-name-namespace-svc-cluster-local
|
||||||
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
|
||||||
command: ['curl']
|
command: ['curl']
|
||||||
args: ['-s', '-f', 'http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}/.well-known/openid-configuration']
|
args: ['-s', '-f', '-k', '{{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}/.well-known/openid-configuration']
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
{{- include "spire-lib.securitycontext" . | nindent 8 }}
|
||||||
{{- if .Values.ingress.enabled }}
|
{{- if .Values.ingress.enabled }}
|
||||||
|
|||||||
@@ -1,3 +1,9 @@
|
|||||||
|
{{- $protocol := "https" }}
|
||||||
|
{{- $port := .Values.service.ports.https }}
|
||||||
|
{{- if eq (include "spiffe-oidc-discovery-provider.tls-enabled" .) "false" }}
|
||||||
|
{{- $protocol = "http" }}
|
||||||
|
{{- $port = .Values.service.ports.http }}
|
||||||
|
{{- end }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
@@ -5,6 +11,9 @@ metadata:
|
|||||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||||
labels:
|
labels:
|
||||||
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
{{- include "spiffe-oidc-discovery-provider.labels" . | nindent 4 }}
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: test-keys
|
||||||
annotations:
|
annotations:
|
||||||
"helm.sh/hook": test
|
"helm.sh/hook": test
|
||||||
spec:
|
spec:
|
||||||
@@ -70,7 +79,7 @@ spec:
|
|||||||
args:
|
args:
|
||||||
- -cx
|
- -cx
|
||||||
- |
|
- |
|
||||||
URL=http://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.service.port }}
|
URL={{ $protocol }}://{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ $port }}
|
||||||
|
|
||||||
cat /data/token.svid
|
cat /data/token.svid
|
||||||
JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs)
|
JWT=$(cat /data/token.svid | jq -r '.[] | select(.svids) | .svids[0].svid' | xargs)
|
||||||
|
|||||||
@@ -8,6 +8,8 @@ global: {}
|
|||||||
##
|
##
|
||||||
## @param agentSocketName The name of the spire-agent unix socket
|
## @param agentSocketName The name of the spire-agent unix socket
|
||||||
agentSocketName: spire-agent.sock
|
agentSocketName: spire-agent.sock
|
||||||
|
## @param csiDriverName The csi driver to use
|
||||||
|
csiDriverName: csi.spiffe.io
|
||||||
|
|
||||||
## @param replicaCount Replica count
|
## @param replicaCount Replica count
|
||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
@@ -45,12 +47,15 @@ resources: {}
|
|||||||
# memory: 64Mi
|
# memory: 64Mi
|
||||||
|
|
||||||
## @param service.type Service type
|
## @param service.type Service type
|
||||||
## @param service.port Service port
|
## @param service.ports.http Insecure port for the service
|
||||||
|
## @param service.ports.https Secure port for the service
|
||||||
## @param service.annotations Annotations for service resource
|
## @param service.annotations Annotations for service resource
|
||||||
##
|
##
|
||||||
service:
|
service:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
port: 80
|
ports:
|
||||||
|
http: 80
|
||||||
|
https: 443
|
||||||
annotations: {}
|
annotations: {}
|
||||||
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
|
||||||
|
|
||||||
@@ -88,16 +93,53 @@ livenessProbe:
|
|||||||
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
|
## @param podAnnotations [object] Pod annotations for Spire OIDC discovery provider
|
||||||
podAnnotations: {}
|
podAnnotations: {}
|
||||||
|
|
||||||
insecureScheme:
|
# Select from one of the options below to be the source of certificates for OIDC Discovery Provider.
|
||||||
## @param insecureScheme.enabled Flag to enable insecure schema
|
# If none are enabled, connections won't be TLS encrypted.
|
||||||
enabled: false
|
tls:
|
||||||
|
spire:
|
||||||
|
## @param tls.spire.enabled Use spire to secure the oidc-discovery-provider
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
externalSecret:
|
||||||
|
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
|
||||||
|
enabled: false
|
||||||
|
## @param tls.externalSecret.secretName Specify which Secret to use
|
||||||
|
secretName: ""
|
||||||
|
|
||||||
|
certManager:
|
||||||
|
## @param tls.certManager.enabled Use certificateManager to create the certificate
|
||||||
|
enabled: false
|
||||||
|
issuer:
|
||||||
|
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
|
||||||
|
create: true
|
||||||
|
acme:
|
||||||
|
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
|
||||||
|
email: ""
|
||||||
|
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
|
||||||
|
server: https://acme-v02.api.letsencrypt.org/directory
|
||||||
|
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||||
|
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
|
||||||
|
solvers: {}
|
||||||
|
# - http01:
|
||||||
|
# ingress:
|
||||||
|
# ingressClassName: nginx
|
||||||
|
certificate:
|
||||||
|
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
|
||||||
|
dnsNames: []
|
||||||
|
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
|
||||||
|
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
|
||||||
|
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
|
||||||
|
issuerRef:
|
||||||
|
group: ""
|
||||||
|
kind: Issuer
|
||||||
|
name: ""
|
||||||
|
|
||||||
|
insecureScheme:
|
||||||
nginx:
|
nginx:
|
||||||
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from
|
## @param insecureScheme.nginx.image.registry The OCI registry to pull the image from. Only used when TLS is disabled.
|
||||||
## @param insecureScheme.nginx.image.repository The repository within the registry
|
## @param insecureScheme.nginx.image.repository The repository within the registry. Only used when TLS is disabled.
|
||||||
## @param insecureScheme.nginx.image.pullPolicy The image pull policy
|
## @param insecureScheme.nginx.image.pullPolicy The image pull policy. Only used when TLS is disabled.
|
||||||
## @param insecureScheme.nginx.image.version This value is deprecated in favor of tag. (Will be removed in a future release)
|
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion. Only used when TLS is disabled.
|
||||||
## @param insecureScheme.nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
|
||||||
## Example:
|
## Example:
|
||||||
## chainguard image does not support the templates feature
|
## chainguard image does not support the templates feature
|
||||||
## https://github.com/chainguard-images/nginx/issues/43
|
## https://github.com/chainguard-images/nginx/issues/43
|
||||||
@@ -110,7 +152,6 @@ insecureScheme:
|
|||||||
registry: docker.io
|
registry: docker.io
|
||||||
repository: nginxinc/nginx-unprivileged
|
repository: nginxinc/nginx-unprivileged
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
version: ""
|
|
||||||
tag: 1.25.3-alpine
|
tag: 1.25.3-alpine
|
||||||
## @param insecureScheme.nginx.resources Resource requests and limits
|
## @param insecureScheme.nginx.resources Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
@@ -135,16 +176,6 @@ config:
|
|||||||
additionalDomains: []
|
additionalDomains: []
|
||||||
# - localhost
|
# - localhost
|
||||||
|
|
||||||
acme:
|
|
||||||
## @param config.acme.tosAccepted Flag for Terms of Service acceptance
|
|
||||||
tosAccepted: false
|
|
||||||
## @param config.acme.cacheDir Path for cache directory
|
|
||||||
cacheDir: /run/spire
|
|
||||||
## @param config.acme.directoryUrl URL for acme directory
|
|
||||||
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
## @param config.acme.emailAddress Email address for registration
|
|
||||||
emailAddress: [email protected]
|
|
||||||
|
|
||||||
## @param imagePullSecrets [array] Image pull secret names
|
## @param imagePullSecrets [array] Image pull secret names
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
|||||||
@@ -80,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| --------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
@@ -237,6 +237,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.admin` | Indicates any pod matched by this identity will be an admin. Use this with extreme care. | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.downstream` | Set if this spire instance is a root server and the workloads are downstream servers. | `false` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
| `controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames` | Auto populate DNS names from services attached to pods | `false` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable this identity for controller manager | `true` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of rule this is. | `oidc-discovery-provider` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate DNS names to the discovery provider | `true` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
||||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||||
|
|||||||
@@ -1,17 +1,50 @@
|
|||||||
|
{{- define "spire-controller-manager-identity-nsselector" }}
|
||||||
|
key: "kubernetes.io/metadata.name"
|
||||||
|
{{- if eq .type "base" }}
|
||||||
|
operator: NotIn
|
||||||
|
{{- else }}
|
||||||
|
operator: In
|
||||||
|
{{- end }}
|
||||||
|
values:
|
||||||
|
{{ .namespaces | toYaml | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- define "spire-controller-manager-identity-podselector" }}
|
||||||
|
{{- if eq .type "oidc-discovery-provider" }}
|
||||||
|
matchLabels:
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: oidc-discovery-provider
|
||||||
|
{{- else if eq .type "test-keys" }}
|
||||||
|
matchLabels:
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: test-keys
|
||||||
|
{{- else }}
|
||||||
|
{}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- $root := . }}
|
{{- $root := . }}
|
||||||
|
{{ $namespaces := list .Release.Namespace .Values.namespaceOverride (dig "spire" "namespaces" "server" "name" "" .Values.global) (dig "spire" "namespaces" "system" "name" "" .Values.global) | compact | uniq }}
|
||||||
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
{{- range $key, $value := .Values.controllerManager.identities.clusterSPIFFEIDs }}
|
||||||
{{- range $skey, $svalue := $value }}
|
{{- range $skey, $svalue := $value }}
|
||||||
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
|
{{- if not (has $skey (list "name" "annotations" "labels" "enabled" "type" "admin" "dnsNameTemplates" "downstream" "federatesWith" "jwtTTL" "namespaceSelector" "podSelector" "spiffeIDTemplate" "ttl" "workloadSelectorTemplates" "autoPopulateDNSNames")) }}
|
||||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- range $rprop := list "spiffeIDTemplate" }}
|
|
||||||
{{- if not (hasKey $value $rprop) }}
|
|
||||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||||
|
{{- $type := dig "type" "base" $value }}
|
||||||
|
{{- if not (has $type (list "base" "raw" "oidc-discovery-provider" "test-keys")) }}
|
||||||
|
{{- fail (printf "Type given: %s, must be one of [base, raw, oidc-discovery-provider, test-keys]" $type) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||||
|
{{- if ne $type "raw" }}
|
||||||
|
{{- $namespaceSelector := merge $namespaceSelector (dict "matchExpressions" (list)) }}
|
||||||
|
{{- $namespaceSelectorToAdd := include "spire-controller-manager-identity-nsselector" (dict "type" $type "namespaces" $namespaces) | fromYaml }}
|
||||||
|
{{- $_ := set $namespaceSelector "matchExpressions" (append $namespaceSelector.matchExpressions $namespaceSelectorToAdd) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $podSelector := deepCopy (dig "podSelector" (dict) $value) }}
|
||||||
|
{{- $podSelector := merge $podSelector (include "spire-controller-manager-identity-podselector" (dict "type" $type "Release" $root.Release) | fromYaml ) }}
|
||||||
---
|
---
|
||||||
apiVersion: spire.spiffe.io/v1alpha1
|
apiVersion: spire.spiffe.io/v1alpha1
|
||||||
kind: ClusterSPIFFEID
|
kind: ClusterSPIFFEID
|
||||||
@@ -27,16 +60,20 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||||
|
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
||||||
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
||||||
|
{{- else }}
|
||||||
|
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
||||||
|
{{- end }}
|
||||||
{{- with $value.federatesWith }}
|
{{- with $value.federatesWith }}
|
||||||
federatesWith:
|
federatesWith:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with $value.podSelector }}
|
{{- with $podSelector }}
|
||||||
podSelector:
|
podSelector:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with $value.namespaceSelector }}
|
{{- with $namespaceSelector }}
|
||||||
namespaceSelector:
|
namespaceSelector:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -39,6 +39,9 @@ spec:
|
|||||||
labels:
|
labels:
|
||||||
{{- include "spire-server.selectorLabels" . | nindent 8 }}
|
{{- include "spire-server.selectorLabels" . | nindent 8 }}
|
||||||
app.kubernetes.io/component: server
|
app.kubernetes.io/component: server
|
||||||
|
component: server
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
spec:
|
spec:
|
||||||
{{- with .Values.imagePullSecrets }}
|
{{- with .Values.imagePullSecrets }}
|
||||||
imagePullSecrets:
|
imagePullSecrets:
|
||||||
|
|||||||
@@ -480,6 +480,23 @@ controllerManager:
|
|||||||
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
## @param controllerManager.identities.clusterSPIFFEIDs.default.autoPopulateDNSNames Auto populate DNS names from services attached to pods
|
||||||
autoPopulateDNSNames: false
|
autoPopulateDNSNames: false
|
||||||
|
|
||||||
|
oidc-discovery-provider:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable this identity for controller manager
|
||||||
|
enabled: true
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type The type of rule this is.
|
||||||
|
type: oidc-discovery-provider
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate DNS names to the discovery provider
|
||||||
|
autoPopulateDNSNames: true
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates [array] DNS name template for issued identities
|
||||||
|
dnsNameTemplates:
|
||||||
|
- oidc-discovery.{{ .TrustDomain }}
|
||||||
|
|
||||||
|
test-keys:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable this identity for controller manager
|
||||||
|
enabled: true
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.test-keys.type The type of rule this is.
|
||||||
|
type: test-keys
|
||||||
|
|
||||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||||
# foo:
|
# foo:
|
||||||
# labels:
|
# labels:
|
||||||
|
|||||||
@@ -1,8 +1,9 @@
|
|||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
enabled: true
|
enabled: true
|
||||||
namespaceOverride: spire-server
|
namespaceOverride: spire-server
|
||||||
insecureScheme:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
spire-server:
|
spire-server:
|
||||||
namespaceOverride: spire-server
|
namespaceOverride: spire-server
|
||||||
|
|||||||
@@ -1,3 +1,5 @@
|
|||||||
spire-server:
|
spire-server:
|
||||||
controllerManager:
|
controllerManager:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
enabled: false
|
||||||
|
|||||||
@@ -21,8 +21,9 @@ spire-agent:
|
|||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
insecureScheme:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
config:
|
config:
|
||||||
additionalDomains:
|
additionalDomains:
|
||||||
|
|||||||
@@ -9,5 +9,6 @@ global:
|
|||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
enabled: true
|
enabled: true
|
||||||
insecureScheme:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
|
enabled: false
|
||||||
|
|||||||
@@ -14,11 +14,14 @@ spire-server:
|
|||||||
clusterSPIFFEIDs:
|
clusterSPIFFEIDs:
|
||||||
default:
|
default:
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||||
|
oidc-discovery-provider:
|
||||||
|
autoPopulateDNSNames: false
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
enabled: true
|
enabled: true
|
||||||
insecureScheme:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
upstream:
|
upstream:
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|||||||
@@ -5,5 +5,6 @@ global:
|
|||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
enabled: true
|
enabled: true
|
||||||
insecureScheme:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
|
enabled: false
|
||||||
|
|||||||
Reference in New Issue
Block a user