From 1c98c618b19df0b6312be6a0e6ca24a2aa81a525 Mon Sep 17 00:00:00 2001 From: unufr33 <129618334+unufr33@users.noreply.github.com> Date: Wed, 20 Sep 2023 19:12:11 +0300 Subject: [PATCH] =?UTF-8?q?Fix=20spire-server=20configmap=20UpstreamAuthor?= =?UTF-8?q?ity/aws=5Fpca=20and=20KeyManager/a=E2=80=A6=20(#489)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Current configmap template renders to a wrong KeyManager and UpstreamAuthority configurarion when aws_kms and aws_pca are enabled and container is crashing. The proposed changes will fix the issue. --------- Signed-off-by: unufree Signed-off-by: unufr33 <129618334+unufr33@users.noreply.github.com> Co-authored-by: Faisal Memon --- .../spire-server/templates/configmap.yaml | 60 +++++++++---------- tests/unit/spire_test.go | 34 ++++++++++- 2 files changed, 63 insertions(+), 31 deletions(-) diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 33c70c5..1fea319 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -89,19 +89,19 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $keyManagerUsed = add1 $keyManagerUsed }} KeyManager: - - aws_kms: - plugin_data: - region: {{ .region | quote }} - key_metadata_file: "/run/spire/data/aws-kms-key-metadata" - {{- if ne .accessKeyID "" }} - access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" - {{- end }} - {{- if ne .secretAccessKey "" }} - secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}" - {{- end }} - {{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }} - key_policy_file: "/run/spire/data/aws-kms-key-policy.json" - {{- end }} + aws_kms: + plugin_data: + region: {{ .region | quote }} + key_metadata_file: "/run/spire/data/aws-kms-key-metadata" + {{- if ne .accessKeyID "" }} + access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" + {{- end }} + {{- if ne .secretAccessKey "" }} + secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}" + {{- end }} + {{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }} + key_policy_file: "/run/spire/data/aws-kms-key-policy.json" + {{- end }} {{- end }} {{- end }} @@ -193,23 +193,23 @@ plugins: {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} UpstreamAuthority: - - aws_pca: - plugin_data: - region: {{ .region | quote }} - certificate_authority_arn: {{ .certificateAuthorityARN | quote }} - ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }} - {{- if ne .signingAlgorithm "" }} - signing_algorithm: {{ .signingAlgorithm | quote }} - {{- end }} - {{- if ne .assumeRoleARN "" }} - assume_role_arn: {{ .assumeRoleARN | quote }} - {{- end }} - {{- if ne .endpoint "" }} - endpoint: {{ .endpoint | quote }} - {{- end }} - {{- if ne .supplementalBundlePath "" }} - supplemental_bundle_path: {{ .supplementalBundlePath | quote }} - {{- end }} + aws_pca: + plugin_data: + region: {{ .region | quote }} + certificate_authority_arn: {{ .certificateAuthorityARN | quote }} + ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }} + {{- if ne .signingAlgorithm "" }} + signing_algorithm: {{ .signingAlgorithm | quote }} + {{- end }} + {{- if ne .assumeRoleARN "" }} + assume_role_arn: {{ .assumeRoleARN | quote }} + {{- end }} + {{- if ne .endpoint "" }} + endpoint: {{ .endpoint | quote }} + {{- end }} + {{- if ne .supplementalBundlePath "" }} + supplemental_bundle_path: {{ .supplementalBundlePath | quote }} + {{- end }} {{- end }} {{- end }} {{- if gt $upstreamAuthorityUsed 1 }} diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index d22c0b8..4db554c 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -16,7 +16,7 @@ func ValueStringRender(chart *helmchart.Chart, values string) (map[string]string return nil, err } ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true} - v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities); + v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities) if err != nil { return nil, err } @@ -71,4 +71,36 @@ spire-server: Expect(notes).Should(ContainSubstring("join_token")) }) }) + Describe("spire-server.keyManager.aws_kms", func() { + It("plugin set ok", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + keyManager: + awsKMS: + enabled: true + region: us-west-2 + plugin_data: {} + disk: + enabled: false +`) + Expect(err).Should(Succeed()) + notes := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(notes).Should(ContainSubstring("\"aws_kms\": {")) + }) + }) + Describe("spire-server.UpstreamAuthority.aws_pca", func() { + It("plugin set ok", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + upstreamAuthority: + awsPCA: + enabled: true + region: us-west-2 + plugin_data: {} +`) + Expect(err).Should(Succeed()) + notes := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(notes).Should(ContainSubstring("\"aws_pca\": {")) + }) + }) })