diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index af44c40..45e3da5 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -430,66 +430,69 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr ### Tornjak -| Name | Description | Value | -| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | -| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | -| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | -| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | -| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v2.1.0` | -| `tornjak.service.type` | Type of service resource | `ClusterIP` | -| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | -| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | -| `tornjak.service.annotations` | Annotations for the service | `{}` | -| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | -| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | -| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | -| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | -| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `tornjak.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | -| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | -| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | -| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | -| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | -| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | -| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | -| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | -| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | -| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | -| `tornjak.config.userManagement` | UserManagement config | | -| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` | -| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` | -| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | -| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | -| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | -| `tornjak.resources` | Resource requests and limits | `{}` | -| `tornjak.securityContext` | Security Context to use | `{}` | -| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` | -| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` | -| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` | -| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` | -| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` | -| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | -| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | -| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | -| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | -| `chown.image.registry` | The OCI registry to pull the image from | `""` | -| `chown.image.repository` | The repository within the registry | `busybox` | -| `chown.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | -| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | -| `experimental.enabled` | Allow configuration of experimental features | `false` | -| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | -| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | -| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | -| `experimental.featureFlags` | List of developer feature flags | `[]` | -| `tests.hostAliases` | List of host aliases for testing | `[]` | -| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | -| `tests.tls.customCA` | Custom CA value for tests | `""` | -| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | -| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | -| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a91822a6dcb07b972aab88d43c97a5234115fb01786044eb937950d7b9d06555` | -| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | +| Name | Description | Value | +| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | +| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` | +| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` | +| `tornjak.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tornjak.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `""` | +| `tornjak.image.defaultTag` | Sets the default image to use when image.tag is not set. It will automatically be updated with a ubi- prefix if on OpenShift. | `v2.1.0` | +| `tornjak.service.type` | Type of service resource | `ClusterIP` | +| `tornjak.service.ports.http` | Insecure port for tornjak service | `10000` | +| `tornjak.service.ports.https` | Secure port for tornjak service | `10443` | +| `tornjak.service.annotations` | Annotations for the service | `{}` | +| `tornjak.ingress.enabled` | Flag to enable ingress for Tornjak backend service | `false` | +| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | +| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | +| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | +| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tornjak.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | +| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | +| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | +| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | +| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | +| `tornjak.startupProbe.successThreshold` | Success threshold count | `1` | +| `tornjak.startupProbe.timeoutSeconds` | Timeout in seconds | `5` | +| `tornjak.config.dataStore` | Persistent DB for storing Tornjak specific information | | +| `tornjak.config.dataStore.driver` | Database driver name | `sqlite3` | +| `tornjak.config.dataStore.file` | File path for sqlite3 file | `/run/spire/data/tornjak.sqlite3` | +| `tornjak.config.userManagement` | UserManagement config | | +| `tornjak.config.userManagement.issuer` | UserManagement issuer URL | `""` | +| `tornjak.config.userManagement.audience` | UserManagement audience check | `""` | +| `tornjak.config.tlsSecret` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | `tornjak-tls-secret` | +| `tornjak.config.clientCA.type` | Type of delivery for the user CA for TLS client verification. Options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | `Secret` | +| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | +| `tornjak.resources` | Resource requests and limits | `{}` | +| `tornjak.securityContext` | Security Context to use | `{}` | +| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` | +| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` | +| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` | +| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` | +| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` | +| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | +| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | +| `customPlugins.upstreamAuthority` | Custom plugins of type upstreamAuthority are configured here | `{}` | +| `customPlugins.notifier` | Custom plugins of type notifier are configured here | `{}` | +| `chown.image.registry` | The OCI registry to pull the image from | `""` | +| `chown.image.repository` | The repository within the registry | `busybox` | +| `chown.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `chown.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | +| `chown.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `experimental.enabled` | Allow configuration of experimental features | `false` | +| `experimental.cacheReloadInterval` | The amount of time between two reloads of the in-memory entry cache. | `5s` | +| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` | +| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` | +| `experimental.featureFlags` | List of developer feature flags | `[]` | +| `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` | +| `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` | +| `experimental.authOpaPolicyEngine.local.rego` | The contents of a rego policy file defining how to authorize the API calls. | `""` | +| `tests.hostAliases` | List of host aliases for testing | `[]` | +| `tests.tls.enabled` | Flag for enabling tls for tests | `false` | +| `tests.tls.customCA` | Custom CA value for tests | `""` | +| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | +| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | +| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:a91822a6dcb07b972aab88d43c97a5234115fb01786044eb937950d7b9d06555` | +| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index b06a270..77966d7 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -101,6 +101,12 @@ server: - {{ . | quote }} {{- end }} {{- end }} + {{- if (and .authOpaPolicyEngine.local.policy_data .authOpaPolicyEngine.local.rego) }} + auth_opa_policy_engine: + local: + policy_data_path: /run/spire/config/policy_data.json + rego_path: /run/spire/config/policy.rego + {{- end }} {{- end }} {{- end }} @@ -520,4 +526,10 @@ metadata: data: server.conf: | {{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }} + {{- if (and .Values.experimental.enabled .Values.experimental.authOpaPolicyEngine.local.policy_data .Values.experimental.authOpaPolicyEngine.local.rego) }} + policy_data.json: | + {{- .Values.experimental.authOpaPolicyEngine.local.policy_data | toString | nindent 4 }} + policy.rego: | + {{- .Values.experimental.authOpaPolicyEngine.local.rego | toString | nindent 4 }} + {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index ee3c604..2b94cb8 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1233,6 +1233,13 @@ experimental: pruneEventsOlderThan: 12h ## @param experimental.featureFlags [array] List of developer feature flags featureFlags: [] + ## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. + authOpaPolicyEngine: + local: + ## @param experimental.authOpaPolicyEngine.local.policy_data [string] A JSON blob that defines additional data that can be used in the rego policy. + policy_data: "" + ## @param experimental.authOpaPolicyEngine.local.rego [string] The contents of a rego policy file defining how to authorize the API calls. + rego: "" tests: ## @param tests.hostAliases [array] List of host aliases for testing