panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

make spire server's auth_opa_policy_engine configurable in the helm chart (#663)

Browse Source
This commit is contained in:
Daniel Schlatter
2025-09-16 16:58:37 -07:00
committed by GitHub
parent d51bf52a91
commit 1feeca1ce1
3 changed files with 85 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+4 -1
View File
@@ -431,7 +431,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
### Tornjak
| Name | Description | Value |
| ------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
| `tornjak.enabled` | Deploys Tornjak API (backend) (Not for production) | `false` |
| `tornjak.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `tornjak.image.repository` | The repository within the registry | `spiffe/tornjak-backend` |
@@ -485,6 +485,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `experimental.eventsBasedCache` | Use events to update the cache with what's changed since the last update. | `false` |
| `experimental.pruneEventsOlderThan` | How old an event can be before being deleted. Used with events based cache. | `12h` |
| `experimental.featureFlags` | List of developer feature flags | `[]` |
| `experimental.authOpaPolicyEngine` | The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy. | `{}` |
| `experimental.authOpaPolicyEngine.local.policy_data` | A JSON blob that defines additional data that can be used in the rego policy. | `""` |
| `experimental.authOpaPolicyEngine.local.rego` | The contents of a rego policy file defining how to authorize the API calls. | `""` |
| `tests.hostAliases` | List of host aliases for testing | `[]` |
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
| `tests.tls.customCA` | Custom CA value for tests | `""` |
charts/spire/charts/spire-server/templates/configmap.yaml
+12
View File
@@ -101,6 +101,12 @@ server:
- {{ . | quote }}
{{- end }}
{{- end }}
{{- if (and .authOpaPolicyEngine.local.policy_data .authOpaPolicyEngine.local.rego) }}
auth_opa_policy_engine:
local:
policy_data_path: /run/spire/config/policy_data.json
rego_path: /run/spire/config/policy.rego
{{- end }}
{{- end }}
{{- end }}
@@ -520,4 +526,10 @@ metadata:
data:
server.conf: |
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
{{- if (and .Values.experimental.enabled .Values.experimental.authOpaPolicyEngine.local.policy_data .Values.experimental.authOpaPolicyEngine.local.rego) }}
policy_data.json: |
{{- .Values.experimental.authOpaPolicyEngine.local.policy_data | toString | nindent 4 }}
policy.rego: |
{{- .Values.experimental.authOpaPolicyEngine.local.rego | toString | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/values.yaml
+7
View File
@@ -1233,6 +1233,13 @@ experimental:
pruneEventsOlderThan: 12h
## @param experimental.featureFlags [array] List of developer feature flags
featureFlags: []
## @param experimental.authOpaPolicyEngine [object] The [auth opa_policy engine](https://github.com/spiffe/spire/blob/main/doc/authorization_policy_engine.md) used for authorization decisions. Defaults to the default SPIRE authorization policy.
authOpaPolicyEngine:
local:
## @param experimental.authOpaPolicyEngine.local.policy_data [string] A JSON blob that defines additional data that can be used in the rego policy.
policy_data: ""
## @param experimental.authOpaPolicyEngine.local.rego [string] The contents of a rego policy file defining how to authorize the API calls.
rego: ""
tests:
## @param tests.hostAliases [array] List of host aliases for testing