Add external k8s bundler (#270)
* Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update based on parent pr feedback Signed-off-by: Kevin Fox <[email protected]> * Reformat config file Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Reconfigure kind Signed-off-by: Kevin Fox <[email protected]> * More debugging Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -223,7 +223,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||||
|
| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` |
|
||||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
|
| `notifier.externalK8sBundle.enabled` | Enable exernal k8s bundle uploader | `true` |
|
||||||
|
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||||
|
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||||
|
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||||
|
| `notifier.externalK8sBundle.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||||
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
| `controllerManager.className` | specify to use an explicit class name. If empty, it will be automatically set to Release.Namespace-Release.Name to not conflict with other installs, enabling parallel installs. | `""` |
|
||||||
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
| `controllerManager.watchClassless` | specify to process custom resources without class name specified. Useful to slowly migrate to class names from classless installs. Do not have two installs on the same k8s cluster both set to true. | `false` |
|
||||||
|
|||||||
@@ -205,11 +205,35 @@ plugins:
|
|||||||
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.notifier.k8sbundle.enabled .Values.notifier.externalK8sBundle.enabled }}
|
||||||
Notifier:
|
Notifier:
|
||||||
k8sbundle:
|
k8sbundle:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
|
{{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }}
|
||||||
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
|
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
|
||||||
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $clusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }}
|
||||||
|
{{- if and (eq (.Values.notifier.externalK8sBundle.enabled | toString) "true") (ne (len $clusters) 0) }}
|
||||||
|
clusters:
|
||||||
|
- "":
|
||||||
|
{{- $clusterDefaults := .Values.notifier.externalK8sBundle.defaults }}
|
||||||
|
{{- range $name, $_ := $clusters }}
|
||||||
|
{{- $clusterSettings := dict }}
|
||||||
|
{{- if hasKey $root.Values.notifier.externalK8sBundle.clusters $name }}
|
||||||
|
{{- $clusterSettings = index $root.Values.notifier.externalK8sBundle.clusters $name }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey $clusterSettings "kubeConfigName" }}
|
||||||
|
- kube_config_file_path: /kubeconfigs/{{ $clusterSettings.kubeConfigName }}
|
||||||
|
{{- else }}
|
||||||
|
- kube_config_file_path: /kubeconfigs/{{ $name }}
|
||||||
|
{{- end }}
|
||||||
|
namespace: {{ if hasKey $clusterSettings "namespace" }}{{ $clusterSettings.namespace }}{{ else }}{{ $clusterDefaults.namespace }}{{ end }}
|
||||||
|
config_map: {{ if hasKey $clusterSettings "configMap" }}{{ $clusterSettings.configMap }}{{ else }}{{ $clusterDefaults.configMap }}{{ end }}
|
||||||
|
config_map_key: {{ if hasKey $clusterSettings "configMapKey" }}{{ $clusterSettings.configMapKey }}{{ else }}{{ $clusterDefaults.configMapKey }}{{ end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.disk }}
|
{{- with .Values.upstreamAuthority.disk }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
|||||||
@@ -423,8 +423,25 @@ upstreamAuthority:
|
|||||||
|
|
||||||
notifier:
|
notifier:
|
||||||
k8sbundle:
|
k8sbundle:
|
||||||
|
## @param notifier.k8sbundle.enabled Enable local k8s bundle uploader
|
||||||
|
enabled: true
|
||||||
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
||||||
namespace: ""
|
namespace: ""
|
||||||
|
externalK8sBundle:
|
||||||
|
## @param notifier.externalK8sBundle.enabled Enable exernal k8s bundle uploader
|
||||||
|
enabled: true
|
||||||
|
defaults:
|
||||||
|
## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
|
||||||
|
namespace: "spire-system"
|
||||||
|
## @param notifier.externalK8sBundle.defaults.configMap ConfigMap name to push the bundle into on external clusters
|
||||||
|
configMap: "spire-bundle-upstream"
|
||||||
|
## @param notifier.externalK8sBundle.defaults.configMapKey ConfigMap key to push the bundle into on external clusters
|
||||||
|
configMapKey: "bundle.crt"
|
||||||
|
## @param notifier.externalK8sBundle.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
|
||||||
|
clusters: {}
|
||||||
|
# clustera:
|
||||||
|
# namespace: foo
|
||||||
|
# clusterb: {}
|
||||||
|
|
||||||
controllerManager:
|
controllerManager:
|
||||||
## @param controllerManager.enabled Flag to enable controller manager
|
## @param controllerManager.enabled Flag to enable controller manager
|
||||||
|
|||||||
@@ -59,8 +59,10 @@ kind create cluster --name other --kubeconfig "${SCRIPTPATH}/kubeconfig" --confi
|
|||||||
md5sum "${SCRIPTPATH}/kubeconfig"
|
md5sum "${SCRIPTPATH}/kubeconfig"
|
||||||
wc -l "${SCRIPTPATH}/kubeconfig"
|
wc -l "${SCRIPTPATH}/kubeconfig"
|
||||||
KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||||
|
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" create namespace spire-system
|
||||||
|
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" create configmap -n spire-system spire-bundle-upstream
|
||||||
|
|
||||||
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml" \
|
helm upgrade --install --create-namespace --namespace spire-server --values "${SCRIPTPATH}/values.yaml" \
|
||||||
--wait spire charts/spire --set "spire-server.kubeConfigs.other.kubeConfigBase64=$KCB64"
|
--wait spire charts/spire --set "spire-server.kubeConfigs.other.kubeConfigBase64=$KCB64"
|
||||||
helm test --namespace spire-server spire
|
helm test --namespace spire-server spire
|
||||||
|
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig" get configmap -n spire-system spire-bundle-upstream
|
||||||
|
|||||||
Reference in New Issue
Block a user