panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add support for Vault UpstreamAuthority plugin - K8s Auth (#415)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
LaithLite
2023-09-15 08:48:56 +02:00
committed by GitHub
co-authored by Marco Franssen
parent 1aac2d483d
commit 38f0af4491
4 changed files with 303 additions and 191 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/configmap.yaml
+32
View File
@@ -157,6 +157,38 @@ plugins:
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.vault }}
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
vault:
plugin_data:
vault_addr: {{ .vaultAddr | quote }}
pki_mount_point: {{ .pkiMountPoint | quote }}
insecure_skip_verify: {{ .insecureSkipVerify }}
{{- if ne (.insecureSkipVerify | toString) "true" }}
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
{{- end }}
{{- if ne .namespace "" }}
namespace: {{ .namespace | quote }}
{{- end }}
{{- $vaultAuthMethodUsed := 0 }}
{{- with .k8sAuth }}
{{- if eq (.enabled | toString) "true" }}
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
k8s_auth:
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
token_path: "/var/run/secrets/tokens/spire-server"
{{- end }}
{{- end }}
{{- if gt $vaultAuthMethodUsed 1 }}
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.upstreamAuthority.awsPCA }}
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}