Add support for Vault UpstreamAuthority plugin - K8s Auth (#415)
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
LaithLite
co-authored by
Marco Franssen
Marco Franssen
parent
1aac2d483d
commit
38f0af4491
@@ -86,7 +86,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------- |
|
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
@@ -198,6 +198,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
| `upstreamAuthority.spire.server` | Server details for the Spire instance use as upstream CA | |
|
||||||
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
| `upstreamAuthority.spire.server.address` | Address for upstream Spire server | `""` |
|
||||||
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
| `upstreamAuthority.spire.server.port` | Port for upstream Spire server | `8081` |
|
||||||
|
| `upstreamAuthority.vault.enabled` | Enable Hashicorp Vault as upstream CA | `false` |
|
||||||
|
| `upstreamAuthority.vault.vaultAddr` | The URL of the Vault server. (e.g., https://vault.example.com:8443/) | `""` |
|
||||||
|
| `upstreamAuthority.vault.namespace` | Name of the Vault namespace. This is only available in the Vault Enterprise. | `""` |
|
||||||
|
| `upstreamAuthority.vault.pkiMountPoint` | Name of the mount point where PKI secret engine is mounted | `pki` |
|
||||||
|
| `upstreamAuthority.vault.insecureSkipVerify` | If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault | `false` |
|
||||||
|
| `upstreamAuthority.vault.caCert.type` | Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt` | `Secret` |
|
||||||
|
| `upstreamAuthority.vault.caCert.name` | Name of the Kubernetes resource containing the Vault server certificate | `vault-ca` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.enabled` | Enable k8s authentication to Hashicorp Vault | `false` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint` | Name of the mount point where the Kubernetes auth method is mounted | `kubernetes` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||||
|
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||||
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||||
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
| `controllerManager.enabled` | Flag to enable controller manager | `false` |
|
||||||
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
| `controllerManager.installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
|||||||
@@ -157,6 +157,38 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
UpstreamAuthority:
|
||||||
|
vault:
|
||||||
|
plugin_data:
|
||||||
|
vault_addr: {{ .vaultAddr | quote }}
|
||||||
|
pki_mount_point: {{ .pkiMountPoint | quote }}
|
||||||
|
insecure_skip_verify: {{ .insecureSkipVerify }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .namespace "" }}
|
||||||
|
namespace: {{ .namespace | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- $vaultAuthMethodUsed := 0 }}
|
||||||
|
{{- with .k8sAuth }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
|
||||||
|
k8s_auth:
|
||||||
|
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
|
||||||
|
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
|
||||||
|
token_path: "/var/run/secrets/tokens/spire-server"
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if gt $vaultAuthMethodUsed 1 }}
|
||||||
|
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.awsPCA }}
|
{{- with .Values.upstreamAuthority.awsPCA }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
|||||||
@@ -170,7 +170,19 @@ spec:
|
|||||||
subPath: policy.json
|
subPath: policy.json
|
||||||
readOnly: true
|
readOnly: true
|
||||||
{{ end }}
|
{{ end }}
|
||||||
{{ end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
mountPath: /var/run/secrets/tokens
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
- name: vault-ca
|
||||||
|
mountPath: /run/spire/vault-upstream
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||||
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@@ -357,6 +369,33 @@ spec:
|
|||||||
path: {{ .Values.persistence.hostPath }}
|
path: {{ .Values.persistence.hostPath }}
|
||||||
type: Directory
|
type: Directory
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.vault }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
||||||
|
{{- if eq (.caCert.type | lower) "configmap" }}
|
||||||
|
- name: vault-ca
|
||||||
|
configMap:
|
||||||
|
name: {{ .caCert.name }}
|
||||||
|
{{- else if eq (.caCert.type | lower) "secret" }}
|
||||||
|
- name: vault-ca
|
||||||
|
secret:
|
||||||
|
secretName: {{ .caCert.name }}
|
||||||
|
optional: false
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if eq (.k8sAuth.enabled | toString) "true" }}
|
||||||
|
- name: spire-psat
|
||||||
|
projected:
|
||||||
|
sources:
|
||||||
|
- serviceAccountToken:
|
||||||
|
path: spire-server
|
||||||
|
expirationSeconds: {{ .k8sAuth.token.expiry }}
|
||||||
|
{{- if ne .k8sAuth.token.audience "" }}
|
||||||
|
audience: {{ .k8sAuth.token.audience }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
{{- if eq .Values.persistence.type "pvc" }}
|
{{- if eq .Values.persistence.type "pvc" }}
|
||||||
volumeClaimTemplates:
|
volumeClaimTemplates:
|
||||||
- metadata:
|
- metadata:
|
||||||
|
|||||||
@@ -330,6 +330,35 @@ upstreamAuthority:
|
|||||||
address: ""
|
address: ""
|
||||||
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
## @param upstreamAuthority.spire.server.port Port for upstream Spire server
|
||||||
port: 8081
|
port: 8081
|
||||||
|
vault:
|
||||||
|
## @param upstreamAuthority.vault.enabled Enable Hashicorp Vault as upstream CA
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.vaultAddr The URL of the Vault server. (e.g., https://vault.example.com:8443/)
|
||||||
|
vaultAddr: ""
|
||||||
|
## @param upstreamAuthority.vault.namespace Name of the Vault namespace. This is only available in the Vault Enterprise.
|
||||||
|
namespace: ""
|
||||||
|
## @param upstreamAuthority.vault.pkiMountPoint Name of the mount point where PKI secret engine is mounted
|
||||||
|
pkiMountPoint: "pki"
|
||||||
|
## @param upstreamAuthority.vault.insecureSkipVerify If true, caCert options are ignored and Spire accepts any server certificates claiming to be Vault
|
||||||
|
insecureSkipVerify: false
|
||||||
|
caCert:
|
||||||
|
## @param upstreamAuthority.vault.caCert.type Type of resource representing the Vault server certificate, options are 'Secret' or 'Configmap', the item must be named `ca.crt`
|
||||||
|
type: Secret
|
||||||
|
## @param upstreamAuthority.vault.caCert.name Name of the Kubernetes resource containing the Vault server certificate
|
||||||
|
name: vault-ca
|
||||||
|
|
||||||
|
k8sAuth:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.enabled Enable k8s authentication to Hashicorp Vault
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthMountPoint Name of the mount point where the Kubernetes auth method is mounted
|
||||||
|
k8sAuthMountPoint: "kubernetes"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.k8sAuthRoleName Required - Name of the Vault role. The plugin authenticates against the named role
|
||||||
|
k8sAuthRoleName: ""
|
||||||
|
token:
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.audience Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info.
|
||||||
|
audience: "vault"
|
||||||
|
## @param upstreamAuthority.vault.k8sAuth.token.expiry Expiry time in seconds for the token
|
||||||
|
expiry: 7200
|
||||||
|
|
||||||
notifier:
|
notifier:
|
||||||
k8sbundle:
|
k8sbundle:
|
||||||
|
|||||||
Reference in New Issue
Block a user