diff --git a/charts/spire/charts/spiffe-csi-driver/README.md b/charts/spire/charts/spiffe-csi-driver/README.md index c3e96fe..1e1150d 100644 --- a/charts/spire/charts/spiffe-csi-driver/README.md +++ b/charts/spire/charts/spiffe-csi-driver/README.md @@ -28,37 +28,42 @@ A Helm chart to install the SPIFFE CSI driver. ### SPIFFE CSI Driver Chart parameters -| Name | Description | Value | -| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | -| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | -| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | -| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | -| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | -| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | -| `nameOverride` | Name override for spiffe-csi-driver | `""` | -| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | -| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | -| `podSecurityContext` | Security context for CSI driver pods | `{}` | -| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | -| `securityContext.privileged` | Flag for specifying privileged mode | `true` | -| `nodeSelector` | Node selector for CSI driver pods | `{}` | -| `tolerations` | Tolerations for CSI driver pods | `[]` | -| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | -| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | -| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | -| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | -| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | -| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | -| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | -| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| Name | Description | Value | +| ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- | +| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | +| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | +| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | +| `nameOverride` | Name override for spiffe-csi-driver | `""` | +| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | +| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | +| `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` | +| `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | +| `podSecurityContext` | Security context for CSI driver pods | `{}` | +| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | +| `securityContext.privileged` | Flag for specifying privileged mode | `true` | +| `nodeSelector` | Node selector for CSI driver pods | `{}` | +| `tolerations` | Tolerations for CSI driver pods | `[]` | +| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | +| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | +| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | +| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | +| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | +| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | +| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | +| `priorityClassName` | Priority class assigned to daemonset pods | `""` | +| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` | +| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` | +| `restrictedScc.version` | Version of the restricted SCC | `2` | diff --git a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml index 2031f7f..7d5339e 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml @@ -36,6 +36,10 @@ spec: {{- if .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }} {{- end }} + {{- with .Values.initContainers }} + initContainers: + {{- toYaml . | nindent 8 }} + {{- end }} containers: # This is the container which runs the SPIFFE CSI driver. - name: {{ .Chart.Name }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml new file mode 100644 index 0000000..5e94562 --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml @@ -0,0 +1,61 @@ +{{- if and .Values.global.openshift .Values.restrictedScc.enabled }} +{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}} +{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +allowHostPorts: false +priority: null +requiredDropCapabilities: +{{- if eq (.Values.restrictedScc.version | toString) "2" }} + - ALL +{{- else }} + - KILL + - MKNOD + - SETUID + - SETGID +{{- end }} +allowPrivilegedContainer: false +runAsUser: + type: MustRunAsRange +users: [] +allowHostDirVolumePlugin: false +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +seccompProfiles: + - runtime/default +{{- end }} +allowHostIPC: false +seLinuxContext: + type: MustRunAs +readOnlyRootFilesystem: false +metadata: + name: {{ $name }} + annotations: + kubernetes.io/description: >- + {{ $name }} denies access to all host features and requires pods to be + run with a UID, and SELinux context that are allocated to the namespace. + {{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }} +fsGroup: + type: MustRunAs +groups: [] +defaultAddCapabilities: null +supplementalGroups: + type: RunAsAny +volumes: + - configMap + - csi + - downwardAPI + - emptyDir + - ephemeral + - persistentVolumeClaim + - projected + - secret +allowHostPID: false +allowHostNetwork: false +allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }} +{{- if eq (.Values.restrictedScc.version | toString) "2" }} +allowedCapabilities: + - NET_BIND_SERVICE +{{ else}} +allowedCapabilities: null +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml new file mode 100644 index 0000000..73ef6fa --- /dev/null +++ b/charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml @@ -0,0 +1,30 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-csi-driver.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }} +volumes: + - configmap + - hostPath + - secret +allowHostDirVolumePlugin: true +allowHostIPC: false +allowHostNetwork: false +allowHostPID: false +allowHostPorts: false +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml index 4c1d51d..95d0086 100644 --- a/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml +++ b/charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml @@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1 kind: CSIDriver metadata: name: {{ .Values.pluginName | quote }} + {{- with .Values.csiDriverLabels }} + labels: + {{- toYaml . | nindent 4 }} + {{- end }} + spec: # Only ephemeral, inline volumes are supported. There is no need for a # controller to provision and attach volumes. diff --git a/charts/spire/charts/spiffe-csi-driver/values.yaml b/charts/spire/charts/spiffe-csi-driver/values.yaml index 6664072..aa4e943 100644 --- a/charts/spire/charts/spiffe-csi-driver/values.yaml +++ b/charts/spire/charts/spiffe-csi-driver/values.yaml @@ -58,6 +58,12 @@ namespaceOverride: "" ## @param fullnameOverride Full name override for spiffe-csi-driver fullnameOverride: "" +## @param csiDriverLabels Labels to apply to the CSIDriver +csiDriverLabels: {} + +## @param initContainers Init Containers to apply to the CSI Driver DaemonSet +initContainers: [] + ## @param serviceAccount.create Specifies whether a service account should be created ## @param serviceAccount.annotations Annotations to add to the service account ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. @@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet ## @param priorityClassName Priority class assigned to daemonset pods priorityClassName: "" + +restrictedScc: + ## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support + enabled: false + + ## @param restrictedScc.name Set the name of the restricted SCC with CSI support + name: "" + ## @param restrictedScc.version Version of the restricted SCC + version: 2 diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml new file mode 100644 index 0000000..71c147c --- /dev/null +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml @@ -0,0 +1,38 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spiffe-oidc-discovery-provider.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }} + - system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete +volumes: + - configMap + - hostPath + - projected + - secret + - ephemeral + - downwardAPI + - csi + - emptyDir +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] +seccompProfiles: + - '*' + +{{ end }} diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 82e150e..5719008 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -59,7 +59,7 @@ A Helm chart to install the SPIRE agent. | `server.address` | Address for Spire server | `""` | | `server.port` | Port number for Spire server | `8081` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` | -| `healthChecks.port` | override the host port used for health checking | `9980` | +| `healthChecks.port` | override the host port used for health checking | `9982` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | diff --git a/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml new file mode 100644 index 0000000..b92549b --- /dev/null +++ b/charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml @@ -0,0 +1,31 @@ +{{- if eq (.Values.global.openshift | toString) "true" }} +apiVersion: security.openshift.io/v1 +kind: SecurityContextConstraints +metadata: + name: {{ include "spire-agent.fullname" . }} +readOnlyRootFilesystem: true +runAsUser: + type: RunAsAny +seLinuxContext: + type: RunAsAny +supplementalGroups: + type: RunAsAny +users: + - system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }} +volumes: + - configMap + - hostPath + - projected + - secret +allowHostDirVolumePlugin: true +allowHostIPC: true +allowHostNetwork: true +allowHostPID: true +allowHostPorts: true +allowPrivilegeEscalation: true +allowPrivilegedContainer: true +fsGroup: + type: RunAsAny +groups: [] + +{{ end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index de857f9..0011f7b 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -106,7 +106,7 @@ server: healthChecks: ## @param healthChecks.port override the host port used for health checking - port: 9980 + port: 9982 ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 8d10558..7b0752c 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -23,8 +23,8 @@ metadata: {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 4c6710d..21d7093 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -88,6 +88,7 @@ port forwarding. See the chart NOTES output for more details. | `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | | `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` | | `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | | `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | diff --git a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml index c7ba337..a1c4f42 100644 --- a/charts/spire/charts/tornjak-frontend/templates/deployment.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/deployment.yaml @@ -53,9 +53,9 @@ spec: {{- end }} volumeMounts: - name: cache - mountPath: /usr/src/app/node_modules/.cache + mountPath: {{ .Values.workingDir }}/node_modules/.cache - name: env - mountPath: /usr/src/app/build/tmp + mountPath: {{ .Values.workingDir }}/build/tmp {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 2965f06..cf3c0ec 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -113,6 +113,9 @@ startupProbe: failureThreshold: 6 successThreshold: 1 +## @param workingDir Path containing the Tornjak frontend within the image +workingDir: /usr/src/app + ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. diff --git a/examples/openshift/README.md b/examples/openshift/README.md new file mode 100644 index 0000000..da3d5b2 --- /dev/null +++ b/examples/openshift/README.md @@ -0,0 +1,76 @@ +# Recommended setup for installing Spire on Openshift + +> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future. + +This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com) + +To be consistent with the rest of the Spire helm-charts, +we deploy Spire across 2 namespaces. + +```shell +kubectl create namespace "spire-system" +kubectl create namespace "spire-server" + +#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up. +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged + +kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false +kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged +kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite +kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite + +helm upgrade --install --namespace spire-server spire-crds charts/spire-crds +``` + +Obtain you ingress subdomain: + +```shell +appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//') +echo "$appdomain" +``` + +Update the `example-your-values.yaml` file with your subdomain. + +_Note: The location of the apps subdomain may be different in certain environments_ + +## Standard Deployment + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## IBM Cloud Deployment + +Openshift on IBM Cloud requires additional configuration: + +```shell +helm upgrade --install --namespace spire-server spire charts/spire \ +--values examples/production/values.yaml \ +--values examples/openshift/openshift-values.yaml \ +--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \ +--set spiffe-csi-driver.restrictedScc.enabled=true \ +--values examples/production/example-your-values.yaml \ +--render-subchart-notes +``` + +## Feature Customization + +Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml + +For example: +``` +--values examples/openshift/openshift-values.yaml \ +--values examples/tornjak/values.yaml \ +--values examples/production/example-your-values.yaml \ +``` + +## Finish install + +Once installed, the namespace security can be tightened back up. +```shell +kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite +``` diff --git a/examples/openshift/openshift-values.yaml b/examples/openshift/openshift-values.yaml new file mode 100644 index 0000000..5d9ae79 --- /dev/null +++ b/examples/openshift/openshift-values.yaml @@ -0,0 +1,82 @@ +global: + openshift: true + telemetry: + prometheus: + enabled: true + +spire-server: + tornjak: + image: + registry: ghcr.io + repository: spiffe/tornjak-backend + tag: ubi-v1.4.1 + + nodeAttestor: + k8sPsat: + serviceAccountAllowList: ["spire-system:spire-agent"] + notifier: + k8sbundle: + namespace: spire-system + podSecurityContext: + # These are unset so that openshift can automatically assign its own restricted uids to the pods + runAsUser: null + runAsGroup: null + fsGroup: null + +spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + # Talk from the agent to kubelet based on hostname instead of localhost + extraEnvVars: + - name: MY_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + +upstream-spire-agent: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-oidc-discovery-provider: + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +tornjak-frontend: + workingDir: /opt/app-root/src + image: + registry: ghcr.io + repository: spiffe/tornjak-frontend + tag: ubi-v1.4.1 + podSecurityContext: + runAsUser: null + runAsGroup: null + fsGroup: null + +spiffe-csi-driver: + csiDriverLabels: + security.openshift.io/csi-ephemeral-volume-profile: restricted + initContainers: + - terminationMessagePath: /dev/termination-log + name: set-context + command: + - chcon + - '-Rvt' + - container_file_t + - spire-agent-socket/ + securityContext: + capabilities: + drop: + - all + privileged: true + imagePullPolicy: Always + volumeMounts: + - name: spire-agent-socket-dir + mountPath: /spire-agent-socket + terminationMessagePolicy: File + image: 'registry.access.redhat.com/ubi9:latest' diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index 68b7b63..67eaaed 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -22,3 +22,6 @@ spire-server: # host: oidc-discovery # tlsSecret: tls-cert +tornjak-frontend: + apiServerURL: https://tornjak-backend.production.other/ + diff --git a/project/openshift.md b/project/openshift.md new file mode 100644 index 0000000..b47ddef --- /dev/null +++ b/project/openshift.md @@ -0,0 +1,38 @@ +# OpenShift notes for K8S developers + +## SecurityContexts + +OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior. + +## CSIDriver issues + +A workload in a restricted namespace can not access a csidriver that isn't labeled: + +```yaml +security.openshift.io/csi-ephemeral-volume-profile: restricted +``` + +If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects. + +## Pod Security Standard + +Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html) + +The defaults though are too chatty. It puts audit/warn still at restricted. + +## Ingress + +Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress. + +Some things to watch out for. + +When the ingress is annotated: + +```yaml + "route.openshift.io/termination": "passthrough" +``` + +The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific + +Also, unless a secretName is specified, it can not have a tls section. +