panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support Openshift deployment (#13)

Browse Source 
* Add support for SPIRE deployment on OpenShift 4.13

Signed-off-by: Mariusz Sabath <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>

* Render README

Signed-off-by: Mariusz Sabath <[email protected]>

* Fix tornjak HTTP/HTTPS port values

Signed-off-by: Mariusz Sabath <[email protected]>

* Update Frontend README

Signed-off-by: Mariusz Sabath <[email protected]>

* Add env. variable to Agent to inject node name

Signed-off-by: Mariusz Sabath <[email protected]>

* Implement Marco's suggestion on CSI CSS version

Signed-off-by: Mariusz Sabath <[email protected]>

* Add MY_NODE_NAME env. variable to agent for openshift example

Signed-off-by: Mariusz Sabath <[email protected]>

* Move Openshift examples to dedicated directory

Signed-off-by: Mariusz Sabath <[email protected]>

* Simplified the install instructions

Signed-off-by: Mariusz Sabath <[email protected]>

* Suggested changes

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Andrew Block <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Update docs, fix default for backwards compat

Signed-off-by: Kevin Fox <[email protected]>

* Don't recommend experimental features by default, dont debug helm install by default and explain how to add additional features

Signed-off-by: Kevin Fox <[email protected]>

* Add notes about openshift to the project for other reviewers.

Signed-off-by: Kevin Fox <[email protected]>

* Fix incorrectly reverted change

Signed-off-by: Kevin Fox <[email protected]>

* Correct notes

Signed-off-by: Kevin Fox <[email protected]>

* Update default

Signed-off-by: Kevin Fox <[email protected]>

* Fix issue created from bad merge conflict resolution

Signed-off-by: kfox1111 <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

* Update examples/openshift/openshift-values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: Mariusz Sabath <[email protected]>

---------

Signed-off-by: Mariusz Sabath <[email protected]>
Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Trilok Geer <[email protected]>
Co-authored-by: Andrew Block <[email protected]>
Co-authored-by: Kevin Fox <[email protected]>
This commit is contained in:
Mariusz Sabath
2023-10-31 16:27:23 +00:00
committed by GitHub
co-authored by Trilok Geer Andrew Block kfox1111
parent ed23d8b714
commit 3b016841da
18 changed files with 432 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-csi-driver/README.md
+39 -34
View File
@@ -28,37 +28,42 @@ A Helm chart to install the SPIFFE CSI driver.
### SPIFFE CSI Driver Chart parameters ### SPIFFE CSI Driver Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ---------------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------- | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
| `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` | | `pluginName` | Set the csi driver name deployed to Kubernetes. | `csi.spiffe.io` |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` | | `image.repository` | The repository within the registry | `spiffe/spiffe-csi-driver` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `resources` | Resource requests and limits for spiffe-csi-driver | `{}` | | `resources` | Resource requests and limits for spiffe-csi-driver | `{}` |
| `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` | | `healthChecks.port` | The healthcheck port for spiffe-csi-driver | `9809` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
| `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` | | `livenessProbe.timeoutSeconds` | Timeout value in seconds for livenessProbe | `5` |
| `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` | | `imagePullSecrets` | Image pull secret details for spiffe-csi-driver | `[]` |
| `nameOverride` | Name override for spiffe-csi-driver | `""` | | `nameOverride` | Name override for spiffe-csi-driver | `""` |
| `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` | | `namespaceOverride` | Namespace to install spiffe-csi-driver | `""` |
| `fullnameOverride` | Full name override for spiffe-csi-driver | `""` | | `fullnameOverride` | Full name override for spiffe-csi-driver | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `csiDriverLabels` | Labels to apply to the CSIDriver | `{}` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `initContainers` | Init Containers to apply to the CSI Driver DaemonSet | `[]` |
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `podSecurityContext` | Security context for CSI driver pods | `{}` | | `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
| `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` | | `podAnnotations` | Pod annotations for spiffe-csi-driver | `{}` |
| `securityContext.privileged` | Flag for specifying privileged mode | `true` | | `podSecurityContext` | Security context for CSI driver pods | `{}` |
| `nodeSelector` | Node selector for CSI driver pods | `{}` | | `securityContext.readOnlyRootFilesystem` | Flag for read only root filesystem | `true` |
| `tolerations` | Tolerations for CSI driver pods | `[]` | | `securityContext.privileged` | Flag for specifying privileged mode | `true` |
| `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `nodeSelector` | Node selector for CSI driver pods | `{}` |
| `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` | | `tolerations` | Tolerations for CSI driver pods | `[]` |
| `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeDriverRegistrar.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `nodeDriverRegistrar.image.repository` | The repository within the registry | `sig-storage/csi-node-driver-registrar` |
| `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` | | `nodeDriverRegistrar.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` | | `nodeDriverRegistrar.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
| `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `nodeDriverRegistrar.image.tag` | Overrides the image tag | `v2.9.0` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` | | `nodeDriverRegistrar.resources` | Resource requests and limits for CSI driver pods | `{}` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` | | `agentSocketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `kubeletPath` | Path to kubelet file | `/var/lib/kubelet` |
| `priorityClassName` | Priority class assigned to daemonset pods | `""` |
| `restrictedScc.enabled` | Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support | `false` |
| `restrictedScc.name` | Set the name of the restricted SCC with CSI support | `""` |
| `restrictedScc.version` | Version of the restricted SCC | `2` |
charts/spire/charts/spiffe-csi-driver/templates/daemonset.yaml
+4
View File
@@ -36,6 +36,10 @@ spec:
{{- if .Values.priorityClassName }} {{- if .Values.priorityClassName }}
priorityClassName: {{ .Values.priorityClassName }} priorityClassName: {{ .Values.priorityClassName }}
{{- end }} {{- end }}
{{- with .Values.initContainers }}
initContainers:
{{- toYaml . | nindent 8 }}
{{- end }}
containers: containers:
# This is the container which runs the SPIFFE CSI driver. # This is the container which runs the SPIFFE CSI driver.
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
charts/spire/charts/spiffe-csi-driver/templates/scc-restricted-csi.yaml
+61
View File
@@ -0,0 +1,61 @@
{{- if and .Values.global.openshift .Values.restrictedScc.enabled }}
{{- $name := default (printf "restricted-%scsi" (eq (.Values.restrictedScc.version | toString) "2" | ternary "v2-" "")) .Values.restrictedScc.name -}}
{{- $v2Description := "This is the most restrictive SCC and it is used by default for authenticated users. On top of the legacy 'restricted' SCC, it also requires to drop ALL capabilities and does not allow privilege escalation binaries. It will also default the seccomp profile to runtime/default if unset, otherwise this seccomp profile is required." -}}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
allowHostPorts: false
priority: null
requiredDropCapabilities:
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
- ALL
{{- else }}
- KILL
- MKNOD
- SETUID
- SETGID
{{- end }}
allowPrivilegedContainer: false
runAsUser:
type: MustRunAsRange
users: []
allowHostDirVolumePlugin: false
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
seccompProfiles:
- runtime/default
{{- end }}
allowHostIPC: false
seLinuxContext:
type: MustRunAs
readOnlyRootFilesystem: false
metadata:
name: {{ $name }}
annotations:
kubernetes.io/description: >-
{{ $name }} denies access to all host features and requires pods to be
run with a UID, and SELinux context that are allocated to the namespace.
{{ eq (.Values.restrictedScc.version | toString) "2" | ternary $v2Description "" }}
fsGroup:
type: MustRunAs
groups: []
defaultAddCapabilities: null
supplementalGroups:
type: RunAsAny
volumes:
- configMap
- csi
- downwardAPI
- emptyDir
- ephemeral
- persistentVolumeClaim
- projected
- secret
allowHostPID: false
allowHostNetwork: false
allowPrivilegeEscalation: {{ eq (.Values.restrictedScc.version | toString) "2" | ternary false true }}
{{- if eq (.Values.restrictedScc.version | toString) "2" }}
allowedCapabilities:
- NET_BIND_SERVICE
{{ else}}
allowedCapabilities: null
{{- end }}
{{- end }}
charts/spire/charts/spiffe-csi-driver/templates/scc-spiffe-csi-driver.yaml
+30
View File
@@ -0,0 +1,30 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spiffe-csi-driver.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spiffe-csi-driver.namespace" . }}:{{ include "spiffe-csi-driver.serviceAccountName" . }}
volumes:
- configmap
- hostPath
- secret
allowHostDirVolumePlugin: true
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
{{ end }}
charts/spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml
+5
View File
@@ -2,6 +2,11 @@ apiVersion: storage.k8s.io/v1
kind: CSIDriver kind: CSIDriver
metadata: metadata:
name: {{ .Values.pluginName | quote }} name: {{ .Values.pluginName | quote }}
{{- with .Values.csiDriverLabels }}
labels:
{{- toYaml . | nindent 4 }}
{{- end }}
spec: spec:
# Only ephemeral, inline volumes are supported. There is no need for a # Only ephemeral, inline volumes are supported. There is no need for a
# controller to provision and attach volumes. # controller to provision and attach volumes.
charts/spire/charts/spiffe-csi-driver/values.yaml
+15
View File
@@ -58,6 +58,12 @@ namespaceOverride: ""
## @param fullnameOverride Full name override for spiffe-csi-driver ## @param fullnameOverride Full name override for spiffe-csi-driver
fullnameOverride: "" fullnameOverride: ""
## @param csiDriverLabels Labels to apply to the CSIDriver
csiDriverLabels: {}
## @param initContainers Init Containers to apply to the CSI Driver DaemonSet
initContainers: []
## @param serviceAccount.create Specifies whether a service account should be created ## @param serviceAccount.create Specifies whether a service account should be created
## @param serviceAccount.annotations Annotations to add to the service account ## @param serviceAccount.annotations Annotations to add to the service account
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated. ## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
@@ -126,3 +132,12 @@ kubeletPath: /var/lib/kubelet
## @param priorityClassName Priority class assigned to daemonset pods ## @param priorityClassName Priority class assigned to daemonset pods
priorityClassName: "" priorityClassName: ""
restrictedScc:
## @param restrictedScc.enabled Enables the creation of a SecurityContextConstraint based on the restricted SCC with CSI volume support
enabled: false
## @param restrictedScc.name Set the name of the restricted SCC with CSI support
name: ""
## @param restrictedScc.version Version of the restricted SCC
version: 2
charts/spire/charts/spiffe-oidc-discovery-provider/templates/scc-spire-oidc-discovery-provider.yaml
+38
View File
@@ -0,0 +1,38 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spiffe-oidc-discovery-provider.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
- system:serviceaccount:{{ include "spiffe-oidc-discovery-provider.namespace" . }}:{{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}-pre-delete
volumes:
- configMap
- hostPath
- projected
- secret
- ephemeral
- downwardAPI
- csi
- emptyDir
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
seccompProfiles:
- '*'
{{ end }}
charts/spire/charts/spire-agent/README.md
+1 -1
View File
@@ -59,7 +59,7 @@ A Helm chart to install the SPIRE agent.
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `8081` | | `server.port` | Port number for Spire server | `8081` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `healthChecks.port` | override the host port used for health checking | `9980` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
charts/spire/charts/spire-agent/templates/scc-spire-agent.yaml
+31
View File
@@ -0,0 +1,31 @@
{{- if eq (.Values.global.openshift | toString) "true" }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
name: {{ include "spire-agent.fullname" . }}
readOnlyRootFilesystem: true
runAsUser:
type: RunAsAny
seLinuxContext:
type: RunAsAny
supplementalGroups:
type: RunAsAny
users:
- system:serviceaccount:{{ include "spire-agent.namespace" . }}:{{ include "spire-agent.serviceAccountName" . }}
volumes:
- configMap
- hostPath
- projected
- secret
allowHostDirVolumePlugin: true
allowHostIPC: true
allowHostNetwork: true
allowHostPID: true
allowHostPorts: true
allowPrivilegeEscalation: true
allowPrivilegedContainer: true
fsGroup:
type: RunAsAny
groups: []
{{ end }}
charts/spire/charts/spire-agent/values.yaml
+1 -1
View File
@@ -106,7 +106,7 @@ server:
healthChecks: healthChecks:
## @param healthChecks.port override the host port used for health checking ## @param healthChecks.port override the host port used for health checking
port: 9980 port: 9982
## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe ## @param livenessProbe.initialDelaySeconds Initial delay seconds for probe
## @param livenessProbe.periodSeconds Period seconds for probe ## @param livenessProbe.periodSeconds Period seconds for probe
charts/spire/charts/spire-server/templates/tornjak-ingress.yaml
+2 -2
View File
@@ -23,8 +23,8 @@ metadata:
{{- end }} {{- end }}
spec: spec:
{{- if eq (include "spire-tornjak.connectionType" .) "http" }} {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.http "Values" .Values) | nindent 2 }}
{{- else -}} {{- else -}}
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }} {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" .Values.tornjak.service.ports.https "Values" .Values) | nindent 2 }}
{{- end -}} {{- end -}}
{{- end }} {{- end }}
charts/spire/charts/tornjak-frontend/README.md
+1
View File
@@ -88,6 +88,7 @@ port forwarding. See the chart NOTES output for more details.
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | | `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | | `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | | `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
| `workingDir` | Path containing the Tornjak frontend within the image | `/usr/src/app` |
| `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` | | `ingress.enabled` | Flag to enable ingress for Tornjak frontend service | `false` |
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
charts/spire/charts/tornjak-frontend/templates/deployment.yaml
+2 -2
View File
@@ -53,9 +53,9 @@ spec:
{{- end }} {{- end }}
volumeMounts: volumeMounts:
- name: cache - name: cache
mountPath: /usr/src/app/node_modules/.cache mountPath: {{ .Values.workingDir }}/node_modules/.cache
- name: env - name: env
mountPath: /usr/src/app/build/tmp mountPath: {{ .Values.workingDir }}/build/tmp
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{- toYaml . | nindent 8 }} {{- toYaml . | nindent 8 }}
charts/spire/charts/tornjak-frontend/values.yaml
+3
View File
@@ -113,6 +113,9 @@ startupProbe:
failureThreshold: 6 failureThreshold: 6
successThreshold: 1 successThreshold: 1
## @param workingDir Path containing the Tornjak frontend within the image
workingDir: /usr/src/app
## @param ingress.enabled Flag to enable ingress for Tornjak frontend service ## @param ingress.enabled Flag to enable ingress for Tornjak frontend service
## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.className Ingress class name for Tornjak frontend service
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
examples/openshift/README.md
+76
View File
@@ -0,0 +1,76 @@
# Recommended setup for installing Spire on Openshift
> **Note**: This functionality is under development. It works but has no automated testing and will have security tightened in the future.
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
To be consistent with the rest of the Spire helm-charts,
we deploy Spire across 2 namespaces.
```shell
kubectl create namespace "spire-system"
kubectl create namespace "spire-server"
#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up.
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged
kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite
kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite
helm upgrade --install --namespace spire-server spire-crds charts/spire-crds
```
Obtain you ingress subdomain:
```shell
appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
echo "$appdomain"
```
Update the `example-your-values.yaml` file with your subdomain.
_Note: The location of the apps subdomain may be different in certain environments_
## Standard Deployment
```shell
helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \
--values examples/openshift/openshift-values.yaml \
--values examples/production/example-your-values.yaml \
--render-subchart-notes
```
## IBM Cloud Deployment
Openshift on IBM Cloud requires additional configuration:
```shell
helm upgrade --install --namespace spire-server spire charts/spire \
--values examples/production/values.yaml \
--values examples/openshift/openshift-values.yaml \
--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \
--set spiffe-csi-driver.restrictedScc.enabled=true \
--values examples/production/example-your-values.yaml \
--render-subchart-notes
```
## Feature Customization
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
For example:
```
--values examples/openshift/openshift-values.yaml \
--values examples/tornjak/values.yaml \
--values examples/production/example-your-values.yaml \
```
## Finish install
Once installed, the namespace security can be tightened back up.
```shell
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
```
examples/openshift/openshift-values.yaml
+82
View File
@@ -0,0 +1,82 @@
global:
openshift: true
telemetry:
prometheus:
enabled: true
spire-server:
tornjak:
image:
registry: ghcr.io
repository: spiffe/tornjak-backend
tag: ubi-v1.4.1
nodeAttestor:
k8sPsat:
serviceAccountAllowList: ["spire-system:spire-agent"]
notifier:
k8sbundle:
namespace: spire-system
podSecurityContext:
# These are unset so that openshift can automatically assign its own restricted uids to the pods
runAsUser: null
runAsGroup: null
fsGroup: null
spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
# Talk from the agent to kubelet based on hostname instead of localhost
extraEnvVars:
- name: MY_NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
upstream-spire-agent:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
spiffe-oidc-discovery-provider:
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
tornjak-frontend:
workingDir: /opt/app-root/src
image:
registry: ghcr.io
repository: spiffe/tornjak-frontend
tag: ubi-v1.4.1
podSecurityContext:
runAsUser: null
runAsGroup: null
fsGroup: null
spiffe-csi-driver:
csiDriverLabels:
security.openshift.io/csi-ephemeral-volume-profile: restricted
initContainers:
- terminationMessagePath: /dev/termination-log
name: set-context
command:
- chcon
- '-Rvt'
- container_file_t
- spire-agent-socket/
securityContext:
capabilities:
drop:
- all
privileged: true
imagePullPolicy: Always
volumeMounts:
- name: spire-agent-socket-dir
mountPath: /spire-agent-socket
terminationMessagePolicy: File
image: 'registry.access.redhat.com/ubi9:latest'
examples/production/example-your-values.yaml
+3
View File
@@ -22,3 +22,6 @@ spire-server:
# host: oidc-discovery # host: oidc-discovery
# tlsSecret: tls-cert # tlsSecret: tls-cert
tornjak-frontend:
apiServerURL: https://tornjak-backend.production.other/
project/openshift.md
+38
View File
@@ -0,0 +1,38 @@
# OpenShift notes for K8S developers
## SecurityContexts
OpenShift automatically generates uid/gid's for pods. They should not be set to get this behavior.
## CSIDriver issues
A workload in a restricted namespace can not access a csidriver that isn't labeled:
```yaml
security.openshift.io/csi-ephemeral-volume-profile: restricted
```
If the CSIDriver doesn't exist, the workload is blocked from being uploaded into the cluster. This runs into ordering issues with helm install as it always loads regular workloads before CSIDriver objects.
## Pod Security Standard
Pod Security Standard (PSS) rules are automatically generated on openshift. Details at [https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html](https://docs.openshift.com/container-platform/4.13/authentication/understanding-and-managing-pod-security-admission.html)
The defaults though are too chatty. It puts audit/warn still at restricted.
## Ingress
Ingress objects automatically create Role objects in the same namespace, when the ingress object is viewed as valid by openshift, if not it is ignored. A missing Role object is a sure sign that something is wrong in the Ingress.
Some things to watch out for.
When the ingress is annotated:
```yaml
"route.openshift.io/termination": "passthrough"
```
The ingress object can not have a path specified and the pathType needs to be ImplementationSpecific
Also, unless a secretName is specified, it can not have a tls section.