panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add tls section to federation bundle endpoint and fix up annotations (#173)

Browse Source 
* Add cert-manager support to the federation bundle endpoint and fix up bundle endpoint ingress annotations

Signed-off-by: Kevin Fox <[email protected]>

* Add external secret too

Signed-off-by: Kevin Fox <[email protected]>

* Add forgotten files

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
2024-01-17 00:17:15 -08:00
committed by GitHub
parent c7ab1319cc
commit 3ccdb5e4c1
6 changed files with 134 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/configmap.yaml
+13
View File
@@ -22,6 +22,19 @@
{{- end }}
{{- end }}
{{- end }}
{{- $tlsFederationCount := 0 }}
{{- if .Values.federation.tls.spire.enabled }}
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
{{- end }}
{{- if .Values.federation.tls.externalSecret.enabled }}
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
{{- end }}
{{- if .Values.federation.tls.certManager.enabled }}
{{- $tlsFederationCount = add $tlsFederationCount 1 }}
{{- end }}
{{- if ne $tlsFederationCount 1 }}
{{- fail "You must enable one and only one federation TLS configuration" }}
{{- end }}
{{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }}
charts/spire/charts/spire-server/templates/federation-certificate.yaml
+27
View File
@@ -0,0 +1,27 @@
{{- define "spire-server.federation-cert-manager-default-cert" }}
{{- $fullName := include "spire-server.fullname" . }}
{{- $issuerFullName := printf "%s-federation" $fullName }}
dnsNames:
{{- if ne (len .Values.federation.tls.certManager.certificate.dnsNames) 0 }}
{{- toYaml .Values.federation.tls.certManager.certificate.dnsNames | nindent 4 }}
{{- else }}
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.federation.ingress "Values" .Values) }}
{{- end }}
issuerRef:
{{- with .Values.federation.tls.certManager.certificate.issuerRef.group }}
group: {{ . }}
{{- end }}
kind: {{ default "Issuer" .Values.federation.tls.certManager.certificate.issuerRef.kind }}
name: {{ default $issuerFullName .Values.federation.tls.certManager.certificate.issuerRef.name }}
secretName: {{ $issuerFullName }}-cert
{{- end }}
{{- if .Values.federation.tls.certManager.enabled }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ include "spire-server.namespace" . }}
spec:
{{ merge (include "spire-server.federation-cert-manager-default-cert" . | fromYaml) .Values.federation.tls.certManager.certificate | toYaml | nindent 2 }}
{{- end }}
charts/spire/charts/spire-server/templates/federation-ingress.yaml
+21 -3
View File
@@ -1,16 +1,34 @@
{{- if .Values.federation.enabled }}
{{- if .Values.federation.ingress.enabled -}}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
{{- $svcName := include "spire-server.fullname" . }}
{{/* Until https://github.com/spiffe/spire/issues/2202 is resolved, use ingress to implement cert-manager and externalSecret support. */}}
{{- $federationIngress := deepCopy .Values.federation.ingress }}
{{- if .Values.federation.tls.certManager.enabled }}
{{- $secret := printf "%s-federation-cert" $svcName }}
{{- $_ := set $federationIngress "tlsSecret" $secret }}
{{- end }}
{{- if .Values.federation.tls.externalSecret.enabled }}
{{- $_ := set $federationIngress "tlsSecret" .Values.federation.tls.externalSecret.secretName }}
{{- end }}
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
{{- $tlsSection := true }}
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
{{- if eq $ingressControllerType "ingress-nginx" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
{{- if not .Values.federation.ingress.tlsSecret }}
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
{{- end }}
{{- else if eq $ingressControllerType "openshift" }}
{{- $_ := set $annotations "route.openshift.io/termination" "edge" }}
{{- if $federationIngress.tlsSecret }}
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
{{- else }}
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
{{- $path = "" }}
{{- $pathType = "ImplementationSpecific" }}
{{- $tlsSection = false }}
{{- end }}
{{- end }}
apiVersion: networking.k8s.io/v1
kind: Ingress
@@ -24,6 +42,6 @@ metadata:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{ include "spire-lib.ingress-spec" (dict "ingress" $federationIngress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" "/" "pathType" "Prefix" "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/federation-issuer.yaml
+22
View File
@@ -0,0 +1,22 @@
{{- define "spire-server.federation-cert-manager-default-issuer" }}
{{- if not .Values.federation.tls.certManager.issuer.acme.email }}
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
{{- end }}
email: {{ .Values.federation.tls.certManager.issuer.acme.email | quote}}
server: {{ .Values.federation.tls.certManager.issuer.acme.server | quote}}
privateKeySecretRef:
name: {{ include "spire-server.fullname" . }}-federation-issuer
solvers:
- http01:
ingress: {}
{{- end }}
{{- if and .Values.federation.tls.certManager.enabled .Values.federation.tls.certManager.issuer.create }}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ include "spire-server.fullname" . }}-federation
namespace: {{ include "spire-server.namespace" . }}
spec:
acme:
{{ mergeOverwrite (include "spire-server.federation-cert-manager-default-issuer" . | fromYaml) .Values.federation.tls.certManager.issuer.acme | toYaml | nindent 4 }}
{{- end }}