panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deny production runs of example.org trust domains (#229)

Browse Source
This commit is contained in:
kfox1111
2023-09-25 12:06:48 -07:00
committed by GitHub
parent 712a0f6fbe
commit 50825d9fc9
16 changed files with 101 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1
View File
@@ -98,6 +98,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+2
View File
@@ -1,3 +1,5 @@
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
{{- $oidcSocket := .oidcSocket }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+2
View File
@@ -1,3 +1,5 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- define "spire-agent.yaml-config" -}}
agent:
data_dir: "/run/spire"
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -153,7 +153,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
| `ca_subject.country` | Country for Spire server CA | `NL` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
charts/spire/charts/spire-server/templates/configmap.yaml
+6
View File
@@ -1,3 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -225,7 +225,7 @@ federation:
ca_subject:
## @param ca_subject.country Country for Spire server CA
country: NL
country: ARPA
## @param ca_subject.organization Organization for Spire server CA
organization: Example
## @param ca_subject.common_name Common Name for Spire server CA
charts/spire/templates/_spire-lib.tpl
+15
View File
@@ -107,3 +107,18 @@ rules:
{{- end }}
{{- include "spire-lib.image" $root }}
{{- end }}
{{/*
Take in an array of, '.', a failure string to display, and boolean to to display it,
if strictMode is enabled and the boolean is true
*/}}
{{- define "spire-lib.check-strict-mode" }}
{{ $root := index . 0 }}
{{ $message := index . 1 }}
{{ $condition := index . 2 }}
{{- if (dig "spire" "strictMode" false $root.Values.global) }}
{{- if $condition }}
{{- fail $message }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/values.yaml
+3
View File
@@ -24,6 +24,9 @@ global:
## @param global.spire.image.registry Override all Spire image registries at once
registry: ""
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
strictMode: false
installAndUpgradeHooks:
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
enabled: true