panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deny production runs of example.org trust domains (#229)

Browse Source
This commit is contained in:
kfox1111
2023-09-25 12:06:48 -07:00
committed by GitHub
parent 712a0f6fbe
commit 50825d9fc9
16 changed files with 101 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spiffe-oidc-discovery-provider/templates/configmap.yaml
+2
View File
@@ -1,3 +1,5 @@
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
{{- $oidcSocket := .oidcSocket }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+2
View File
@@ -1,3 +1,5 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- define "spire-agent.yaml-config" -}}
agent:
data_dir: "/run/spire"
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -153,7 +153,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
| `ca_subject.country` | Country for Spire server CA | `NL` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
charts/spire/charts/spire-server/templates/configmap.yaml
+6
View File
@@ -1,3 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -225,7 +225,7 @@ federation:
ca_subject:
## @param ca_subject.country Country for Spire server CA
country: NL
country: ARPA
## @param ca_subject.organization Organization for Spire server CA
organization: Example
## @param ca_subject.common_name Common Name for Spire server CA