panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add customPlugins and unsupportedBuiltInPlugins sections to spire-server (#198)

Browse Source 
This patch enables end users to configure external plugins in the
spire-server config. Unsupported internal plugins are not able to be
set.

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Edwin Buck <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2023-08-24 21:13:28 +00:00
committed by GitHub
co-authored by Edwin Buck Faisal Memon
parent f4ee2c2b3a
commit 51cba5b530
10 changed files with 210 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/configmap.yaml
+57 -39
View File
@@ -1,3 +1,21 @@
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
{{- end }}
{{- range $name, $nval := $tvals }}
{{- if not (hasKey $nval "plugin_cmd") }}
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
{{- end }}
{{- if not (hasKey $nval "plugin_checksum") }}
{{- fail (printf "plugin_checksum is a required field.") }}
{{- end }}
{{- range $sname, $svals := $nval }}
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }}
@@ -33,18 +51,18 @@ server:
plugins:
DataStore:
- sql:
plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }}
sql:
plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }}
{{- with .Values.nodeAttestor.k8sPsat }}
{{- if eq (.enabled | toString) "true" }}
NodeAttestor:
- k8s_psat:
plugin_data:
clusters:
{{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
k8s_psat:
plugin_data:
clusters:
{{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
{{- end }}
{{- end }}
@@ -52,9 +70,9 @@ plugins:
{{- if eq (.enabled | toString) "true" }}
{{- $keyManagerUsed = add1 $keyManagerUsed }}
KeyManager:
- disk:
plugin_data:
keys_path: "/run/spire/data/keys.json"
disk:
plugin_data:
keys_path: "/run/spire/data/keys.json"
{{- end }}
{{- end }}
@@ -62,8 +80,8 @@ plugins:
{{- if eq (.enabled | toString) "true" }}
{{- $keyManagerUsed = add1 $keyManagerUsed }}
KeyManager:
- memory:
plugin_data:
memory:
plugin_data:
{{- end }}
{{- end }}
@@ -92,22 +110,22 @@ plugins:
{{- end }}
Notifier:
- k8sbundle:
plugin_data:
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
k8sbundle:
plugin_data:
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
- disk:
plugin_data:
cert_file_path: "/run/spire/upstream_ca/tls.crt"
key_file_path: "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
{{- end }}
disk:
plugin_data:
cert_file_path: "/run/spire/upstream_ca/tls.crt"
key_file_path: "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
{{- end }}
{{- end }}
{{- end }}
@@ -115,15 +133,15 @@ plugins:
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
- cert-manager:
plugin_data:
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }}
kube_config_file: {{ .kube_config_file | quote }}
{{- end }}
cert-manager:
plugin_data:
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }}
kube_config_file: {{ .kube_config_file | quote }}
{{- end }}
{{- end }}
{{- end }}
@@ -131,11 +149,11 @@ plugins:
{{- if eq (.enabled | toString) "true" }}
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
UpstreamAuthority:
- spire:
plugin_data:
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
server_port: {{ .server.port }}
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
spire:
plugin_data:
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
server_port: {{ .server.port }}
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
{{- end }}
{{- end }}
@@ -191,4 +209,4 @@ metadata:
{{- end }}
data:
server.conf: |
{{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
{{- include "spire-server.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}