Add customPlugins and unsupportedBuiltInPlugins sections to spire-server (#198)

This patch enables end users to configure external plugins in the spire-server config. Unsupported internal plugins are not able to be set. --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Edwin Buck <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2023-08-24 21:13:28 +00:00
parent f4ee2c2b3a
commit 51cba5b530
10 changed files with 210 additions and 39 deletions
@@ -0,0 +1,9 @@
+FROM alpine
+RUN \
+  cd /tmp && \
+  wget -O plugin.tar.gz https://github.com/boxboat/spire-tpm-plugin/releases/download/v1.3.3/spire_tpm_plugin_tpm_attestor_agent_linux_amd64_v1.3.3.tar.gz && \
+  tar -zxvf plugin.tar.gz && \
+  mv tpm_attestor_agent /
+
+FROM ghcr.io/spiffe/spire-server:1.5.4
+COPY --from=0 /tpm_attestor_agent /bin/tpm_attestor_agent
@@ -0,0 +1,9 @@
+FROM alpine
+RUN \
+  cd /tmp && \
+  wget -O plugin.tar.gz https://github.com/boxboat/spire-tpm-plugin/releases/download/v1.3.3/spire_tpm_plugin_tpm_attestor_server_linux_amd64_v1.3.3.tar.gz && \
+  tar -zxvf plugin.tar.gz && \
+  mv tpm_attestor_server /
+
+FROM ghcr.io/spiffe/spire-server:1.5.4
+COPY --from=0 /tpm_attestor_server /bin/tpm_attestor_server
@@ -0,0 +1,25 @@
+spire-server:
+  initContainers:
+  - name: tpm-init
+    image: busybox
+    command:
+    - sh
+    - -c
+    - |
+      mkdir -p /run/spire/data/certs
+      mkdir -p /run/spire/data/hashes
+    volumeMounts:
+    - mountPath: /run/spire/data
+      name: spire-data
+  image:
+    registry: docker.io
+    repository: kfox1111/misc
+    version: tpm-server-test
+  customPlugins:
+    nodeAttestor:
+      tpm:
+        plugin_cmd: /bin/tpm_attestor_server
+        plugin_checksum: 97442358ae946e3fb8f2464432b8c23efdc0b5d44ec1eea27babe59ef646cc2f
+        plugin_data:
+        - ca_path: /run/spire/data/certs
+          hash_path: /run/spire/data/hashes