panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align tornjak clientCA naming convention (#393)

Browse Source
This commit is contained in:
Marco Franssen
2023-07-19 09:13:50 -07:00
committed by GitHub
parent f05cb4fe1e
commit 522066e9f9
6 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+2 -2
View File
@@ -398,10 +398,10 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag | | spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag |
| spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| spire-server.topologySpreadConstraints | list | `[]` | | | spire-server.topologySpreadConstraints | list | `[]` | |
| spire-server.tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
| spire-server.tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
| spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | | spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
| spire-server.tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | | spire-server.tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
| spire-server.tornjak.config.userCA.name | string | `"tornjak-user-ca"` | |
| spire-server.tornjak.config.userCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
| spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | | spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
| spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | | spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
| spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | | spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
charts/spire/charts/spire-server/README.md
+3 -3
View File
@@ -68,7 +68,7 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
Here is an example using a *Secret* in `spire-server` namespace: Here is an example using a *Secret* in `spire-server` namespace:
```console ```console
kubectl -n spire-server create secret generic tornjak-user-ca --from-file=ca.crt="CA/rootCA.crt" kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
``` ```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
@@ -198,10 +198,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| tools.kubectl.image.tag | string | `""` | Overrides the image tag | | tools.kubectl.image.tag | string | `""` | Overrides the image tag |
| tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) |
| topologySpreadConstraints | list | `[]` | | | topologySpreadConstraints | list | `[]` | |
| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | |
| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
| tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | | tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information |
| tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | | tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) |
| tornjak.config.userCA.name | string | `"tornjak-user-ca"` | |
| tornjak.config.userCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) |
| tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | | tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) |
| tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | | tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy |
| tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | | tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from |
charts/spire/charts/spire-server/README.md.gotmpl
+1 -1
View File
@@ -63,7 +63,7 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/
Here is an example using a *Secret* in `spire-server` namespace: Here is an example using a *Secret* in `spire-server` namespace:
```console ```console
kubectl -n spire-server create secret generic tornjak-user-ca --from-file=ca.crt="CA/rootCA.crt" kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
``` ```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
charts/spire/charts/spire-server/templates/_helpers.tpl
+2 -2
View File
@@ -180,8 +180,8 @@ The code below determines what connection type should be used.
{{- if (lookup "v1" "Secret" (include "spire-server.namespace" .) .Values.tornjak.config.tlsSecret) -}} {{- if (lookup "v1" "Secret" (include "spire-server.namespace" .) .Values.tornjak.config.tlsSecret) -}}
{{- $caType := default "INVALID" .Values.tornjak.config.userCA.type }} {{- $caType := default "INVALID" .Values.tornjak.config.clientCA.type }}
{{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.userCA.name) -}} {{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.clientCA.name) -}}
{{- printf "mtls" -}} {{- printf "mtls" -}}
{{- else }} {{- else }}
{{- printf "tls" -}} {{- printf "tls" -}}
charts/spire/charts/spire-server/templates/statefulset.yaml
+4 -4
View File
@@ -253,15 +253,15 @@ spec:
secretName: {{ .Values.tornjak.config.tlsSecret }} secretName: {{ .Values.tornjak.config.tlsSecret }}
{{- end }} {{- end }}
{{- if eq (include "spire-tornjak.connectionType" .) "mtls" }} {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
{{- if eq .Values.tornjak.config.userCA.type "Secret" }} {{- if eq .Values.tornjak.config.clientCA.type "Secret" }}
- name: user-cert - name: user-cert
secret: secret:
defaultMode: 256 defaultMode: 256
secretName: {{ .Values.tornjak.config.userCA.name }} secretName: {{ .Values.tornjak.config.clientCA.name }}
{{- else if eq .Values.tornjak.config.userCA.type "ConfigMap" }} {{- else if eq .Values.tornjak.config.clientCA.type "ConfigMap" }}
- name: user-cert - name: user-cert
configMap: configMap:
name: {{ .Values.tornjak.config.userCA.name }} name: {{ .Values.tornjak.config.clientCA.name }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
charts/spire/charts/spire-server/values.yaml
+3 -3
View File
@@ -384,18 +384,18 @@ tornjak:
# Tornjak supports 3 connection types: `http`, `tls`, and `mtls`. # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`.
# The connections are determined based on provided configuration # The connections are determined based on provided configuration
# When `tlsSecret` is created in this chart namespace, the TLS connection is started # When `tlsSecret` is created in this chart namespace, the TLS connection is started
# When `tlsSecret` and `userCa.tornjak-user-ca` are created in this chart namespace, the mTLS connection is started # When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started
# When none of them are created, Tornjak starts with HTTP connection only # When none of them are created, Tornjak starts with HTTP connection only
# -- Name of the secret containing server side key and certificate for TLS verification # -- Name of the secret containing server side key and certificate for TLS verification
# (required for `tls` or `mtls` connectionType) # (required for `tls` or `mtls` connectionType)
tlsSecret: tornjak-tls-secret tlsSecret: tornjak-tls-secret
userCA: clientCA:
# -- Type of delivery for the user CA for mTLS client verification # -- Type of delivery for the user CA for mTLS client verification
# options are `Secret` or `ConfigMap` # options are `Secret` or `ConfigMap`
# (required for `mtls` connectionType) # (required for `mtls` connectionType)
type: Secret type: Secret
name: tornjak-user-ca name: tornjak-client-ca
resources: {} resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious # We usually recommend not to specify default resources and to leave this as a conscious