From 57a61438befd64171880ce346a701ebfc8308a3b Mon Sep 17 00:00:00 2001 From: Eric Cavalcanti Date: Thu, 10 Jul 2025 17:27:07 -0500 Subject: [PATCH] Add aws_iid to helm chart (#620) * Add aws_iid Signed-off-by: Eric Cavalcanti * Change to awsIid Signed-off-by: Eric Cavalcanti * Change to awsIid Signed-off-by: Eric Cavalcanti * update helm Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * Change to awsIID Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti * add signed off Signed-off-by: Eric Cavalcanti * Add doc Signed-off-by: Eric Cavalcanti * remove not used config Signed-off-by: Eric Cavalcanti * remove not used config Signed-off-by: Eric Cavalcanti * add example awsiid Signed-off-by: Eric Cavalcanti --------- Signed-off-by: Eric Cavalcanti Signed-off-by: Eric Cavalcanti --- charts/spire/charts/spire-agent/README.md | 1 + .../spire-agent/templates/configmap.yaml | 7 ++ charts/spire/charts/spire-agent/values.yaml | 3 + charts/spire/charts/spire-server/README.md | 3 + .../spire-server/templates/configmap.yaml | 12 ++- charts/spire/charts/spire-server/values.yaml | 7 ++ examples/aws-iid/README.md | 75 +++++++++++++++++++ 7 files changed, 107 insertions(+), 1 deletion(-) create mode 100644 examples/aws-iid/README.md diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index bb523b3..470afa4 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -90,6 +90,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | +| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index eb4253a..a06ce67 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -104,6 +104,13 @@ plugins: {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.awsIID }} + {{- if eq (.enabled | toString) "true" }} + aws_iid: + plugin_data: {} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} + {{- end }} {{- if ne $nodeAttestorUsed 1 }} {{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} {{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 0e03510..beb8c03 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -207,6 +207,9 @@ nodeAttestor: repository: spiffe/spire-tpm-plugin-get-tpm-pubhash pullPolicy: IfNotPresent tag: "v1.9.0" + awsIID: + ## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor + enabled: false # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 5924854..a68a876 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -397,6 +397,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` | | `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` | | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | +| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` | +| `nodeAttestor.awsIID.region` | AWS region to use for the attestation | `""` | +| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` | | `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` | | `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 12659b6..bcf3f0d 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -142,7 +142,7 @@ plugins: {{- end }} disable_migration: {{ .Values.dataStore.sql.disableMigration }} - {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} + {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }} NodeAttestor: {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }} {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }} @@ -222,6 +222,16 @@ plugins: {{- end }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.awsIID }} + {{- if eq (.enabled | toString) "true" }} + aws_iid: + plugin_data: + region: {{ .region | quote }} + {{- if ne .assumeRole "" }} + assume_role: {{ .assumeRole | quote }} + {{- end }} + {{- end }} + {{- end }} {{- end }} {{- with .Values.keyManager.disk }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 237143c..53c5aa2 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -977,6 +977,13 @@ nodeAttestor: cas: {} ## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect. hashes: [] + awsIID: + ## @param nodeAttestor.awsIID.enabled Enable the aws_iid node attestor + enabled: false + ## @param nodeAttestor.awsIID.region AWS region to use for the attestation + region: "" + ## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation + assumeRole: "" # The secrets needed for this plugin are configured in the secrets: section bundlePublisher: diff --git a/examples/aws-iid/README.md b/examples/aws-iid/README.md new file mode 100644 index 0000000..402a616 --- /dev/null +++ b/examples/aws-iid/README.md @@ -0,0 +1,75 @@ +# AWS IID Node Attestor + +This document provides a concise guide to the AWS IID node attestor plugin support in your system. The AWS IID attestor plugin automatically verifies instances using AWS's Instance Metadata API and Instance Identity Document. + +## Configuration + +The AWS IID node attestor can be configured with the following properties: + +| Parameter | Description | Default | +|-------------------------------|-----------------------------------------------------|---------| +| **nodeAttestor.awsIID.enabled** | Enable the AWS IID node attestor | false | +| **nodeAttestor.awsIID.region** | AWS region to use for the attestation | "" | +| **nodeAttestor.awsIID.assumeRole** | AWS IAM Role NAME to use for the attestation | "" | + +### Sample Configuration + +Here's a minimal configuration example for the server: + +```yaml +awsIID: + enabled: true + region: "us-west-2" # Specify your desired AWS region + assumeRole: "example-role" # Specify the IAM Role NAME +``` + +For the agent, ensure that the `awsIID` is also enabled: + +```yaml +awsIID: + enabled: true +``` + +**Note:** When the `awsIID` node attestor is enabled on the server, it must also be enabled on the agent to ensure proper attestation. + +### IAM Role + +The `assumeRole` parameter requires the name of the IAM Role you wish to use for the attestation process. Ensure this role has the appropriate permissions. + +### Required IAM Policy + +To facilitate the node attestation, the following IAM policy example should be attached to the IAM Role mentioned in the `assumeRole`. This policy example is needed to get the instance's info from AWS: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:DescribeInstances", + "iam:GetInstanceProfile" + ], + "Resource": "*" + } + ] +} +``` + +## Security Considerations + +It’s important to note that while the AWS Instance Identity Document is used to prove node identity, it is accessible to any process running on the instance. Therefore, precautions should be made to ensure only the desired agent uses it for attestation. + +Always monitor your systems for unauthorized access attempts and ensure your IAM roles follow the principle of least privilege. + +For more information on AWS IAM roles and security best practices, refer to the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html). + +## Additional Information + +For more information on the server plugin, see the [Server Plugin Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md). + +And for the agent, see the [Agent Plugin Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_agent_nodeattestor_aws_iid.md). + +--- + +By following the above guidelines, you can ensure a simple yet secure implementation of the AWS IID node attestor within your system.