Add aws_iid to helm chart (#620)
* Add aws_iid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * update helm Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * add signed off Signed-off-by: Eric Cavalcanti <[email protected]> * Add doc Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * add example awsiid Signed-off-by: Eric Cavalcanti <[email protected]> --------- Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]>
This commit is contained in:
Eric Cavalcanti
@@ -90,6 +90,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
|
||||
@@ -104,6 +104,13 @@ plugins:
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
aws_iid:
|
||||
plugin_data: {}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if ne $nodeAttestorUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -207,6 +207,9 @@ nodeAttestor:
|
||||
repository: spiffe/spire-tpm-plugin-get-tpm-pubhash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.9.0"
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor
|
||||
enabled: false
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
|
||||
@@ -397,6 +397,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.region` | AWS region to use for the attestation | `""` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
|
||||
@@ -142,7 +142,7 @@ plugins:
|
||||
{{- end }}
|
||||
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -222,6 +222,16 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
aws_iid:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
{{- if ne .assumeRole "" }}
|
||||
assume_role: {{ .assumeRole | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.keyManager.disk }}
|
||||
|
||||
@@ -977,6 +977,13 @@ nodeAttestor:
|
||||
cas: {}
|
||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||
hashes: []
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid node attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.awsIID.region AWS region to use for the attestation
|
||||
region: ""
|
||||
## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation
|
||||
assumeRole: ""
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
|
||||
Reference in New Issue
Block a user