Add aws_iid to helm chart (#620)
* Add aws_iid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * update helm Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * add signed off Signed-off-by: Eric Cavalcanti <[email protected]> * Add doc Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * add example awsiid Signed-off-by: Eric Cavalcanti <[email protected]> --------- Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]>
This commit is contained in:
Eric Cavalcanti
@@ -397,6 +397,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.region` | AWS region to use for the attestation | `""` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
|
||||
@@ -142,7 +142,7 @@ plugins:
|
||||
{{- end }}
|
||||
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -222,6 +222,16 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
aws_iid:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
{{- if ne .assumeRole "" }}
|
||||
assume_role: {{ .assumeRole | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.keyManager.disk }}
|
||||
|
||||
@@ -977,6 +977,13 @@ nodeAttestor:
|
||||
cas: {}
|
||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||
hashes: []
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid node attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.awsIID.region AWS region to use for the attestation
|
||||
region: ""
|
||||
## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation
|
||||
assumeRole: ""
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
|
||||
Reference in New Issue
Block a user