Add aws_iid to helm chart (#620)
* Add aws_iid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIid Signed-off-by: Eric Cavalcanti <[email protected]> * update helm Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change to awsIID Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * add signed off Signed-off-by: Eric Cavalcanti <[email protected]> * Add doc Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * remove not used config Signed-off-by: Eric Cavalcanti <[email protected]> * add example awsiid Signed-off-by: Eric Cavalcanti <[email protected]> --------- Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]>
This commit is contained in:
Eric Cavalcanti
@@ -90,6 +90,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
|
||||
@@ -104,6 +104,13 @@ plugins:
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
aws_iid:
|
||||
plugin_data: {}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if ne $nodeAttestorUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -207,6 +207,9 @@ nodeAttestor:
|
||||
repository: spiffe/spire-tpm-plugin-get-tpm-pubhash
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.9.0"
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor
|
||||
enabled: false
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
|
||||
@@ -397,6 +397,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.region` | AWS region to use for the attestation | `""` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
|
||||
@@ -142,7 +142,7 @@ plugins:
|
||||
{{- end }}
|
||||
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -222,6 +222,16 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
aws_iid:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
{{- if ne .assumeRole "" }}
|
||||
assume_role: {{ .assumeRole | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.keyManager.disk }}
|
||||
|
||||
@@ -977,6 +977,13 @@ nodeAttestor:
|
||||
cas: {}
|
||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||
hashes: []
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid node attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.awsIID.region AWS region to use for the attestation
|
||||
region: ""
|
||||
## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation
|
||||
assumeRole: ""
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
# AWS IID Node Attestor
|
||||
|
||||
This document provides a concise guide to the AWS IID node attestor plugin support in your system. The AWS IID attestor plugin automatically verifies instances using AWS's Instance Metadata API and Instance Identity Document.
|
||||
|
||||
## Configuration
|
||||
|
||||
The AWS IID node attestor can be configured with the following properties:
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-------------------------------|-----------------------------------------------------|---------|
|
||||
| **nodeAttestor.awsIID.enabled** | Enable the AWS IID node attestor | false |
|
||||
| **nodeAttestor.awsIID.region** | AWS region to use for the attestation | "" |
|
||||
| **nodeAttestor.awsIID.assumeRole** | AWS IAM Role NAME to use for the attestation | "" |
|
||||
|
||||
### Sample Configuration
|
||||
|
||||
Here's a minimal configuration example for the server:
|
||||
|
||||
```yaml
|
||||
awsIID:
|
||||
enabled: true
|
||||
region: "us-west-2" # Specify your desired AWS region
|
||||
assumeRole: "example-role" # Specify the IAM Role NAME
|
||||
```
|
||||
|
||||
For the agent, ensure that the `awsIID` is also enabled:
|
||||
|
||||
```yaml
|
||||
awsIID:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
**Note:** When the `awsIID` node attestor is enabled on the server, it must also be enabled on the agent to ensure proper attestation.
|
||||
|
||||
### IAM Role
|
||||
|
||||
The `assumeRole` parameter requires the name of the IAM Role you wish to use for the attestation process. Ensure this role has the appropriate permissions.
|
||||
|
||||
### Required IAM Policy
|
||||
|
||||
To facilitate the node attestation, the following IAM policy example should be attached to the IAM Role mentioned in the `assumeRole`. This policy example is needed to get the instance's info from AWS:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"ec2:DescribeInstances",
|
||||
"iam:GetInstanceProfile"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Security Considerations
|
||||
|
||||
It’s important to note that while the AWS Instance Identity Document is used to prove node identity, it is accessible to any process running on the instance. Therefore, precautions should be made to ensure only the desired agent uses it for attestation.
|
||||
|
||||
Always monitor your systems for unauthorized access attempts and ensure your IAM roles follow the principle of least privilege.
|
||||
|
||||
For more information on AWS IAM roles and security best practices, refer to the [AWS IAM documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html).
|
||||
|
||||
## Additional Information
|
||||
|
||||
For more information on the server plugin, see the [Server Plugin Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_server_nodeattestor_aws_iid.md).
|
||||
|
||||
And for the agent, see the [Agent Plugin Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_agent_nodeattestor_aws_iid.md).
|
||||
|
||||
---
|
||||
|
||||
By following the above guidelines, you can ensure a simple yet secure implementation of the AWS IID node attestor within your system.
|
||||
Reference in New Issue
Block a user