panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align more settings to convention (#467)

Browse Source 
* Align more settings to convention

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-10-03 12:06:38 -07:00
committed by GitHub
parent ea2d673830
commit 5d07eaff52
20 changed files with 164 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/_helpers.tpl
+7 -7
View File
@@ -66,8 +66,8 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- end -}}
{{- define "spire-server.bundle-namespace" -}}
{{- if .Values.notifier.k8sbundle.namespace }}
{{- .Values.notifier.k8sbundle.namespace }}
{{- if .Values.notifier.k8sBundle.namespace }}
{{- .Values.notifier.k8sBundle.namespace }}
{{- else if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
@@ -146,9 +146,9 @@ Create the name of the service account to use
{{- define "spire-server.serviceAccountAllowedList" }}
{{- $releaseNamespace := include "spire-server.agent-namespace" . }}
{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
{{- if ne (len .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList) 0 }}
{{- $list := list }}
{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }}
{{- range .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList }}
{{- if contains ":" . }}
{{- $list = append $list . }}
{{- else }}
@@ -293,17 +293,17 @@ The code below determines what connection type should be used.
{{- define "spire-server.ca-subject-country" }}
{{- $g := dig "spire" "caSubject" "country" "" .Values.global }}
{{- default .Values.ca_subject.country $g }}
{{- default .Values.caSubject.country $g }}
{{- end }}
{{- define "spire-server.ca-subject-organization" }}
{{- $g := dig "spire" "caSubject" "organization" "" .Values.global }}
{{- default .Values.ca_subject.organization $g }}
{{- default .Values.caSubject.organization $g }}
{{- end }}
{{- define "spire-server.ca-subject-common-name" }}
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
{{- default .Values.ca_subject.common_name $g }}
{{- default .Values.caSubject.commonName $g }}
{{- end }}
{{- define "spire-server.subject" }}
charts/spire/charts/spire-server/templates/configmap.yaml
+18 -18
View File
@@ -1,9 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
@@ -103,14 +103,14 @@ plugins:
plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }}
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
NodeAttestor:
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }}
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }}
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
k8s_psat:
plugin_data:
clusters:
{{- with .Values.nodeAttestor.k8sPsat }}
{{- with .Values.nodeAttestor.k8sPSAT }}
{{- if eq (.enabled | toString) "true" }}
- {{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
@@ -121,12 +121,12 @@ plugins:
{{ toYaml .allowedPodLabelKeys | nindent 14 }}
{{- end }}
{{- end }}
{{- if eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true" }}
{{- $clusterDefaults := .Values.nodeAttestor.externalK8sPsat.defaults }}
{{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }}
{{- $clusterDefaults := .Values.nodeAttestor.externalK8sPSAT.defaults }}
{{- range $name, $_ := $clusters }}
{{- $clusterSettings := dict }}
{{- if hasKey $root.Values.nodeAttestor.externalK8sPsat.clusters $name }}
{{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPsat.clusters $name }}
{{- if hasKey $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
{{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
{{- end }}
- {{ $name }}:
{{- if hasKey $clusterSettings "kubeConfigName" }}
@@ -233,11 +233,11 @@ plugins:
{{- end }}
{{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }}
{{- if or .Values.notifier.k8sbundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }}
{{- if or .Values.notifier.k8sBundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }}
Notifier:
k8sbundle:
plugin_data:
{{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }}
{{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- end }}
@@ -307,12 +307,12 @@ plugins:
UpstreamAuthority:
cert-manager:
plugin_data:
issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuer_name }}
issuer_kind: {{ .issuer_kind | quote }}
issuer_group: {{ .issuer_group | quote }}
issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }}
issuer_kind: {{ .issuerKind | quote }}
issuer_group: {{ .issuerGroup | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }}
kube_config_file: {{ .kube_config_file | quote }}
{{- if ne .kubeConfigFile "" }}
kube_config_file: {{ .kubeConfigFile | quote }}
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/issuer.yaml
+4 -4
View File
@@ -1,6 +1,6 @@
{{- with .Values.upstreamAuthority.certManager }}
{{ if and .enabled .ca.create }}
{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }}
{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuerName) }}
{{/*
Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/
*/}}
@@ -21,14 +21,14 @@ metadata:
namespace: {{ include "spire-server.namespace" $ }}
spec:
isCA: true
commonName: {{ $.Values.ca_subject.common_name }}
commonName: {{ $.Values.caSubject.commonName }}
secretName: {{ include "spire-server.fullname" $ }}-ca-keys
duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }}
subject:
countries:
- {{ $.Values.ca_subject.country }}
- {{ $.Values.caSubject.country }}
organizations:
- {{ $.Values.ca_subject.organization }}
- {{ $.Values.caSubject.organization }}
privateKey:
algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }}
size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }}
charts/spire/charts/spire-server/templates/roles.yaml
+3 -3
View File
@@ -1,7 +1,7 @@
{{- $subject := include "spire-server.subject" . }}
{{- $namespace := include "spire-server.namespace" . }}
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
{{- if .Values.notifier.k8sbundle.enabled }}
{{- if .Values.notifier.k8sBundle.enabled }}
# Role to be able to push certificate bundles to a configmap
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
@@ -48,7 +48,7 @@ roleRef:
name: {{ include "spire-server.fullname" . }}-cm
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if .Values.notifier.k8sbundle.enabled }}
{{- if .Values.notifier.k8sBundle.enabled }}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
@@ -61,7 +61,7 @@ roleRef:
name: {{ include "spire-lib.bundle-configmap" . }}
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- if and .Values.nodeAttestor.k8sPsat.enabled }}
{{- if and .Values.nodeAttestor.k8sPSAT.enabled }}
---
# ClusterRole to allow spire-server node attestor to query Token Review API
kind: ClusterRole
charts/spire/charts/spire-server/templates/server-resource.yaml
+27 -1
View File
@@ -6,7 +6,33 @@
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
{{- $fullname := include "spire-server.fullname" . }}
{{- if hasKey .Values "ca_subject" }}
{{- fail "ca_subject was renamed to caSubject. Please update your config." }}
{{- end }}
{{- if hasKey .Values.caSubject "common_name" }}
{{- fail "ca_name was renamed to caName. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_name" }}
{{- fail "issuer_name was renamed to issuerName. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_group" }}
{{- fail "issuer_group was renamed to issuerGroup. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_kind" }}
{{- fail "issuer_kind was renamed to issuerKind. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "kube_config_file" }}
{{- fail "kube_config_file was renamed to kubeConfigFile. Please update your config." }}
{{- end }}
{{- if hasKey .Values.nodeAttestor "k8sPsat" }}
{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }}
{{- end }}
{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }}
{{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }}
{{- end }}
{{- if hasKey .Values.notifier "k8sbundle" }}
{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }}
{{- end }}
{{- if eq .Values.kind "statefulset" }}
{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }}
{{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }}