panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align more settings to convention (#467)

Browse Source 
* Align more settings to convention

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-10-03 12:06:38 -07:00
committed by GitHub
parent ea2d673830
commit 5d07eaff52
20 changed files with 164 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-nested/README.md
+5 -5
View File
@@ -303,7 +303,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` |
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | | `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
| `root-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` | | `root-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
| `root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` |
| `root-spire-server.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `root-spire-server.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
| `external-root-spire-server-full.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-full.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` |
| `external-root-spire-server-full.nameOverride` | Name override | `root-server` | | `external-root-spire-server-full.nameOverride` | Name override | `root-server` |
@@ -315,7 +315,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` |
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` |
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` | | `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
| `external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` |
| `external-root-spire-server-full.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-full.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
| `external-root-spire-server-security.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` | | `external-root-spire-server-security.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` |
| `external-root-spire-server-security.nameOverride` | Name override | `root-server` | | `external-root-spire-server-security.nameOverride` | Name override | `root-server` |
@@ -323,7 +323,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `external-root-spire-server-security.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` | | `external-root-spire-server-security.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
| `external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` | | `external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
| `external-root-spire-server-security.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` | | `external-root-spire-server-security.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
| `external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor | `[]` |
| `external-root-spire-server-security.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` | | `external-root-spire-server-security.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
### Spire server parameters ### Spire server parameters
@@ -350,6 +350,6 @@ Now you can interact with the Spire agent socket from your own application. The
| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` | | `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` | | `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | | `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
| `external-spire-server.notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `false` | | `external-spire-server.notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
| `external-spire-server.nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `false` | | `external-spire-server.nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `false` |
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` | | `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
charts/spire-nested/values.yaml
+10 -10
View File
@@ -246,8 +246,8 @@ root-spire-server:
## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers ## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
enabled: true enabled: true
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param root-spire-server.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList: serviceAccountAllowList:
- spire-agent-upstream - spire-agent-upstream
## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle ## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
@@ -284,8 +284,8 @@ external-root-spire-server-full:
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity ## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
enabled: false enabled: false
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param external-root-spire-server-full.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList: serviceAccountAllowList:
- spire-agent-upstream - spire-agent-upstream
## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle ## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
@@ -308,8 +308,8 @@ external-root-spire-server-security:
## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name. ## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
className: spire-mgmt-external-server className: spire-mgmt-external-server
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param external-root-spire-server-security.nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor
serviceAccountAllowList: serviceAccountAllowList:
- spire-agent-upstream - spire-agent-upstream
## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle ## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
@@ -385,12 +385,12 @@ external-spire-server:
## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server ## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server nameOverride: root-server
notifier: notifier:
k8sbundle: k8sBundle:
## @param external-spire-server.notifier.k8sbundle.enabled Enable local k8s bundle uploader ## @param external-spire-server.notifier.k8sBundle.enabled Enable local k8s bundle uploader
enabled: false enabled: false
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param external-spire-server.nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor ## @param external-spire-server.nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
enabled: false enabled: false
joinToken: joinToken:
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor ## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
charts/spire/charts/spire-agent/README.md
+4 -4
View File
@@ -72,7 +72,7 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:255cefa977e1868391b60eb9eacfee85900510011135661bcf52381bd8001da4` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
@@ -84,7 +84,7 @@ A Helm chart to install the SPIRE agent.
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.8.7` |
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `1d7c73ccac948ee86cbd78ddde2d30128a1838b403f7bb2100d38d916a252244` |
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
| `nodeAttestor.tpmDirect.pubHash.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-get-tpm-pubhash` |
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
@@ -98,10 +98,10 @@ A Helm chart to install the SPIRE agent.
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` | | `sds.enabled` | Enables Envoy SDS configuration | `false` |
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` | | `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+3 -3
View File
@@ -50,10 +50,10 @@ agent:
{{- end }} {{- end }}
{{- if .Values.sds.enabled }} {{- if .Values.sds.enabled }}
sds: sds:
default_svid_name: {{ .Values.sds.defaultSvidName | quote }} default_svid_name: {{ .Values.sds.defaultSVIDName | quote }}
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }} default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }} default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }} disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
{{- end }} {{- end }}
{{- with .Values.experimental }} {{- with .Values.experimental }}
@@ -73,7 +73,7 @@ agent:
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} {{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
plugins: plugins:
NodeAttestor: NodeAttestor:
{{- if .Values.nodeAttestor.k8sPsat.enabled }} {{- if .Values.nodeAttestor.k8sPSAT.enabled }}
k8s_psat: k8s_psat:
plugin_data: plugin_data:
cluster: {{ include "spire-lib.cluster-name" . | quote }} cluster: {{ include "spire-lib.cluster-name" . | quote }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+9
View File
@@ -1,5 +1,14 @@
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }} {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
{{- $root := . }} {{- $root := . }}
{{- if hasKey .Values.nodeAttestor "k8sPsat" }}
{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }}
{{- end }}
{{- if hasKey .Values.sds "defaultSvidName" }}
{{- fail "defaultSvidName was renamed to defaultSVIDName. Please update your config." }}
{{- end }}
{{- if hasKey .Values.sds "disableSpiffeCertValidation" }}
{{- fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }}
{{- end }}
{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }} {{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }} {{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
{{- $nameSuffix := "" }} {{- $nameSuffix := "" }}
charts/spire/charts/spire-agent/values.yaml
+8 -8
View File
@@ -162,8 +162,8 @@ keyManager:
enabled: true enabled: true
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s Node Attestor
enabled: true enabled: true
httpChallenge: httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor ## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
@@ -193,7 +193,7 @@ nodeAttestor:
## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin ## @param nodeAttestor.tpmDirect.plugin.path The filename in the container of the plugin
path: /app/tpm_attestor_agent path: /app/tpm_attestor_agent
pubHash: pubHash:
## @param nodeAttestor.tpmDirect.pubHash.enabled Enable Psat k8s nodeattestor ## @param nodeAttestor.tpmDirect.pubHash.enabled Display pubhash in logs
enabled: true enabled: true
## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from ## @param nodeAttestor.tpmDirect.pubHash.image.registry The OCI registry to pull the image from
## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry ## @param nodeAttestor.tpmDirect.pubHash.image.repository The repository within the registry
@@ -233,14 +233,14 @@ workloadAttestors:
sds: sds:
## @param sds.enabled Enables Envoy SDS configuration ## @param sds.enabled Enables Envoy SDS configuration
enabled: false enabled: false
## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS ## @param sds.defaultSVIDName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
defaultSvidName: "default" defaultSVIDName: "default"
## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS ## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
defaultBundleName: "ROOTCA" defaultBundleName: "ROOTCA"
## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS ## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
defaultAllBundlesName: "ALL" defaultAllBundlesName: "ALL"
## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation ## @param sds.disableSPIFFECertValidation Disable Envoy SDS custom validation
disableSpiffeCertValidation: false disableSPIFFECertValidation: false
telemetry: telemetry:
prometheus: prometheus:
@@ -355,7 +355,7 @@ agents: {}
# nodeSelector: # nodeSelector:
# tpm: with # tpm: with
# nodeAttestor: # nodeAttestor:
# k8sPsat: # k8sPSAT:
# enabled: false # enabled: false
# tpmDirect: # tpmDirect:
# enabled: true # enabled: true
charts/spire/charts/spire-server/README.md
+20 -20
View File
@@ -168,9 +168,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | | `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
| `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | | `federation.ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
| `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | | `federation.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
| `ca_subject.country` | Country for Spire server CA | `ARPA` | | `caSubject.country` | Country for Spire server CA | `ARPA` |
| `ca_subject.organization` | Organization for Spire server CA | `Example` | | `caSubject.organization` | Organization for Spire server CA | `Example` |
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | | `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` | | `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` | | `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
@@ -201,11 +201,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` | | `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` | | `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` | | `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
| `upstreamAuthority.certManager.issuer_name` | Defaults to the release name, override if CA is provided outside of the chart | `""` | | `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
| `upstreamAuthority.certManager.issuer_kind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` | | `upstreamAuthority.certManager.issuerKind` | Defaults to "Issuer", override if CA is provided outside of the chart | `Issuer` |
| `upstreamAuthority.certManager.issuer_group` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` | | `upstreamAuthority.certManager.issuerGroup` | Defaults to "cert-manager.io", override if CA is provided outside of the chart | `cert-manager.io` |
| `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` | | `upstreamAuthority.certManager.namespace` | Specify to use a namespace other then the one the chart is installed into | `""` |
| `upstreamAuthority.certManager.kube_config_file` | Path to kube_config_file on node to setup cert manager | `""` | | `upstreamAuthority.certManager.kubeConfigFile` | Path to kube config file on node to setup cert manager | `""` |
| `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` | | `upstreamAuthority.certManager.ca.create` | Creates a Cert-Manager CA | `false` |
| `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` | | `upstreamAuthority.certManager.ca.duration` | Duration of the CA. Defaults to 10 years | `87600h` |
| `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` | | `upstreamAuthority.certManager.ca.privateKey.algorithm` | Algorithm to generate private key for CA | `ECDSA` |
@@ -230,8 +230,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` | | `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` | | `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` | | `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
| `notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `true` | | `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` |
| `notifier.k8sbundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` | | `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` |
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` | | `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` | | `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
@@ -327,17 +327,17 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `caTTL` | TTL for CA | `24h` | | `caTTL` | TTL for CA | `24h` |
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPSAT.serviceAccountAllowList` | Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
| `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
| `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
| `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
| `nodeAttestor.externalK8sPsat.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | | `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
| `nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
| `nodeAttestor.externalK8sPsat.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
| `nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` | | `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
charts/spire/charts/spire-server/templates/_helpers.tpl
+7 -7
View File
@@ -66,8 +66,8 @@ Allow the release namespace to be overridden for multi-namespace deployments in
{{- end -}} {{- end -}}
{{- define "spire-server.bundle-namespace" -}} {{- define "spire-server.bundle-namespace" -}}
{{- if .Values.notifier.k8sbundle.namespace }} {{- if .Values.notifier.k8sBundle.namespace }}
{{- .Values.notifier.k8sbundle.namespace }} {{- .Values.notifier.k8sBundle.namespace }}
{{- else if .Values.namespaceOverride -}} {{- else if .Values.namespaceOverride -}}
{{- .Values.namespaceOverride -}} {{- .Values.namespaceOverride -}}
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }} {{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
@@ -146,9 +146,9 @@ Create the name of the service account to use
{{- define "spire-server.serviceAccountAllowedList" }} {{- define "spire-server.serviceAccountAllowedList" }}
{{- $releaseNamespace := include "spire-server.agent-namespace" . }} {{- $releaseNamespace := include "spire-server.agent-namespace" . }}
{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} {{- if ne (len .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList) 0 }}
{{- $list := list }} {{- $list := list }}
{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }} {{- range .Values.nodeAttestor.k8sPSAT.serviceAccountAllowList }}
{{- if contains ":" . }} {{- if contains ":" . }}
{{- $list = append $list . }} {{- $list = append $list . }}
{{- else }} {{- else }}
@@ -293,17 +293,17 @@ The code below determines what connection type should be used.
{{- define "spire-server.ca-subject-country" }} {{- define "spire-server.ca-subject-country" }}
{{- $g := dig "spire" "caSubject" "country" "" .Values.global }} {{- $g := dig "spire" "caSubject" "country" "" .Values.global }}
{{- default .Values.ca_subject.country $g }} {{- default .Values.caSubject.country $g }}
{{- end }} {{- end }}
{{- define "spire-server.ca-subject-organization" }} {{- define "spire-server.ca-subject-organization" }}
{{- $g := dig "spire" "caSubject" "organization" "" .Values.global }} {{- $g := dig "spire" "caSubject" "organization" "" .Values.global }}
{{- default .Values.ca_subject.organization $g }} {{- default .Values.caSubject.organization $g }}
{{- end }} {{- end }}
{{- define "spire-server.ca-subject-common-name" }} {{- define "spire-server.ca-subject-common-name" }}
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }} {{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
{{- default .Values.ca_subject.common_name $g }} {{- default .Values.caSubject.commonName $g }}
{{- end }} {{- end }}
{{- define "spire-server.subject" }} {{- define "spire-server.subject" }}
charts/spire/charts/spire-server/templates/configmap.yaml
+18 -18
View File
@@ -1,9 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}} {{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}} {{- include "spire-lib.check-strict-mode" (list . "caSubject.country must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}} {{- include "spire-lib.check-strict-mode" (list . "caSubject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}} {{- include "spire-lib.check-strict-mode" (list . "caSubject.commonNname must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }} {{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }} {{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }} {{- fail (printf "Unknown plugin type specified: %s" $type) }}
@@ -103,14 +103,14 @@ plugins:
plugin_data: plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }} {{ include "spire-server.datastore-config" . | nindent 10 }}
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
NodeAttestor: NodeAttestor:
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
k8s_psat: k8s_psat:
plugin_data: plugin_data:
clusters: clusters:
{{- with .Values.nodeAttestor.k8sPsat }} {{- with .Values.nodeAttestor.k8sPSAT }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
- {{ include "spire-lib.cluster-name" $root }}: - {{ include "spire-lib.cluster-name" $root }}:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
@@ -121,12 +121,12 @@ plugins:
{{ toYaml .allowedPodLabelKeys | nindent 14 }} {{ toYaml .allowedPodLabelKeys | nindent 14 }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true" }} {{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }}
{{- $clusterDefaults := .Values.nodeAttestor.externalK8sPsat.defaults }} {{- $clusterDefaults := .Values.nodeAttestor.externalK8sPSAT.defaults }}
{{- range $name, $_ := $clusters }} {{- range $name, $_ := $clusters }}
{{- $clusterSettings := dict }} {{- $clusterSettings := dict }}
{{- if hasKey $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} {{- if hasKey $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
{{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPsat.clusters $name }} {{- $clusterSettings = index $root.Values.nodeAttestor.externalK8sPSAT.clusters $name }}
{{- end }} {{- end }}
- {{ $name }}: - {{ $name }}:
{{- if hasKey $clusterSettings "kubeConfigName" }} {{- if hasKey $clusterSettings "kubeConfigName" }}
@@ -233,11 +233,11 @@ plugins:
{{- end }} {{- end }}
{{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }} {{- $externalK8sBundleClusters := default .Values.kubeConfigs .Values.notifier.externalK8sBundle.clusters }}
{{- if or .Values.notifier.k8sbundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }} {{- if or .Values.notifier.k8sBundle.enabled (and .Values.notifier.externalK8sBundle.enabled (ne (len $externalK8sBundleClusters) 0)) }}
Notifier: Notifier:
k8sbundle: k8sbundle:
plugin_data: plugin_data:
{{- if eq (.Values.notifier.k8sbundle.enabled | toString) "true" }} {{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
namespace: {{ include "spire-server.bundle-namespace" . | quote }} namespace: {{ include "spire-server.bundle-namespace" . | quote }}
config_map: {{ include "spire-lib.bundle-configmap" . | quote }} config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
{{- end }} {{- end }}
@@ -307,12 +307,12 @@ plugins:
UpstreamAuthority: UpstreamAuthority:
cert-manager: cert-manager:
plugin_data: plugin_data:
issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuer_name }} issuer_name: {{ default (printf "%s-ca" (include "spire-server.fullname" $root)) .issuerName }}
issuer_kind: {{ .issuer_kind | quote }} issuer_kind: {{ .issuerKind | quote }}
issuer_group: {{ .issuer_group | quote }} issuer_group: {{ .issuerGroup | quote }}
namespace: {{ default $root.Release.Namespace .namespace | quote }} namespace: {{ default $root.Release.Namespace .namespace | quote }}
{{- if ne .kube_config_file "" }} {{- if ne .kubeConfigFile "" }}
kube_config_file: {{ .kube_config_file | quote }} kube_config_file: {{ .kubeConfigFile | quote }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/issuer.yaml
+4 -4
View File
@@ -1,6 +1,6 @@
{{- with .Values.upstreamAuthority.certManager }} {{- with .Values.upstreamAuthority.certManager }}
{{ if and .enabled .ca.create }} {{ if and .enabled .ca.create }}
{{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuer_name) }} {{ $issuerName := printf "%s-selfsigned" (default (include "spire-server.fullname" $) .issuerName) }}
{{/* {{/*
Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/ Configuring CA Issuer: https://cert-manager.io/docs/configuration/ca/
*/}} */}}
@@ -21,14 +21,14 @@ metadata:
namespace: {{ include "spire-server.namespace" $ }} namespace: {{ include "spire-server.namespace" $ }}
spec: spec:
isCA: true isCA: true
commonName: {{ $.Values.ca_subject.common_name }} commonName: {{ $.Values.caSubject.commonName }}
secretName: {{ include "spire-server.fullname" $ }}-ca-keys secretName: {{ include "spire-server.fullname" $ }}-ca-keys
duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }} duration: {{ $.Values.upstreamAuthority.certManager.ca.duration }}
subject: subject:
countries: countries:
- {{ $.Values.ca_subject.country }} - {{ $.Values.caSubject.country }}
organizations: organizations:
- {{ $.Values.ca_subject.organization }} - {{ $.Values.caSubject.organization }}
privateKey: privateKey:
algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }} algorithm: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.algorithm }}
size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }} size: {{ $.Values.upstreamAuthority.certManager.ca.privateKey.size }}
charts/spire/charts/spire-server/templates/roles.yaml
+3 -3
View File
@@ -1,7 +1,7 @@
{{- $subject := include "spire-server.subject" . }} {{- $subject := include "spire-server.subject" . }}
{{- $namespace := include "spire-server.namespace" . }} {{- $namespace := include "spire-server.namespace" . }}
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }} {{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
{{- if .Values.notifier.k8sbundle.enabled }} {{- if .Values.notifier.k8sBundle.enabled }}
# Role to be able to push certificate bundles to a configmap # Role to be able to push certificate bundles to a configmap
kind: Role kind: Role
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -48,7 +48,7 @@ roleRef:
name: {{ include "spire-server.fullname" . }}-cm name: {{ include "spire-server.fullname" . }}-cm
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
{{- end }} {{- end }}
{{- if .Values.notifier.k8sbundle.enabled }} {{- if .Values.notifier.k8sBundle.enabled }}
--- ---
kind: RoleBinding kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -61,7 +61,7 @@ roleRef:
name: {{ include "spire-lib.bundle-configmap" . }} name: {{ include "spire-lib.bundle-configmap" . }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
{{- end }} {{- end }}
{{- if and .Values.nodeAttestor.k8sPsat.enabled }} {{- if and .Values.nodeAttestor.k8sPSAT.enabled }}
--- ---
# ClusterRole to allow spire-server node attestor to query Token Review API # ClusterRole to allow spire-server node attestor to query Token Review API
kind: ClusterRole kind: ClusterRole
charts/spire/charts/spire-server/templates/server-resource.yaml
+27 -1
View File
@@ -6,7 +6,33 @@
{{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }} {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }} {{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
{{- $fullname := include "spire-server.fullname" . }} {{- $fullname := include "spire-server.fullname" . }}
{{- if hasKey .Values "ca_subject" }}
{{- fail "ca_subject was renamed to caSubject. Please update your config." }}
{{- end }}
{{- if hasKey .Values.caSubject "common_name" }}
{{- fail "ca_name was renamed to caName. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_name" }}
{{- fail "issuer_name was renamed to issuerName. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_group" }}
{{- fail "issuer_group was renamed to issuerGroup. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "issuer_kind" }}
{{- fail "issuer_kind was renamed to issuerKind. Please update your config." }}
{{- end }}
{{- if hasKey .Values.upstreamAuthority.certManager "kube_config_file" }}
{{- fail "kube_config_file was renamed to kubeConfigFile. Please update your config." }}
{{- end }}
{{- if hasKey .Values.nodeAttestor "k8sPsat" }}
{{- fail "k8sPsat was renamed to k8sPSAT. Please update your config." }}
{{- end }}
{{- if hasKey .Values.nodeAttestor "externalK8sPSA" }}
{{- fail "externalK8sPsat was renamed to externalK8sPSAT. Please update your config." }}
{{- end }}
{{- if hasKey .Values.notifier "k8sbundle" }}
{{- fail "k8sbundle was renmaed to k8sBundle. Please update your config." }}
{{- end }}
{{- if eq .Values.kind "statefulset" }} {{- if eq .Values.kind "statefulset" }}
{{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }} {{- if not (has .Values.persistence.type (list "pvc" "hostPath" "emptyDir")) }}
{{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }} {{- fail "persistence.type must be one of [\"pvc\", \"hostPath\", \"emptyDir\"]" }}
charts/spire/charts/spire-server/values.yaml
+29 -29
View File
@@ -287,13 +287,13 @@ federation:
# If Profile Type == https_web: # If Profile Type == https_web:
# secretName: spire-server-federation-tls # secretName: spire-server-federation-tls
ca_subject: caSubject:
## @param ca_subject.country Country for Spire server CA ## @param caSubject.country Country for Spire server CA
country: ARPA country: ARPA
## @param ca_subject.organization Organization for Spire server CA ## @param caSubject.organization Organization for Spire server CA
organization: Example organization: Example
## @param ca_subject.common_name Common Name for Spire server CA ## @param caSubject.commonName Common Name for Spire server CA
common_name: example.org commonName: example.org
credentialComposer: credentialComposer:
uniqueID: uniqueID:
@@ -371,16 +371,16 @@ upstreamAuthority:
## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles ## @param upstreamAuthority.certManager.rbac.create Flag to create RBAC roles
rbac: rbac:
create: true create: true
## @param upstreamAuthority.certManager.issuer_name Defaults to the release name, override if CA is provided outside of the chart ## @param upstreamAuthority.certManager.issuerName Defaults to the release name, override if CA is provided outside of the chart
issuer_name: "" issuerName: ""
## @param upstreamAuthority.certManager.issuer_kind Defaults to "Issuer", override if CA is provided outside of the chart ## @param upstreamAuthority.certManager.issuerKind Defaults to "Issuer", override if CA is provided outside of the chart
issuer_kind: "Issuer" issuerKind: "Issuer"
## @param upstreamAuthority.certManager.issuer_group Defaults to "cert-manager.io", override if CA is provided outside of the chart ## @param upstreamAuthority.certManager.issuerGroup Defaults to "cert-manager.io", override if CA is provided outside of the chart
issuer_group: "cert-manager.io" issuerGroup: "cert-manager.io"
## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into ## @param upstreamAuthority.certManager.namespace Specify to use a namespace other then the one the chart is installed into
namespace: "" namespace: ""
## @param upstreamAuthority.certManager.kube_config_file Path to kube_config_file on node to setup cert manager ## @param upstreamAuthority.certManager.kubeConfigFile Path to kube config file on node to setup cert manager
kube_config_file: "" kubeConfigFile: ""
ca: ca:
## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA ## @param upstreamAuthority.certManager.ca.create Creates a Cert-Manager CA
@@ -440,10 +440,10 @@ upstreamAuthority:
expiry: 7200 expiry: 7200
notifier: notifier:
k8sbundle: k8sBundle:
## @param notifier.k8sbundle.enabled Enable local k8s bundle uploader ## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader
enabled: true enabled: true
## @param notifier.k8sbundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace ## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
namespace: "" namespace: ""
externalK8sBundle: externalK8sBundle:
## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader ## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
@@ -795,30 +795,30 @@ defaultX509SvidTTL: 4h
defaultJwtSvidTTL: 1h defaultJwtSvidTTL: 1h
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor ## @param nodeAttestor.k8sPSAT.enabled Enable PSAT k8s nodeattestor
enabled: true enabled: true
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. ## @param nodeAttestor.k8sPSAT.serviceAccountAllowList [array] Allowed service accounts for PSAT nodeattestor. If namespace isn't specified, release namespace will be used.
serviceAccountAllowList: [] serviceAccountAllowList: []
## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used ## @param nodeAttestor.k8sPSAT.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used
audience: ["spire-server"] audience: ["spire-server"]
## @param nodeAttestor.k8sPsat.allowedNodeLabelKeys [array] Node label keys considered for selectors ## @param nodeAttestor.k8sPSAT.allowedNodeLabelKeys [array] Node label keys considered for selectors
allowedNodeLabelKeys: [] allowedNodeLabelKeys: []
## @param nodeAttestor.k8sPsat.allowedPodLabelKeys [array] Pod label keys considered for selectors ## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors
allowedPodLabelKeys: [] allowedPodLabelKeys: []
externalK8sPsat: externalK8sPSAT:
## @param nodeAttestor.externalK8sPsat.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters ## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters
enabled: true enabled: true
defaults: defaults:
## @param nodeAttestor.externalK8sPsat.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor ## @param nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList [array] Allowed service accounts for PSAT node attestor
serviceAccountAllowList: ["spire-system:spire-agent-upstream"] serviceAccountAllowList: ["spire-system:spire-agent-upstream"]
## @param nodeAttestor.externalK8sPsat.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used ## @param nodeAttestor.externalK8sPSAT.defaults.audience [array] Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used
audience: ["spire-server"] audience: ["spire-server"]
## @param nodeAttestor.externalK8sPsat.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors ## @param nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys [array] Node label keys considered for selectors
allowedNodeLabelKeys: [] allowedNodeLabelKeys: []
## @param nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors ## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors
allowedPodLabelKeys: [] allowedPodLabelKeys: []
## @param nodeAttestor.externalK8sPsat.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. ## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
clusters: {} clusters: {}
# clustera: # clustera:
# kubeConfigName: foo # kubeConfigName: foo
charts/spire/ci/namespace-override-values-skip.yaml
+2 -2
View File
@@ -8,10 +8,10 @@ spiffe-oidc-discovery-provider:
spire-server: spire-server:
namespaceOverride: spire-server namespaceOverride: spire-server
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
serviceAccountAllowList: ["spire-system:spire-agent"] serviceAccountAllowList: ["spire-system:spire-agent"]
notifier: notifier:
k8sbundle: k8sBundle:
namespace: spire-system namespace: spire-system
spiffe-csi-driver: spiffe-csi-driver:
examples/federation/a-values.yaml
+4 -4
View File
@@ -9,12 +9,12 @@ global:
clusterName: a clusterName: a
trustDomain: a-org.local trustDomain: a-org.local
bundleConfigMap: spire-bundle-a bundleConfigMap: spire-bundle-a
caSubject:
country: US
organization: A
commonName: a.local
spire-server: spire-server:
ca_subject:
country: US
organization: A
common_name: a.local
federation: federation:
enabled: true enabled: true
ingress: ingress:
examples/federation/b-values.yaml
+4 -4
View File
@@ -9,12 +9,12 @@ global:
clusterName: b clusterName: b
trustDomain: b-org.local trustDomain: b-org.local
bundleConfigMap: spire-bundle-b bundleConfigMap: spire-bundle-b
caSubject:
country: US
organization: B
commonName: b.local
spire-server: spire-server:
ca_subject:
country: US
organization: B
common_name: b.local
federation: federation:
enabled: true enabled: true
ingress: ingress:
examples/tpm-direct/different-nodes.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ spire-agent:
nodeSelector: nodeSelector:
tpm: with tpm: with
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
enabled: false enabled: false
tpmDirect: tpmDirect:
enabled: true enabled: true
examples/tpm-direct/same-nodes.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
spire-agent: spire-agent:
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
enabled: false enabled: false
tpmDirect: tpmDirect:
enabled: true enabled: true
examples/tpm-direct/values.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
spire-agent: spire-agent:
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
enabled: false enabled: false
tpmDirect: tpmDirect:
enabled: true enabled: true
tests/unit/spire_test.go
+4 -4
View File
@@ -28,13 +28,13 @@ var _ = Describe("Spire", func() {
chart, err := helmloader.Load("../../charts/spire") chart, err := helmloader.Load("../../charts/spire")
Expect(err).Should(Succeed()) Expect(err).Should(Succeed())
Describe("spire-server.upstream.cert-manager", func() { Describe("spire-server.upstream.cert-manager", func() {
It("issuer_name when set is passed through", func() { It("issuerName when set is passed through", func() {
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
spire-server: spire-server:
upstreamAuthority: upstreamAuthority:
certManager: certManager:
enabled: true enabled: true
issuer_name: abc123 issuerName: abc123
`) `)
Expect(err).Should(Succeed()) Expect(err).Should(Succeed())
notes := objs["spire/charts/spire-server/templates/configmap.yaml"] notes := objs["spire/charts/spire-server/templates/configmap.yaml"]
@@ -108,7 +108,7 @@ spire-server:
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
spire-agent: spire-agent:
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
enabled: false enabled: false
customPlugins: customPlugins:
nodeAttestor: nodeAttestor:
@@ -127,7 +127,7 @@ spire-agent:
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
spire-agent: spire-agent:
nodeAttestor: nodeAttestor:
k8sPsat: k8sPSAT:
enabled: false enabled: false
unsupportedBuiltInPlugins: unsupportedBuiltInPlugins:
nodeAttestor: nodeAttestor: