Add disk based KeyManager (#627)
* Add disk based KeyManager Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change disk to false Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Change disk to false Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> * Fix per requirement Signed-off-by: Eric Cavalcanti <[email protected]> * Update information Signed-off-by: Eric Cavalcanti <[email protected]> * Detail doc Signed-off-by: Eric Cavalcanti <[email protected]> * Test change comment Signed-off-by: Eric Cavalcanti <[email protected]> * Commnet better before Signed-off-by: Eric Cavalcanti <[email protected]> --------- Signed-off-by: Eric Cavalcanti <[email protected]> Signed-off-by: Eric Cavalcanti <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Eric Cavalcanti
co-authored by
kfox1111
kfox1111
parent
d2913ffca0
commit
6581b117a0
@@ -73,6 +73,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:1d3fa92a7ad5cfad6fbc3817bf82d25d0b6b4fa6c9711bcd273ffb3bfc926bce` |
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
|
||||
@@ -19,8 +19,11 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") }}
|
||||
{{- fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
|
||||
{{- end }}
|
||||
{{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }}
|
||||
{{- fail "The sockets.hostBasePath can not be located under the socketPath direcotry" }}
|
||||
{{- fail "The sockets.hostBasePath can not be located under the socketPath directory" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- define "spire-agent.yaml-config" -}}
|
||||
@@ -121,6 +124,12 @@ plugins:
|
||||
plugin_data:
|
||||
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
||||
{{- end }}
|
||||
{{- if .Values.keyManager.disk.enabled }}
|
||||
disk:
|
||||
plugin_data:
|
||||
directory: {{ .Values.persistence.hostPath }}
|
||||
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
||||
{{- end }}
|
||||
{{- if ne $keyManagerUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -9,6 +9,9 @@
|
||||
{{- if hasKey .Values.sds "disableSpiffeCertValidation" }}
|
||||
{{- fail "disableSpiffeCertValidation was renamed to disableSPIFFECertValidation. Please update your config." }}
|
||||
{{- end }}
|
||||
{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") }}
|
||||
{{- fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
|
||||
{{- end }}
|
||||
{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
|
||||
{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
|
||||
{{- $nameSuffix := "" }}
|
||||
@@ -256,6 +259,11 @@ spec:
|
||||
- name: spire-config
|
||||
mountPath: /opt/spire/conf/agent
|
||||
readOnly: true
|
||||
{{- if .Values.keyManager.disk.enabled }}
|
||||
- name: spire-key-manager
|
||||
mountPath: {{ .Values.persistence.hostPath }}
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
- name: spire-agent-persistence
|
||||
mountPath: /var/lib/spire
|
||||
{{- if .Values.sockets.admin.enabled }}
|
||||
@@ -324,6 +332,12 @@ spec:
|
||||
- name: spire-config
|
||||
configMap:
|
||||
name: {{ include "spire-agent.fullname" . }}
|
||||
{{- if .Values.keyManager.disk.enabled }}
|
||||
- name: spire-key-manager
|
||||
hostPath:
|
||||
path: {{ .Values.persistence.hostPath }}
|
||||
type: DirectoryOrCreate
|
||||
{{- end }}
|
||||
{{- if .Values.sockets.admin.mountOnHost }}
|
||||
- name: spire-agent-admin-socket-dir
|
||||
hostPath:
|
||||
|
||||
@@ -162,6 +162,9 @@ keyManager:
|
||||
memory:
|
||||
## @param keyManager.memory.enabled Enable the memory based Key Manager
|
||||
enabled: true
|
||||
disk:
|
||||
## @param keyManager.disk.enabled Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled)
|
||||
enabled: false
|
||||
|
||||
nodeAttestor:
|
||||
k8sPSAT:
|
||||
|
||||
Reference in New Issue
Block a user