From 6b03d5a0bdc3270687cd4bcff0ada929322fe595 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 30 Jan 2024 11:33:32 -0800 Subject: [PATCH] Fix hardcoded nodeAttestor and keyManager in spire-agent (#221) * Fix hardcoded nodeAttestor and keyManager in spire-agent --------- Signed-off-by: Kevin Fox --- charts/spire/charts/spire-agent/README.md | 2 ++ .../charts/spire-agent/templates/configmap.yaml | 14 ++++++++++++++ charts/spire/charts/spire-agent/values.yaml | 10 ++++++++++ tests/unit/spire_test.go | 6 ++++++ 4 files changed, 32 insertions(+) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index a54b664..b7ccf43 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -70,6 +70,8 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | +| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | +| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 347ffca..34a0d7e 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -56,15 +56,29 @@ agent: {{- end }} {{- end }} +{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }} +{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }} plugins: NodeAttestor: + {{- if .Values.nodeAttestor.k8sPsat.enabled }} k8s_psat: plugin_data: cluster: {{ include "spire-lib.cluster-name" . | quote }} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} +{{- if ne $nodeAttestorUsed 1 }} +{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} +{{- end }} KeyManager: + {{- if .Values.keyManager.memory.enabled }} memory: plugin_data: + {{- $keyManagerUsed = add1 $keyManagerUsed }} + {{- end }} +{{- if ne $keyManagerUsed 1 }} +{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }} +{{- end }} WorkloadAttestor: {{- if .Values.workloadAttestors.k8s.enabled }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 7eb8aae..8bcb698 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -154,6 +154,16 @@ fsGroupFix: ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ resources: {} +keyManager: + memory: + ## @param keyManager.memory.enabled Enable the memory based Key Manager + enabled: true + +nodeAttestor: + k8sPsat: + ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor + enabled: true + # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'. diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 0c849ca..f356636 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -107,6 +107,9 @@ spire-server: It("plugin set ok", func() { objs, err := ValueStringRender(chart, ` spire-agent: + nodeAttestor: + k8sPsat: + enabled: false customPlugins: nodeAttestor: tpm: @@ -123,6 +126,9 @@ spire-agent: It("plugin set ok", func() { objs, err := ValueStringRender(chart, ` spire-agent: + nodeAttestor: + k8sPsat: + enabled: false unsupportedBuiltInPlugins: nodeAttestor: join_token: