panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix hardcoded nodeAttestor and keyManager in spire-agent (#221)

Browse Source 
* Fix hardcoded nodeAttestor and keyManager in spire-agent

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-01-30 11:33:32 -08:00
committed by GitHub
parent f4c92ed3ca
commit 6b03d5a0bd
4 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+2
View File
@@ -70,6 +70,8 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:f37793c4af2a98f6cc313ac8af635d713e92d19344b11d499f92d8c644dd3b9f` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | | `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+14
View File
@@ -56,15 +56,29 @@ agent:
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }}
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
plugins: plugins:
NodeAttestor: NodeAttestor:
{{- if .Values.nodeAttestor.k8sPsat.enabled }}
k8s_psat: k8s_psat:
plugin_data: plugin_data:
cluster: {{ include "spire-lib.cluster-name" . | quote }} cluster: {{ include "spire-lib.cluster-name" . | quote }}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }}
{{- if ne $nodeAttestorUsed 1 }}
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
{{- end }}
KeyManager: KeyManager:
{{- if .Values.keyManager.memory.enabled }}
memory: memory:
plugin_data: plugin_data:
{{- $keyManagerUsed = add1 $keyManagerUsed }}
{{- end }}
{{- if ne $keyManagerUsed 1 }}
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
{{- end }}
WorkloadAttestor: WorkloadAttestor:
{{- if .Values.workloadAttestors.k8s.enabled }} {{- if .Values.workloadAttestors.k8s.enabled }}
charts/spire/charts/spire-agent/values.yaml
+10
View File
@@ -154,6 +154,16 @@ fsGroupFix:
## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ ## @param fsGroupFix.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
resources: {} resources: {}
keyManager:
memory:
## @param keyManager.memory.enabled Enable the memory based Key Manager
enabled: true
nodeAttestor:
k8sPsat:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
enabled: true
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
workloadAttestors: workloadAttestors:
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'. # unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
tests/unit/spire_test.go
+6
View File
@@ -107,6 +107,9 @@ spire-server:
It("plugin set ok", func() { It("plugin set ok", func() {
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
spire-agent: spire-agent:
nodeAttestor:
k8sPsat:
enabled: false
customPlugins: customPlugins:
nodeAttestor: nodeAttestor:
tpm: tpm:
@@ -123,6 +126,9 @@ spire-agent:
It("plugin set ok", func() { It("plugin set ok", func() {
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
spire-agent: spire-agent:
nodeAttestor:
k8sPsat:
enabled: false
unsupportedBuiltInPlugins: unsupportedBuiltInPlugins:
nodeAttestor: nodeAttestor:
join_token: join_token: