Merge pull request #113 from spiffe/spire-config-as-yaml-converted-json
This commit is contained in:
Marco Franssen
@@ -17,7 +17,7 @@ A Helm chart for deploying the complete Spire stack including: spire-server, spi
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.x` |
|
||||
| SPIRE | `1.5.3+`, `1.6.3+` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.21+` |
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
|
||||
| Dependency | Supported Versions |
|
||||
|:-----------|:-------------------|
|
||||
| SPIRE | `1.5.3+`, `1.6.x` |
|
||||
| SPIRE | `1.5.3+`, `1.6.3+` |
|
||||
| Helm | `3.x` |
|
||||
| Kubernetes | `1.21+` |
|
||||
|
||||
|
||||
@@ -1,4 +1,38 @@
|
||||
{{- $oidcSocket := "/run/spire/oidc-sockets/spire-oidc-server.sock" }}
|
||||
{{- define "spiffe-oidc-discovery-provider.yaml-config" -}}
|
||||
{{- $oidcSocket := .oidcSocket }}
|
||||
{{- with .root }}
|
||||
log_level: {{ .Values.config.logLevel | quote }}
|
||||
|
||||
domains:
|
||||
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}"
|
||||
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}"
|
||||
- "{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}"
|
||||
{{- if gt (len .Values.config.domains) 0 }}
|
||||
{{- .Values.config.domains | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
allow_insecure_scheme: {{ .Values.insecureScheme.enabled }}
|
||||
listen_socket_path: {{ $oidcSocket | quote }}
|
||||
{{- else }}
|
||||
acme:
|
||||
directory_url: {{ .Values.config.acme.directoryUrl | quote }}
|
||||
cache_dir: {{ .Values.config.acme.cacheDir | quote }}
|
||||
tos_accepted: {{ .Values.config.acme.tosAccepted }}
|
||||
email: {{ .Values.config.acme.emailAddress | quote }}
|
||||
{{- end }}
|
||||
|
||||
workload_api:
|
||||
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
||||
trust_domain: {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
|
||||
|
||||
health_checks:
|
||||
bind_port: "8008"
|
||||
ready_path: "/ready"
|
||||
live_path: "/live"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
@@ -6,39 +40,7 @@ metadata:
|
||||
namespace: {{ include "spiffe-oidc-discovery-provider.namespace" . }}
|
||||
data:
|
||||
oidc-discovery-provider.conf: |
|
||||
log_level = "{{ .Values.config.logLevel }}"
|
||||
|
||||
domains = [
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}",
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}",
|
||||
"{{ include "spiffe-oidc-discovery-provider.fullname" . }}.{{ include "spiffe-oidc-discovery-provider.namespace" . }}.svc.{{ include "spiffe-oidc-discovery-provider.cluster-domain" . }}",
|
||||
{{- if gt (len .Values.config.domains) 0 }}
|
||||
"{{- join "\",\n \"" .Values.config.domains }}"
|
||||
{{- end }}
|
||||
]
|
||||
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
allow_insecure_scheme = {{ .Values.insecureScheme.enabled }}
|
||||
listen_socket_path = {{ $oidcSocket | quote }}
|
||||
{{- else }}
|
||||
acme {
|
||||
directory_url = "{{ .Values.config.acme.directoryUrl }}"
|
||||
cache_dir = "{{ .Values.config.acme.cacheDir }}"
|
||||
tos_accepted = {{ .Values.config.acme.tosAccepted }}
|
||||
email = "{{ .Values.config.acme.emailAddress }}"
|
||||
}
|
||||
{{- end }}
|
||||
|
||||
workload_api {
|
||||
socket_path = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
||||
trust_domain = {{ include "spiffe-oidc-discovery-provider.trust-domain" . | quote }}
|
||||
}
|
||||
|
||||
health_checks {
|
||||
bind_port = "8008"
|
||||
ready_path = "/ready"
|
||||
live_path = "/live"
|
||||
}
|
||||
{{- include "spiffe-oidc-discovery-provider.yaml-config" (dict "oidcSocket" $oidcSocket "root" .) | fromYaml | toPrettyJson | nindent 4 }}
|
||||
{{- if .Values.insecureScheme.enabled }}
|
||||
default.conf: |
|
||||
upstream oidc {
|
||||
|
||||
@@ -1,3 +1,50 @@
|
||||
{{- define "spire-agent.yaml-config" -}}
|
||||
agent:
|
||||
data_dir: "/run/spire"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
server_port: {{ .Values.server.port | quote }}
|
||||
socket_path: {{ include "spire-agent.socket-path" . | quote }}
|
||||
trust_bundle_path: "/run/spire/bundle/bundle.crt"
|
||||
trust_domain: {{ include "spire-agent.trust-domain" . | quote }}
|
||||
|
||||
plugins:
|
||||
NodeAttestor:
|
||||
- k8s_psat:
|
||||
plugin_data:
|
||||
cluster: {{ include "spire-agent.cluster-name" . | quote }}
|
||||
|
||||
KeyManager:
|
||||
- memory:
|
||||
plugin_data:
|
||||
|
||||
WorkloadAttestor:
|
||||
- k8s:
|
||||
plugin_data:
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification: true
|
||||
|
||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||
- unix:
|
||||
plugin_data:
|
||||
{{- end }}
|
||||
|
||||
health_checks:
|
||||
listener_enabled: true
|
||||
bind_address: "0.0.0.0"
|
||||
bind_port: {{ .Values.healthChecks.port | quote }}
|
||||
live_path: "/live"
|
||||
ready_path: "/ready"
|
||||
|
||||
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
||||
telemetry:
|
||||
- Prometheus:
|
||||
- host: "0.0.0.0"
|
||||
port: {{ .Values.telemetry.prometheus.port }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
@@ -5,58 +52,4 @@ metadata:
|
||||
namespace: {{ include "spire-agent.namespace" . }}
|
||||
data:
|
||||
agent.conf: |
|
||||
agent {
|
||||
data_dir = "/run/spire"
|
||||
log_level = {{ .Values.logLevel | quote }}
|
||||
server_address = {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
server_port = {{ .Values.server.port | quote }}
|
||||
socket_path = {{ include "spire-agent.socket-path" . | quote }}
|
||||
trust_bundle_path = "/run/spire/bundle/bundle.crt"
|
||||
trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
|
||||
}
|
||||
|
||||
plugins {
|
||||
NodeAttestor "k8s_psat" {
|
||||
plugin_data {
|
||||
cluster = {{ include "spire-agent.cluster-name" . | quote }}
|
||||
}
|
||||
}
|
||||
|
||||
KeyManager "memory" {
|
||||
plugin_data {
|
||||
}
|
||||
}
|
||||
|
||||
WorkloadAttestor "k8s" {
|
||||
plugin_data {
|
||||
# Defaults to the secure kubelet port by default.
|
||||
# Minikube does not have a cert in the cluster CA bundle that
|
||||
# can authenticate the kubelet cert, so skip validation.
|
||||
skip_kubelet_verification = true
|
||||
}
|
||||
}
|
||||
|
||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||
WorkloadAttestor "unix" {
|
||||
plugin_data {
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = {{ .Values.healthChecks.port | quote }}
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
|
||||
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
||||
telemetry {
|
||||
Prometheus {
|
||||
host = "0.0.0.0"
|
||||
port = {{ .Values.telemetry.prometheus.port }}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- include "spire-agent.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
|
||||
|
||||
@@ -1,5 +1,105 @@
|
||||
{{- define "spire-server.yaml-config" -}}
|
||||
{{- $root := . }}
|
||||
{{- $namespace := include "spire-server.namespace" . }}
|
||||
server:
|
||||
bind_address: "0.0.0.0"
|
||||
bind_port: "8081"
|
||||
trust_domain: {{ include "spire-server.trust-domain" . | quote }}
|
||||
data_dir: "/run/spire/data"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
jwt_issuer: {{ .Values.jwtIssuer | quote }}
|
||||
|
||||
ca_key_type: {{ .Values.caKeyType | quote }}
|
||||
ca_ttl: {{ .Values.caTTL | quote }}
|
||||
|
||||
default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
|
||||
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
|
||||
|
||||
ca_subject:
|
||||
{{- with .Values.ca_subject }}
|
||||
- country: [{{ .country | quote }}]
|
||||
organization: [{{ .organization | quote }}]
|
||||
common_name: {{ .common_name | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.federation }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
federation:
|
||||
bundle_endpoint:
|
||||
- {{ .bundleEndpoint | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
plugins:
|
||||
DataStore:
|
||||
- sql:
|
||||
plugin_data:
|
||||
database_type: "sqlite3"
|
||||
connection_string: "/run/spire/data/datastore.sqlite3"
|
||||
|
||||
{{- with .Values.nodeAttestor.k8sPsat }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
NodeAttestor:
|
||||
- k8s_psat:
|
||||
plugin_data:
|
||||
clusters:
|
||||
{{ include "spire-server.cluster-name" $root }}:
|
||||
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
KeyManager:
|
||||
- disk:
|
||||
plugin_data:
|
||||
keys_path: "/run/spire/data/keys.json"
|
||||
|
||||
Notifier:
|
||||
- k8sbundle:
|
||||
plugin_data:
|
||||
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
|
||||
config_map: {{ include "spire-server.bundle-configmap" . | quote }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
UpstreamAuthority:
|
||||
- disk:
|
||||
plugin_data:
|
||||
cert_file_path: "/run/spire/upstream_ca/tls.crt"
|
||||
key_file_path: "/run/spire/upstream_ca/tls.key"
|
||||
{{- if ne .secret.data.bundle "" }}
|
||||
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.certManager }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
UpstreamAuthority:
|
||||
- cert-manager:
|
||||
plugin_data:
|
||||
issuer_name: {{ .issuer_name | quote }}
|
||||
issuer_kind: {{ .issuer_kind | quote }}
|
||||
issuer_group: {{ .issuer_group | quote }}
|
||||
namespace: {{ default $root.Release.Namespace .namespace | quote }}
|
||||
{{- if ne .kube_config_file "" }}
|
||||
kube_config_file: {{ .kube_config_file | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
health_checks:
|
||||
listener_enabled: true
|
||||
bind_address: "0.0.0.0"
|
||||
bind_port: "8080"
|
||||
live_path: "/live"
|
||||
ready_path: "/ready"
|
||||
|
||||
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
||||
telemetry:
|
||||
- Prometheus:
|
||||
- host: "0.0.0.0"
|
||||
port: 9988
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
@@ -7,120 +107,4 @@ metadata:
|
||||
namespace: {{ include "spire-server.namespace" . }}
|
||||
data:
|
||||
server.conf: |
|
||||
server {
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8081"
|
||||
trust_domain = {{ include "spire-server.trust-domain" . | quote }}
|
||||
data_dir = "/run/spire/data"
|
||||
log_level = {{ .Values.logLevel | quote }}
|
||||
|
||||
jwt_issuer = {{ .Values.jwtIssuer | quote }}
|
||||
|
||||
ca_key_type = {{ .Values.caKeyType | quote }}
|
||||
ca_ttl = {{ .Values.caTTL | quote }}
|
||||
|
||||
default_x509_svid_ttl = {{ .Values.defaultX509SvidTTL | quote }}
|
||||
default_jwt_svid_ttl = {{ .Values.defaultJwtSvidTTL | quote }}
|
||||
|
||||
ca_subject = {
|
||||
{{- with .Values.ca_subject }}
|
||||
country = [{{ .country | quote }}],
|
||||
organization = [{{ .organization | quote }}],
|
||||
common_name = {{ .common_name | quote }},
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
{{- with .Values.federation }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
federation {
|
||||
bundle_endpoint {
|
||||
address = "{{ .bundleEndpoint.address }}"
|
||||
port = {{ .bundleEndpoint.port }}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
plugins {
|
||||
DataStore "sql" {
|
||||
plugin_data {
|
||||
database_type = "sqlite3"
|
||||
connection_string = "/run/spire/data/datastore.sqlite3"
|
||||
}
|
||||
}
|
||||
|
||||
{{- with .Values.nodeAttestor.k8sPsat }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
NodeAttestor "k8s_psat" {
|
||||
plugin_data {
|
||||
clusters = {
|
||||
{{ include "spire-server.cluster-name" $root | quote }} = {
|
||||
service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
KeyManager "disk" {
|
||||
plugin_data {
|
||||
keys_path = "/run/spire/data/keys.json"
|
||||
}
|
||||
}
|
||||
|
||||
Notifier "k8sbundle" {
|
||||
plugin_data {
|
||||
namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
|
||||
config_map = {{ include "spire-server.bundle-configmap" . | quote }}
|
||||
}
|
||||
}
|
||||
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
UpstreamAuthority "disk" {
|
||||
plugin_data {
|
||||
cert_file_path = "/run/spire/upstream_ca/tls.crt"
|
||||
key_file_path = "/run/spire/upstream_ca/tls.key"
|
||||
{{- if ne .secret.data.bundle "" }}
|
||||
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
|
||||
{{- end }}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.certManager }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
UpstreamAuthority "cert-manager" {
|
||||
plugin_data {
|
||||
issuer_name = {{ .issuer_name | quote }}
|
||||
issuer_kind = {{ .issuer_kind | quote }}
|
||||
issuer_group = {{ .issuer_group | quote }}
|
||||
namespace = {{ default $root.Release.Namespace .namespace | quote }}
|
||||
{{- if ne .kube_config_file "" }}
|
||||
kube_config_file = {{ .kube_config_file | quote }}
|
||||
{{- end }}
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = "8080"
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
|
||||
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
||||
telemetry {
|
||||
Prometheus {
|
||||
host = "0.0.0.0"
|
||||
port = 9988
|
||||
}
|
||||
}
|
||||
{{- end }}
|
||||
{{- include "spire-server.yaml-config" . | fromYaml | toPrettyJson | nindent 4 }}
|
||||
|
||||
Reference in New Issue
Block a user