Add Tornjak

This reverts commit 3210dfe49dfabc96437d1fe60a1b9a5eedb2312b.

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/README.md

@@ -106,7 +106,15 @@ A Helm chart to install the SPIRE server.
 | telemetry.prometheus.podMonitor.namespace | string | `""` | Override where to install the podMonitor, if not set will use the same namespace as the spire-server |
 | tolerations | list | `[]` |  |
 | topologySpreadConstraints | list | `[]` |  |
-| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
+| tornjak.config.backend.dataStore.driver | string | `"sqlite3"` |  |
+| tornjak.config.backend.dataStore.file | string | `"/run/spire/data/tornjak.sqlite3"` |  |
+| tornjak.config.frontend.apiServerURL | string | `"http://localhost:10000"` |  |
+| tornjak.enabled | bool | `false` |  |
+| tornjak.image.pullPolicy | string | `"IfNotPresent"` |  |
+| tornjak.image.registry | string | `"ghcr.io"` |  |
+| tornjak.image.repository | string | `"spiffe/tornjak"` |  |
+| tornjak.image.version | string | `"latest"` |  |
+| trustDomain | string | `"example.org"` |  |
 | upstreamAuthority.certManager.enabled | bool | `false` |  |
 | upstreamAuthority.certManager.issuer_group | string | `"cert-manager.io"` |  |
 | upstreamAuthority.certManager.issuer_kind | string | `"Issuer"` |  |

charts/spire/charts/spire-server/templates/NOTES.txt

@@ -4,3 +4,21 @@ Installed {{ .Chart.Name }}…
 
   kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
     spire-server entry show
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+
+### WARNING ###
+This Tornjak is configured without authentication and it is intended for
+testing only. Please do not use this version in production.
+
+Tornjak APIs (Backend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 10000:10000
+
+Tornjak UI (Frontend):
+      kubectl -n {{ include "spire-server.namespace" . }} port-forward {{ include "spire-server.fullname" . }}-0 3000:3000
+
+Tornjak API access:  {{ include "tornjak.apiURL" . }}
+Tornjak UI access:   {{ include "tornjak.frontendURL" . }}
+
+Installed {{ include "spire-tornjak.fullname" . }}…
+{{- end }}

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -153,3 +153,35 @@ Create the name of the service account to use
 {{- end }}
 {{- $config | toYaml }}
 {{- end }}
+
+{{/*
+Tornjak specific section
+*/}}
+
+{{- define "spire-tornjak.fullname" -}}
+{{ include "spire-server.fullname" . | trimSuffix "-server" }}-tornjak
+{{- end }}
+{{- define "spire-tornjak.config" -}}
+{{ include "spire-tornjak.fullname" . }}-config
+{{- end }}
+{{- define "spire-tornjak.frontend" -}}
+{{ include "spire-tornjak.fullname" . }}-fe
+{{- end }}
+{{- define "spire-tornjak.backend" -}}
+{{ include "spire-tornjak.fullname" . }}-be
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Backend
+*/}}
+{{- define "tornjak.apiURL" -}}
+{{- default .Values.tornjak.config.frontend.apiServerURL }}
+{{- end }}
+
+{{/*
+Create URL for accessing Tornjak Frontend
+*/}}
+{{- define "tornjak.frontendURL" -}}
+{{- $feurl := print "http://localhost:3000" }}
+{{- $feurl }}
+{{- end }}

charts/spire/charts/spire-server/templates/service.yaml

@@ -26,3 +26,36 @@ spec:
     {{- end }}
   selector:
     {{- include "spire-server.selectorLabels" . | nindent 4 }}
+
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.frontend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+    {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.frontend" . }}
+      port: 3000
+      targetPort: 3000
+      protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: {{ include "spire-server.namespace" . }}
+  name: {{ include "spire-tornjak.backend" . }}
+spec:
+  type: {{ .Values.service.type }} # ClusterIP
+  selector:
+   {{- include "spire-server.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: {{ include "spire-tornjak.backend" . }}
+      port: 10000
+      targetPort: 10000
+      protocol: TCP
+{{- end }}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -1,6 +1,7 @@
 {{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
 {{- $configSum2 := (include (print $.Template.BasePath "/secret.yaml") . | sha256sum) }}
 {{- $configSum3 := (include (print $.Template.BasePath "/controller-manager-configmap.yaml") . | sha256sum) }}
+{{- $configSumTornjak := (include (print $.Template.BasePath "/tornjak-config.yaml") . | sha256sum) }}
 {{- $fullname := include "spire-server.fullname" . }}
 apiVersion: apps/v1
 kind: StatefulSet
@@ -26,6 +27,7 @@ spec:
         checksum/config: {{ $configSum }}
         checksum/config2: {{ $configSum2 }}
         checksum/config3: {{ $configSum3 }}
+        checksum/configTornjak: {{ $configSumTornjak }}
         {{- with .Values.podAnnotations }}
           {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -155,6 +157,51 @@ spec:
               mountPath: /tmp
               readOnly: false
         {{- end }}
+
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        - name: tornjak
+          securityContext:
+            {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image) }}
+          imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
+          startupProbe:
+            httpGet:
+              scheme: HTTP
+              port: 3000
+            failureThreshold: 6
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 10
+          env:
+          {{- if .Values.tornjak.config.frontend }}
+          - name: REACT_APP_API_SERVER_URI
+            value: {{ include "tornjak.apiURL" . | required "Either .Values.tornjak.config.backend.ingress or .Values.tornjak.config.frontend.apiServerURL is required." }}
+          {{- end }}
+          args:
+          - -c
+          - /run/spire/config/server.conf
+          - -t
+          - /run/spire/tornjak-config/server.conf
+          ports:
+          - containerPort: 3000
+            protocol: TCP
+          volumeMounts:
+          - name: {{ include "spire-tornjak.config" . }}
+            mountPath: /run/spire/tornjak-config
+          - name: spire-server-socket
+            mountPath: /tmp/spire-server/private
+            readOnly: true
+          - name: spire-config
+            mountPath: /run/spire/config
+            readOnly: true
+          {{- if eq (.Values.dataStorage.enabled | toString) "true" }}
+          - name: spire-data
+            mountPath: /run/spire/data
+            readOnly: false
+          {{- end }}
+        {{- end }}
+
         {{- if gt (len .Values.extraContainers) 0 }}
         {{- toYaml .Values.extraContainers | nindent 8 }}
         {{- end }}
@@ -192,6 +239,14 @@ spec:
           configMap:
             name: {{ include "spire-controller-manager.fullname" . }}
         {{- end }}
+        {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+        {{- if .Values.tornjak.config }}
+        - name: {{ include "spire-tornjak.config" . }}
+          configMap:
+            defaultMode: 420
+            name: {{ include "spire-tornjak.config" . }}
+        {{- end }}
+        {{- end }}
         {{- if gt (len .Values.extraVolumes) 0 }}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
         {{- end }}

charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml

@@ -0,0 +1,27 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "{{ include "spire-tornjak.fullname" . }}-test-connection"
+  namespace: {{ include "spire-server.namespace" . }}
+  labels:  
+  annotations:
+    "helm.sh/hook": test
+spec:
+  securityContext:
+    {{- toYaml .Values.podSecurityContext | nindent 4 }}
+  containers:
+    - name: wget-tornjak-backend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.backend" . }}:10000/api/tornjak/serverinfo']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+    - name: wget-tornjak-frontend
+      image: busybox
+      command: ['wget']
+      args: ['--no-check-certificate', '-O', '/dev/null', 'http://{{ include "spire-tornjak.frontend" . }}:3000']
+      securityContext:
+        {{- toYaml .Values.securityContext | nindent 8 }}
+  restartPolicy: Never
+{{- end }}

charts/spire/charts/spire-server/templates/tornjak-config.yaml

@@ -0,0 +1,23 @@
+{{- if eq (.Values.tornjak.enabled | toString) "true" }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-tornjak.config" . }}
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  server.conf: |
+    server {
+      metadata = "insert metadata"
+    }
+
+    plugins {
+    {{- if .Values.tornjak.config.backend.dataStore }}
+      DataStore "sql" {
+        plugin_data {
+          drivername = "{{ .Values.tornjak.config.backend.dataStore.driver }}"
+          filename = "{{ .Values.tornjak.config.backend.dataStore.file }}"
+        }
+      }
+    {{- end }}
+    }
+    {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -255,3 +255,26 @@ nodeAttestor:
   k8sPsat:
     enabled: true
     serviceAccountAllowList: []
+
+# tornjak - Tornjak specific configuration
+tornjak:
+  enabled: false
+  # image - Tornjak image (frontend + backend) if not separated above
+  image: # ghcr.io/spiffe/tornjak
+    registry: ghcr.io
+    repository: spiffe/tornjak
+    pullPolicy: IfNotPresent
+    # Overrides the image tag whose default is the chart appVersion.
+    # TODO we should use a specific Tornjak version instead of 'latest'
+    version: "latest"
+  config:
+    # Front-end specific configuration:
+    frontend:
+      # apiServerURL - URL of the Tornjak back-end
+      apiServerURL: "http://localhost:10000"  # 👈 Use it for minikube or kind
+     # Back-end specific configuration
+    backend:
+      # dataStore - persistent DB for storing Tornjak specific information
+      dataStore:
+        driver: "sqlite3"
+        file: "/run/spire/data/tornjak.sqlite3"