diff --git a/charts/spire/README.md b/charts/spire/README.md index 9bdb755..d4914f2 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -91,7 +91,7 @@ We only support upgrading one major/minor version at a time. Version skipping is ### 0.23.X In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with -spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "hostCert". Please try +spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "auto". Please try setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone. ### 0.21.X diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 61b0eb7..3147cdd 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -87,7 +87,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | -| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip] | `skip` | +| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 670958d..34b1a64 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -106,7 +106,7 @@ plugins: {{- if .Values.workloadAttestors.k8s.enabled }} k8s: plugin_data: - {{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} + {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }} kubelet_ca_path: /hostCert/kubelet.crt {{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }} kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index fed53bb..3bec7b0 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -74,13 +74,13 @@ spec: {{- toYaml .Values.hostAliases | nindent 8 }} {{- end }} initContainers: - {{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} + {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }} - name: gather-host-cert securityContext: {{- $mainSecurityContext | toYaml | nindent 12 }} image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }} imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }} - command: ["bash", "-xec"] + command: ["bash", "-xc"] args: - | {{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }} @@ -91,11 +91,34 @@ spec: elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt else + {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} + {{- if $cbh }} + URL="https://$NODE_NAME:10250/spec/" + {{- else }} + URL="https://localhost:10250/spec/" + {{- end }} + curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL" + if [ $? -eq 0 ]; then + echo Mode detected as apiServerCA. + ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt + exit 0 + fi + {{- end }} echo Could not find certificate. exit 1 fi {{- end }} + {{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }} + echo Mode detected as hostCert. + {{- end }} chmod 644 /hostCert/kubelet.crt + env: + {{- if $cbh }} + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + {{- end }} volumeMounts: - name: host-cert-isolated mountPath: /hostCert @@ -249,7 +272,7 @@ spec: readOnly: false - name: spire-token mountPath: /var/run/secrets/tokens - {{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} + {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }} - name: host-cert-isolated mountPath: /hostCert readOnly: true @@ -336,7 +359,7 @@ spec: path: /dev/kmsg type: CharDevice {{- end }} - {{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} + {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }} - name: host-cert-isolated emptyDir: {} - name: host-cert diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 3878cd5..e3be89f 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -207,7 +207,7 @@ workloadAttestors: ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor enabled: true verification: - ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip] + ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] type: skip hostCert: ## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates