panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a spire-agent auto kubelet verification mode (#435)

Browse Source 
* Add a spire-agent auto kubelet verification mode

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-08-23 15:09:55 -07:00
committed by GitHub
parent 50c741e047
commit 6e8ad569b3
5 changed files with 31 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+1 -1
View File
@@ -91,7 +91,7 @@ We only support upgrading one major/minor version at a time. Version skipping is
### 0.23.X ### 0.23.X
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "hostCert". Please try spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "auto". Please try
setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone. setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone.
### 0.21.X ### 0.21.X
charts/spire/charts/spire-agent/README.md
+1 -1
View File
@@ -87,7 +87,7 @@ A Helm chart to install the SPIRE agent.
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip] | `skip` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+1 -1
View File
@@ -106,7 +106,7 @@ plugins:
{{- if .Values.workloadAttestors.k8s.enabled }} {{- if .Values.workloadAttestors.k8s.enabled }}
k8s: k8s:
plugin_data: plugin_data:
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
kubelet_ca_path: /hostCert/kubelet.crt kubelet_ca_path: /hostCert/kubelet.crt
{{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }} {{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
charts/spire/charts/spire-agent/templates/daemonset.yaml
+27 -4
View File
@@ -74,13 +74,13 @@ spec:
{{- toYaml .Values.hostAliases | nindent 8 }} {{- toYaml .Values.hostAliases | nindent 8 }}
{{- end }} {{- end }}
initContainers: initContainers:
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: gather-host-cert - name: gather-host-cert
securityContext: securityContext:
{{- $mainSecurityContext | toYaml | nindent 12 }} {{- $mainSecurityContext | toYaml | nindent 12 }}
image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }} image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }}
imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }} imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }}
command: ["bash", "-xec"] command: ["bash", "-xc"]
args: args:
- | - |
{{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }} {{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }}
@@ -91,11 +91,34 @@ spec:
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt
else else
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
{{- if $cbh }}
URL="https://$NODE_NAME:10250/spec/"
{{- else }}
URL="https://localhost:10250/spec/"
{{- end }}
curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
if [ $? -eq 0 ]; then
echo Mode detected as apiServerCA.
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt
exit 0
fi
{{- end }}
echo Could not find certificate. echo Could not find certificate.
exit 1 exit 1
fi fi
{{- end }} {{- end }}
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
echo Mode detected as hostCert.
{{- end }}
chmod 644 /hostCert/kubelet.crt chmod 644 /hostCert/kubelet.crt
env:
{{- if $cbh }}
- name: NODE_NAME
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{{- end }}
volumeMounts: volumeMounts:
- name: host-cert-isolated - name: host-cert-isolated
mountPath: /hostCert mountPath: /hostCert
@@ -249,7 +272,7 @@ spec:
readOnly: false readOnly: false
- name: spire-token - name: spire-token
mountPath: /var/run/secrets/tokens mountPath: /var/run/secrets/tokens
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: host-cert-isolated - name: host-cert-isolated
mountPath: /hostCert mountPath: /hostCert
readOnly: true readOnly: true
@@ -336,7 +359,7 @@ spec:
path: /dev/kmsg path: /dev/kmsg
type: CharDevice type: CharDevice
{{- end }} {{- end }}
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }} {{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
- name: host-cert-isolated - name: host-cert-isolated
emptyDir: {} emptyDir: {}
- name: host-cert - name: host-cert
charts/spire/charts/spire-agent/values.yaml
+1 -1
View File
@@ -207,7 +207,7 @@ workloadAttestors:
## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
enabled: true enabled: true
verification: verification:
## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip] ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]
type: skip type: skip
hostCert: hostCert:
## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates ## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates