Add a spire-agent auto kubelet verification mode (#435)
* Add a spire-agent auto kubelet verification mode Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -91,7 +91,7 @@ We only support upgrading one major/minor version at a time. Version skipping is
|
||||
### 0.23.X
|
||||
|
||||
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
|
||||
spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "hostCert". Please try
|
||||
spire-agent.workloadAttestors.k8s.verification.type. It defaults to "skip" which will have the same behavior as before. In a future version, it will be set to "auto". Please try
|
||||
setting it to this with your deployment and let us know if you run into any problems so we can fix it before we change the default for everyone.
|
||||
|
||||
### 0.21.X
|
||||
|
||||
@@ -87,7 +87,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.8.7` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip] | `skip` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
|
||||
@@ -106,7 +106,7 @@ plugins:
|
||||
{{- if .Values.workloadAttestors.k8s.enabled }}
|
||||
k8s:
|
||||
plugin_data:
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
kubelet_ca_path: /hostCert/kubelet.crt
|
||||
{{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
|
||||
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
|
||||
@@ -74,13 +74,13 @@ spec:
|
||||
{{- toYaml .Values.hostAliases | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: gather-host-cert
|
||||
securityContext:
|
||||
{{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.hostCert.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.hostCert.image.pullPolicy }}
|
||||
command: ["bash", "-xec"]
|
||||
command: ["bash", "-xc"]
|
||||
args:
|
||||
- |
|
||||
{{- if ne .Values.workloadAttestors.k8s.verification.hostCert.fileName "" }}
|
||||
@@ -91,11 +91,34 @@ spec:
|
||||
elif [ -f "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" ]; then
|
||||
openssl x509 -in "{{ .Values.workloadAttestors.k8s.verification.hostCert.basePath }}/kubelet.crt" -out /hostCert/kubelet.crt
|
||||
else
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
|
||||
{{- if $cbh }}
|
||||
URL="https://$NODE_NAME:10250/spec/"
|
||||
{{- else }}
|
||||
URL="https://localhost:10250/spec/"
|
||||
{{- end }}
|
||||
curl --caPath /var/run/secrets/kubernetes.io/serviceaccount/ca.crt "$URL"
|
||||
if [ $? -eq 0 ]; then
|
||||
echo Mode detected as apiServerCA.
|
||||
ln -s /var/run/secrets/kubernetes.io/serviceaccount/ca.crt /hostCert/kubelet.crt
|
||||
exit 0
|
||||
fi
|
||||
{{- end }}
|
||||
echo Could not find certificate.
|
||||
exit 1
|
||||
fi
|
||||
{{- end }}
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "auto" }}
|
||||
echo Mode detected as hostCert.
|
||||
{{- end }}
|
||||
chmod 644 /hostCert/kubelet.crt
|
||||
env:
|
||||
{{- if $cbh }}
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: host-cert-isolated
|
||||
mountPath: /hostCert
|
||||
@@ -249,7 +272,7 @@ spec:
|
||||
readOnly: false
|
||||
- name: spire-token
|
||||
mountPath: /var/run/secrets/tokens
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: host-cert-isolated
|
||||
mountPath: /hostCert
|
||||
readOnly: true
|
||||
@@ -336,7 +359,7 @@ spec:
|
||||
path: /dev/kmsg
|
||||
type: CharDevice
|
||||
{{- end }}
|
||||
{{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }}
|
||||
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
||||
- name: host-cert-isolated
|
||||
emptyDir: {}
|
||||
- name: host-cert
|
||||
|
||||
@@ -207,7 +207,7 @@ workloadAttestors:
|
||||
## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
|
||||
enabled: true
|
||||
verification:
|
||||
## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip]
|
||||
## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip]
|
||||
type: skip
|
||||
hostCert:
|
||||
## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates
|
||||
|
||||
Reference in New Issue
Block a user