Support hybrid nodes with different attestors or config (#218)

* Add direct tpm support for spire-agent

Signed-off-by: Kevin Fox <[email protected]>

* Add fingerprinting support

Signed-off-by: Kevin Fox <[email protected]>

* Add example

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Support hybrid nodes with different attestors

In some clusters, you may have a mix of nodes with differing attestor
needs. For example, some nodes have hardware TPMs and some without.
This patch enables configuring multiple daemonsets for the agent
that you can target to pools of nodes.

Signed-off-by: Kevin Fox <[email protected]>

* Remove extra slash

Signed-off-by: Kevin Fox <[email protected]>

* Update docs

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/templates/configmap.yaml

Signed-off-by: kfox1111 <[email protected]>

* Fix broken tests

Signed-off-by: Kevin Fox <[email protected]>

* Add daemonset labels

Signed-off-by: Kevin Fox <[email protected]>

* Add temporary upgrade hook

Signed-off-by: Kevin Fox <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Fix include

Signed-off-by: Kevin Fox <[email protected]>

* Add missing values

Signed-off-by: Kevin Fox <[email protected]>

* Fix perms, add upgrade note

Signed-off-by: Kevin Fox <[email protected]>

* Fix hardcoded nodeAttestor and keyManager in spire-agent

Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge issues

Signed-off-by: Kevin Fox <[email protected]>

* Fix unit tests

Signed-off-by: Kevin Fox <[email protected]>

* Pass the agent's securityContext on to Kubernetes

Currently its ignored.

Signed-off-by: Kevin Fox <[email protected]>

* Update example to be usable

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Update example

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Fix merge conflict issue

Signed-off-by: Kevin Fox <[email protected]>

* Update to the newest release

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix version numbers in docs

Signed-off-by: Kevin Fox <[email protected]>

* Remove merge conflicted extra code

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>

charts/spire/README.md

@@ -75,7 +75,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
 
 We only support upgrading one major version at a time. Version skipping isn't supported.
 
-### 0.18.x
+### 0.19.X
+
+- The spire-agent daemonset gained a new label. For those disabling the upgrade hooks, you need to delete the spire-agent daemonset before issuing the helm upgrade.
+
+### 0.18.X
 
 - SPIRE no longer emits x509UniqueIdentifiers in x509-SVIDS by default. The old behavior can be reenabled with spire-server.credentialComposer.uniqueID.enabled=true. See https://github.com/spiffe/spire/pull/4862 for details.
 - SPIRE agents will now automatically reattest when they can. The old behavior can be reenabled with spire-agent.disableReattestToRenew=true. See https://github.com/spiffe/spire/pull/4791 for details.