Support hybrid nodes with different attestors or config (#218)
* Add direct tpm support for spire-agent Signed-off-by: Kevin Fox <[email protected]> * Add fingerprinting support Signed-off-by: Kevin Fox <[email protected]> * Add example Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Support hybrid nodes with different attestors In some clusters, you may have a mix of nodes with differing attestor needs. For example, some nodes have hardware TPMs and some without. This patch enables configuring multiple daemonsets for the agent that you can target to pools of nodes. Signed-off-by: Kevin Fox <[email protected]> * Remove extra slash Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Fix broken tests Signed-off-by: Kevin Fox <[email protected]> * Add daemonset labels Signed-off-by: Kevin Fox <[email protected]> * Add temporary upgrade hook Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix include Signed-off-by: Kevin Fox <[email protected]> * Add missing values Signed-off-by: Kevin Fox <[email protected]> * Fix perms, add upgrade note Signed-off-by: Kevin Fox <[email protected]> * Fix hardcoded nodeAttestor and keyManager in spire-agent Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220 Signed-off-by: Kevin Fox <[email protected]> * Fix merge issues Signed-off-by: Kevin Fox <[email protected]> * Fix unit tests Signed-off-by: Kevin Fox <[email protected]> * Pass the agent's securityContext on to Kubernetes Currently its ignored. Signed-off-by: Kevin Fox <[email protected]> * Update example to be usable Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Update example Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict issue Signed-off-by: Kevin Fox <[email protected]> * Update to the newest release Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix version numbers in docs Signed-off-by: Kevin Fox <[email protected]> * Remove merge conflicted extra code Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -126,6 +126,12 @@ A Helm chart to install the SPIRE agent.
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `installAndUpgradeHook.enabled` | Enable Helm hook to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
|
||||
Reference in New Issue
Block a user