From 7df063f8db1150b03c09c8176bcd56c491986da2 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Wed, 4 Sep 2024 13:16:50 -0700 Subject: [PATCH] Upgrade SPIRE to 1.10.3 (#412) * Update SPIRE to 1.10.3 Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-agent/README.md Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Incorperate feedback Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire-nested/Chart.yaml | 2 +- charts/spire-nested/README.md | 45 ++++++++++--------- charts/spire-nested/values.yaml | 9 ++++ charts/spire/Chart.yaml | 2 +- charts/spire/README.md | 21 ++++----- .../spiffe-oidc-discovery-provider/Chart.yaml | 2 +- charts/spire/charts/spire-agent/Chart.yaml | 2 +- charts/spire/charts/spire-agent/README.md | 6 ++- .../spire-agent/templates/configmap.yaml | 16 ++++++- charts/spire/charts/spire-agent/values.yaml | 11 ++++- charts/spire/charts/spire-server/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 7 ++- .../spire-server/templates/configmap.yaml | 17 ++++++- charts/spire/charts/spire-server/values.yaml | 13 +++++- charts/spire/values.yaml | 3 ++ 15 files changed, 116 insertions(+), 42 deletions(-) diff --git a/charts/spire-nested/Chart.yaml b/charts/spire-nested/Chart.yaml index 3a70cc8..69f15a9 100644 --- a/charts/spire-nested/Chart.yaml +++ b/charts/spire-nested/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.22.0 -appVersion: "1.10.1" +appVersion: "1.10.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire-nested/README.md b/charts/spire-nested/README.md index 06527ee..f898029 100644 --- a/charts/spire-nested/README.md +++ b/charts/spire-nested/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) +![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -236,32 +236,35 @@ Now you can interact with the Spire agent socket from your own application. The ### Spire agent parameters -| Name | Description | Value | -| ------------------------------------------------- | ------------------------------------------------------------- | ------------------------- | -| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | -| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` | -| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` | +| Name | Description | Value | +| -------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------- | +| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | +| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` | +| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` | +| `downstream-spire-agent-full.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` | ### Spire agent parameters -| Name | Description | Value | -| ----------------------------------------------------- | ------------------------------------------------------------- | ----------------------- | -| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | -| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` | -| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` | +| Name | Description | Value | +| ------------------------------------------------------ | -------------------------------------------------------------- | ------------------------------------- | +| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | +| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` | +| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` | +| `downstream-spire-agent-security.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` | ### Upstream Spire agent parameters -| Name | Description | Value | -| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | -| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | -| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | -| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | -| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | -| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | -| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | -| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | -| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| Name | Description | Value | +| ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- | +| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | +| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | +| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | +| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | +| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | +| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | +| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | +| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | +| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` | ### SPIFFE CSI Driver parameters diff --git a/charts/spire-nested/values.yaml b/charts/spire-nested/values.yaml index 00bc805..f7c9549 100644 --- a/charts/spire-nested/values.yaml +++ b/charts/spire-nested/values.yaml @@ -117,6 +117,9 @@ downstream-spire-agent-full: nameOverride: internal-server ## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle bundleConfigMap: spire-bundle-downstream + ## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath + persistence: + hostPath: /var/lib/spire/k8s/downstream-agent ## @section Spire agent parameters ## Parameter values for Spire agent @@ -131,6 +134,9 @@ downstream-spire-agent-security: serviceAccount: ## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use name: spire-agent-upstream + ## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath + persistence: + hostPath: /var/lib/spire/k8s/downstream-agent ## @section Upstream Spire agent parameters ## Parameter values for upstream Spire agent @@ -159,6 +165,9 @@ upstream-spire-agent: server: ## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server nameOverride: root-server + ## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath + persistence: + hostPath: /var/lib/spire/k8s/upstream-agent ## @section SPIFFE CSI Driver parameters ## Parameter values for spiffe-csi-driver diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index 1ed2a92..bea920d 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application version: 0.22.0 -appVersion: "1.10.1" +appVersion: "1.10.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/README.md b/charts/spire/README.md index d4914f2..3d17703 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -1,6 +1,6 @@ # spire -![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) +![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. @@ -306,15 +306,16 @@ Now you can interact with the Spire agent socket from your own application. The ### Upstream Spire agent parameters -| Name | Description | Value | -| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | -| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | -| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | -| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | -| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | -| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | -| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | -| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | +| Name | Description | Value | +| ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- | +| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | +| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | +| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | +| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | +| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | +| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | +| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | +| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` | ### SPIFFE CSI Driver parameters diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml index 15673aa..05f64e9 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml @@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider description: A Helm chart to install the SPIFFE OIDC discovery provider. type: application version: 0.1.0 -appVersion: "1.10.1" +appVersion: "1.10.3" keywords: ["spiffe", "oidc"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/Chart.yaml b/charts/spire/charts/spire-agent/Chart.yaml index 580d8bf..234a5ca 100644 --- a/charts/spire/charts/spire-agent/Chart.yaml +++ b/charts/spire/charts/spire-agent/Chart.yaml @@ -3,7 +3,7 @@ name: spire-agent description: A Helm chart to install the SPIRE agent. type: application version: 0.1.0 -appVersion: "1.10.1" +appVersion: "1.10.3" keywords: ["spiffe", "spire-agent"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 1816049..a662ace 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -73,6 +73,10 @@ A Helm chart to install the SPIRE agent. | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | +| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | +| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | +| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | +| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` | @@ -139,4 +143,4 @@ A Helm chart to install the SPIRE agent. | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | -| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` | +| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 34b1a64..d659ce7 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -32,7 +32,7 @@ agent: authorized_delegates: {{- toYaml . | nindent 4 }} {{- end }} - data_dir: "/run/spire" + data_dir: "/var/lib/spire" log_level: {{ .Values.logLevel | quote }} retry_bootstrap: true server_address: {{ include "spire-agent.server-address" . | trim | quote }} @@ -79,6 +79,20 @@ plugins: cluster: {{ include "spire-lib.cluster-name" . | quote }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} + {{- with .Values.nodeAttestor.httpChallenge }} + {{- if eq (.enabled | toString) "true" }} + http_challenge: + plugin_data: + agentname: {{ .agentname | quote }} + {{- if ne (int .port) 0 }} + port: {{ .port }} + {{- end }} + {{- if ne (int .advertisedPort) 0 }} + advertisedPort: {{ .advertisedPort }} + {{- end }} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} + {{- end }} {{- with .Values.nodeAttestor.tpmDirect }} {{- if eq (.enabled | toString) "true" }} tpm: diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 628467d..ddca079 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -165,6 +165,15 @@ nodeAttestor: k8sPsat: ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor enabled: true + httpChallenge: + ## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor + enabled: false + ## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. + agentname: default + ## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used. + port: 0 + ## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. + advertisedPort: 0 tpmDirect: ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. enabled: false @@ -374,7 +383,7 @@ sockets: mountOnHost: false ## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) -## @param persistence.hostPath Which path to use on the host when type = hostPath +## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath ## persistence: type: emptyDir diff --git a/charts/spire/charts/spire-server/Chart.yaml b/charts/spire/charts/spire-server/Chart.yaml index 3338308..13be7fc 100644 --- a/charts/spire/charts/spire-server/Chart.yaml +++ b/charts/spire/charts/spire-server/Chart.yaml @@ -3,7 +3,7 @@ name: spire-server description: A Helm chart to install the SPIRE server. type: application version: 0.1.0 -appVersion: "1.10.1" +appVersion: "1.10.3" keywords: ["spiffe", "spire-server", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 6cbd0cd..836c534 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -124,7 +124,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `persistence.size` | What size volume to use for persistence | `1Gi` | | `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | | `persistence.storageClass` | What storage class to use for persistence | `nil` | -| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` | +| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` | | `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | | `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | @@ -339,6 +339,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | +| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` | +| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` | +| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` | +| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` | +| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5cc1e4b..c43f358 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -103,7 +103,7 @@ plugins: plugin_data: {{ include "spire-server.datastore-config" . | nindent 10 }} - {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }} + {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} @@ -150,6 +150,21 @@ plugins: plugin_data: {} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.httpChallenge }} + {{- if eq (.enabled | toString) "true" }} + http_challenge: + plugin_data: + {{- with .allowedDNSPatterns }} + allowed_dns_patterns: + {{ toYaml . | nindent 10 }} + {{- end }} + {{- if ne (int .requiredPort) 0 }} + required_port: {{ .requiredPort }} + {{- end }} + allow_non_root_ports: {{ .allowNonRootPorts }} + tofu: {{ .tofu }} + {{- end }} + {{- end }} {{- with .Values.nodeAttestor.tpmDirect }} {{- if eq (.enabled | toString) "true" }} tpm: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 9d2eece..19e8f4a 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -144,7 +144,7 @@ readinessProbe: ## @param persistence.size What size volume to use for persistence ## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) ## @param persistence.storageClass What storage class to use for persistence -## @param persistence.hostPath Which path to use on the host when type = hostPath +## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath ## persistence: type: pvc @@ -827,6 +827,17 @@ nodeAttestor: joinToken: ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor enabled: false + httpChallenge: + ## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto + enabled: false + ## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. + allowedDNSPatterns: [] + ## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed + requiredPort: 0 + ## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation + allowNonRootPorts: true + ## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 + tofu: true tpmDirect: ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. enabled: false diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index fa805b7..bb76fee 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -183,6 +183,9 @@ upstream-spire-agent: prometheus: ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available port: 9989 + ## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath + persistence: + hostPath: /var/lib/spire/k8s/upstream-agent ## @section SPIFFE CSI Driver parameters ## Parameter values for spiffe-csi-driver