Upgrade SPIRE to 1.10.3 (#412)
* Update SPIRE to 1.10.3 Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
type: application
|
||||
version: 0.22.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
+11
-10
@@ -1,6 +1,6 @@
|
||||
# spire
|
||||
|
||||
  
|
||||
  
|
||||
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
@@ -306,15 +306,16 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
|
||||
### Upstream Spire agent parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
|
||||
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
|
||||
|
||||
### SPIFFE CSI Driver parameters
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
|
||||
description: A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "oidc"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -73,6 +73,10 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
@@ -139,4 +143,4 @@ A Helm chart to install the SPIRE agent.
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
|
||||
@@ -32,7 +32,7 @@ agent:
|
||||
authorized_delegates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data_dir: "/run/spire"
|
||||
data_dir: "/var/lib/spire"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
retry_bootstrap: true
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
@@ -79,6 +79,20 @@ plugins:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.httpChallenge }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
http_challenge:
|
||||
plugin_data:
|
||||
agentname: {{ .agentname | quote }}
|
||||
{{- if ne (int .port) 0 }}
|
||||
port: {{ .port }}
|
||||
{{- end }}
|
||||
{{- if ne (int .advertisedPort) 0 }}
|
||||
advertisedPort: {{ .advertisedPort }}
|
||||
{{- end }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.tpmDirect }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
tpm:
|
||||
|
||||
@@ -165,6 +165,15 @@ nodeAttestor:
|
||||
k8sPsat:
|
||||
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
|
||||
enabled: true
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
|
||||
agentname: default
|
||||
## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
|
||||
port: 0
|
||||
## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
|
||||
advertisedPort: 0
|
||||
tpmDirect:
|
||||
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
|
||||
enabled: false
|
||||
@@ -374,7 +383,7 @@ sockets:
|
||||
mountOnHost: false
|
||||
|
||||
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
|
||||
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
##
|
||||
persistence:
|
||||
type: emptyDir
|
||||
|
||||
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -124,7 +124,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
|
||||
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
|
||||
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
|
||||
@@ -339,6 +339,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
|
||||
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
|
||||
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
|
||||
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
|
||||
|
||||
@@ -103,7 +103,7 @@ plugins:
|
||||
plugin_data:
|
||||
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -150,6 +150,21 @@ plugins:
|
||||
plugin_data: {}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.httpChallenge }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
http_challenge:
|
||||
plugin_data:
|
||||
{{- with .allowedDNSPatterns }}
|
||||
allowed_dns_patterns:
|
||||
{{ toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if ne (int .requiredPort) 0 }}
|
||||
required_port: {{ .requiredPort }}
|
||||
{{- end }}
|
||||
allow_non_root_ports: {{ .allowNonRootPorts }}
|
||||
tofu: {{ .tofu }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.tpmDirect }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
tpm:
|
||||
|
||||
@@ -144,7 +144,7 @@ readinessProbe:
|
||||
## @param persistence.size What size volume to use for persistence
|
||||
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
|
||||
## @param persistence.storageClass What storage class to use for persistence
|
||||
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
##
|
||||
persistence:
|
||||
type: pvc
|
||||
@@ -827,6 +827,17 @@ nodeAttestor:
|
||||
joinToken:
|
||||
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||
enabled: false
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
|
||||
enabled: false
|
||||
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
|
||||
allowedDNSPatterns: []
|
||||
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
|
||||
requiredPort: 0
|
||||
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
|
||||
allowNonRootPorts: true
|
||||
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
|
||||
tofu: true
|
||||
tpmDirect:
|
||||
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
|
||||
enabled: false
|
||||
|
||||
@@ -183,6 +183,9 @@ upstream-spire-agent:
|
||||
prometheus:
|
||||
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
||||
port: 9989
|
||||
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
persistence:
|
||||
hostPath: /var/lib/spire/k8s/upstream-agent
|
||||
|
||||
## @section SPIFFE CSI Driver parameters
|
||||
## Parameter values for spiffe-csi-driver
|
||||
|
||||
Reference in New Issue
Block a user