Upgrade SPIRE to 1.10.3 (#412)
* Update SPIRE to 1.10.3 Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -3,7 +3,7 @@ name: spire-agent
|
||||
description: A Helm chart to install the SPIRE agent.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.10.1"
|
||||
appVersion: "1.10.3"
|
||||
keywords: ["spiffe", "spire-agent"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -73,6 +73,10 @@ A Helm chart to install the SPIRE agent.
|
||||
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
@@ -139,4 +143,4 @@ A Helm chart to install the SPIRE agent.
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
|
||||
@@ -32,7 +32,7 @@ agent:
|
||||
authorized_delegates:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data_dir: "/run/spire"
|
||||
data_dir: "/var/lib/spire"
|
||||
log_level: {{ .Values.logLevel | quote }}
|
||||
retry_bootstrap: true
|
||||
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
||||
@@ -79,6 +79,20 @@ plugins:
|
||||
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.httpChallenge }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
http_challenge:
|
||||
plugin_data:
|
||||
agentname: {{ .agentname | quote }}
|
||||
{{- if ne (int .port) 0 }}
|
||||
port: {{ .port }}
|
||||
{{- end }}
|
||||
{{- if ne (int .advertisedPort) 0 }}
|
||||
advertisedPort: {{ .advertisedPort }}
|
||||
{{- end }}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.tpmDirect }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
tpm:
|
||||
|
||||
@@ -165,6 +165,15 @@ nodeAttestor:
|
||||
k8sPsat:
|
||||
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
|
||||
enabled: true
|
||||
httpChallenge:
|
||||
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
|
||||
agentname: default
|
||||
## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
|
||||
port: 0
|
||||
## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
|
||||
advertisedPort: 0
|
||||
tpmDirect:
|
||||
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
|
||||
enabled: false
|
||||
@@ -374,7 +383,7 @@ sockets:
|
||||
mountOnHost: false
|
||||
|
||||
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
|
||||
## @param persistence.hostPath Which path to use on the host when type = hostPath
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
##
|
||||
persistence:
|
||||
type: emptyDir
|
||||
|
||||
Reference in New Issue
Block a user