panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Upgrade SPIRE to 1.10.3 (#412)

Browse Source 
* Update SPIRE to 1.10.3

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/README.md

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-09-04 13:16:50 -07:00
committed by GitHub
co-authored by Faisal Memon
parent de5ec47613
commit 7df063f8db
15 changed files with 116 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire-nested/Chart.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.22.0 version: 0.22.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire-nested/README.md
+24 -21
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) ![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -236,32 +236,35 @@ Now you can interact with the Spire agent socket from your own application. The
### Spire agent parameters ### Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------- | ------------------------------------------------------------- | ------------------------- | | -------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------- |
| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | | `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` | | `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` | | `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` |
| `downstream-spire-agent-full.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
### Spire agent parameters ### Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ----------------------------------------------------- | ------------------------------------------------------------- | ----------------------- | | ------------------------------------------------------ | -------------------------------------------------------------- | ------------------------------------- |
| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` | | `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` | | `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` |
| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` | | `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` |
| `downstream-spire-agent-security.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/downstream-agent` |
### Upstream Spire agent parameters ### Upstream Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | | ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | | `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | | `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | | `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | | `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | | `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | | `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | | `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` | | `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
### SPIFFE CSI Driver parameters ### SPIFFE CSI Driver parameters
charts/spire-nested/values.yaml
+9
View File
@@ -117,6 +117,9 @@ downstream-spire-agent-full:
nameOverride: internal-server nameOverride: internal-server
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle ## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
bundleConfigMap: spire-bundle-downstream bundleConfigMap: spire-bundle-downstream
## @param downstream-spire-agent-full.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Spire agent parameters ## @section Spire agent parameters
## Parameter values for Spire agent ## Parameter values for Spire agent
@@ -131,6 +134,9 @@ downstream-spire-agent-security:
serviceAccount: serviceAccount:
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use ## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
name: spire-agent-upstream name: spire-agent-upstream
## @param downstream-spire-agent-security.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/downstream-agent
## @section Upstream Spire agent parameters ## @section Upstream Spire agent parameters
## Parameter values for upstream Spire agent ## Parameter values for upstream Spire agent
@@ -159,6 +165,9 @@ upstream-spire-agent:
server: server:
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server ## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
nameOverride: root-server nameOverride: root-server
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters ## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver ## Parameter values for spiffe-csi-driver
charts/spire/Chart.yaml
+1 -1
View File
@@ -4,7 +4,7 @@ description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.22.0 version: 0.22.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/README.md
+11 -10
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.1](https://img.shields.io/badge/AppVersion-1.10.1-informational?style=flat-square) ![Version: 0.22.0](https://img.shields.io/badge/Version-0.22.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.10.3](https://img.shields.io/badge/AppVersion-1.10.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -306,15 +306,16 @@ Now you can interact with the Spire agent socket from your own application. The
### Upstream Spire agent parameters ### Upstream Spire agent parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- | | ------------------------------------------------ | -------------------------------------------------------------- | ---------------------------------------------------- |
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` | | `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` | | `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` | | `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` | | `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` | | `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` | | `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` | | `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
| `upstream-spire-agent.persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/upstream-agent` |
### SPIFFE CSI Driver parameters ### SPIFFE CSI Driver parameters
charts/spire/charts/spiffe-oidc-discovery-provider/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spiffe-oidc-discovery-provider
description: A Helm chart to install the SPIFFE OIDC discovery provider. description: A Helm chart to install the SPIFFE OIDC discovery provider.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "oidc"] keywords: ["spiffe", "oidc"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-agent
description: A Helm chart to install the SPIRE agent. description: A Helm chart to install the SPIRE agent.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire-agent"] keywords: ["spiffe", "spire-agent"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-agent/README.md
+5 -1
View File
@@ -73,6 +73,10 @@ A Helm chart to install the SPIRE agent.
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s Node Attestor | `true` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-agent` |
@@ -139,4 +143,4 @@ A Helm chart to install the SPIRE agent.
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | | `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `/var/lib/spire/k8s/agent` | | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+15 -1
View File
@@ -32,7 +32,7 @@ agent:
authorized_delegates: authorized_delegates:
{{- toYaml . | nindent 4 }} {{- toYaml . | nindent 4 }}
{{- end }} {{- end }}
data_dir: "/run/spire" data_dir: "/var/lib/spire"
log_level: {{ .Values.logLevel | quote }} log_level: {{ .Values.logLevel | quote }}
retry_bootstrap: true retry_bootstrap: true
server_address: {{ include "spire-agent.server-address" . | trim | quote }} server_address: {{ include "spire-agent.server-address" . | trim | quote }}
@@ -79,6 +79,20 @@ plugins:
cluster: {{ include "spire-lib.cluster-name" . | quote }} cluster: {{ include "spire-lib.cluster-name" . | quote }}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }} {{- end }}
{{- with .Values.nodeAttestor.httpChallenge }}
{{- if eq (.enabled | toString) "true" }}
http_challenge:
plugin_data:
agentname: {{ .agentname | quote }}
{{- if ne (int .port) 0 }}
port: {{ .port }}
{{- end }}
{{- if ne (int .advertisedPort) 0 }}
advertisedPort: {{ .advertisedPort }}
{{- end }}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }}
{{- end }}
{{- with .Values.nodeAttestor.tpmDirect }} {{- with .Values.nodeAttestor.tpmDirect }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
tpm: tpm:
charts/spire/charts/spire-agent/values.yaml
+10 -1
View File
@@ -165,6 +165,15 @@ nodeAttestor:
k8sPsat: k8sPsat:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s Node Attestor
enabled: true enabled: true
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http challenge Node Attestor
enabled: false
## @param nodeAttestor.httpChallenge.agentname Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port.
agentname: default
## @param nodeAttestor.httpChallenge.port The port to listen on. If 0, a random value will be used.
port: 0
## @param nodeAttestor.httpChallenge.advertisedPort The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting.
advertisedPort: 0
tpmDirect: tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false enabled: false
@@ -374,7 +383,7 @@ sockets:
mountOnHost: false mountOnHost: false
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) ## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
## @param persistence.hostPath Which path to use on the host when type = hostPath ## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
## ##
persistence: persistence:
type: emptyDir type: emptyDir
charts/spire/charts/spire-server/Chart.yaml
+1 -1
View File
@@ -3,7 +3,7 @@ name: spire-server
description: A Helm chart to install the SPIRE server. description: A Helm chart to install the SPIRE server.
type: application type: application
version: 0.1.0 version: 0.1.0
appVersion: "1.10.1" appVersion: "1.10.3"
keywords: ["spiffe", "spire-server", "spire-controller-manager"] keywords: ["spiffe", "spire-server", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
sources: sources:
charts/spire/charts/spire-server/README.md
+6 -1
View File
@@ -124,7 +124,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `persistence.size` | What size volume to use for persistence | `1Gi` | | `persistence.size` | What size volume to use for persistence | `1Gi` |
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | | `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
| `persistence.storageClass` | What storage class to use for persistence | `nil` | | `persistence.storageClass` | What storage class to use for persistence | `nil` |
| `persistence.hostPath` | Which path to use on the host when type = hostPath | `""` | | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
| `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` | | `dataStore.sql.databaseType` | Other supported databases are "postgres" and "mysql" | `sqlite3` |
| `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.databaseName` | Only used by "postgres" or "mysql" | `spire` |
| `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.host` | Only used by "postgres" or "mysql" | `""` |
@@ -339,6 +339,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPsat.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
| `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.externalK8sPsat.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
| `nodeAttestor.httpChallenge.allowedDNSPatterns` | A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed. | `[]` |
| `nodeAttestor.httpChallenge.requiredPort` | Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed | `0` |
| `nodeAttestor.httpChallenge.allowNonRootPorts` | Allow using ports >= 1024 from clients for attestation | `true` |
| `nodeAttestor.httpChallenge.tofu` | Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024 | `true` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` | | `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` | | `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
charts/spire/charts/spire-server/templates/configmap.yaml
+16 -1
View File
@@ -103,7 +103,7 @@ plugins:
plugin_data: plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }} {{ include "spire-server.datastore-config" . | nindent 10 }}
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }} {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.externalK8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
NodeAttestor: NodeAttestor:
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }} {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPsat.clusters }}
{{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }} {{- if or (eq (.Values.nodeAttestor.k8sPsat.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPsat.enabled | toString) "true") (gt (len $clusters) 0)) }}
@@ -150,6 +150,21 @@ plugins:
plugin_data: {} plugin_data: {}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- with .Values.nodeAttestor.httpChallenge }}
{{- if eq (.enabled | toString) "true" }}
http_challenge:
plugin_data:
{{- with .allowedDNSPatterns }}
allowed_dns_patterns:
{{ toYaml . | nindent 10 }}
{{- end }}
{{- if ne (int .requiredPort) 0 }}
required_port: {{ .requiredPort }}
{{- end }}
allow_non_root_ports: {{ .allowNonRootPorts }}
tofu: {{ .tofu }}
{{- end }}
{{- end }}
{{- with .Values.nodeAttestor.tpmDirect }} {{- with .Values.nodeAttestor.tpmDirect }}
{{- if eq (.enabled | toString) "true" }} {{- if eq (.enabled | toString) "true" }}
tpm: tpm:
charts/spire/charts/spire-server/values.yaml
+12 -1
View File
@@ -144,7 +144,7 @@ readinessProbe:
## @param persistence.size What size volume to use for persistence ## @param persistence.size What size volume to use for persistence
## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) ## @param persistence.accessMode What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended)
## @param persistence.storageClass What storage class to use for persistence ## @param persistence.storageClass What storage class to use for persistence
## @param persistence.hostPath Which path to use on the host when type = hostPath ## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
## ##
persistence: persistence:
type: pvc type: pvc
@@ -827,6 +827,17 @@ nodeAttestor:
joinToken: joinToken:
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: false enabled: false
httpChallenge:
## @param nodeAttestor.httpChallenge.enabled Enable the http_challenge nodeattesto
enabled: false
## @param nodeAttestor.httpChallenge.allowedDNSPatterns A list of regular expressions to match to the hostname being attested. If none match, attestation will fail. If a blank list, all hostnames are allowed.
allowedDNSPatterns: []
## @param nodeAttestor.httpChallenge.requiredPort Set to a port number to require clients to listen only on that port. If 0, all port numbers are allowed
requiredPort: 0
## @param nodeAttestor.httpChallenge.allowNonRootPorts Allow using ports >= 1024 from clients for attestation
allowNonRootPorts: true
## @param nodeAttestor.httpChallenge.tofu Trust on first use of the successful challenge. Can only be disabled if allowNonRootPorts=false or requiredPort < 1024
tofu: true
tpmDirect: tpmDirect:
## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
enabled: false enabled: false
charts/spire/values.yaml
+3
View File
@@ -183,6 +183,9 @@ upstream-spire-agent:
prometheus: prometheus:
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available ## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
port: 9989 port: 9989
## @param upstream-spire-agent.persistence.hostPath Which path to use on the host when persistence.type = hostPath
persistence:
hostPath: /var/lib/spire/k8s/upstream-agent
## @section SPIFFE CSI Driver parameters ## @section SPIFFE CSI Driver parameters
## Parameter values for spiffe-csi-driver ## Parameter values for spiffe-csi-driver