From 813203a4d22bbccfbcac9173ea2814e8fa388d69 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Fri, 23 Jan 2026 12:32:18 -0800 Subject: [PATCH] Update spike to the newest version (#665) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Update spike bits Signed-off-by: Kevin Fox * Update Signed-off-by: Kevin Fox * Update Signed-off-by: Kevin Fox * Add trust roots. SPIKE SDK uses the appropriate trust root from the environment which makes SDK usage easier, but it requires additional env vars on the pod meta. Signed-off-by: Volkan Özçelik * Chart updates to make it work with the new SDK changes of SPIKE. Signed-off-by: Volkan Özçelik * Making the self-reference more evident. Signed-off-by: Volkan Özçelik * Documentation update. Signed-off-by: Volkan Özçelik * Documentation update. Signed-off-by: Volkan Özçelik * updates to align with recent SPIKE. * SPIKE assumes all trust roots can be arrays (for distributed setups), modified values accordingly. * Added cross-references between bootstrap and keeper job/statefulsets for PoP validation to work. * other possible minor updates. Signed-off-by: Volkan Özçelik * minor changes. Signed-off-by: Volkan Özçelik * Update docs --------- Signed-off-by: Kevin Fox Signed-off-by: Volkan Özçelik Co-authored-by: Volkan Özçelik Co-authored-by: Faisal Memon --- charts/spire/charts/spike-keeper/Chart.yaml | 2 +- charts/spire/charts/spike-keeper/README.md | 4 +- .../spike-keeper/templates/statefulset.yaml | 7 +- charts/spire/charts/spike-keeper/values.yaml | 8 +- charts/spire/charts/spike-nexus/Chart.yaml | 2 +- charts/spire/charts/spike-nexus/README.md | 114 ++++++++-------- .../spike-nexus/templates/bootstrap-hook.yaml | 125 ++++++++++++++++++ .../spike-nexus/templates/statefulset.yaml | 9 +- charts/spire/charts/spike-nexus/values.yaml | 33 ++++- charts/spire/charts/spike-pilot/Chart.yaml | 2 +- charts/spire/charts/spike-pilot/README.md | 3 +- .../spike-pilot/templates/deployment.yaml | 4 +- charts/spire/charts/spike-pilot/values.yaml | 6 +- charts/spire/charts/spire-server/README.md | 7 +- .../controller-manager-cluster-ids.yaml | 9 +- charts/spire/charts/spire-server/values.yaml | 11 +- 16 files changed, 268 insertions(+), 78 deletions(-) create mode 100644 charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml diff --git a/charts/spire/charts/spike-keeper/Chart.yaml b/charts/spire/charts/spike-keeper/Chart.yaml index 7a31ec8..1955ed3 100644 --- a/charts/spire/charts/spike-keeper/Chart.yaml +++ b/charts/spire/charts/spike-keeper/Chart.yaml @@ -3,7 +3,7 @@ name: spike-keeper description: A Helm chart to deploy SPIKE Keeper type: application version: 0.1.0 -appVersion: "0.4.2" +appVersion: "0.5.0" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/spike diff --git a/charts/spire/charts/spike-keeper/README.md b/charts/spire/charts/spike-keeper/README.md index 2552edf..2287872 100644 --- a/charts/spire/charts/spike-keeper/README.md +++ b/charts/spire/charts/spike-keeper/README.md @@ -35,7 +35,9 @@ A Helm chart to deploy spike keepers | `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `replicas` | The number of keepers to launch | `3` | -| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` | +| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` | +| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` | +| `trustRoot.self` | Override which trustRoot(s) this Keeper instance is in (array) | `[]` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `csiDriverName` | The csi driver to use | `csi.spiffe.io` | diff --git a/charts/spire/charts/spike-keeper/templates/statefulset.yaml b/charts/spire/charts/spike-keeper/templates/statefulset.yaml index baf33f8..6af56c0 100644 --- a/charts/spire/charts/spike-keeper/templates/statefulset.yaml +++ b/charts/spire/charts/spike-keeper/templates/statefulset.yaml @@ -43,8 +43,13 @@ spec: value: {{ .Values.logLevel | upper }} - name: SPIKE_TRUST_ROOT value: {{ include "spire-lib.trust-domain" . }} + - name: SPIKE_TRUST_ROOT_KEEPER + value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} - name: SPIKE_TRUST_ROOT_NEXUS - value: {{if eq .Values.trustRoot.nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.nexus }}{{ end }} + value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + - name: SPIKE_TRUST_ROOT_BOOTSTRAP + value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + - name: SPIKE_KEEPER_TLS_PORT value: ":8443" {{- if .Values.startupProbe.enabled }} diff --git a/charts/spire/charts/spike-keeper/values.yaml b/charts/spire/charts/spike-keeper/values.yaml index 312280d..9f2fe16 100644 --- a/charts/spire/charts/spike-keeper/values.yaml +++ b/charts/spire/charts/spike-keeper/values.yaml @@ -21,8 +21,12 @@ image: replicas: 3 trustRoot: - ## @param trustRoot.nexus Override which trustRoot Nexus is in - nexus: "" + ## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array) + nexus: [] + ## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array) + bootstrap: [] + ## @param trustRoot.self Override which trustRoot(s) this Keeper instance is in (array) + self: [] ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: debug diff --git a/charts/spire/charts/spike-nexus/Chart.yaml b/charts/spire/charts/spike-nexus/Chart.yaml index 05fd4e1..d41e987 100644 --- a/charts/spire/charts/spike-nexus/Chart.yaml +++ b/charts/spire/charts/spike-nexus/Chart.yaml @@ -3,7 +3,7 @@ name: spike-nexus description: A Helm chart to deploy SPIKE Nexus type: application version: 0.1.0 -appVersion: "0.4.2" +appVersion: "0.5.0" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/spike diff --git a/charts/spire/charts/spike-nexus/README.md b/charts/spire/charts/spike-nexus/README.md index d7140a1..eb4be08 100644 --- a/charts/spire/charts/spike-nexus/README.md +++ b/charts/spire/charts/spike-nexus/README.md @@ -28,56 +28,64 @@ A Helm chart to deploy spike nexus ### Chart parameters -| Name | Description | Value | -| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- | -| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | -| `image.repository` | The repository within the registry | `spiffe/spike-nexus` | -| `image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | -| `backendStore` | The backend store to use. Must be one of [sqlite, memory, lite] | `sqlite` | -| `replicas` | The number of keepers to launch | `1` | -| `shamir.shares` | How many shares to configure for shamir secrets | `3` | -| `shamir.threshold` | How many shares needed to recover | `2` | -| `keeperPeers` | Keeper peer configuration. If blank, it will be autodetected | `[]` | -| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` | -| `trustRoot.keepers` | Override which trustRoot Keepers are in | `[]` | -| `trustRoot.pilot` | Override which trustRoot Pilot is in | `""` | -| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` | -| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | -| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | -| `imagePullSecrets` | Pull secrets for images | `[]` | -| `nameOverride` | Name override | `""` | -| `namespaceOverride` | Namespace override | `""` | -| `fullnameOverride` | Fullname override | `""` | -| `serviceAccount.create` | Specifies whether a service account should be created | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | -| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | -| `labels` | Labels for pods | `{}` | -| `podSecurityContext` | Pod security context | `{}` | -| `securityContext` | Security context | `{}` | -| `service.type` | Service type | `ClusterIP` | -| `service.port` | Service port | `443` | -| `service.annotations` | Annotations for service resource | `{}` | -| `nodeSelector` | (Optional) Select specific nodes to run on. | `{}` | -| `affinity` | Affinity rules | `{}` | -| `tolerations` | List of tolerations | `[]` | -| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | -| `startupProbe.enabled` | Enable startupProbe | `true` | -| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | -| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | -| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | -| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | -| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | -| `ingress.enabled` | Flag to enable ingress | `false` | -| `ingress.className` | Ingress class name | `""` | -| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | -| `ingress.annotations` | Annotations | `{}` | -| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `nexus` | -| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | -| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | -| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` | -| `persistence.size` | What size volume to use for persistence | `1Gi` | -| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | -| `persistence.storageClass` | What storage class to use for persistence | `nil` | -| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` | +| Name | Description | Value | +| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ | +| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `image.repository` | The repository within the registry | `spiffe/spike-nexus` | +| `image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `bootstrap.force` | Force bootstrapping | `false` | +| `bootstrap.image.registry` | The OCI registry to pull the image from | `ghcr.io` | +| `bootstrap.image.repository` | The repository within the registry | `spiffe/spike-bootstrap` | +| `bootstrap.image.pullPolicy` | The image pull policy | `IfNotPresent` | +| `bootstrap.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | +| `installAndUpgradeHook.enabled` | Enable Helm hook to bootstrap | `true` | +| `backendStore` | The backend store to use. Must be one of [sqlite, memory, lite] | `sqlite` | +| `replicas` | The number of keepers to launch | `1` | +| `shamir.shares` | How many shares to configure for shamir secrets | `3` | +| `shamir.threshold` | How many shares needed to recover | `2` | +| `keeperPeers` | Keeper peer configuration. If blank, it will be autodetected | `[]` | +| `trustRoot.self` | Override which trustRoot(s) this SPIKE Nexus instance is in (array) | `[]` | +| `trustRoot.keeper` | Override which trustRoot(s) Keeper is in (array) | `[]` | +| `trustRoot.pilot` | Override which trustRoot(s) Pilot is in (array) | `[]` | +| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` | +| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` | +| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` | +| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | +| `csiDriverName` | The csi driver to use | `csi.spiffe.io` | +| `imagePullSecrets` | Pull secrets for images | `[]` | +| `nameOverride` | Name override | `""` | +| `namespaceOverride` | Namespace override | `""` | +| `fullnameOverride` | Fullname override | `""` | +| `serviceAccount.create` | Specifies whether a service account should be created | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | +| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` | +| `labels` | Labels for pods | `{}` | +| `podSecurityContext` | Pod security context | `{}` | +| `securityContext` | Security context | `{}` | +| `service.type` | Service type | `ClusterIP` | +| `service.port` | Service port | `443` | +| `service.annotations` | Annotations for service resource | `{}` | +| `nodeSelector` | (Optional) Select specific nodes to run on. | `{}` | +| `affinity` | Affinity rules | `{}` | +| `tolerations` | List of tolerations | `[]` | +| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` | +| `startupProbe.enabled` | Enable startupProbe | `true` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` | +| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` | +| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` | +| `ingress.enabled` | Flag to enable ingress | `false` | +| `ingress.className` | Ingress class name | `""` | +| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` | +| `ingress.annotations` | Annotations | `{}` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `nexus` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` | +| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` | +| `persistence.size` | What size volume to use for persistence | `1Gi` | +| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` | +| `persistence.storageClass` | What storage class to use for persistence | `nil` | +| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` | diff --git a/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml new file mode 100644 index 0000000..b272d44 --- /dev/null +++ b/charts/spire/charts/spike-nexus/templates/bootstrap-hook.yaml @@ -0,0 +1,125 @@ +{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap + namespace: {{ include "spike-nexus.namespace" . }} + labels: + {{- include "spike-nexus.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": "post-install,post-upgrade" + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "spike-nexus.fullname" . }}-bootstrap + namespace: {{ include "spike-nexus.namespace" . }} + annotations: + "helm.sh/hook": "post-install,post-upgrade" + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["create","list"] + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["get", "update", "patch"] + resourceNames: + - {{ include "spike-nexus.fullname" . }}-bootstrap +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spike-nexus.fullname" . }}-bootstrap + namespace: {{ include "spike-nexus.namespace" . }} + annotations: + "helm.sh/hook": "post-install,post-upgrade" + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed +subjects: + - kind: ServiceAccount + name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap + namespace: {{ include "spike-nexus.namespace" . }} +roleRef: + kind: Role + name: {{ include "spike-nexus.fullname" . }}-bootstrap + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "spike-nexus.fullname" . }}-bootstrap + namespace: {{ include "spike-nexus.namespace" . }} + labels: + {{- include "spike-nexus.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": "post-install,post-upgrade" + "helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed + # "helm.sh/hook-delete-policy": before-hook-creation # for debugging. +spec: + # ttlSecondsAfterFinished: 3600 # 1 hour; useful for debugging + template: + metadata: + name: {{ include "spike-nexus.fullname" . }}-bootstrap + labels: + {{- include "spike-nexus.labels" . | nindent 8 }} + release: {{ .Release.Name }} + release-namespace: {{ .Release.Namespace }} + component: spike-bootstrap + spec: + restartPolicy: Never + serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap + securityContext: + {{- include "spire-lib.podsecuritycontext" . | nindent 8 }} + containers: + - name: bootstrap-job + securityContext: + {{- include "spire-lib.securitycontext" . | nindent 10 }} + image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.bootstrap.image "global" .Values.global "ubi" false) }} + command: + - "/bootstrap" + - "-init" + {{- with (((.Values).global).installAndUpgradeHooks).resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + env: + - name: SPIKE_BOOTSTRAP_CONFIGMAP_NAME + value: {{ include "spike-nexus.fullname" . }}-bootstrap + - name: SPIKE_TRUST_ROOT + value: {{ include "spire-lib.trust-domain" . }} + - name: SPIKE_TRUST_ROOT_KEEPER + value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + - name: SPIKE_TRUST_ROOT_BOOTSTRAP + value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + # This is required for bootstrap to work while calling nexus for a pop validation. + - name: SPIKE_TRUST_ROOT_NEXUS + value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + - name: SPIKE_SYSTEM_LOG_LEVEL + value: {{ .Values.logLevel | upper }} + - name: SPIKE_NEXUS_KEEPER_PEERS + {{- if gt (len .Values.keeperPeers) 0 }} + value: {{ .Values.keeperPeers | join "," | quote }} + {{- else }} + value: https://{{ .Release.Name }}-spike-keeper-0.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-1.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-2.{{ .Release.Name }}-spike-keeper-headless:8443 + {{- end }} + - name: SPIKE_NEXUS_SHAMIR_SHARES + value: {{ .Values.shamir.shares | quote }} + - name: SPIKE_NEXUS_SHAMIR_THRESHOLD + value: {{ .Values.shamir.threshold | quote }} + - name: SPIFFE_ENDPOINT_SOCKET + value: unix://{{ include "spike-nexus.workload-api-socket-path" . }} + - name: SPIKE_NEXUS_API_URL + value: https://{{ include "spike-nexus.fullname" . }}:443 + - name: SPIKE_BOOTSTRAP_FORCE + value: {{ .Values.bootstrap.force | toString | quote }} + volumeMounts: + - name: spiffe-workload-api + mountPath: {{ include "spike-nexus.workload-api-socket-path" . | dir }} + readOnly: true + volumes: + - name: spiffe-workload-api + csi: + driver: "{{ .Values.csiDriverName }}" + readOnly: true +{{- end }} diff --git a/charts/spire/charts/spike-nexus/templates/statefulset.yaml b/charts/spire/charts/spike-nexus/templates/statefulset.yaml index 3038ba7..638998a 100644 --- a/charts/spire/charts/spike-nexus/templates/statefulset.yaml +++ b/charts/spire/charts/spike-nexus/templates/statefulset.yaml @@ -55,10 +55,15 @@ spec: value: {{ .Values.logLevel | upper }} - name: SPIKE_TRUST_ROOT value: {{ include "spire-lib.trust-domain" . }} + - name: SPIKE_TRUST_ROOT_NEXUS + value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + # required for nexus-bootstrap pop validation + - name: SPIKE_TRUST_ROOT_BOOTSTRAP + value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} - name: SPIKE_TRUST_ROOT_KEEPER - value: {{ if gt (len .Values.trustRoot.keepers) 0 }}{{ .Values.trustRoot.keepers | join "," | quote}}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} - name: SPIKE_TRUST_ROOT_PILOT - value: {{if eq .Values.trustRoot.pilot "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.pilot }}{{ end }} + value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} - name: SPIKE_NEXUS_TLS_PORT value: ":8443" {{- if .Values.startupProbe.enabled }} diff --git a/charts/spire/charts/spike-nexus/values.yaml b/charts/spire/charts/spike-nexus/values.yaml index 98555b2..fce827a 100644 --- a/charts/spire/charts/spike-nexus/values.yaml +++ b/charts/spire/charts/spike-nexus/values.yaml @@ -17,6 +17,23 @@ image: pullPolicy: IfNotPresent tag: "" +bootstrap: + ## @param bootstrap.force Force bootstrapping + force: false + ## @param bootstrap.image.registry The OCI registry to pull the image from + ## @param bootstrap.image.repository The repository within the registry + ## @param bootstrap.image.pullPolicy The image pull policy + ## @param bootstrap.image.tag Overrides the image tag whose default is the chart appVersion + image: + registry: ghcr.io + repository: spiffe/spike-bootstrap + pullPolicy: IfNotPresent + tag: "" + +installAndUpgradeHook: + ## @param installAndUpgradeHook.enabled Enable Helm hook to bootstrap + enabled: true + ## @param backendStore The backend store to use. Must be one of [sqlite, memory, lite] backendStore: sqlite @@ -33,12 +50,16 @@ shamir: keeperPeers: [] trustRoot: - ## @param trustRoot.nexus Override which trustRoot Nexus is in - nexus: "" - ## @param trustRoot.keepers Override which trustRoot Keepers are in - keepers: [] - ## @param trustRoot.pilot Override which trustRoot Pilot is in - pilot: "" + ## @param trustRoot.self Override which trustRoot(s) this SPIKE Nexus instance is in (array) + self: [] + ## @param trustRoot.keeper Override which trustRoot(s) Keeper is in (array) + keeper: [] + ## @param trustRoot.pilot Override which trustRoot(s) Pilot is in (array) + pilot: [] + ## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array) + bootstrap: [] + ## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array) + nexus: [] ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: debug diff --git a/charts/spire/charts/spike-pilot/Chart.yaml b/charts/spire/charts/spike-pilot/Chart.yaml index 122192d..e4363c1 100644 --- a/charts/spire/charts/spike-pilot/Chart.yaml +++ b/charts/spire/charts/spike-pilot/Chart.yaml @@ -3,7 +3,7 @@ name: spike-pilot description: A Helm chart to deploy SPIKE Pilot type: application version: 0.1.0 -appVersion: "0.4.2" +appVersion: "0.5.0" home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire sources: - https://github.com/spiffe/spike diff --git a/charts/spire/charts/spike-pilot/README.md b/charts/spire/charts/spike-pilot/README.md index 0bc3b31..bf1c88e 100644 --- a/charts/spire/charts/spike-pilot/README.md +++ b/charts/spire/charts/spike-pilot/README.md @@ -43,7 +43,8 @@ A Helm chart to deploy spike pilot | `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | | `replicas` | The number of keepers to launch | `1` | -| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` | +| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` | +| `trustRoot.pilot` | Override which trustRoot(s) this SPIKE Pilot instance is in (array) | `[]` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` | | `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` | | `csiDriverName` | The csi driver to use | `csi.spiffe.io` | diff --git a/charts/spire/charts/spike-pilot/templates/deployment.yaml b/charts/spire/charts/spike-pilot/templates/deployment.yaml index 0c0958a..f6f8a8f 100644 --- a/charts/spire/charts/spike-pilot/templates/deployment.yaml +++ b/charts/spire/charts/spike-pilot/templates/deployment.yaml @@ -62,7 +62,9 @@ spec: - name: SPIKE_TRUST_ROOT value: {{ include "spire-lib.trust-domain" . }} - name: SPIKE_TRUST_ROOT_NEXUS - value: {{if eq .Values.trustRoot.Nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.Nexus }}{{ end }} + value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} + - name: SPIKE_TRUST_ROOT_PILOT + value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }} volumeMounts: - name: spiffe-workload-api mountPath: {{ include "spike-pilot.workload-api-socket-path" . | dir }} diff --git a/charts/spire/charts/spike-pilot/values.yaml b/charts/spire/charts/spike-pilot/values.yaml index 6bf2310..6efb550 100644 --- a/charts/spire/charts/spike-pilot/values.yaml +++ b/charts/spire/charts/spike-pilot/values.yaml @@ -46,8 +46,10 @@ tools: replicas: 1 trustRoot: - ## @param trustRoot.nexus Override which trustRoot Nexus is in - nexus: "" + ## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array) + nexus: [] + ## @param trustRoot.pilot Override which trustRoot(s) this SPIKE Pilot instance is in (array) + pilot: [] ## @param logLevel The log level, valid values are "debug", "info", "warn", and "error" logLevel: debug diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index bd1f7ec..9d78f68 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -318,10 +318,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` | | `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` | -| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper` | +| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` | | `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` | -| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus` | +| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` | +| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` | +| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` | +| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` | | `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` | | `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` | | `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` | diff --git a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml index 26027a8..7c0b553 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-cluster-ids.yaml @@ -27,6 +27,11 @@ matchLabels: release: {{ .Release.Name }} release-namespace: {{ .Release.Namespace }} component: spike-nexus +{{- else if eq .type "spike-bootstrap" }} +matchLabels: + release: {{ .Release.Name }} + release-namespace: {{ .Release.Namespace }} + component: spike-bootstrap {{- else if eq .type "spike-pilot" }} matchLabels: release: {{ .Release.Name }} @@ -53,8 +58,8 @@ matchLabels: {{- if eq ($root.Values.controllerManager.enabled | toString) "true" }} {{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }} {{- $type := dig "type" "base" $value }} -{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-pilot" "test-keys")) }} -{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-pilot, test-keys]" $type) }} +{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }} +{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }} {{- end }} {{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }} {{- if ne $type "raw" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5bca3e3..df87679 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -717,14 +717,21 @@ controllerManager: ## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is. type: spike-keeper ## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule. - spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }} spike-nexus: ## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager enabled: true ## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is. type: spike-nexus ## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule. - spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }} + spike-bootstrap: + ## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager + enabled: true + ## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is. + type: spike-bootstrap + ## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule. + spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }} spike-pilot: ## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager enabled: true