Update spike to the newest version (#665)
* Update spike bits Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Add trust roots. SPIKE SDK uses the appropriate trust root from the environment which makes SDK usage easier, but it requires additional env vars on the pod meta. Signed-off-by: Volkan Özçelik <[email protected]> * Chart updates to make it work with the new SDK changes of SPIKE. Signed-off-by: Volkan Özçelik <[email protected]> * Making the self-reference more evident. Signed-off-by: Volkan Özçelik <[email protected]> * Documentation update. Signed-off-by: Volkan Özçelik <[email protected]> * Documentation update. Signed-off-by: Volkan Özçelik <[email protected]> * updates to align with recent SPIKE. * SPIKE assumes all trust roots can be arrays (for distributed setups), modified values accordingly. * Added cross-references between bootstrap and keeper job/statefulsets for PoP validation to work. * other possible minor updates. Signed-off-by: Volkan Özçelik <[email protected]> * minor changes. Signed-off-by: Volkan Özçelik <[email protected]> * Update docs --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: Volkan Özçelik <[email protected]> Co-authored-by: Volkan Özçelik <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Volkan Özçelik
Faisal Memon
Volkan Özçelik
Faisal Memon
parent
97c383b1cb
commit
813203a4d2
@@ -3,7 +3,7 @@ name: spike-keeper
|
|||||||
description: A Helm chart to deploy SPIKE Keeper
|
description: A Helm chart to deploy SPIKE Keeper
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "0.4.2"
|
appVersion: "0.5.0"
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/spiffe/spike
|
- https://github.com/spiffe/spike
|
||||||
|
|||||||
@@ -35,7 +35,9 @@ A Helm chart to deploy spike keepers
|
|||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `replicas` | The number of keepers to launch | `3` |
|
| `replicas` | The number of keepers to launch | `3` |
|
||||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||||
|
| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` |
|
||||||
|
| `trustRoot.self` | Override which trustRoot(s) this Keeper instance is in (array) | `[]` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
|
|||||||
@@ -43,8 +43,13 @@ spec:
|
|||||||
value: {{ .Values.logLevel | upper }}
|
value: {{ .Values.logLevel | upper }}
|
||||||
- name: SPIKE_TRUST_ROOT
|
- name: SPIKE_TRUST_ROOT
|
||||||
value: {{ include "spire-lib.trust-domain" . }}
|
value: {{ include "spire-lib.trust-domain" . }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||||
|
value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||||
value: {{if eq .Values.trustRoot.nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.nexus }}{{ end }}
|
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||||
|
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
|
||||||
- name: SPIKE_KEEPER_TLS_PORT
|
- name: SPIKE_KEEPER_TLS_PORT
|
||||||
value: ":8443"
|
value: ":8443"
|
||||||
{{- if .Values.startupProbe.enabled }}
|
{{- if .Values.startupProbe.enabled }}
|
||||||
|
|||||||
@@ -21,8 +21,12 @@ image:
|
|||||||
replicas: 3
|
replicas: 3
|
||||||
|
|
||||||
trustRoot:
|
trustRoot:
|
||||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||||
nexus: ""
|
nexus: []
|
||||||
|
## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array)
|
||||||
|
bootstrap: []
|
||||||
|
## @param trustRoot.self Override which trustRoot(s) this Keeper instance is in (array)
|
||||||
|
self: []
|
||||||
|
|
||||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: debug
|
logLevel: debug
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spike-nexus
|
|||||||
description: A Helm chart to deploy SPIKE Nexus
|
description: A Helm chart to deploy SPIKE Nexus
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "0.4.2"
|
appVersion: "0.5.0"
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/spiffe/spike
|
- https://github.com/spiffe/spike
|
||||||
|
|||||||
@@ -28,56 +28,64 @@ A Helm chart to deploy spike nexus
|
|||||||
|
|
||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
|
| ---------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spike-nexus` |
|
| `image.repository` | The repository within the registry | `spiffe/spike-nexus` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `backendStore` | The backend store to use. Must be one of [sqlite, memory, lite] | `sqlite` |
|
| `bootstrap.force` | Force bootstrapping | `false` |
|
||||||
| `replicas` | The number of keepers to launch | `1` |
|
| `bootstrap.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `shamir.shares` | How many shares to configure for shamir secrets | `3` |
|
| `bootstrap.image.repository` | The repository within the registry | `spiffe/spike-bootstrap` |
|
||||||
| `shamir.threshold` | How many shares needed to recover | `2` |
|
| `bootstrap.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `keeperPeers` | Keeper peer configuration. If blank, it will be autodetected | `[]` |
|
| `bootstrap.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
| `installAndUpgradeHook.enabled` | Enable Helm hook to bootstrap | `true` |
|
||||||
| `trustRoot.keepers` | Override which trustRoot Keepers are in | `[]` |
|
| `backendStore` | The backend store to use. Must be one of [sqlite, memory, lite] | `sqlite` |
|
||||||
| `trustRoot.pilot` | Override which trustRoot Pilot is in | `""` |
|
| `replicas` | The number of keepers to launch | `1` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
| `shamir.shares` | How many shares to configure for shamir secrets | `3` |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `shamir.threshold` | How many shares needed to recover | `2` |
|
||||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
| `keeperPeers` | Keeper peer configuration. If blank, it will be autodetected | `[]` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `trustRoot.self` | Override which trustRoot(s) this SPIKE Nexus instance is in (array) | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `trustRoot.keeper` | Override which trustRoot(s) Keeper is in (array) | `[]` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `trustRoot.pilot` | Override which trustRoot(s) Pilot is in (array) | `[]` |
|
||||||
| `fullnameOverride` | Fullname override | `""` |
|
| `trustRoot.bootstrap` | Override which trustRoot(s) Bootstrap is in (array) | `[]` |
|
||||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `labels` | Labels for pods | `{}` |
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
| `podSecurityContext` | Pod security context | `{}` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `securityContext` | Security context | `{}` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `service.type` | Service type | `ClusterIP` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `service.port` | Service port | `443` |
|
| `fullnameOverride` | Fullname override | `""` |
|
||||||
| `service.annotations` | Annotations for service resource | `{}` |
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||||
| `nodeSelector` | (Optional) Select specific nodes to run on. | `{}` |
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||||
| `affinity` | Affinity rules | `{}` |
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||||
| `tolerations` | List of tolerations | `[]` |
|
| `labels` | Labels for pods | `{}` |
|
||||||
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
| `podSecurityContext` | Pod security context | `{}` |
|
||||||
| `startupProbe.enabled` | Enable startupProbe | `true` |
|
| `securityContext` | Security context | `{}` |
|
||||||
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
| `service.port` | Service port | `443` |
|
||||||
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
| `service.annotations` | Annotations for service resource | `{}` |
|
||||||
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
| `nodeSelector` | (Optional) Select specific nodes to run on. | `{}` |
|
||||||
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
| `affinity` | Affinity rules | `{}` |
|
||||||
| `ingress.enabled` | Flag to enable ingress | `false` |
|
| `tolerations` | List of tolerations | `[]` |
|
||||||
| `ingress.className` | Ingress class name | `""` |
|
| `topologySpreadConstraints` | List of topology spread constraints for resilience | `[]` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
| `startupProbe.enabled` | Enable startupProbe | `true` |
|
||||||
| `ingress.annotations` | Annotations | `{}` |
|
| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `5` |
|
||||||
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `nexus` |
|
| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` |
|
||||||
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `5` |
|
||||||
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
| `startupProbe.failureThreshold` | Failure threshold count for startupProbe | `6` |
|
||||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
| `startupProbe.successThreshold` | Success threshold count for startupProbe | `1` |
|
||||||
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
| `ingress.enabled` | Flag to enable ingress | `false` |
|
||||||
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, auto-detection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
| `ingress.annotations` | Annotations | `{}` |
|
||||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `nexus` |
|
||||||
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object. If empty, rules will be built based on the host var. | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
|
| `persistence.type` | What type of volume to use for persistence. Valid options pvc (recommended), hostPath, emptyDir (testing only) | `pvc` |
|
||||||
|
| `persistence.size` | What size volume to use for persistence | `1Gi` |
|
||||||
|
| `persistence.accessMode` | What access mode to use for persistence. Valid options are ReadWriteOnce (recommended), ReadWriteOncePod, ReadWriteMany (not recommended) | `ReadWriteOnce` |
|
||||||
|
| `persistence.storageClass` | What storage class to use for persistence | `nil` |
|
||||||
|
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `""` |
|
||||||
|
|||||||
@@ -0,0 +1,125 @@
|
|||||||
|
{{- if eq ((dig "installAndUpgradeHooks" "enabled" .Values.installAndUpgradeHook.enabled .Values.global) | toString) "true" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||||
|
namespace: {{ include "spike-nexus.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spike-nexus.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": "post-install,post-upgrade"
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
namespace: {{ include "spike-nexus.namespace" . }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": "post-install,post-upgrade"
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["create","list"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["get", "update", "patch"]
|
||||||
|
resourceNames:
|
||||||
|
- {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
---
|
||||||
|
kind: RoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
namespace: {{ include "spike-nexus.namespace" . }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": "post-install,post-upgrade"
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||||
|
namespace: {{ include "spike-nexus.namespace" . }}
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
namespace: {{ include "spike-nexus.namespace" . }}
|
||||||
|
labels:
|
||||||
|
{{- include "spike-nexus.labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
"helm.sh/hook": "post-install,post-upgrade"
|
||||||
|
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||||
|
# "helm.sh/hook-delete-policy": before-hook-creation # for debugging.
|
||||||
|
spec:
|
||||||
|
# ttlSecondsAfterFinished: 3600 # 1 hour; useful for debugging
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
labels:
|
||||||
|
{{- include "spike-nexus.labels" . | nindent 8 }}
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: spike-bootstrap
|
||||||
|
spec:
|
||||||
|
restartPolicy: Never
|
||||||
|
serviceAccountName: {{ include "spike-nexus.serviceAccountName" . }}-bootstrap
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||||
|
containers:
|
||||||
|
- name: bootstrap-job
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 10 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.bootstrap.image "global" .Values.global "ubi" false) }}
|
||||||
|
command:
|
||||||
|
- "/bootstrap"
|
||||||
|
- "-init"
|
||||||
|
{{- with (((.Values).global).installAndUpgradeHooks).resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: SPIKE_BOOTSTRAP_CONFIGMAP_NAME
|
||||||
|
value: {{ include "spike-nexus.fullname" . }}-bootstrap
|
||||||
|
- name: SPIKE_TRUST_ROOT
|
||||||
|
value: {{ include "spire-lib.trust-domain" . }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||||
|
value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||||
|
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
# This is required for bootstrap to work while calling nexus for a pop validation.
|
||||||
|
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||||
|
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
- name: SPIKE_SYSTEM_LOG_LEVEL
|
||||||
|
value: {{ .Values.logLevel | upper }}
|
||||||
|
- name: SPIKE_NEXUS_KEEPER_PEERS
|
||||||
|
{{- if gt (len .Values.keeperPeers) 0 }}
|
||||||
|
value: {{ .Values.keeperPeers | join "," | quote }}
|
||||||
|
{{- else }}
|
||||||
|
value: https://{{ .Release.Name }}-spike-keeper-0.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-1.{{ .Release.Name }}-spike-keeper-headless:8443,https://{{ .Release.Name }}-spike-keeper-2.{{ .Release.Name }}-spike-keeper-headless:8443
|
||||||
|
{{- end }}
|
||||||
|
- name: SPIKE_NEXUS_SHAMIR_SHARES
|
||||||
|
value: {{ .Values.shamir.shares | quote }}
|
||||||
|
- name: SPIKE_NEXUS_SHAMIR_THRESHOLD
|
||||||
|
value: {{ .Values.shamir.threshold | quote }}
|
||||||
|
- name: SPIFFE_ENDPOINT_SOCKET
|
||||||
|
value: unix://{{ include "spike-nexus.workload-api-socket-path" . }}
|
||||||
|
- name: SPIKE_NEXUS_API_URL
|
||||||
|
value: https://{{ include "spike-nexus.fullname" . }}:443
|
||||||
|
- name: SPIKE_BOOTSTRAP_FORCE
|
||||||
|
value: {{ .Values.bootstrap.force | toString | quote }}
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: {{ include "spike-nexus.workload-api-socket-path" . | dir }}
|
||||||
|
readOnly: true
|
||||||
|
volumes:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
csi:
|
||||||
|
driver: "{{ .Values.csiDriverName }}"
|
||||||
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
@@ -55,10 +55,15 @@ spec:
|
|||||||
value: {{ .Values.logLevel | upper }}
|
value: {{ .Values.logLevel | upper }}
|
||||||
- name: SPIKE_TRUST_ROOT
|
- name: SPIKE_TRUST_ROOT
|
||||||
value: {{ include "spire-lib.trust-domain" . }}
|
value: {{ include "spire-lib.trust-domain" . }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||||
|
value: {{ if gt (len .Values.trustRoot.self) 0 }}{{ .Values.trustRoot.self | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
# required for nexus-bootstrap pop validation
|
||||||
|
- name: SPIKE_TRUST_ROOT_BOOTSTRAP
|
||||||
|
value: {{ if gt (len .Values.trustRoot.bootstrap) 0 }}{{ .Values.trustRoot.bootstrap | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
- name: SPIKE_TRUST_ROOT_KEEPER
|
- name: SPIKE_TRUST_ROOT_KEEPER
|
||||||
value: {{ if gt (len .Values.trustRoot.keepers) 0 }}{{ .Values.trustRoot.keepers | join "," | quote}}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
value: {{ if gt (len .Values.trustRoot.keeper) 0 }}{{ .Values.trustRoot.keeper | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
- name: SPIKE_TRUST_ROOT_PILOT
|
- name: SPIKE_TRUST_ROOT_PILOT
|
||||||
value: {{if eq .Values.trustRoot.pilot "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.pilot }}{{ end }}
|
value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
- name: SPIKE_NEXUS_TLS_PORT
|
- name: SPIKE_NEXUS_TLS_PORT
|
||||||
value: ":8443"
|
value: ":8443"
|
||||||
{{- if .Values.startupProbe.enabled }}
|
{{- if .Values.startupProbe.enabled }}
|
||||||
|
|||||||
@@ -17,6 +17,23 @@ image:
|
|||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
bootstrap:
|
||||||
|
## @param bootstrap.force Force bootstrapping
|
||||||
|
force: false
|
||||||
|
## @param bootstrap.image.registry The OCI registry to pull the image from
|
||||||
|
## @param bootstrap.image.repository The repository within the registry
|
||||||
|
## @param bootstrap.image.pullPolicy The image pull policy
|
||||||
|
## @param bootstrap.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spike-bootstrap
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: ""
|
||||||
|
|
||||||
|
installAndUpgradeHook:
|
||||||
|
## @param installAndUpgradeHook.enabled Enable Helm hook to bootstrap
|
||||||
|
enabled: true
|
||||||
|
|
||||||
## @param backendStore The backend store to use. Must be one of [sqlite, memory, lite]
|
## @param backendStore The backend store to use. Must be one of [sqlite, memory, lite]
|
||||||
backendStore: sqlite
|
backendStore: sqlite
|
||||||
|
|
||||||
@@ -33,12 +50,16 @@ shamir:
|
|||||||
keeperPeers: []
|
keeperPeers: []
|
||||||
|
|
||||||
trustRoot:
|
trustRoot:
|
||||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
## @param trustRoot.self Override which trustRoot(s) this SPIKE Nexus instance is in (array)
|
||||||
nexus: ""
|
self: []
|
||||||
## @param trustRoot.keepers Override which trustRoot Keepers are in
|
## @param trustRoot.keeper Override which trustRoot(s) Keeper is in (array)
|
||||||
keepers: []
|
keeper: []
|
||||||
## @param trustRoot.pilot Override which trustRoot Pilot is in
|
## @param trustRoot.pilot Override which trustRoot(s) Pilot is in (array)
|
||||||
pilot: ""
|
pilot: []
|
||||||
|
## @param trustRoot.bootstrap Override which trustRoot(s) Bootstrap is in (array)
|
||||||
|
bootstrap: []
|
||||||
|
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||||
|
nexus: []
|
||||||
|
|
||||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: debug
|
logLevel: debug
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ name: spike-pilot
|
|||||||
description: A Helm chart to deploy SPIKE Pilot
|
description: A Helm chart to deploy SPIKE Pilot
|
||||||
type: application
|
type: application
|
||||||
version: 0.1.0
|
version: 0.1.0
|
||||||
appVersion: "0.4.2"
|
appVersion: "0.5.0"
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/spiffe/spike
|
- https://github.com/spiffe/spike
|
||||||
|
|||||||
@@ -43,7 +43,8 @@ A Helm chart to deploy spike pilot
|
|||||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||||
| `replicas` | The number of keepers to launch | `1` |
|
| `replicas` | The number of keepers to launch | `1` |
|
||||||
| `trustRoot.nexus` | Override which trustRoot Nexus is in | `""` |
|
| `trustRoot.nexus` | Override which trustRoot(s) Nexus is in (array) | `[]` |
|
||||||
|
| `trustRoot.pilot` | Override which trustRoot(s) this SPIKE Pilot instance is in (array) | `[]` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `debug` |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
|
|||||||
@@ -62,7 +62,9 @@ spec:
|
|||||||
- name: SPIKE_TRUST_ROOT
|
- name: SPIKE_TRUST_ROOT
|
||||||
value: {{ include "spire-lib.trust-domain" . }}
|
value: {{ include "spire-lib.trust-domain" . }}
|
||||||
- name: SPIKE_TRUST_ROOT_NEXUS
|
- name: SPIKE_TRUST_ROOT_NEXUS
|
||||||
value: {{if eq .Values.trustRoot.Nexus "" }}{{ include "spire-lib.trust-domain" . }}{{ else }}{{.Values.trustRoot.Nexus }}{{ end }}
|
value: {{ if gt (len .Values.trustRoot.nexus) 0 }}{{ .Values.trustRoot.nexus | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
|
- name: SPIKE_TRUST_ROOT_PILOT
|
||||||
|
value: {{ if gt (len .Values.trustRoot.pilot) 0 }}{{ .Values.trustRoot.pilot | join "," | quote }}{{ else }}{{ include "spire-lib.trust-domain" . }}{{ end }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- name: spiffe-workload-api
|
- name: spiffe-workload-api
|
||||||
mountPath: {{ include "spike-pilot.workload-api-socket-path" . | dir }}
|
mountPath: {{ include "spike-pilot.workload-api-socket-path" . | dir }}
|
||||||
|
|||||||
@@ -46,8 +46,10 @@ tools:
|
|||||||
replicas: 1
|
replicas: 1
|
||||||
|
|
||||||
trustRoot:
|
trustRoot:
|
||||||
## @param trustRoot.nexus Override which trustRoot Nexus is in
|
## @param trustRoot.nexus Override which trustRoot(s) Nexus is in (array)
|
||||||
nexus: ""
|
nexus: []
|
||||||
|
## @param trustRoot.pilot Override which trustRoot(s) this SPIKE Pilot instance is in (array)
|
||||||
|
pilot: []
|
||||||
|
|
||||||
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
## @param logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||||
logLevel: debug
|
logLevel: debug
|
||||||
|
|||||||
@@ -318,10 +318,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||||
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||||
|
|||||||
@@ -27,6 +27,11 @@ matchLabels:
|
|||||||
release: {{ .Release.Name }}
|
release: {{ .Release.Name }}
|
||||||
release-namespace: {{ .Release.Namespace }}
|
release-namespace: {{ .Release.Namespace }}
|
||||||
component: spike-nexus
|
component: spike-nexus
|
||||||
|
{{- else if eq .type "spike-bootstrap" }}
|
||||||
|
matchLabels:
|
||||||
|
release: {{ .Release.Name }}
|
||||||
|
release-namespace: {{ .Release.Namespace }}
|
||||||
|
component: spike-bootstrap
|
||||||
{{- else if eq .type "spike-pilot" }}
|
{{- else if eq .type "spike-pilot" }}
|
||||||
matchLabels:
|
matchLabels:
|
||||||
release: {{ .Release.Name }}
|
release: {{ .Release.Name }}
|
||||||
@@ -53,8 +58,8 @@ matchLabels:
|
|||||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||||
{{- $type := dig "type" "base" $value }}
|
{{- $type := dig "type" "base" $value }}
|
||||||
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-pilot" "test-keys")) }}
|
{{- if not (has $type (list "base" "raw" "child-servers" "oidc-discovery-provider" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }}
|
||||||
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-pilot, test-keys]" $type) }}
|
{{- fail (printf "Type given: %s, must be one of [base, raw, child-servers, oidc-discovery-provider, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||||
{{- if ne $type "raw" }}
|
{{- if ne $type "raw" }}
|
||||||
|
|||||||
@@ -717,14 +717,21 @@ controllerManager:
|
|||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
||||||
type: spike-keeper
|
type: spike-keeper
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
||||||
spike-nexus:
|
spike-nexus:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
||||||
enabled: true
|
enabled: true
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
||||||
type: spike-nexus
|
type: spike-nexus
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
||||||
|
spike-bootstrap:
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager
|
||||||
|
enabled: true
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
||||||
|
type: spike-bootstrap
|
||||||
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
||||||
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
||||||
spike-pilot:
|
spike-pilot:
|
||||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|||||||
Reference in New Issue
Block a user