From 87904164ad0c167fd80425310444e7c36620f8a1 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Sun, 2 Apr 2023 10:28:49 -0700 Subject: [PATCH] Enable global config for clusterName, trustDomain, and bundleConfigMap (#156) --- charts/spire/README.md | 10 +++---- .../templates/_helpers.tpl | 16 +++++++++++ .../charts/spire-agent/templates/_helpers.tpl | 24 +++++++++++++++++ .../spire-agent/templates/configmap.yaml | 4 +-- .../spire-agent/templates/daemonset.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 +- .../spire-server/templates/_helpers.tpl | 24 +++++++++++++++++ .../templates/bundle-configmap.yaml | 2 +- .../spire-server/templates/configmap.yaml | 6 ++--- .../controller-manager-configmap.yaml | 4 +-- .../charts/spire-server/templates/roles.yaml | 2 +- charts/spire/charts/spire-server/values.yaml | 2 +- charts/spire/values.yaml | 27 +++++++++---------- 13 files changed, 92 insertions(+), 33 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 20b945f..d23e402 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -105,20 +105,16 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | fullnameOverride | string | `""` | | +| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap | +| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster | +| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers | | nameOverride | string | `""` | | | spiffe-csi-driver.enabled | bool | `true` | | | spiffe-oidc-discovery-provider.enabled | bool | `false` | | -| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | | -| spire-agent.bundleConfigMap | string | `"spire-bundle"` | | -| spire-agent.clusterName | string | `"example-cluster"` | | | spire-agent.enabled | bool | `true` | | | spire-agent.nameOverride | string | `"agent"` | | -| spire-agent.trustDomain | string | `"example.org"` | | -| spire-server.bundleConfigMap | string | `"spire-bundle"` | | -| spire-server.clusterName | string | `"example-cluster"` | | | spire-server.controllerManager.enabled | bool | `true` | | | spire-server.enabled | bool | `true` | | | spire-server.nameOverride | string | `"server"` | | -| spire-server.trustDomain | string | `"example.org"` | | ---------------------------------------------- diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl index 6ff4768..bda54f2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl @@ -87,3 +87,19 @@ Create the name of the service account to use {{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}} {{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }} {{- end }} + +{{- define "spiffe-oidc-discovery-provider.cluster-name" }} +{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} +{{- .Values.global.spire.clusterName }} +{{- else }} +{{- .Values.clusterName }} +{{- end }} +{{- end }} + +{{- define "spiffe-oidc-discovery-provider.trust-domain" }} +{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} +{{- .Values.global.spire.trustDomain }} +{{- else }} +{{- .Values.trustDomain }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/_helpers.tpl b/charts/spire/charts/spire-agent/templates/_helpers.tpl index f3704fc..065f6ed 100644 --- a/charts/spire/charts/spire-agent/templates/_helpers.tpl +++ b/charts/spire/charts/spire-agent/templates/_helpers.tpl @@ -103,3 +103,27 @@ Create the name of the service account to use {{- define "spire-agent.socket-path" -}} {{- print .Values.socketPath }} {{- end }} + +{{- define "spire-agent.cluster-name" }} +{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} +{{- .Values.global.spire.clusterName }} +{{- else }} +{{- .Values.clusterName }} +{{- end }} +{{- end }} + +{{- define "spire-agent.trust-domain" }} +{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} +{{- .Values.global.spire.trustDomain }} +{{- else }} +{{- .Values.trustDomain }} +{{- end }} +{{- end }} + +{{- define "spire-agent.bundle-configmap" }} +{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }} +{{- .Values.global.spire.bundleConfigMap }} +{{- else }} +{{- .Values.bundleConfigMap }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 9d368e8..900f526 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -12,13 +12,13 @@ data: server_port = {{ .Values.server.port | quote }} socket_path = {{ include "spire-agent.socket-path" . | quote }} trust_bundle_path = "/run/spire/bundle/bundle.crt" - trust_domain = {{ .Values.trustDomain | quote }} + trust_domain = {{ include "spire-agent.trust-domain" . | quote }} } plugins { NodeAttestor "k8s_psat" { plugin_data { - cluster = {{ .Values.clusterName | quote }} + cluster = {{ include "spire-agent.cluster-name" . | quote }} } } diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 503c171..10c2603 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -100,7 +100,7 @@ spec: name: {{ include "spire-agent.fullname" . }} - name: spire-bundle configMap: - name: {{ .Values.bundleConfigMap }} + name: {{ include "spire-agent.bundle-configmap" . }} - name: spire-token projected: sources: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ce5cbb8..347c653 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -22,7 +22,7 @@ A Helm chart to install the SPIRE server. | autoscaling.maxReplicas | int | `100` | | | autoscaling.minReplicas | int | `1` | | | autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| bundleConfigMap | string | `"spire-server"` | | +| bundleConfigMap | string | `"spire-bundle"` | | | caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) | | caTTL | string | `"24h"` | | | ca_subject.common_name | string | `"example.org"` | | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 6a8355f..6d53181 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -110,3 +110,27 @@ Create the name of the service account to use [{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}] {{- end }} {{- end }} + +{{- define "spire-server.cluster-name" }} +{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }} +{{- .Values.global.spire.clusterName }} +{{- else }} +{{- .Values.clusterName }} +{{- end }} +{{- end }} + +{{- define "spire-server.trust-domain" }} +{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }} +{{- .Values.global.spire.trustDomain }} +{{- else }} +{{- .Values.trustDomain }} +{{- end }} +{{- end }} + +{{- define "spire-server.bundle-configmap" }} +{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }} +{{- .Values.global.spire.bundleConfigMap }} +{{- else }} +{{- .Values.bundleConfigMap }} +{{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml index 948c120..bbc2fb5 100644 --- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -2,5 +2,5 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ .Values.bundleConfigMap }} + name: {{ include "spire-server.bundle-configmap" . }} namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 31063da..d1143f5 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -10,7 +10,7 @@ data: server { bind_address = "0.0.0.0" bind_port = "8081" - trust_domain = {{ .Values.trustDomain | quote }} + trust_domain = {{ include "spire-server.trust-domain" . | quote }} data_dir = "/run/spire/data" log_level = {{ .Values.logLevel | quote }} @@ -55,7 +55,7 @@ data: NodeAttestor "k8s_psat" { plugin_data { clusters = { - {{ $root.Values.clusterName | quote }} = { + {{ include "spire-server.cluster-name" $root | quote }} = { service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }} } } @@ -73,7 +73,7 @@ data: Notifier "k8sbundle" { plugin_data { namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }} - config_map = {{ .Values.bundleConfigMap | quote }} + config_map = {{ include "spire-server.bundle-configmap" . | quote }} } } diff --git a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml index ebf9ee8..0509a56 100644 --- a/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml @@ -22,8 +22,8 @@ data: resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io resourceNamespace: {{ include "spire-server.namespace" . }} validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook - clusterName: {{ .Values.clusterName }} - trustDomain: {{ .Values.trustDomain }} + clusterName: {{ include "spire-server.cluster-name" . }} + trustDomain: {{ include "spire-server.trust-domain" . }} ignoreNamespaces: {{- with .Values.controllerManager.ignoreNamespaces }} {{- toYaml . | nindent 6 }} diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index 3382d67..7bd8b1c 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -8,7 +8,7 @@ metadata: rules: - apiGroups: [""] resources: [configmaps] - resourceNames: [{{ .Values.bundleConfigMap }}] + resourceNames: [{{ include "spire-server.bundle-configmap" . }}] verbs: - get - patch diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5324b55..07ed1e4 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -85,7 +85,7 @@ jwtIssuer: oidc-discovery.example.org clusterName: example-cluster trustDomain: example.org -bundleConfigMap: spire-server +bundleConfigMap: spire-bundle federation: enabled: false diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 76e0e1b..fb91ef5 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -1,8 +1,16 @@ -# You can enable features that affect all services here. -# global: -# telemetry: -# prometheus: -# enabled: true +# You can enable config/features that affect all services here. +global: + spire: + # -- Set the name of the Kubernetes cluster + clusterName: "example-cluster" + # -- Set the trust domain to use for the spiffe identifiers + trustDomain: "example.org" + # -- Override all instances of bundleConfigMap + bundleConfigMap: "" + +# telemetry: +# prometheus: +# enabled: true nameOverride: "" fullnameOverride: "" @@ -11,10 +19,6 @@ fullnameOverride: "" spire-server: enabled: true nameOverride: server - bundleConfigMap: &bundleConfigMap spire-bundle - - clusterName: &clusterName "example-cluster" - trustDomain: &trustDomain "example.org" controllerManager: enabled: true @@ -22,14 +26,9 @@ spire-server: spire-agent: enabled: true nameOverride: agent - bundleConfigMap: *bundleConfigMap - - clusterName: *clusterName - trustDomain: *trustDomain spiffe-csi-driver: enabled: true spiffe-oidc-discovery-provider: enabled: false - trustDomain: *trustDomain