panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable global config for clusterName, trustDomain, and bundleConfigMap (#156)

Browse Source
This commit is contained in:
kfox1111
2023-04-02 19:28:49 +02:00
committed by GitHub
parent b54c41aee0
commit 87904164ad
13 changed files with 92 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+3 -7
View File
@@ -105,20 +105,16 @@ Kubernetes: `>=1.21.0-0`
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| fullnameOverride | string | `""` | |
| global.spire.bundleConfigMap | string | `""` | Override all instances of bundleConfigMap |
| global.spire.clusterName | string | `"example-cluster"` | Set the name of the Kubernetes cluster |
| global.spire.trustDomain | string | `"example.org"` | Set the trust domain to use for the spiffe identifiers |
| nameOverride | string | `""` | |
| spiffe-csi-driver.enabled | bool | `true` | |
| spiffe-oidc-discovery-provider.enabled | bool | `false` | |
| spiffe-oidc-discovery-provider.trustDomain | string | `"example.org"` | |
| spire-agent.bundleConfigMap | string | `"spire-bundle"` | |
| spire-agent.clusterName | string | `"example-cluster"` | |
| spire-agent.enabled | bool | `true` | |
| spire-agent.nameOverride | string | `"agent"` | |
| spire-agent.trustDomain | string | `"example.org"` | |
| spire-server.bundleConfigMap | string | `"spire-bundle"` | |
| spire-server.clusterName | string | `"example-cluster"` | |
| spire-server.controllerManager.enabled | bool | `true` | |
| spire-server.enabled | bool | `true` | |
| spire-server.nameOverride | string | `"server"` | |
| spire-server.trustDomain | string | `"example.org"` | |
----------------------------------------------
charts/spire/charts/spiffe-oidc-discovery-provider/templates/_helpers.tpl
+16
View File
@@ -87,3 +87,19 @@ Create the name of the service account to use
{{- define "spiffe-oidc-discovery-provider.workload-api-socket-path" -}}
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spiffe-oidc-discovery-provider.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/_helpers.tpl
+24
View File
@@ -103,3 +103,27 @@ Create the name of the service account to use
{{- define "spire-agent.socket-path" -}}
{{- print .Values.socketPath }}
{{- end }}
{{- define "spire-agent.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-agent.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-agent.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+2 -2
View File
@@ -12,13 +12,13 @@ data:
server_port = {{ .Values.server.port | quote }}
socket_path = {{ include "spire-agent.socket-path" . | quote }}
trust_bundle_path = "/run/spire/bundle/bundle.crt"
trust_domain = {{ .Values.trustDomain | quote }}
trust_domain = {{ include "spire-agent.trust-domain" . | quote }}
}
plugins {
NodeAttestor "k8s_psat" {
plugin_data {
cluster = {{ .Values.clusterName | quote }}
cluster = {{ include "spire-agent.cluster-name" . | quote }}
}
}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+1 -1
View File
@@ -100,7 +100,7 @@ spec:
name: {{ include "spire-agent.fullname" . }}
- name: spire-bundle
configMap:
name: {{ .Values.bundleConfigMap }}
name: {{ include "spire-agent.bundle-configmap" . }}
- name: spire-token
projected:
sources:
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -22,7 +22,7 @@ A Helm chart to install the SPIRE server.
| autoscaling.maxReplicas | int | `100` | |
| autoscaling.minReplicas | int | `1` | |
| autoscaling.targetCPUUtilizationPercentage | int | `80` | |
| bundleConfigMap | string | `"spire-server"` | |
| bundleConfigMap | string | `"spire-bundle"` | |
| caKeyType | string | `"rsa-2048"` | The CA key type to use, possible values are rsa-2048, rsa-4096, ec-p256, ec-p384 (AWS requires the use of RSA. EC cryptography is not supported) |
| caTTL | string | `"24h"` | |
| ca_subject.common_name | string | `"example.org"` | |
charts/spire/charts/spire-server/templates/_helpers.tpl
+24
View File
@@ -110,3 +110,27 @@ Create the name of the service account to use
[{{ printf "%s:%s-agent" .Release.Namespace .Release.Name | quote }}]
{{- end }}
{{- end }}
{{- define "spire-server.cluster-name" }}
{{- if ne (len (dig "spire" "clusterName" "" .Values.global)) 0 }}
{{- .Values.global.spire.clusterName }}
{{- else }}
{{- .Values.clusterName }}
{{- end }}
{{- end }}
{{- define "spire-server.trust-domain" }}
{{- if ne (len (dig "spire" "trustDomain" "" .Values.global)) 0 }}
{{- .Values.global.spire.trustDomain }}
{{- else }}
{{- .Values.trustDomain }}
{{- end }}
{{- end }}
{{- define "spire-server.bundle-configmap" }}
{{- if ne (len (dig "spire" "bundleConfigMap" "" .Values.global)) 0 }}
{{- .Values.global.spire.bundleConfigMap }}
{{- else }}
{{- .Values.bundleConfigMap }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+1 -1
View File
@@ -2,5 +2,5 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Values.bundleConfigMap }}
name: {{ include "spire-server.bundle-configmap" . }}
namespace: {{ .Values.notifier.k8sbundle.namespace | default $namespace }}
charts/spire/charts/spire-server/templates/configmap.yaml
+3 -3
View File
@@ -10,7 +10,7 @@ data:
server {
bind_address = "0.0.0.0"
bind_port = "8081"
trust_domain = {{ .Values.trustDomain | quote }}
trust_domain = {{ include "spire-server.trust-domain" . | quote }}
data_dir = "/run/spire/data"
log_level = {{ .Values.logLevel | quote }}
@@ -55,7 +55,7 @@ data:
NodeAttestor "k8s_psat" {
plugin_data {
clusters = {
{{ $root.Values.clusterName | quote }} = {
{{ include "spire-server.cluster-name" $root | quote }} = {
service_account_allow_list = {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
}
}
@@ -73,7 +73,7 @@ data:
Notifier "k8sbundle" {
plugin_data {
namespace = {{ .Values.notifier.k8sbundle.namespace | default $namespace | quote }}
config_map = {{ .Values.bundleConfigMap | quote }}
config_map = {{ include "spire-server.bundle-configmap" . | quote }}
}
}
charts/spire/charts/spire-server/templates/controller-manager-configmap.yaml
+2 -2
View File
@@ -22,8 +22,8 @@ data:
resourceName: {{ .Release.Name | sha256sum | trunc 8 }}.spiffe.io
resourceNamespace: {{ include "spire-server.namespace" . }}
validatingWebhookConfigurationName: {{ include "spire-controller-manager.fullname" . }}-webhook
clusterName: {{ .Values.clusterName }}
trustDomain: {{ .Values.trustDomain }}
clusterName: {{ include "spire-server.cluster-name" . }}
trustDomain: {{ include "spire-server.trust-domain" . }}
ignoreNamespaces:
{{- with .Values.controllerManager.ignoreNamespaces }}
{{- toYaml . | nindent 6 }}
charts/spire/charts/spire-server/templates/roles.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
rules:
- apiGroups: [""]
resources: [configmaps]
resourceNames: [{{ .Values.bundleConfigMap }}]
resourceNames: [{{ include "spire-server.bundle-configmap" . }}]
verbs:
- get
- patch
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -85,7 +85,7 @@ jwtIssuer: oidc-discovery.example.org
clusterName: example-cluster
trustDomain: example.org
bundleConfigMap: spire-server
bundleConfigMap: spire-bundle
federation:
enabled: false
charts/spire/values.yaml
+10 -11
View File
@@ -1,5 +1,13 @@
# You can enable features that affect all services here.
# global:
# You can enable config/features that affect all services here.
global:
spire:
# -- Set the name of the Kubernetes cluster
clusterName: "example-cluster"
# -- Set the trust domain to use for the spiffe identifiers
trustDomain: "example.org"
# -- Override all instances of bundleConfigMap
bundleConfigMap: ""
# telemetry:
# prometheus:
# enabled: true
@@ -11,10 +19,6 @@ fullnameOverride: ""
spire-server:
enabled: true
nameOverride: server
bundleConfigMap: &bundleConfigMap spire-bundle
clusterName: &clusterName "example-cluster"
trustDomain: &trustDomain "example.org"
controllerManager:
enabled: true
@@ -22,14 +26,9 @@ spire-server:
spire-agent:
enabled: true
nameOverride: agent
bundleConfigMap: *bundleConfigMap
clusterName: *clusterName
trustDomain: *trustDomain
spiffe-csi-driver:
enabled: true
spiffe-oidc-discovery-provider:
enabled: false
trustDomain: *trustDomain