Add support for AWS KMS key tagging (#721)
* Add support for AWS KMS key tagging Signed-off-by: Shubham Hibare <[email protected]> * fix doc Signed-off-by: Shubham Hibare <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> --------- Signed-off-by: Shubham Hibare <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
Shubham Hibare
co-authored by
Marco Franssen
Marco Franssen
parent
db8f135204
commit
87da80a89a
@@ -80,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||||
@@ -209,6 +209,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||||
|
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
||||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||||
|
|||||||
@@ -286,6 +286,12 @@ plugins:
|
|||||||
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
|
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
|
||||||
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
|
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .keyTags }}
|
||||||
|
key_tags:
|
||||||
|
{{- range $key, $value := . }}
|
||||||
|
{{ $key }}: {{ $value | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
|||||||
@@ -400,6 +400,11 @@ keyManager:
|
|||||||
policy: ""
|
policy: ""
|
||||||
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
|
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
|
||||||
existingConfigMap: ""
|
existingConfigMap: ""
|
||||||
|
## @param keyManager.awsKMS.keyTags [object] Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'.
|
||||||
|
keyTags: {}
|
||||||
|
# Environment: "production"
|
||||||
|
# Team: "security"
|
||||||
|
# Component: "spire"
|
||||||
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
|
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
|
||||||
accessKeyID: ""
|
accessKeyID: ""
|
||||||
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
|
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
|
||||||
|
|||||||
@@ -0,0 +1,74 @@
|
|||||||
|
# AWS KMS Key Tagging
|
||||||
|
|
||||||
|
This example demonstrates how to configure custom tags for AWS KMS keys created by the SPIRE server.
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
The AWS KMS KeyManager supports tagging of KMS keys with user-defined tags:
|
||||||
|
|
||||||
|
| Parameter | Description | Default |
|
||||||
|
|-------------------------------|-----------------------------------------------------|---------|
|
||||||
|
| **keyManager.awsKMS.enabled** | Enable AWS KMS key manager | false |
|
||||||
|
| **keyManager.awsKMS.region** | AWS region for KMS keys | "" |
|
||||||
|
| **keyManager.awsKMS.keyTags** | Custom tags to apply to KMS keys (key-value pairs) | {} |
|
||||||
|
|
||||||
|
### Sample Configuration
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
spire-server:
|
||||||
|
keyManager:
|
||||||
|
disk:
|
||||||
|
enabled: false
|
||||||
|
awsKMS:
|
||||||
|
enabled: true
|
||||||
|
region: "us-east-1"
|
||||||
|
keyIdentifierFile:
|
||||||
|
enabled: true
|
||||||
|
keyTags:
|
||||||
|
Environment: "production"
|
||||||
|
Team: "security"
|
||||||
|
Component: "spire"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Tag Constraints
|
||||||
|
|
||||||
|
- Tag keys: 1-128 characters
|
||||||
|
- Tag values: 0-256 characters
|
||||||
|
- Maximum: 50 tags per key
|
||||||
|
- Valid characters: letters, numbers, spaces, `+ - = . _ : / @`
|
||||||
|
- Keys cannot start with `aws:` (AWS reserved) or `spire-` (SPIRE reserved)
|
||||||
|
|
||||||
|
## Required IAM Permissions
|
||||||
|
|
||||||
|
When using key tagging, the IAM role must include the `kms:TagResource` permission:
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"Version": "2012-10-17",
|
||||||
|
"Statement": [
|
||||||
|
{
|
||||||
|
"Effect": "Allow",
|
||||||
|
"Action": [
|
||||||
|
"kms:CreateAlias",
|
||||||
|
"kms:CreateKey",
|
||||||
|
"kms:DescribeKey",
|
||||||
|
"kms:GetPublicKey",
|
||||||
|
"kms:ListKeys",
|
||||||
|
"kms:ListAliases",
|
||||||
|
"kms:ScheduleKeyDeletion",
|
||||||
|
"kms:Sign",
|
||||||
|
"kms:TagResource",
|
||||||
|
"kms:UpdateAlias",
|
||||||
|
"kms:DeleteAlias"
|
||||||
|
],
|
||||||
|
"Resource": "*"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
**Note:** It's recommended to use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) instead of access keys.
|
||||||
|
|
||||||
|
## Additional Information
|
||||||
|
|
||||||
|
For more details on the AWS KMS plugin, see the [SPIRE AWS KMS KeyManager Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_server_keymanager_aws_kms.md).
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
spire-server:
|
||||||
|
keyManager:
|
||||||
|
disk:
|
||||||
|
enabled: false
|
||||||
|
awsKMS:
|
||||||
|
enabled: true
|
||||||
|
region: "us-east-1"
|
||||||
|
keyIdentifierFile:
|
||||||
|
enabled: true
|
||||||
|
keyTags:
|
||||||
|
Environment: "production"
|
||||||
|
Team: "security"
|
||||||
|
Component: "spire"
|
||||||
Reference in New Issue
Block a user