Add support for AWS KMS key tagging (#721)
* Add support for AWS KMS key tagging Signed-off-by: Shubham Hibare <[email protected]> * fix doc Signed-off-by: Shubham Hibare <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: Marco Franssen <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> --------- Signed-off-by: Shubham Hibare <[email protected]> Signed-off-by: Shubham Hibare <[email protected]> Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
Shubham Hibare
co-authored by
Marco Franssen
Marco Franssen
parent
db8f135204
commit
87da80a89a
@@ -80,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||
| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
@@ -209,6 +209,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||
| `keyManager.awsKMS.keyTags` | Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'. | `{}` |
|
||||
| `keyManager.awsKMS.accessKeyID` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. | `""` |
|
||||
| `keyManager.awsKMS.secretAccessKey` | Secret access key for the AWS account. | `""` |
|
||||
| `upstreamAuthority.disk.enabled` | Flag to enable upstream authority plugin on disk | `false` |
|
||||
|
||||
@@ -286,6 +286,12 @@ plugins:
|
||||
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
|
||||
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
|
||||
{{- end }}
|
||||
{{- with .keyTags }}
|
||||
key_tags:
|
||||
{{- range $key, $value := . }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -400,6 +400,11 @@ keyManager:
|
||||
policy: ""
|
||||
## @param keyManager.awsKMS.keyPolicy.existingConfigMap [nullable] Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
|
||||
existingConfigMap: ""
|
||||
## @param keyManager.awsKMS.keyTags [object] Custom tags to apply to KMS keys created by the plugin. Tags are key-value pairs used for resource management and cost allocation. When using key tagging, you must add the `kms:TagResource` permission to your IAM policy. Constraints: keys (1-128 chars), values (0-256 chars), max 50 tags, valid chars (letters, numbers, spaces, + - = . _ : / @), keys cannot start with 'aws:' or 'spire-'.
|
||||
keyTags: {}
|
||||
# Environment: "production"
|
||||
# Team: "security"
|
||||
# Component: "spire"
|
||||
## @param keyManager.awsKMS.accessKeyID [nullable] Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
|
||||
accessKeyID: ""
|
||||
## @param keyManager.awsKMS.secretAccessKey [nullable] Secret access key for the AWS account.
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
# AWS KMS Key Tagging
|
||||
|
||||
This example demonstrates how to configure custom tags for AWS KMS keys created by the SPIRE server.
|
||||
|
||||
## Configuration
|
||||
|
||||
The AWS KMS KeyManager supports tagging of KMS keys with user-defined tags:
|
||||
|
||||
| Parameter | Description | Default |
|
||||
|-------------------------------|-----------------------------------------------------|---------|
|
||||
| **keyManager.awsKMS.enabled** | Enable AWS KMS key manager | false |
|
||||
| **keyManager.awsKMS.region** | AWS region for KMS keys | "" |
|
||||
| **keyManager.awsKMS.keyTags** | Custom tags to apply to KMS keys (key-value pairs) | {} |
|
||||
|
||||
### Sample Configuration
|
||||
|
||||
```yaml
|
||||
spire-server:
|
||||
keyManager:
|
||||
disk:
|
||||
enabled: false
|
||||
awsKMS:
|
||||
enabled: true
|
||||
region: "us-east-1"
|
||||
keyIdentifierFile:
|
||||
enabled: true
|
||||
keyTags:
|
||||
Environment: "production"
|
||||
Team: "security"
|
||||
Component: "spire"
|
||||
```
|
||||
|
||||
## Tag Constraints
|
||||
|
||||
- Tag keys: 1-128 characters
|
||||
- Tag values: 0-256 characters
|
||||
- Maximum: 50 tags per key
|
||||
- Valid characters: letters, numbers, spaces, `+ - = . _ : / @`
|
||||
- Keys cannot start with `aws:` (AWS reserved) or `spire-` (SPIRE reserved)
|
||||
|
||||
## Required IAM Permissions
|
||||
|
||||
When using key tagging, the IAM role must include the `kms:TagResource` permission:
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"kms:CreateAlias",
|
||||
"kms:CreateKey",
|
||||
"kms:DescribeKey",
|
||||
"kms:GetPublicKey",
|
||||
"kms:ListKeys",
|
||||
"kms:ListAliases",
|
||||
"kms:ScheduleKeyDeletion",
|
||||
"kms:Sign",
|
||||
"kms:TagResource",
|
||||
"kms:UpdateAlias",
|
||||
"kms:DeleteAlias"
|
||||
],
|
||||
"Resource": "*"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Note:** It's recommended to use [IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) instead of access keys.
|
||||
|
||||
## Additional Information
|
||||
|
||||
For more details on the AWS KMS plugin, see the [SPIRE AWS KMS KeyManager Documentation](https://github.com/spiffe/spire/blob/main/doc/plugin_server_keymanager_aws_kms.md).
|
||||
@@ -0,0 +1,13 @@
|
||||
spire-server:
|
||||
keyManager:
|
||||
disk:
|
||||
enabled: false
|
||||
awsKMS:
|
||||
enabled: true
|
||||
region: "us-east-1"
|
||||
keyIdentifierFile:
|
||||
enabled: true
|
||||
keyTags:
|
||||
Environment: "production"
|
||||
Team: "security"
|
||||
Component: "spire"
|
||||
Reference in New Issue
Block a user