panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Protects SPIRE Agent's Chart Against YAML Template Injection (#450)

Browse Source 
* protects agent's chart against template injection

Signed-off-by: Nico Weisenauer <[email protected]>

* removes unnecessary braces and whitespace

Signed-off-by: Nico Weisenauer <[email protected]>

* Removes int type validation via cast

Signed-off-by: Nico Weisenauer <[email protected]>

---------

Signed-off-by: Nico Weisenauer <[email protected]>
This commit is contained in:
nweisenauer
2024-09-16 06:23:01 -07:00
committed by GitHub
parent ea710023f4
commit 8832da39b4
8 changed files with 61 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/templates/configmap.yaml
+7 -7
View File
@@ -53,7 +53,7 @@ agent:
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }}
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSpiffeCertValidation true }}
{{- end }}
{{- with .Values.experimental }}
@@ -97,7 +97,7 @@ plugins:
{{- if eq (.enabled | toString) "true" }}
tpm:
plugin_cmd: "/tpm/tpm_attestor_agent"
plugin_checksum: {{ .plugin.checksum }}
plugin_checksum: {{ .plugin.checksum | quote }}
plugin_data: {}
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
{{- end }}
@@ -126,9 +126,9 @@ plugins:
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
{{- end }}
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}}
use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }}
verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }}
{{- if eq (include "spire-agent.connect-by-hostname" .) "true" }}
node_name_env: "MY_NODE_NAME"
{{- end }}
@@ -168,8 +168,8 @@ telemetry:
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-agent.fullname" . }}{{ $nameSuffix }}
namespace: {{ include "spire-agent.namespace" . }}
name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
namespace: {{ include "spire-agent.namespace" . | quote }}
{{- with .Values.configMap.annotations }}
annotations:
{{- toYaml . | nindent 4 }}