From 8887d017b0f279ba37c7287c8059b1a593392bc9 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Thu, 28 Mar 2024 11:38:36 -0700 Subject: [PATCH] Enable serviceAccountAllowList to autocalculate namespace (#304) * Enable serviceAccountAllowList to autocalculate namespace Signed-off-by: Kevin Fox * Incorperate feedback Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 * Fix docs Signed-off-by: Kevin Fox --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 2 +- .../charts/spire-server/templates/_helpers.tpl | 13 +++++++++++-- charts/spire/charts/spire-server/values.yaml | 2 +- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 1ecad75..9309b48 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -302,7 +302,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | -| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` | | `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 87d8060..b3b6062 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -145,10 +145,19 @@ Create the name of the service account to use {{- end }} {{- define "spire-server.serviceAccountAllowedList" }} +{{- $releaseNamespace := include "spire-server.agent-namespace" . }} {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} -{{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }} +{{- $list := list }} +{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }} +{{- if contains ":" . }} +{{- $list = append $list . }} +{{- else }} +{{- $list = append $list ( printf "%s:%s" $releaseNamespace . ) | }} +{{- end }} +{{- end }} +{{- $list | toJson }} {{- else }} -[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}] +[{{ printf "%s:%s-agent" $releaseNamespace .Release.Name | quote }}] {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5c449be..82db888 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -718,7 +718,7 @@ nodeAttestor: k8sPsat: ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor enabled: true - ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor + ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. serviceAccountAllowList: [] ## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used audience: ["spire-server"]