panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable serviceAccountAllowList to autocalculate namespace (#304)

Browse Source 
* Enable serviceAccountAllowList to autocalculate namespace

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-03-28 11:38:36 -07:00
committed by GitHub
co-authored by Faisal Memon
parent d418ee16f8
commit 8887d017b0
3 changed files with 13 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1 -1
View File
@@ -302,7 +302,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `defaultX509SvidTTL` | TTL for X509 Svids | `4h` | | `defaultX509SvidTTL` | TTL for X509 Svids | `4h` |
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used. | `[]` |
| `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPsat.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
| `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.k8sPsat.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
| `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | | `nodeAttestor.k8sPsat.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
charts/spire/charts/spire-server/templates/_helpers.tpl
+11 -2
View File
@@ -145,10 +145,19 @@ Create the name of the service account to use
{{- end }} {{- end }}
{{- define "spire-server.serviceAccountAllowedList" }} {{- define "spire-server.serviceAccountAllowedList" }}
{{- $releaseNamespace := include "spire-server.agent-namespace" . }}
{{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }} {{- if ne (len .Values.nodeAttestor.k8sPsat.serviceAccountAllowList) 0 }}
{{- .Values.nodeAttestor.k8sPsat.serviceAccountAllowList | toJson }} {{- $list := list }}
{{- range .Values.nodeAttestor.k8sPsat.serviceAccountAllowList }}
{{- if contains ":" . }}
{{- $list = append $list . }}
{{- else }}
{{- $list = append $list ( printf "%s:%s" $releaseNamespace . ) | }}
{{- end }}
{{- end }}
{{- $list | toJson }}
{{- else }} {{- else }}
[{{ printf "%s:%s-agent" (include "spire-server.agent-namespace" .) .Release.Name | quote }}] [{{ printf "%s:%s-agent" $releaseNamespace .Release.Name | quote }}]
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/values.yaml
+1 -1
View File
@@ -718,7 +718,7 @@ nodeAttestor:
k8sPsat: k8sPsat:
## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor ## @param nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor
enabled: true enabled: true
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor. If namespace isn't specified, release namespace will be used.
serviceAccountAllowList: [] serviceAccountAllowList: []
## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used ## @param nodeAttestor.k8sPsat.audience [array] Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used
audience: ["spire-server"] audience: ["spire-server"]