Update for 1.12.4 (#605)
* Update for 1.12.3 Signed-off-by: Kevin Fox <[email protected]> * Fix typo. Use test image Signed-off-by: Kevin Fox <[email protected]> * Fix lint Signed-off-by: Kevin Fox <[email protected]> * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox <[email protected]> * Fix role Signed-off-by: Kevin Fox <[email protected]> * Update rbac Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix format Signed-off-by: Kevin Fox <[email protected]> * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox <[email protected]> * Update key Signed-off-by: Kevin Fox <[email protected]> * Fix test rather then reconfigure Signed-off-by: Kevin Fox <[email protected]> * Add namespace Signed-off-by: Kevin Fox <[email protected]> * Update to follow the new patch Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Update filename based on format Signed-off-by: Kevin Fox <[email protected]> * Add upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update for final release Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -3,7 +3,7 @@ name: spire-server
|
||||
description: A Helm chart to install the SPIRE server.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "1.12.2"
|
||||
appVersion: "1.12.4"
|
||||
keywords: ["spiffe", "spire-server", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
sources:
|
||||
|
||||
@@ -256,11 +256,11 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `upstreamAuthority.vault.k8sAuth.k8sAuthRoleName` | Required - Name of the Vault role. The plugin authenticates against the named role | `""` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.audience` | Intended audience of the PSAT, it must match one of the audiences supported by the Kubernetes API server. If no audience is specified, it defaults to the identifier of API Server. See ['Service Account Documentation'](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection) for more info. | `vault` |
|
||||
| `upstreamAuthority.vault.k8sAuth.token.expiry` | Expiry time in seconds for the token | `7200` |
|
||||
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `notifier.k8sBundle.enabled` | Enable local k8s bundle uploader | `false` |
|
||||
| `notifier.k8sBundle.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `notifier.k8sBundle.apiServiceLabel` | If set, rotate the CA Bundle in API services with this label set to true. | `""` |
|
||||
| `notifier.k8sBundle.webhookLabel` | If set, rotate the CA Bundle in validating and mutating webhooks with this label set to true. | `""` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `true` |
|
||||
| `notifier.externalK8sBundle.enabled` | Enable external k8s bundle uploader | `false` |
|
||||
| `notifier.externalK8sBundle.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `notifier.externalK8sBundle.defaults.configMap` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `notifier.externalK8sBundle.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `bundle.crt` |
|
||||
@@ -396,6 +396,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.enabled` | Enable external k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.namespace` | Namespace to push the bundle into on clusters | `spire-system` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapName` | ConfigMap name to push the bundle into on external clusters | `spire-bundle-upstream` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.configMapKey` | ConfigMap key to push the bundle into on external clusters | `""` |
|
||||
| `bundlePublisher.externalK8sConfigMap.defaults.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
| `bundlePublisher.externalK8sConfigMap.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||
|
||||
@@ -65,7 +65,23 @@ Allow the release namespace to be overridden for multi-namespace deployments in
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace" -}}
|
||||
{{- define "spire-server.bundle-namespace-bundlepublisher" -}}
|
||||
{{- if .Values.bundlePublisher.k8sConfigMap.namespace }}
|
||||
{{- .Values.bundlePublisher.k8sConfigMap.namespace }}
|
||||
{{- else if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "system" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.system.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-system" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace-notifier" -}}
|
||||
{{- if .Values.notifier.k8sBundle.namespace }}
|
||||
{{- .Values.notifier.k8sBundle.namespace }}
|
||||
{{- else if .Values.namespaceOverride -}}
|
||||
@@ -81,6 +97,14 @@ Allow the release namespace to be overridden for multi-namespace deployments in
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-server.bundle-namespace" -}}
|
||||
{{- if .Values.notifier.k8sBundle.namespace }}
|
||||
{{- .Values.notifier.k8sBundle.namespace }}
|
||||
{{- else }}
|
||||
{{- include "spire-server.bundle-namespace-bundlepublisher" . -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.podMonitor.namespace" -}}
|
||||
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||
|
||||
@@ -1,3 +1,7 @@
|
||||
{{- if and .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
{{- fail "You can only enable either notifier.k8sBundle or bundlePublisher.k8sConfigMap." }}
|
||||
{{- end }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- $namespace := include "spire-server.bundle-namespace" . }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -8,3 +12,4 @@ metadata:
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -274,7 +274,7 @@ plugins:
|
||||
k8sbundle:
|
||||
plugin_data:
|
||||
{{- if eq (.Values.notifier.k8sBundle.enabled | toString) "true" }}
|
||||
namespace: {{ include "spire-server.bundle-namespace" . | quote }}
|
||||
namespace: {{ include "spire-server.bundle-namespace-notifier" . | quote }}
|
||||
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||
{{- with .Values.notifier.k8sBundle.apiServiceLabel }}
|
||||
api_service_label: {{ . | quote }}
|
||||
@@ -304,8 +304,51 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
{{- $externalK8sConfigMapClusters := default .Values.kubeConfigs .Values.bundlePublisher.externalK8sConfigMap.clusters }}
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled .Values.bundlePublisher.k8sConfigMap.enabled (and .Values.bundlePublisher.externalK8sConfigMap.enabled (ne (len $externalK8sConfigMapClusters) 0)) }}
|
||||
BundlePublisher:
|
||||
{{- if or .Values.bundlePublisher.k8sConfigMap.enabled (and .Values.bundlePublisher.externalK8sConfigMap.enabled (ne (len $externalK8sConfigMapClusters) 0)) }}
|
||||
k8s_configmap:
|
||||
plugin_data:
|
||||
clusters:
|
||||
{{- $prefix := "-" }}
|
||||
{{- if eq (.Values.bundlePublisher.k8sConfigMap.enabled | toString) "true" }}
|
||||
{{ $prefix }} chart-internal:
|
||||
format: {{ .Values.bundlePublisher.k8sConfigMap.format | quote }}
|
||||
namespace: {{ include "spire-server.bundle-namespace-bundlepublisher" . | quote }}
|
||||
configmap_name: {{ include "spire-lib.bundle-configmap" . | quote }}
|
||||
configmap_key: {{ printf "bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" .Values.bundlePublisher.k8sConfigMap.format)) | quote }}
|
||||
{{- $prefix := " " }}
|
||||
{{- end }}
|
||||
{{- if and (eq (.Values.bundlePublisher.externalK8sConfigMap.enabled | toString) "true") (ne (len $externalK8sConfigMapClusters) 0) }}
|
||||
{{- $clusterDefaults := .Values.bundlePublisher.externalK8sConfigMap.defaults }}
|
||||
{{- range $name, $_ := $externalK8sConfigMapClusters }}
|
||||
{{ $prefix }} {{ $name | quote }}:
|
||||
{{- $clusterSettings := dict }}
|
||||
{{- if hasKey $root.Values.bundlePublisher.externalK8sConfigMap.clusters $name }}
|
||||
{{- $clusterSettings = index $root.Values.bundlePublisher.externalK8sConfigMap.clusters $name }}
|
||||
{{- end }}
|
||||
{{- if hasKey $clusterSettings "kubeConfigName" }}
|
||||
kubeconfig_path: /kubeconfigs/{{ $clusterSettings.kubeConfigName }}
|
||||
{{- else }}
|
||||
kubeconfig_path: /kubeconfigs/{{ $name }}
|
||||
{{- end }}
|
||||
{{- $format := $clusterDefaults.format }}
|
||||
{{- if hasKey $clusterSettings "format" }}{{- $format = $clusterSettings.format }}{{- end }}
|
||||
format: {{ $format | quote }}
|
||||
namespace: {{ if hasKey $clusterSettings "namespace" }}{{ $clusterSettings.namespace }}{{ else }}{{ $clusterDefaults.namespace }}{{ end }}
|
||||
configmap_name: {{ if hasKey $clusterSettings "configMapName" }}{{ $clusterSettings.configMapName }}{{ else }}{{ $clusterDefaults.configMapName }}{{ end }}
|
||||
{{- if hasKey $clusterSettings "configMapKey" }}
|
||||
configmap_key: {{ $clusterSettings.configMapKey | quote }}
|
||||
{{- else if ne $clusterDefaults.configMapKey "" }}
|
||||
configmap_key: {{ $clusterDefaults.configMapKey | quote }}
|
||||
{{- else }}
|
||||
configmap_key: {{ printf "bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" $format)) | quote }}
|
||||
{{- end }}
|
||||
{{- $prefix := " " }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
||||
aws_rolesanywhere_trustanchor:
|
||||
plugin_data:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{{- $subject := include "spire-server.subject" . }}
|
||||
{{- $namespace := include "spire-server.namespace" . }}
|
||||
{{- $bundleNamespace := include "spire-server.bundle-namespace" . }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- if or .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
# Role to be able to push certificate bundles to a configmap
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
@@ -15,6 +15,9 @@ rules:
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
{{- if .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
- create
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }}
|
||||
---
|
||||
@@ -48,7 +51,7 @@ roleRef:
|
||||
name: {{ include "spire-server.fullname" . }}-cm
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
{{- if .Values.notifier.k8sBundle.enabled }}
|
||||
{{- if or .Values.notifier.k8sBundle.enabled .Values.bundlePublisher.k8sConfigMap.enabled }}
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
|
||||
@@ -514,7 +514,7 @@ upstreamAuthority:
|
||||
notifier:
|
||||
k8sBundle:
|
||||
## @param notifier.k8sBundle.enabled Enable local k8s bundle uploader
|
||||
enabled: true
|
||||
enabled: false
|
||||
## @param notifier.k8sBundle.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
||||
namespace: ""
|
||||
## @param notifier.k8sBundle.apiServiceLabel If set, rotate the CA Bundle in API services with this label set to true.
|
||||
@@ -523,7 +523,7 @@ notifier:
|
||||
webhookLabel: ""
|
||||
externalK8sBundle:
|
||||
## @param notifier.externalK8sBundle.enabled Enable external k8s bundle uploader
|
||||
enabled: true
|
||||
enabled: false
|
||||
defaults:
|
||||
## @param notifier.externalK8sBundle.defaults.namespace Namespace to push the bundle into on clusters
|
||||
namespace: "spire-system"
|
||||
@@ -978,6 +978,30 @@ nodeAttestor:
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
k8sConfigMap:
|
||||
## @param bundlePublisher.k8sConfigMap.enabled Enable local k8s bundle uploader
|
||||
enabled: true
|
||||
## @param bundlePublisher.k8sConfigMap.namespace Namespace to push the bundle into, if blank will default to SPIRE Server namespace
|
||||
namespace: ""
|
||||
## @param bundlePublisher.k8sConfigMap.format Format of the trust bundle. Can be pem or spiffe
|
||||
format: spiffe
|
||||
externalK8sConfigMap:
|
||||
## @param bundlePublisher.externalK8sConfigMap.enabled Enable external k8s bundle uploader
|
||||
enabled: true
|
||||
defaults:
|
||||
## @param bundlePublisher.externalK8sConfigMap.defaults.namespace Namespace to push the bundle into on clusters
|
||||
namespace: "spire-system"
|
||||
## @param bundlePublisher.externalK8sConfigMap.defaults.configMapName ConfigMap name to push the bundle into on external clusters
|
||||
configMapName: "spire-bundle-upstream"
|
||||
## @param bundlePublisher.externalK8sConfigMap.defaults.configMapKey ConfigMap key to push the bundle into on external clusters
|
||||
configMapKey: ""
|
||||
## @param bundlePublisher.externalK8sConfigMap.defaults.format Format of the trust bundle. Can be pem or spiffe
|
||||
format: spiffe
|
||||
## @param bundlePublisher.externalK8sConfigMap.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
|
||||
clusters: {}
|
||||
# clustera:
|
||||
# namespace: foo
|
||||
# clusterb: {}
|
||||
awsRolesAnywhereTrustAnchor:
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
|
||||
enabled: false
|
||||
|
||||
Reference in New Issue
Block a user