diff --git a/charts/spire/README.md b/charts/spire/README.md index 172d736..dd17d84 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -88,6 +88,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see for details. +### 0.24.X + +We have added the remaining options needed for the SPIRE Server SQL data store plugin. We have removed `spire-server.dataStore.sql.plugin_data` section as it is no longer needed. If you are using it, please migrate +your settings to the ones under `spire-server.dataStore.sql`. + ### 0.23.X In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 19dc4a1..a2e7852 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -132,10 +132,25 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` | | `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` | | `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` | -| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` | +| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` | +| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` | +| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` | | `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` | | `dataStore.sql.externalSecret.name` | The name of the secret object | `""` | | `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | +| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` | +| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` | +| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` | +| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` | +| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` | +| `dataStore.sql.readOnly.host` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` | +| `dataStore.sql.readOnly.username` | Only used by "postgres" or "mysql" | `spire` | +| `dataStore.sql.readOnly.password` | Only used by "postgres" or "mysql" | `""` | +| `dataStore.sql.readOnly.options` | Only used by "postgres" or "mysql" | `[]` | +| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` | +| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` | +| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` | | `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` | | `auditLogEnabled` | If true, enables audit logging | `false` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index ce0fb91..299dae3 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -189,7 +189,7 @@ Create the name of the service account to use {{- end }} {{- define "spire-server.datastore-config" }} -{{- $config := deepCopy .Values.dataStore.sql.plugin_data }} +{{- $config := dict }} {{- if eq .Values.dataStore.sql.databaseType "sqlite3" }} {{- $_ := set $config "database_type" "sqlite3" }} {{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }} @@ -198,11 +198,21 @@ Create the name of the service account to use {{- $port := int .Values.dataStore.sql.port | default 3306 }} {{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }} {{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 3306 }} + {{- $roQuery := include "spire-server.config-mysql-query" .Values.dataStore.sql.readOnly.options }} + {{- $_ := set $config "ro_connection_string" (printf "%s:${RODBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }} + {{- end }} {{- else if eq .Values.dataStore.sql.databaseType "postgres" }} {{- $_ := set $config "database_type" "postgres" }} {{- $port := int .Values.dataStore.sql.port | default 5432 }} {{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }} {{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + {{- $roPort := int .Values.dataStore.sql.readOnly.port | default 5432 }} + {{- $roOptions:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.readOnly.options }} + {{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s password=${RODBPW} host=%s port=%d%s" .Values.dataStore.sql.readOnly.databaseName .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort $roOptions) }} + {{- end }} {{- else }} {{- fail "Unsupported database type" }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d5ca253..5f2ed55 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -101,7 +101,22 @@ plugins: DataStore: sql: plugin_data: - {{ include "spire-server.datastore-config" . | nindent 10 }} + {{ include "spire-server.datastore-config" . | nindent 8 }} + {{- if ne .Values.dataStore.sql.rootCAPath "" }} + root_ca_path: {{ .Values.dataStore.sql.rootCAPath }} + {{- end }} + {{- if ne .Values.dataStore.sql.clientCertPath "" }} + client_cert_path: {{ .Values.dataStore.sql.clientCertPath }} + {{- end }} + {{- if ne .Values.dataStore.sql.clientKeyPath "" }} + client_key_path : {{ .Values.dataStore.sql.clientKeyPath }} + {{- end }} + max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }} + max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }} + {{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }} + conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }} + {{- end }} + disable_migration: {{ .Values.dataStore.sql.disableMigration }} {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }} NodeAttestor: diff --git a/charts/spire/charts/spire-server/templates/secret.yaml b/charts/spire/charts/spire-server/templates/secret.yaml index c318280..8ba00a2 100644 --- a/charts/spire/charts/spire-server/templates/secret.yaml +++ b/charts/spire/charts/spire-server/templates/secret.yaml @@ -16,5 +16,8 @@ metadata: namespace: {{ include "spire-server.namespace" . }} data: DBPW: {{ .Values.dataStore.sql.password | b64enc }} + {{- if .Values.dataStore.sql.readOnly.enabled }} + RODBPW: {{ .Values.dataStore.sql.readOnly.password | b64enc }} + {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index e6b5491..3cf971b 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -50,6 +50,20 @@ {{- else }} {{- fail "Unsupported kind." }} {{- end }} +{{- if hasKey .Values.dataStore.sql "plugin_data" }} +{{- fail "The plugin_data setting to the sql data store is no longer supported." }} +{{- end }} +{{- if ne .Values.dataStore.sql.databaseType "mysql" }} +{{- if ne .Values.dataStore.sql.rootCAPath "" }} +{{- fail "rootCAPath can only be set with database type mysql." }} +{{- end }} +{{- if ne .Values.dataStore.sql.clientCertPath "" }} +{{- fail "clientCertPath can only be set with database type mysql." }} +{{- end }} +{{- if ne .Values.dataStore.sql.clientKeyPath "" }} +{{- fail "clientKeyPath can only be set with database type mysql." }} +{{- end }} +{{- end }} {{- if not .Values.externalServer }} apiVersion: apps/v1 {{- if eq .Values.kind "statefulset" }} @@ -195,6 +209,19 @@ spec: name: {{ $fullname }}-dbpw key: DBPW {{- end }} + {{- if and .Values.dataStore.sql.readOnly.enabled .Values.dataStore.sql.readOnly.externalSecret.enabled }} + - name: RODBPW + valueFrom: + secretKeyRef: + name: {{ .Values.dataStore.sql.readOnly.externalSecret.name }} + key: {{ .Values.dataStore.sql.readOnly.externalSecret.key }} + {{- else if .Values.dataStore.sql.readOnly.enabled }} + - name: RODBPW + valueFrom: + secretKeyRef: + name: {{ $fullname }}-dbpw + key: RODBPW + {{- end }} {{- end }} {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} - name: AWS_KMS_ACCESS_KEY_ID diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index b88485d..11a81e9 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -170,8 +170,12 @@ dataStore: ## @param dataStore.sql.options [array] Only used by "postgres" or "mysql" options: [] - ## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section - plugin_data: {} + ## @param dataStore.sql.rootCAPath Path to Root CA bundle (MySQL only) + rootCAPath: "" + ## @param dataStore.sql.clientCertPath Path to client certificate (MySQL only) + clientCertPath: "" + ## @param dataStore.sql.clientKeyPath Path to private key for client certificate (MySQL only) + clientKeyPath: "" ## When an external source creates the secret. The secret should reside in the same namespace as the spire server externalSecret: @@ -182,6 +186,37 @@ dataStore: ## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password key: "" + ## @param dataStore.sql.maxOpenConns The maximum number of open db connections + maxOpenConns: 100 + ## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool + maxIdleConns: 2 + ## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited + connMaxLifetime: 0 + ## @param dataStore.sql.disableMigration True to disable auto-migration functionality + disableMigration: false + + readOnly: + ## @param dataStore.sql.readOnly.enabled Set to true to configure a readOnly dartabase connection + enabled: false + ## @param dataStore.sql.readOnly.host Only used by "postgres" or "mysql" + host: "" + ## @param dataStore.sql.readOnly.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. + port: 0 + ## @param dataStore.sql.readOnly.username Only used by "postgres" or "mysql" + username: spire + ## @param dataStore.sql.readOnly.password Only used by "postgres" or "mysql" + password: "" + ## @param dataStore.sql.readOnly.options [array] Only used by "postgres" or "mysql" + options: [] + ## When an external source creates the secret. The secret should reside in the same namespace as the spire server + externalSecret: + ## @param dataStore.sql.readOnly.externalSecret.enabled Enable external secret for datastore creds + enabled: false + ## @param dataStore.sql.readOnly.externalSecret.name The name of the secret object + name: "" + ## @param dataStore.sql.readOnly.externalSecret.key The key of the secret object whose value is the dataStore.sql password + key: "" + ## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. adminIDs: [] ## @param auditLogEnabled If true, enables audit logging