Add remaining data store options (#463)
* Add remaining data store options Signed-off-by: Kevin Fox <[email protected]> * Fix env var Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update charts/spire/README.md Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -88,6 +88,11 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
|||||||
|
|
||||||
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
||||||
|
|
||||||
|
### 0.24.X
|
||||||
|
|
||||||
|
We have added the remaining options needed for the SPIRE Server SQL data store plugin. We have removed `spire-server.dataStore.sql.plugin_data` section as it is no longer needed. If you are using it, please migrate
|
||||||
|
your settings to the ones under `spire-server.dataStore.sql`.
|
||||||
|
|
||||||
### 0.23.X
|
### 0.23.X
|
||||||
|
|
||||||
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
|
In previous versions, the setting spire-agent.workloadAttestors.k8s.skipKubeletVerification was set to true by default. Starting in 0.23.x, we removed that setting and replaced it with
|
||||||
|
|||||||
@@ -132,10 +132,25 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
| `dataStore.sql.username` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
| `dataStore.sql.password` | Only used by "postgres" or "mysql" | `""` |
|
||||||
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
| `dataStore.sql.options` | Only used by "postgres" or "mysql" | `[]` |
|
||||||
| `dataStore.sql.plugin_data` | Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section | `{}` |
|
| `dataStore.sql.rootCAPath` | Path to Root CA bundle (MySQL only) | `""` |
|
||||||
|
| `dataStore.sql.clientCertPath` | Path to client certificate (MySQL only) | `""` |
|
||||||
|
| `dataStore.sql.clientKeyPath` | Path to private key for client certificate (MySQL only) | `""` |
|
||||||
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
| `dataStore.sql.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
| `dataStore.sql.externalSecret.name` | The name of the secret object | `""` |
|
||||||
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
| `dataStore.sql.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
|
| `dataStore.sql.maxOpenConns` | The maximum number of open db connections | `100` |
|
||||||
|
| `dataStore.sql.maxIdleConns` | The maximum number of idle connections in the pool | `2` |
|
||||||
|
| `dataStore.sql.connMaxLifetime` | The maximum amount of time a connection may be reused. If 0, time is unlimited | `0` |
|
||||||
|
| `dataStore.sql.disableMigration` | True to disable auto-migration functionality | `false` |
|
||||||
|
| `dataStore.sql.readOnly.enabled` | Set to true to configure a readOnly dartabase connection | `false` |
|
||||||
|
| `dataStore.sql.readOnly.host` | Only used by "postgres" or "mysql" | `""` |
|
||||||
|
| `dataStore.sql.readOnly.port` | If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases. | `0` |
|
||||||
|
| `dataStore.sql.readOnly.username` | Only used by "postgres" or "mysql" | `spire` |
|
||||||
|
| `dataStore.sql.readOnly.password` | Only used by "postgres" or "mysql" | `""` |
|
||||||
|
| `dataStore.sql.readOnly.options` | Only used by "postgres" or "mysql" | `[]` |
|
||||||
|
| `dataStore.sql.readOnly.externalSecret.enabled` | Enable external secret for datastore creds | `false` |
|
||||||
|
| `dataStore.sql.readOnly.externalSecret.name` | The name of the secret object | `""` |
|
||||||
|
| `dataStore.sql.readOnly.externalSecret.key` | The key of the secret object whose value is the dataStore.sql password | `""` |
|
||||||
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
| `adminIDs` | SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges. | `[]` |
|
||||||
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
| `auditLogEnabled` | If true, enables audit logging | `false` |
|
||||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||||
|
|||||||
@@ -189,7 +189,7 @@ Create the name of the service account to use
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- define "spire-server.datastore-config" }}
|
{{- define "spire-server.datastore-config" }}
|
||||||
{{- $config := deepCopy .Values.dataStore.sql.plugin_data }}
|
{{- $config := dict }}
|
||||||
{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
|
{{- if eq .Values.dataStore.sql.databaseType "sqlite3" }}
|
||||||
{{- $_ := set $config "database_type" "sqlite3" }}
|
{{- $_ := set $config "database_type" "sqlite3" }}
|
||||||
{{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }}
|
{{- $_ := set $config "connection_string" "/run/spire/data/datastore.sqlite3" }}
|
||||||
@@ -198,11 +198,21 @@ Create the name of the service account to use
|
|||||||
{{- $port := int .Values.dataStore.sql.port | default 3306 }}
|
{{- $port := int .Values.dataStore.sql.port | default 3306 }}
|
||||||
{{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
|
{{- $query := include "spire-server.config-mysql-query" .Values.dataStore.sql.options }}
|
||||||
{{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
|
{{- $_ := set $config "connection_string" (printf "%s:${DBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.username .Values.dataStore.sql.host $port .Values.dataStore.sql.databaseName $query) }}
|
||||||
|
{{- if .Values.dataStore.sql.readOnly.enabled }}
|
||||||
|
{{- $roPort := int .Values.dataStore.sql.readOnly.port | default 3306 }}
|
||||||
|
{{- $roQuery := include "spire-server.config-mysql-query" .Values.dataStore.sql.readOnly.options }}
|
||||||
|
{{- $_ := set $config "ro_connection_string" (printf "%s:${RODBPW}@tcp(%s:%d)/%s%s" .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort .Values.dataStore.sql.readOnly.databaseName $roQuery) }}
|
||||||
|
{{- end }}
|
||||||
{{- else if eq .Values.dataStore.sql.databaseType "postgres" }}
|
{{- else if eq .Values.dataStore.sql.databaseType "postgres" }}
|
||||||
{{- $_ := set $config "database_type" "postgres" }}
|
{{- $_ := set $config "database_type" "postgres" }}
|
||||||
{{- $port := int .Values.dataStore.sql.port | default 5432 }}
|
{{- $port := int .Values.dataStore.sql.port | default 5432 }}
|
||||||
{{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
|
{{- $options:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.options }}
|
||||||
{{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }}
|
{{- $_ := set $config "connection_string" (printf "dbname=%s user=%s password=${DBPW} host=%s port=%d%s" .Values.dataStore.sql.databaseName .Values.dataStore.sql.username .Values.dataStore.sql.host $port $options) }}
|
||||||
|
{{- if .Values.dataStore.sql.readOnly.enabled }}
|
||||||
|
{{- $roPort := int .Values.dataStore.sql.readOnly.port | default 5432 }}
|
||||||
|
{{- $roOptions:= include "spire-server.config-postgresql-options" .Values.dataStore.sql.readOnly.options }}
|
||||||
|
{{- $_ := set $config "ro_connection_string" (printf "dbname=%s user=%s password=${RODBPW} host=%s port=%d%s" .Values.dataStore.sql.readOnly.databaseName .Values.dataStore.sql.readOnly.username .Values.dataStore.sql.readOnly.host $roPort $roOptions) }}
|
||||||
|
{{- end }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
{{- fail "Unsupported database type" }}
|
{{- fail "Unsupported database type" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -101,7 +101,22 @@ plugins:
|
|||||||
DataStore:
|
DataStore:
|
||||||
sql:
|
sql:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
{{ include "spire-server.datastore-config" . | nindent 8 }}
|
||||||
|
{{- if ne .Values.dataStore.sql.rootCAPath "" }}
|
||||||
|
root_ca_path: {{ .Values.dataStore.sql.rootCAPath }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.dataStore.sql.clientCertPath "" }}
|
||||||
|
client_cert_path: {{ .Values.dataStore.sql.clientCertPath }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.dataStore.sql.clientKeyPath "" }}
|
||||||
|
client_key_path : {{ .Values.dataStore.sql.clientKeyPath }}
|
||||||
|
{{- end }}
|
||||||
|
max_open_conns: {{ .Values.dataStore.sql.maxOpenConns }}
|
||||||
|
max_idle_conns: {{ .Values.dataStore.sql.maxIdleConns }}
|
||||||
|
{{- if ne (int .Values.dataStore.sql.connMaxLifetime) 0 }}
|
||||||
|
conn_max_lifetime: {{ .Values.dataStore.sql.connMaxLifetime }}
|
||||||
|
{{- end }}
|
||||||
|
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
||||||
|
|
||||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled }}
|
||||||
NodeAttestor:
|
NodeAttestor:
|
||||||
|
|||||||
@@ -16,5 +16,8 @@ metadata:
|
|||||||
namespace: {{ include "spire-server.namespace" . }}
|
namespace: {{ include "spire-server.namespace" . }}
|
||||||
data:
|
data:
|
||||||
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
|
DBPW: {{ .Values.dataStore.sql.password | b64enc }}
|
||||||
|
{{- if .Values.dataStore.sql.readOnly.enabled }}
|
||||||
|
RODBPW: {{ .Values.dataStore.sql.readOnly.password | b64enc }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -50,6 +50,20 @@
|
|||||||
{{- else }}
|
{{- else }}
|
||||||
{{- fail "Unsupported kind." }}
|
{{- fail "Unsupported kind." }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.dataStore.sql "plugin_data" }}
|
||||||
|
{{- fail "The plugin_data setting to the sql data store is no longer supported." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.dataStore.sql.databaseType "mysql" }}
|
||||||
|
{{- if ne .Values.dataStore.sql.rootCAPath "" }}
|
||||||
|
{{- fail "rootCAPath can only be set with database type mysql." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.dataStore.sql.clientCertPath "" }}
|
||||||
|
{{- fail "clientCertPath can only be set with database type mysql." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.dataStore.sql.clientKeyPath "" }}
|
||||||
|
{{- fail "clientKeyPath can only be set with database type mysql." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if not .Values.externalServer }}
|
{{- if not .Values.externalServer }}
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
{{- if eq .Values.kind "statefulset" }}
|
{{- if eq .Values.kind "statefulset" }}
|
||||||
@@ -195,6 +209,19 @@ spec:
|
|||||||
name: {{ $fullname }}-dbpw
|
name: {{ $fullname }}-dbpw
|
||||||
key: DBPW
|
key: DBPW
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if and .Values.dataStore.sql.readOnly.enabled .Values.dataStore.sql.readOnly.externalSecret.enabled }}
|
||||||
|
- name: RODBPW
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ .Values.dataStore.sql.readOnly.externalSecret.name }}
|
||||||
|
key: {{ .Values.dataStore.sql.readOnly.externalSecret.key }}
|
||||||
|
{{- else if .Values.dataStore.sql.readOnly.enabled }}
|
||||||
|
- name: RODBPW
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ $fullname }}-dbpw
|
||||||
|
key: RODBPW
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
||||||
- name: AWS_KMS_ACCESS_KEY_ID
|
- name: AWS_KMS_ACCESS_KEY_ID
|
||||||
|
|||||||
@@ -170,8 +170,12 @@ dataStore:
|
|||||||
## @param dataStore.sql.options [array] Only used by "postgres" or "mysql"
|
## @param dataStore.sql.options [array] Only used by "postgres" or "mysql"
|
||||||
options: []
|
options: []
|
||||||
|
|
||||||
## @param dataStore.sql.plugin_data [object] Settings from https://github.com/spiffe/spire/blob/main/doc/plugin_server_datastore_sql.md go in this section
|
## @param dataStore.sql.rootCAPath Path to Root CA bundle (MySQL only)
|
||||||
plugin_data: {}
|
rootCAPath: ""
|
||||||
|
## @param dataStore.sql.clientCertPath Path to client certificate (MySQL only)
|
||||||
|
clientCertPath: ""
|
||||||
|
## @param dataStore.sql.clientKeyPath Path to private key for client certificate (MySQL only)
|
||||||
|
clientKeyPath: ""
|
||||||
|
|
||||||
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
|
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
|
||||||
externalSecret:
|
externalSecret:
|
||||||
@@ -182,6 +186,37 @@ dataStore:
|
|||||||
## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password
|
## @param dataStore.sql.externalSecret.key The key of the secret object whose value is the dataStore.sql password
|
||||||
key: ""
|
key: ""
|
||||||
|
|
||||||
|
## @param dataStore.sql.maxOpenConns The maximum number of open db connections
|
||||||
|
maxOpenConns: 100
|
||||||
|
## @param dataStore.sql.maxIdleConns The maximum number of idle connections in the pool
|
||||||
|
maxIdleConns: 2
|
||||||
|
## @param dataStore.sql.connMaxLifetime The maximum amount of time a connection may be reused. If 0, time is unlimited
|
||||||
|
connMaxLifetime: 0
|
||||||
|
## @param dataStore.sql.disableMigration True to disable auto-migration functionality
|
||||||
|
disableMigration: false
|
||||||
|
|
||||||
|
readOnly:
|
||||||
|
## @param dataStore.sql.readOnly.enabled Set to true to configure a readOnly dartabase connection
|
||||||
|
enabled: false
|
||||||
|
## @param dataStore.sql.readOnly.host Only used by "postgres" or "mysql"
|
||||||
|
host: ""
|
||||||
|
## @param dataStore.sql.readOnly.port If 0 (default), it will auto set to 5432 for postgres and 3306 for mysql. Only used by those databases.
|
||||||
|
port: 0
|
||||||
|
## @param dataStore.sql.readOnly.username Only used by "postgres" or "mysql"
|
||||||
|
username: spire
|
||||||
|
## @param dataStore.sql.readOnly.password Only used by "postgres" or "mysql"
|
||||||
|
password: ""
|
||||||
|
## @param dataStore.sql.readOnly.options [array] Only used by "postgres" or "mysql"
|
||||||
|
options: []
|
||||||
|
## When an external source creates the secret. The secret should reside in the same namespace as the spire server
|
||||||
|
externalSecret:
|
||||||
|
## @param dataStore.sql.readOnly.externalSecret.enabled Enable external secret for datastore creds
|
||||||
|
enabled: false
|
||||||
|
## @param dataStore.sql.readOnly.externalSecret.name The name of the secret object
|
||||||
|
name: ""
|
||||||
|
## @param dataStore.sql.readOnly.externalSecret.key The key of the secret object whose value is the dataStore.sql password
|
||||||
|
key: ""
|
||||||
|
|
||||||
## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges.
|
## @param adminIDs SPIFFE IDs that, when present in a caller’s X509-SVID, grant that caller admin privileges.
|
||||||
adminIDs: []
|
adminIDs: []
|
||||||
## @param auditLogEnabled If true, enables audit logging
|
## @param auditLogEnabled If true, enables audit logging
|
||||||
|
|||||||
Reference in New Issue
Block a user