Update spire-ha-agent (#936)
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -25,162 +25,163 @@ A Helm chart to install the SPIRE agent.
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` |
|
||||
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` |
|
||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` |
|
||||
| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
|
||||
| `keyManager.disk.mode` | Where to store the data. Supported options are hostPath and emptyDir | `hostPath` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` |
|
||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_pop Node Attestor | `false` |
|
||||
| `nodeAttestor.x509POP.mode` | Which mode to use. Currently only spiffe is supported | `spiffe` |
|
||||
| `nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent/public/api.sock` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` |
|
||||
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
||||
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
||||
| `dynamicRegistration.audience` | The audience to get the k8s psat for | `spire-controller-manager-dynamic-registration` |
|
||||
| `dynamicRegistration.serverSPIFFEID` | Expected SPIFFE ID of the server. If blank, it will use a sane default. | `""` |
|
||||
| `dynamicRegistration.address` | Address for Spire server | `""` |
|
||||
| `dynamicRegistration.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `dynamicRegistration.securityContext` | Security context | `{}` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||
| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
||||
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
|
||||
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
|
||||
| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `sockets.broker.enabled` | Enable the broker socket. | `false` |
|
||||
| `sockets.broker.mountOnHost` | Enable the broker socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
||||
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `fullnameOverride` | Fullname override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. | `""` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
|
||||
| `podAnnotations` | Annotations to add to pods | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `podSecurityContext` | Pod security context | `{}` |
|
||||
| `securityContext` | Security context | `{}` |
|
||||
| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | List of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
|
||||
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
|
||||
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
|
||||
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` |
|
||||
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` |
|
||||
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
|
||||
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
|
||||
| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` |
|
||||
| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `healthChecks.port` | override the host port used for health checking | `9982` |
|
||||
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
|
||||
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
|
||||
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
|
||||
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
|
||||
| `keyManager.disk.mode` | Where to store the data. Supported options are hostPath and emptyDir | `hostPath` |
|
||||
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
|
||||
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
|
||||
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
|
||||
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
|
||||
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` |
|
||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_pop Node Attestor | `false` |
|
||||
| `nodeAttestor.x509POP.mode` | Which mode to use. Currently only spiffe is supported | `spiffe` |
|
||||
| `nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent/public/api.sock` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
|
||||
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise. | `auto` |
|
||||
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
||||
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly` | Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced. | `auto` |
|
||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
||||
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
|
||||
| `dynamicRegistration.audience` | The audience to get the k8s psat for | `spire-controller-manager-dynamic-registration` |
|
||||
| `dynamicRegistration.serverSPIFFEID` | Expected SPIFFE ID of the server. If blank, it will use a sane default. | `""` |
|
||||
| `dynamicRegistration.address` | Address for Spire server | `""` |
|
||||
| `dynamicRegistration.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
| `dynamicRegistration.securityContext` | Security context | `{}` |
|
||||
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
|
||||
| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
|
||||
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
|
||||
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
|
||||
| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
|
||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
|
||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
|
||||
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
|
||||
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
|
||||
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
|
||||
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
|
||||
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
|
||||
| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
|
||||
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
|
||||
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
|
||||
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
|
||||
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` |
|
||||
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
|
||||
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` |
|
||||
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
|
||||
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
|
||||
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
|
||||
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
|
||||
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
|
||||
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
|
||||
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
|
||||
| `experimental.enabled` | Allow configuration of experimental features | `false` |
|
||||
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
|
||||
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
|
||||
| `experimental.featureFlags` | List of developer feature flags | `[]` |
|
||||
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `sockets.broker.enabled` | Enable the broker socket. | `false` |
|
||||
| `sockets.broker.mountOnHost` | Enable the broker socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
||||
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||
|
||||
@@ -199,3 +199,49 @@ Kept for backward compatibility
|
||||
names:
|
||||
{{ $l | toYaml }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Resolve workloadAttestors.k8s.brokerAPI.accessPolicy to one of the two values
|
||||
spire itself accepts. "auto" picks permissive only when every enabled broker is
|
||||
confined to references that cannot name anything off this node, and enforced
|
||||
otherwise -- including for anything unrecognized, so it fails closed.
|
||||
|
||||
The enforced triggers, in order below: a cluster pod reference scope, which lets
|
||||
a pod reference fall through to the apiserver; an absent or empty
|
||||
allowedReferenceTypes, which is the case spire treats as "no policy" and leaves
|
||||
every reference type open over unix; any reference type other than a pid; and
|
||||
any type reachable over tcp. The types are looked up with dig rather than index
|
||||
so a broker missing from brokerAPI.brokers resolves to enforced instead of
|
||||
erroring.
|
||||
*/}}
|
||||
{{- define "spire-agent.broker-access-policy" -}}
|
||||
{{- $configured := .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | toString }}
|
||||
{{- if and (ne $configured "auto") (ne $configured "") }}
|
||||
{{- if not (has $configured (list "enforced" "permissive")) }}
|
||||
{{- fail (printf "workloadAttestors.k8s.brokerAPI.accessPolicy must be one of [auto, enforced, permissive], got: %s" $configured) }}
|
||||
{{- end }}
|
||||
{{- $configured }}
|
||||
{{- else }}
|
||||
{{- $policy := "permissive" }}
|
||||
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||
{{- if eq (dig "podReferenceScope" "" $value | toString) "cluster" }}
|
||||
{{- $policy = "enforced" }}
|
||||
{{- end }}
|
||||
{{- $types := dig $key "allowedReferenceTypes" (list) $.Values.brokerAPI.brokers }}
|
||||
{{- if not $types }}
|
||||
{{- $policy = "enforced" }}
|
||||
{{- end }}
|
||||
{{- range $types }}
|
||||
{{- if ne (.typeURL | toString) "type.googleapis.com/spiffe.broker.WorkloadPIDReference" }}
|
||||
{{- $policy = "enforced" }}
|
||||
{{- end }}
|
||||
{{- if eq (.allowOverTCP | toString) "true" }}
|
||||
{{- $policy = "enforced" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $policy }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -217,7 +217,7 @@ plugins:
|
||||
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
experimental:
|
||||
broker:
|
||||
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
|
||||
access_policy: {{ include "spire-agent.broker-access-policy" . | quote }}
|
||||
brokers:
|
||||
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
{{- $brokerEndpoint := or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
{{- $enforced := and $brokerEndpoint (eq (include "spire-agent.broker-access-policy" .) "enforced") }}
|
||||
# Required cluster role to allow spire-agent to query k8s API server
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
@@ -10,6 +12,14 @@ rules:
|
||||
- nodes
|
||||
- nodes/proxy
|
||||
verbs: ["get"]
|
||||
{{- if $enforced }}
|
||||
{{- /* The enforced broker access policy asks the cluster's authorizer whether
|
||||
a broker may speak for the pod it named, which the agent does by
|
||||
creating a SubjectAccessReview on its behalf. */}}
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
{{- end }}
|
||||
---
|
||||
# Binds above cluster role to spire-agent service account
|
||||
kind: ClusterRoleBinding
|
||||
@@ -24,3 +34,48 @@ roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ include "spire-agent.fullname" . | quote }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
{{- if $enforced }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||
{{- /* Defaulting to false, not auto, is deliberate: a broker someone adds
|
||||
themselves gets no grant unless they ask for one. */}}
|
||||
{{- $imp := dig "impersonation" "clusterWidePodsOnly" false $value | toString }}
|
||||
{{- $grant := ternary $enforced (eq $imp "true") (eq $imp "auto") }}
|
||||
{{- if and (or (not (hasKey $value "enabled")) $value.enabled) $grant }}
|
||||
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
|
||||
{{- if hasKey $value "idTemplate" }}
|
||||
{{- $idTemplate = $value.idTemplate }}
|
||||
{{- end }}
|
||||
{{- $name := printf "%s-broker-impersonation-%s" (include "spire-agent.fullname" $) $key | trunc 63 | trimSuffix "-" }}
|
||||
---
|
||||
# What the SubjectAccessReview above asks about for this broker. The review
|
||||
# names the broker's SPIFFE ID as the user, so the grant is bound to that name
|
||||
# rather than to any service account. A pair per broker, because a future grant
|
||||
# covering more than pods needs rules of its own.
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ $name | quote }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["impersonate-via-spire"]
|
||||
---
|
||||
# Cluster wide: a broker serves whatever pods land on its node, so the set of
|
||||
# namespaces is not known ahead of time.
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ $name | quote }}
|
||||
subjects:
|
||||
- kind: User
|
||||
name: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) | quote }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: {{ $name | quote }}
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -253,12 +253,15 @@ workloadAttestors:
|
||||
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
||||
verboseContainerLocatorLogs: false
|
||||
brokerAPI:
|
||||
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive
|
||||
accessPolicy: enforced
|
||||
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise.
|
||||
accessPolicy: auto
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
|
||||
enabled: false
|
||||
impersonation:
|
||||
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced.
|
||||
clusterWidePodsOnly: auto
|
||||
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||
# podReferenceScope: agent_node
|
||||
|
||||
|
||||
Reference in New Issue
Block a user