Update spire-ha-agent (#936)
* Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Update with new features Signed-off-by: Kevin Fox <[email protected]> * Updates Signed-off-by: Kevin Fox <[email protected]> * Point at release Signed-off-by: Kevin Fox <[email protected]> * Fix version Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -3,7 +3,7 @@ name: spire-ha-agent
|
|||||||
description: A Helm chart to install the SPIRE HA agent.
|
description: A Helm chart to install the SPIRE HA agent.
|
||||||
type: application
|
type: application
|
||||||
version: 0.3.1
|
version: 0.3.1
|
||||||
appVersion: "0.4.0"
|
appVersion: "0.5.0"
|
||||||
keywords: ["spiffe", "spire-ha-agent"]
|
keywords: ["spiffe", "spire-ha-agent"]
|
||||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
|
||||||
sources:
|
sources:
|
||||||
|
|||||||
@@ -1,6 +1,6 @@
|
|||||||
# spire-ha-agent
|
# spire-ha-agent
|
||||||
|
|
||||||
  
|
  
|
||||||
|
|
||||||
A Helm chart to install the SPIRE HA agent.
|
A Helm chart to install the SPIRE HA agent.
|
||||||
|
|
||||||
@@ -25,12 +25,13 @@ A Helm chart to install the SPIRE HA agent.
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
|
||||||
|
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||||
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
|
||||||
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
|
||||||
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
|
||||||
@@ -43,6 +44,24 @@ A Helm chart to install the SPIRE HA agent.
|
|||||||
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
|
||||||
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
|
||||||
| `port` | Port number to listen on | `999` |
|
| `port` | Port number to listen on | `999` |
|
||||||
|
| `brokerAPI.enabled` | Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker. | `false` |
|
||||||
|
| `brokerAPI.socket.enabled` | Serve the broker api on a unix socket | `true` |
|
||||||
|
| `brokerAPI.socket.mountOnHost` | Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod. | `true` |
|
||||||
|
| `brokerAPI.socket.hostPath` | Where the served broker socket is made available on the host when mountOnHost is true | `/run/spire/agent/sockets/csi.spiffe.io/broker` |
|
||||||
|
| `brokerAPI.tcp.enabled` | Serve the broker api over tcp | `false` |
|
||||||
|
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||||
|
| `brokerAPI.brokers.spiffefs.enabled` | Enable spiffefs as a broker. This feature is experimental. | `false` |
|
||||||
|
| `brokerAPI.brokers.spiffefs.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spiffefs` |
|
||||||
|
| `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||||
|
| `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||||
|
| `upstreamKeepalive.time` | How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection. | `5m` |
|
||||||
|
| `upstreamKeepalive.timeout` | How long to wait for a keepalive ping response before considering the connection dead | `20s` |
|
||||||
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
|
||||||
|
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
|
||||||
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent | `""` |
|
||||||
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
||||||
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
| `imagePullSecrets` | Pull secrets for images | `[]` |
|
||||||
| `nameOverride` | Name override | `""` |
|
| `nameOverride` | Name override | `""` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
|
|||||||
@@ -110,6 +110,15 @@ Create the name of the service account to use
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Whether prometheus metrics are on.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-ha-agent.prometheus-enabled" -}}
|
||||||
|
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
|
||||||
|
{{- printf "true" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- define "spire-ha-agent.socket-path" -}}
|
{{- define "spire-ha-agent.socket-path" -}}
|
||||||
{{- print .Values.socketPath }}
|
{{- print .Values.socketPath }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -0,0 +1,94 @@
|
|||||||
|
{{- define "spire-ha-agent.check-config-values" -}}
|
||||||
|
{{- if not (has .Values.mode (list "delegated" "broker")) }}
|
||||||
|
{{- fail (printf "mode must be one of [delegated, broker], got: %s" .Values.mode) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.brokerAPI.enabled }}
|
||||||
|
{{- if ne .Values.mode "broker" }}
|
||||||
|
{{- fail "brokerAPI.enabled is true but mode is not broker. The served broker api is only available in broker mode." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (not .Values.brokerAPI.socket.enabled) (not .Values.brokerAPI.tcp.enabled) }}
|
||||||
|
{{- fail "brokerAPI.enabled is true but neither brokerAPI.socket.enabled nor brokerAPI.tcp.enabled is set. At least one listener is required." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $enabledBrokers := 0 }}
|
||||||
|
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
||||||
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||||
|
{{- $enabledBrokers = add1 $enabledBrokers }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq $enabledBrokers 0 }}
|
||||||
|
{{- fail "brokerAPI.enabled is true but no entry in brokerAPI.brokers is enabled. Only listed brokers may connect, so at least one is required." }}
|
||||||
|
{{- end }}
|
||||||
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set when brokerAPI is enabled, as broker ids are derived from it" (eq (include "spire-lib.trust-domain" .) "example.org")) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
The agent reads this config as YAML, so it is emitted directly rather than
|
||||||
|
going through spire-lib.reformat-and-yaml2json. That helper exists to hand
|
||||||
|
spire an HCL-compatible JSON document and to reshape its plugins dict into
|
||||||
|
lists; neither applies here.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-ha-agent.yaml-config" -}}
|
||||||
|
{{- $trustDomain := include "spire-lib.trust-domain" . | trim -}}
|
||||||
|
single: {{ eq .Values.singleSocket true }}
|
||||||
|
{{- if .Values.vsock }}
|
||||||
|
vsock:
|
||||||
|
enabled: true
|
||||||
|
port: {{ .Values.port }}
|
||||||
|
{{- else }}
|
||||||
|
socket: /tmp/spire-ha-agent/public/spire-agent.sock
|
||||||
|
{{- end }}
|
||||||
|
upstream_a:
|
||||||
|
broker_address: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
||||||
|
workload_socket: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
||||||
|
{{- if not .Values.singleSocket }}
|
||||||
|
upstream_b:
|
||||||
|
broker_address: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
||||||
|
workload_socket: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
||||||
|
{{- end }}
|
||||||
|
upstream_keepalive:
|
||||||
|
time: {{ .Values.upstreamKeepalive.time | quote }}
|
||||||
|
timeout: {{ .Values.upstreamKeepalive.timeout | quote }}
|
||||||
|
{{- if include "spire-ha-agent.prometheus-enabled" . }}
|
||||||
|
metrics:
|
||||||
|
bind_address: {{ printf "%s:%v" .Values.telemetry.prometheus.host .Values.telemetry.prometheus.port | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.brokerAPI.enabled }}
|
||||||
|
broker_endpoint:
|
||||||
|
{{- /* Deliberately not under the workload api socket directory: the agent
|
||||||
|
rejects a socket_path that shares a directory with it. */}}
|
||||||
|
{{- if .Values.brokerAPI.socket.enabled }}
|
||||||
|
socket_path: /tmp/spire-ha-agent/broker/broker.sock
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.brokerAPI.tcp.enabled }}
|
||||||
|
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
||||||
|
{{- end }}
|
||||||
|
brokers:
|
||||||
|
{{- range $name, $value := .Values.brokerAPI.brokers }}
|
||||||
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||||
|
- id: {{ tpl $value.idTemplate (dict "TrustDomain" $trustDomain) | quote }}
|
||||||
|
allowed_reference_types:
|
||||||
|
{{- range $value.allowedReferenceTypes }}
|
||||||
|
- type_url: {{ .typeURL | quote }}
|
||||||
|
allow_over_tcp: {{ eq .allowOverTCP true }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- /* Validation runs for every mode: two of its checks exist precisely to
|
||||||
|
catch a mode that is not broker. */}}
|
||||||
|
{{- include "spire-ha-agent.check-config-values" . }}
|
||||||
|
{{- if eq .Values.mode "broker" }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||||
|
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
config.yaml: |
|
||||||
|
{{- include "spire-ha-agent.yaml-config" . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
@@ -2,6 +2,7 @@
|
|||||||
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
|
{{- $mainSecurityContext := deepCopy .Values.securityContext }}
|
||||||
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
|
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
|
||||||
{{- $socketPath := include "spire-ha-agent.socket-path" . }}
|
{{- $socketPath := include "spire-ha-agent.socket-path" . }}
|
||||||
|
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||||
apiVersion: apps/v1
|
apiVersion: apps/v1
|
||||||
kind: DaemonSet
|
kind: DaemonSet
|
||||||
metadata:
|
metadata:
|
||||||
@@ -30,6 +31,12 @@ spec:
|
|||||||
metadata:
|
metadata:
|
||||||
annotations:
|
annotations:
|
||||||
kubectl.kubernetes.io/default-container: spire-ha-agent
|
kubectl.kubernetes.io/default-container: spire-ha-agent
|
||||||
|
{{- if eq .Values.mode "broker" }}
|
||||||
|
checksum/config: {{ $configSum | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
labels:
|
labels:
|
||||||
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
|
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
|
||||||
app.kubernetes.io/component: spire-ha-agent
|
app.kubernetes.io/component: spire-ha-agent
|
||||||
@@ -122,43 +129,34 @@ spec:
|
|||||||
args:
|
args:
|
||||||
- "-mode"
|
- "-mode"
|
||||||
- {{ .Values.mode | quote }}
|
- {{ .Values.mode | quote }}
|
||||||
|
{{- if eq .Values.mode "broker" }}
|
||||||
|
- "-config"
|
||||||
|
- "/opt/spire-ha-agent/conf/config.yaml"
|
||||||
|
{{- end }}
|
||||||
securityContext:
|
securityContext:
|
||||||
privileged: true
|
privileged: true
|
||||||
#FIXME read permission to api socket
|
#FIXME read permission to api socket
|
||||||
runAsUser: 0
|
runAsUser: 0
|
||||||
runAsGroup: 0
|
runAsGroup: 0
|
||||||
#{- $mainSecurityContext | toYaml | nindent 12 }}
|
#{- $mainSecurityContext | toYaml | nindent 12 }}
|
||||||
|
{{- /* Broker mode is configured entirely by the rendered config
|
||||||
|
file, so it has nothing to put here unless the user supplied
|
||||||
|
extraEnvVars. Emitting a bare env: would render env: null. */}}
|
||||||
|
{{- if or (eq .Values.mode "delegated") (gt (len .Values.extraEnvVars) 0) }}
|
||||||
env:
|
env:
|
||||||
|
{{- if eq .Values.mode "delegated" }}
|
||||||
- name: SPIRE_HA_AGENT_SOCK
|
- name: SPIRE_HA_AGENT_SOCK
|
||||||
value: /tmp/spire-ha-agent/public/spire-agent.sock
|
value: /tmp/spire-ha-agent/public/spire-agent.sock
|
||||||
{{- if .Values.singleSocket }}
|
{{- if .Values.singleSocket }}
|
||||||
- name: SPIRE_HA_AGENT_SINGLE
|
- name: SPIRE_HA_AGENT_SINGLE
|
||||||
value: enabled
|
value: enabled
|
||||||
{{- if eq .Values.mode "delegated" }}
|
|
||||||
- name: SPIRE_HA_AGENT_SOCKET
|
- name: SPIRE_HA_AGENT_SOCKET
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||||
{{- else }}
|
{{- else }}
|
||||||
- name: SPIRE_HA_AGENT_BROKER
|
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
|
||||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET
|
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
|
||||||
{{- end }}
|
|
||||||
{{- else }}
|
|
||||||
{{- if eq .Values.mode "delegated" }}
|
|
||||||
- name: SPIRE_HA_AGENT_SOCKET_A
|
- name: SPIRE_HA_AGENT_SOCKET_A
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
|
||||||
- name: SPIRE_HA_AGENT_SOCKET_B
|
- name: SPIRE_HA_AGENT_SOCKET_B
|
||||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
|
||||||
{{- else }}
|
|
||||||
- name: SPIRE_HA_AGENT_BROKER_A
|
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
|
|
||||||
- name: SPIRE_HA_AGENT_BROKER_B
|
|
||||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
|
|
||||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_A
|
|
||||||
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
|
|
||||||
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_B
|
|
||||||
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.vsock }}
|
{{- if .Values.vsock }}
|
||||||
- name: SPIRE_HA_AGENT_VSOCK
|
- name: SPIRE_HA_AGENT_VSOCK
|
||||||
@@ -166,9 +164,16 @@ spec:
|
|||||||
- name: SPIRE_HA_AGENT_PORT
|
- name: SPIRE_HA_AGENT_PORT
|
||||||
value: {{ .Values.port | quote }}
|
value: {{ .Values.port | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.extraEnvVars }}
|
{{- with .Values.extraEnvVars }}
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if include "spire-ha-agent.prometheus-enabled" . }}
|
||||||
|
ports:
|
||||||
|
- containerPort: {{ .Values.telemetry.prometheus.port }}
|
||||||
|
name: prom
|
||||||
|
{{- end }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
# - name: spire-ha-agent-persistence
|
# - name: spire-ha-agent-persistence
|
||||||
# mountPath: /var/lib/spire
|
# mountPath: /var/lib/spire
|
||||||
@@ -201,6 +206,18 @@ spec:
|
|||||||
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if eq .Values.mode "broker" }}
|
||||||
|
- name: spire-ha-agent-config
|
||||||
|
mountPath: /opt/spire-ha-agent/conf
|
||||||
|
readOnly: true
|
||||||
|
{{- if .Values.brokerAPI.enabled }}
|
||||||
|
{{- if .Values.brokerAPI.socket.enabled }}
|
||||||
|
- name: spire-ha-agent-broker-socket-dir
|
||||||
|
mountPath: /tmp/spire-ha-agent/broker
|
||||||
|
readOnly: false
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
- name: dev
|
- name: dev
|
||||||
mountPath: /dev
|
mountPath: /dev
|
||||||
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
{{- if gt (len .Values.extraVolumeMounts) 0 }}
|
||||||
@@ -261,6 +278,22 @@ spec:
|
|||||||
type: DirectoryOrCreate
|
type: DirectoryOrCreate
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if eq .Values.mode "broker" }}
|
||||||
|
- name: spire-ha-agent-config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-ha-agent.fullname" . | quote }}
|
||||||
|
{{- if and .Values.brokerAPI.enabled .Values.brokerAPI.socket.enabled }}
|
||||||
|
{{- if .Values.brokerAPI.socket.mountOnHost }}
|
||||||
|
- name: spire-ha-agent-broker-socket-dir
|
||||||
|
hostPath:
|
||||||
|
path: {{ .Values.brokerAPI.socket.hostPath | quote }}
|
||||||
|
type: DirectoryOrCreate
|
||||||
|
{{- else }}
|
||||||
|
- name: spire-ha-agent-broker-socket-dir
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
- name: dev
|
- name: dev
|
||||||
hostPath:
|
hostPath:
|
||||||
path: /dev
|
path: /dev
|
||||||
|
|||||||
@@ -0,0 +1,27 @@
|
|||||||
|
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
|
||||||
|
{{- $namespace := include "spire-ha-agent.podMonitor.namespace" . }}
|
||||||
|
{{- $podNamespace := ( include "spire-ha-agent.namespace" . ) }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PodMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-ha-agent.fullname" . }}
|
||||||
|
namespace: {{ $namespace | quote }}
|
||||||
|
labels:
|
||||||
|
{{- include "spire-ha-agent.labels" . | nindent 4 }}
|
||||||
|
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
|
||||||
|
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
{{- include "spire-ha-agent.selectorLabels" . | nindent 6 }}
|
||||||
|
podMetricsEndpoints:
|
||||||
|
- port: prom
|
||||||
|
{{- if ne $namespace $podNamespace }}
|
||||||
|
namespaceSelector:
|
||||||
|
kubernetes.io/metadata.name: {{ $podNamespace | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -20,6 +20,9 @@ image:
|
|||||||
## @param mode If the spire-ha-agent will run in delegated or broker mode
|
## @param mode If the spire-ha-agent will run in delegated or broker mode
|
||||||
mode: delegated
|
mode: delegated
|
||||||
|
|
||||||
|
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
|
||||||
|
trustDomain: example.org
|
||||||
|
|
||||||
## @param singleSocket If in singleSocket mode, only one driver is used
|
## @param singleSocket If in singleSocket mode, only one driver is used
|
||||||
singleSocket: false
|
singleSocket: false
|
||||||
|
|
||||||
@@ -61,6 +64,58 @@ vsock: false
|
|||||||
## @param port Port number to listen on
|
## @param port Port number to listen on
|
||||||
port: 999
|
port: 999
|
||||||
|
|
||||||
|
brokerAPI:
|
||||||
|
## @param brokerAPI.enabled Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker.
|
||||||
|
enabled: false
|
||||||
|
socket:
|
||||||
|
## @param brokerAPI.socket.enabled Serve the broker api on a unix socket
|
||||||
|
enabled: true
|
||||||
|
## @param brokerAPI.socket.mountOnHost Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod.
|
||||||
|
mountOnHost: true
|
||||||
|
## @param brokerAPI.socket.hostPath Where the served broker socket is made available on the host when mountOnHost is true
|
||||||
|
hostPath: /run/spire/agent/sockets/csi.spiffe.io/broker
|
||||||
|
tcp:
|
||||||
|
## @param brokerAPI.tcp.enabled Serve the broker api over tcp
|
||||||
|
enabled: false
|
||||||
|
## @param brokerAPI.tcp.bindAddress The tcp address to bind to
|
||||||
|
bindAddress: 0.0.0.0:8788
|
||||||
|
## Brokers allowed to use the served broker api, keyed by name. At least one
|
||||||
|
## must be enabled when brokerAPI.enabled is true. Add your own alongside
|
||||||
|
## these following the same shape.
|
||||||
|
brokers:
|
||||||
|
spiffefs:
|
||||||
|
## @param brokerAPI.brokers.spiffefs.enabled Enable spiffefs as a broker. This feature is experimental.
|
||||||
|
enabled: false
|
||||||
|
## @param brokerAPI.brokers.spiffefs.idTemplate The default id template
|
||||||
|
idTemplate: spiffe://{{ .TrustDomain }}/spiffefs
|
||||||
|
allowedReferenceTypes:
|
||||||
|
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL The type of reference allowed
|
||||||
|
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP Allow access over TCP
|
||||||
|
- typeURL: "type.googleapis.com/spiffe.broker.WorkloadPIDReference"
|
||||||
|
allowOverTCP: false
|
||||||
|
|
||||||
|
upstreamKeepalive:
|
||||||
|
## @param upstreamKeepalive.time How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection.
|
||||||
|
time: 5m
|
||||||
|
## @param upstreamKeepalive.timeout How long to wait for a keepalive ping response before considering the connection dead
|
||||||
|
timeout: 20s
|
||||||
|
|
||||||
|
telemetry:
|
||||||
|
prometheus:
|
||||||
|
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
|
||||||
|
enabled: false
|
||||||
|
## @param telemetry.prometheus.port Port for prometheus metrics
|
||||||
|
port: 9988
|
||||||
|
## @param telemetry.prometheus.host Host for prometheus metrics
|
||||||
|
host: "0.0.0.0"
|
||||||
|
podMonitor:
|
||||||
|
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
|
||||||
|
enabled: false
|
||||||
|
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent
|
||||||
|
namespace: ""
|
||||||
|
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
|
||||||
|
labels: {}
|
||||||
|
|
||||||
## @param imagePullSecrets [array] Pull secrets for images
|
## @param imagePullSecrets [array] Pull secrets for images
|
||||||
imagePullSecrets: []
|
imagePullSecrets: []
|
||||||
|
|
||||||
|
|||||||
@@ -26,7 +26,7 @@ A Helm chart to install the SPIRE agent.
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
||||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
@@ -107,8 +107,9 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
||||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||||
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` |
|
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise. | `auto` |
|
||||||
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
||||||
|
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly` | Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced. | `auto` |
|
||||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
||||||
|
|||||||
@@ -199,3 +199,49 @@ Kept for backward compatibility
|
|||||||
names:
|
names:
|
||||||
{{ $l | toYaml }}
|
{{ $l | toYaml }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Resolve workloadAttestors.k8s.brokerAPI.accessPolicy to one of the two values
|
||||||
|
spire itself accepts. "auto" picks permissive only when every enabled broker is
|
||||||
|
confined to references that cannot name anything off this node, and enforced
|
||||||
|
otherwise -- including for anything unrecognized, so it fails closed.
|
||||||
|
|
||||||
|
The enforced triggers, in order below: a cluster pod reference scope, which lets
|
||||||
|
a pod reference fall through to the apiserver; an absent or empty
|
||||||
|
allowedReferenceTypes, which is the case spire treats as "no policy" and leaves
|
||||||
|
every reference type open over unix; any reference type other than a pid; and
|
||||||
|
any type reachable over tcp. The types are looked up with dig rather than index
|
||||||
|
so a broker missing from brokerAPI.brokers resolves to enforced instead of
|
||||||
|
erroring.
|
||||||
|
*/}}
|
||||||
|
{{- define "spire-agent.broker-access-policy" -}}
|
||||||
|
{{- $configured := .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | toString }}
|
||||||
|
{{- if and (ne $configured "auto") (ne $configured "") }}
|
||||||
|
{{- if not (has $configured (list "enforced" "permissive")) }}
|
||||||
|
{{- fail (printf "workloadAttestors.k8s.brokerAPI.accessPolicy must be one of [auto, enforced, permissive], got: %s" $configured) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $configured }}
|
||||||
|
{{- else }}
|
||||||
|
{{- $policy := "permissive" }}
|
||||||
|
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||||
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||||
|
{{- if eq (dig "podReferenceScope" "" $value | toString) "cluster" }}
|
||||||
|
{{- $policy = "enforced" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $types := dig $key "allowedReferenceTypes" (list) $.Values.brokerAPI.brokers }}
|
||||||
|
{{- if not $types }}
|
||||||
|
{{- $policy = "enforced" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- range $types }}
|
||||||
|
{{- if ne (.typeURL | toString) "type.googleapis.com/spiffe.broker.WorkloadPIDReference" }}
|
||||||
|
{{- $policy = "enforced" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq (.allowOverTCP | toString) "true" }}
|
||||||
|
{{- $policy = "enforced" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $policy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -217,7 +217,7 @@ plugins:
|
|||||||
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||||
experimental:
|
experimental:
|
||||||
broker:
|
broker:
|
||||||
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
|
access_policy: {{ include "spire-agent.broker-access-policy" . | quote }}
|
||||||
brokers:
|
brokers:
|
||||||
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||||
|
|||||||
@@ -1,3 +1,5 @@
|
|||||||
|
{{- $brokerEndpoint := or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||||
|
{{- $enforced := and $brokerEndpoint (eq (include "spire-agent.broker-access-policy" .) "enforced") }}
|
||||||
# Required cluster role to allow spire-agent to query k8s API server
|
# Required cluster role to allow spire-agent to query k8s API server
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
@@ -10,6 +12,14 @@ rules:
|
|||||||
- nodes
|
- nodes
|
||||||
- nodes/proxy
|
- nodes/proxy
|
||||||
verbs: ["get"]
|
verbs: ["get"]
|
||||||
|
{{- if $enforced }}
|
||||||
|
{{- /* The enforced broker access policy asks the cluster's authorizer whether
|
||||||
|
a broker may speak for the pod it named, which the agent does by
|
||||||
|
creating a SubjectAccessReview on its behalf. */}}
|
||||||
|
- apiGroups: ["authorization.k8s.io"]
|
||||||
|
resources: ["subjectaccessreviews"]
|
||||||
|
verbs: ["create"]
|
||||||
|
{{- end }}
|
||||||
---
|
---
|
||||||
# Binds above cluster role to spire-agent service account
|
# Binds above cluster role to spire-agent service account
|
||||||
kind: ClusterRoleBinding
|
kind: ClusterRoleBinding
|
||||||
@@ -24,3 +34,48 @@ roleRef:
|
|||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
name: {{ include "spire-agent.fullname" . | quote }}
|
name: {{ include "spire-agent.fullname" . | quote }}
|
||||||
apiGroup: rbac.authorization.k8s.io
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
|
||||||
|
{{- if $enforced }}
|
||||||
|
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||||
|
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||||
|
{{- /* Defaulting to false, not auto, is deliberate: a broker someone adds
|
||||||
|
themselves gets no grant unless they ask for one. */}}
|
||||||
|
{{- $imp := dig "impersonation" "clusterWidePodsOnly" false $value | toString }}
|
||||||
|
{{- $grant := ternary $enforced (eq $imp "true") (eq $imp "auto") }}
|
||||||
|
{{- if and (or (not (hasKey $value "enabled")) $value.enabled) $grant }}
|
||||||
|
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
|
||||||
|
{{- if hasKey $value "idTemplate" }}
|
||||||
|
{{- $idTemplate = $value.idTemplate }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $name := printf "%s-broker-impersonation-%s" (include "spire-agent.fullname" $) $key | trunc 63 | trimSuffix "-" }}
|
||||||
|
---
|
||||||
|
# What the SubjectAccessReview above asks about for this broker. The review
|
||||||
|
# names the broker's SPIFFE ID as the user, so the grant is bound to that name
|
||||||
|
# rather than to any service account. A pair per broker, because a future grant
|
||||||
|
# covering more than pods needs rules of its own.
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ $name | quote }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods"]
|
||||||
|
verbs: ["impersonate-via-spire"]
|
||||||
|
---
|
||||||
|
# Cluster wide: a broker serves whatever pods land on its node, so the set of
|
||||||
|
# namespaces is not known ahead of time.
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ $name | quote }}
|
||||||
|
subjects:
|
||||||
|
- kind: User
|
||||||
|
name: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) | quote }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
roleRef:
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ $name | quote }}
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
@@ -253,12 +253,15 @@ workloadAttestors:
|
|||||||
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
||||||
verboseContainerLocatorLogs: false
|
verboseContainerLocatorLogs: false
|
||||||
brokerAPI:
|
brokerAPI:
|
||||||
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive
|
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise.
|
||||||
accessPolicy: enforced
|
accessPolicy: auto
|
||||||
brokers:
|
brokers:
|
||||||
spire-ha-agent:
|
spire-ha-agent:
|
||||||
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
|
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
|
||||||
enabled: false
|
enabled: false
|
||||||
|
impersonation:
|
||||||
|
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced.
|
||||||
|
clusterWidePodsOnly: auto
|
||||||
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||||
# podReferenceScope: agent_node
|
# podReferenceScope: agent_node
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user