diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 906fe35..ddb1f01 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -107,6 +107,8 @@ A Helm chart to install the SPIRE agent. | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | +| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` | +| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` | | `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` | | `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` | @@ -178,7 +180,7 @@ A Helm chart to install the SPIRE agent. | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | | `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` | | `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` | -| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the istio-ztunnel | `false` | +| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` | | `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` | | `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` | | `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 4536b91..14cbc7f 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -81,24 +81,30 @@ agent: disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }} {{- end }} - {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} + {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }} experimental: + {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} broker: {{- if .Values.sockets.broker.enabled }} - socket_path: "/tmp/spire-agent/broker/broker.sock" }} + socket_path: "/tmp/spire-agent/broker/broker.sock" {{- end }} {{- if .Values.brokerAPI.tcp.enabled }} bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }} {{- end }} brokers: {{- range .Values.brokerAPI.brokers }} - - id: {{ tpl .idTemplate (dict "trustDomain" $trustDomain) }} - {{- with .allowedReferenceTypes }} - allowed_reference_types: - - type_url: {{ .typeURL | quote }} - allow_over_tcp: {{ .allowOverTCP }} + {{- if .enabled }} + - broker: + - id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }} + allowed_reference_types: + {{- range .allowedReferenceTypes }} + - allowed_reference_types: + type_url: {{ .typeURL | quote }} + allow_over_tcp: {{ .allowOverTCP }} + {{- end }} {{- end }} - {{- end }} + {{- end }} + {{- end }} {{- with .Values.experimental }} {{- if eq (.enabled | toString) "true" }} sync_interval: {{ .syncInterval | quote }} @@ -208,6 +214,25 @@ plugins: {{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }} node_name_env: "KUBELET_ADDR" {{- end }} + {{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} + experimental: + broker: + access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }} + brokers: + {{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }} + {{- if or (not (hasKey $value "enabled")) $value.enabled }} + {{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }} + {{- if hasKey $value "idTemplate" }} + {{- $idTemplate = $value.idTemplate }} + {{- end }} + - broker: + - id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }} + {{- with $value.podReferenceScope }} + pod_reference_scope: {{ . | quote }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} {{- end }} {{- if .Values.workloadAttestors.unix.enabled }} diff --git a/charts/spire/charts/spire-agent/templates/daemonset.yaml b/charts/spire/charts/spire-agent/templates/daemonset.yaml index 89e80af..7b1624d 100644 --- a/charts/spire/charts/spire-agent/templates/daemonset.yaml +++ b/charts/spire/charts/spire-agent/templates/daemonset.yaml @@ -299,6 +299,7 @@ spec: args: - | chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private + chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/broker chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire resources: {{- toYaml .Values.resources | nindent 12 }} @@ -309,6 +310,8 @@ spec: mountPath: /var/lib/spire - name: spire-agent-admin-socket-dir mountPath: /tmp/spire-agent/private + - name: spire-agent-broker-socket-dir + mountPath: /tmp/spire-agent/broker securityContext: runAsUser: 0 runAsGroup: 0 diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 69bb96d..efa0cd8 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -252,6 +252,15 @@ workloadAttestors: useNewContainerLocator: true ## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false verboseContainerLocatorLogs: false + brokerAPI: + ## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive + accessPolicy: enforced + brokers: + spire-ha-agent: + ## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api + enabled: false + # idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent + # podReferenceScope: agent_node dynamicRegistration: ## @param dynamicRegistration.enabled Deploys the sidecar helper for dynamic registration @@ -488,7 +497,7 @@ brokerAPI: bindAddress: 0.0.0.0:8788 brokers: spire-ha-agent: - ## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the istio-ztunnel + ## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent enabled: false ## @param brokerAPI.brokers.spire-ha-agent.idTemplate The default id template idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 2b87e74..3541bb7 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -572,7 +572,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `trustSync.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `trustSync.image.repository` | The repository within the registry | `spiffe/spire-ha-agent/spire-trust-sync` | | `trustSync.image.pullPolicy` | The image pull policy | `IfNotPresent` | -| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.0.21` | +| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.2.0` | | `trustSync.resources` | Resource requests and limits | `{}` | | `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` | | `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` | diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index a6ebb73..fc27a51 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1443,7 +1443,7 @@ trustSync: registry: ghcr.io repository: spiffe/spire-ha-agent/spire-trust-sync pullPolicy: IfNotPresent - tag: "0.0.21" + tag: "0.2.0" ## @param trustSync.resources [object] Resource requests and limits resources: {}