Broker updates (#882)

* Broker updates Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Bump versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2026-07-21 18:28:14 -07:00
parent 8deb9ab8b9
commit 952cbedbff
6 changed files with 51 additions and 12 deletions
@@ -81,24 +81,30 @@ agent:
    disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
  {{- end }}

-  {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
+  {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }}
  experimental:
+    {{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
    broker:
      {{- if .Values.sockets.broker.enabled }}
-      socket_path: "/tmp/spire-agent/broker/broker.sock" }}
+      socket_path: "/tmp/spire-agent/broker/broker.sock"
      {{- end }}
      {{- if .Values.brokerAPI.tcp.enabled }}
      bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
      {{- end }}
      brokers:
        {{- range .Values.brokerAPI.brokers }}
-        - id: {{ tpl .idTemplate (dict "trustDomain" $trustDomain) }}
-          {{- with .allowedReferenceTypes }}
-          allowed_reference_types:
-            - type_url: {{ .typeURL | quote }}
-              allow_over_tcp: {{ .allowOverTCP }}
+        {{- if .enabled }}
+        - broker:
+          - id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }}
+            allowed_reference_types:
+              {{- range .allowedReferenceTypes }}
+              - allowed_reference_types:
+                  type_url: {{ .typeURL | quote }}
+                  allow_over_tcp: {{ .allowOverTCP }}
+              {{- end }}
        {{- end }}
-      {{- end }}
+        {{- end }}
+    {{- end }}
    {{- with .Values.experimental }}
    {{- if eq (.enabled | toString) "true" }}
    sync_interval: {{ .syncInterval | quote }}
@@ -208,6 +214,25 @@ plugins:
        {{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }}
        node_name_env: "KUBELET_ADDR"
        {{- end }}
+        {{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
+        experimental:
+          broker:
+            access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
+            brokers:
+              {{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
+              {{-   if or (not (hasKey $value "enabled")) $value.enabled }}
+              {{-     $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
+              {{-     if hasKey $value "idTemplate" }}
+              {{-       $idTemplate = $value.idTemplate }}
+              {{-     end }}
+              - broker:
+                - id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }}
+                  {{- with $value.podReferenceScope }}
+                  pod_reference_scope: {{ . | quote }}
+                  {{- end }}
+              {{-   end }}
+              {{- end }}
+        {{- end }}
  {{- end }}

  {{- if .Values.workloadAttestors.unix.enabled }}