Broker updates (#882)
* Broker updates Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Bump versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -107,6 +107,8 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
||||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||||
|
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` |
|
||||||
|
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
||||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
||||||
@@ -178,7 +180,7 @@ A Helm chart to install the SPIRE agent.
|
|||||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||||
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
||||||
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the istio-ztunnel | `false` |
|
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` |
|
||||||
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||||
|
|||||||
@@ -81,24 +81,30 @@ agent:
|
|||||||
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }}
|
||||||
experimental:
|
experimental:
|
||||||
|
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||||
broker:
|
broker:
|
||||||
{{- if .Values.sockets.broker.enabled }}
|
{{- if .Values.sockets.broker.enabled }}
|
||||||
socket_path: "/tmp/spire-agent/broker/broker.sock" }}
|
socket_path: "/tmp/spire-agent/broker/broker.sock"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.brokerAPI.tcp.enabled }}
|
{{- if .Values.brokerAPI.tcp.enabled }}
|
||||||
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
brokers:
|
brokers:
|
||||||
{{- range .Values.brokerAPI.brokers }}
|
{{- range .Values.brokerAPI.brokers }}
|
||||||
- id: {{ tpl .idTemplate (dict "trustDomain" $trustDomain) }}
|
{{- if .enabled }}
|
||||||
{{- with .allowedReferenceTypes }}
|
- broker:
|
||||||
allowed_reference_types:
|
- id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }}
|
||||||
- type_url: {{ .typeURL | quote }}
|
allowed_reference_types:
|
||||||
allow_over_tcp: {{ .allowOverTCP }}
|
{{- range .allowedReferenceTypes }}
|
||||||
|
- allowed_reference_types:
|
||||||
|
type_url: {{ .typeURL | quote }}
|
||||||
|
allow_over_tcp: {{ .allowOverTCP }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.experimental }}
|
{{- with .Values.experimental }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
sync_interval: {{ .syncInterval | quote }}
|
sync_interval: {{ .syncInterval | quote }}
|
||||||
@@ -208,6 +214,25 @@ plugins:
|
|||||||
{{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }}
|
{{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }}
|
||||||
node_name_env: "KUBELET_ADDR"
|
node_name_env: "KUBELET_ADDR"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||||
|
experimental:
|
||||||
|
broker:
|
||||||
|
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
|
||||||
|
brokers:
|
||||||
|
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||||
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||||
|
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
|
||||||
|
{{- if hasKey $value "idTemplate" }}
|
||||||
|
{{- $idTemplate = $value.idTemplate }}
|
||||||
|
{{- end }}
|
||||||
|
- broker:
|
||||||
|
- id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }}
|
||||||
|
{{- with $value.podReferenceScope }}
|
||||||
|
pod_reference_scope: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||||
|
|||||||
@@ -299,6 +299,7 @@ spec:
|
|||||||
args:
|
args:
|
||||||
- |
|
- |
|
||||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
|
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
|
||||||
|
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/broker
|
||||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
|
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml .Values.resources | nindent 12 }}
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
@@ -309,6 +310,8 @@ spec:
|
|||||||
mountPath: /var/lib/spire
|
mountPath: /var/lib/spire
|
||||||
- name: spire-agent-admin-socket-dir
|
- name: spire-agent-admin-socket-dir
|
||||||
mountPath: /tmp/spire-agent/private
|
mountPath: /tmp/spire-agent/private
|
||||||
|
- name: spire-agent-broker-socket-dir
|
||||||
|
mountPath: /tmp/spire-agent/broker
|
||||||
securityContext:
|
securityContext:
|
||||||
runAsUser: 0
|
runAsUser: 0
|
||||||
runAsGroup: 0
|
runAsGroup: 0
|
||||||
|
|||||||
@@ -252,6 +252,15 @@ workloadAttestors:
|
|||||||
useNewContainerLocator: true
|
useNewContainerLocator: true
|
||||||
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
||||||
verboseContainerLocatorLogs: false
|
verboseContainerLocatorLogs: false
|
||||||
|
brokerAPI:
|
||||||
|
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive
|
||||||
|
accessPolicy: enforced
|
||||||
|
brokers:
|
||||||
|
spire-ha-agent:
|
||||||
|
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
|
||||||
|
enabled: false
|
||||||
|
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||||
|
# podReferenceScope: agent_node
|
||||||
|
|
||||||
dynamicRegistration:
|
dynamicRegistration:
|
||||||
## @param dynamicRegistration.enabled Deploys the sidecar helper for dynamic registration
|
## @param dynamicRegistration.enabled Deploys the sidecar helper for dynamic registration
|
||||||
@@ -488,7 +497,7 @@ brokerAPI:
|
|||||||
bindAddress: 0.0.0.0:8788
|
bindAddress: 0.0.0.0:8788
|
||||||
brokers:
|
brokers:
|
||||||
spire-ha-agent:
|
spire-ha-agent:
|
||||||
## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the istio-ztunnel
|
## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent
|
||||||
enabled: false
|
enabled: false
|
||||||
## @param brokerAPI.brokers.spire-ha-agent.idTemplate The default id template
|
## @param brokerAPI.brokers.spire-ha-agent.idTemplate The default id template
|
||||||
idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||||
|
|||||||
@@ -572,7 +572,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `trustSync.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
| `trustSync.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
| `trustSync.image.repository` | The repository within the registry | `spiffe/spire-ha-agent/spire-trust-sync` |
|
| `trustSync.image.repository` | The repository within the registry | `spiffe/spire-ha-agent/spire-trust-sync` |
|
||||||
| `trustSync.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `trustSync.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.0.21` |
|
| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.2.0` |
|
||||||
| `trustSync.resources` | Resource requests and limits | `{}` |
|
| `trustSync.resources` | Resource requests and limits | `{}` |
|
||||||
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
||||||
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
||||||
|
|||||||
@@ -1443,7 +1443,7 @@ trustSync:
|
|||||||
registry: ghcr.io
|
registry: ghcr.io
|
||||||
repository: spiffe/spire-ha-agent/spire-trust-sync
|
repository: spiffe/spire-ha-agent/spire-trust-sync
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
tag: "0.0.21"
|
tag: "0.2.0"
|
||||||
|
|
||||||
## @param trustSync.resources [object] Resource requests and limits
|
## @param trustSync.resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
|
|||||||
Reference in New Issue
Block a user