Broker updates (#882)
* Broker updates Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Bump versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -107,6 +107,8 @@ A Helm chart to install the SPIRE agent.
|
||||
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
|
||||
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
|
||||
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
|
||||
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` |
|
||||
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
|
||||
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
|
||||
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
|
||||
@@ -178,7 +180,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
||||
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the istio-ztunnel | `false` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||
|
||||
@@ -81,24 +81,30 @@ agent:
|
||||
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }}
|
||||
experimental:
|
||||
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
broker:
|
||||
{{- if .Values.sockets.broker.enabled }}
|
||||
socket_path: "/tmp/spire-agent/broker/broker.sock" }}
|
||||
socket_path: "/tmp/spire-agent/broker/broker.sock"
|
||||
{{- end }}
|
||||
{{- if .Values.brokerAPI.tcp.enabled }}
|
||||
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
||||
{{- end }}
|
||||
brokers:
|
||||
{{- range .Values.brokerAPI.brokers }}
|
||||
- id: {{ tpl .idTemplate (dict "trustDomain" $trustDomain) }}
|
||||
{{- with .allowedReferenceTypes }}
|
||||
{{- if .enabled }}
|
||||
- broker:
|
||||
- id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }}
|
||||
allowed_reference_types:
|
||||
- type_url: {{ .typeURL | quote }}
|
||||
{{- range .allowedReferenceTypes }}
|
||||
- allowed_reference_types:
|
||||
type_url: {{ .typeURL | quote }}
|
||||
allow_over_tcp: {{ .allowOverTCP }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.experimental }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
sync_interval: {{ .syncInterval | quote }}
|
||||
@@ -208,6 +214,25 @@ plugins:
|
||||
{{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }}
|
||||
node_name_env: "KUBELET_ADDR"
|
||||
{{- end }}
|
||||
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
experimental:
|
||||
broker:
|
||||
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
|
||||
brokers:
|
||||
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
||||
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
||||
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
|
||||
{{- if hasKey $value "idTemplate" }}
|
||||
{{- $idTemplate = $value.idTemplate }}
|
||||
{{- end }}
|
||||
- broker:
|
||||
- id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }}
|
||||
{{- with $value.podReferenceScope }}
|
||||
pod_reference_scope: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.workloadAttestors.unix.enabled }}
|
||||
|
||||
@@ -299,6 +299,7 @@ spec:
|
||||
args:
|
||||
- |
|
||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/private
|
||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} {{ $socketPath | dir }} /tmp/spire-agent/broker
|
||||
chown -R {{ printf "%v:%v" $podSecurityContext.runAsUser $podSecurityContext.fsGroup | quote }} /var/lib/spire
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
@@ -309,6 +310,8 @@ spec:
|
||||
mountPath: /var/lib/spire
|
||||
- name: spire-agent-admin-socket-dir
|
||||
mountPath: /tmp/spire-agent/private
|
||||
- name: spire-agent-broker-socket-dir
|
||||
mountPath: /tmp/spire-agent/broker
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsGroup: 0
|
||||
|
||||
@@ -252,6 +252,15 @@ workloadAttestors:
|
||||
useNewContainerLocator: true
|
||||
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
|
||||
verboseContainerLocatorLogs: false
|
||||
brokerAPI:
|
||||
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive
|
||||
accessPolicy: enforced
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
|
||||
enabled: false
|
||||
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||
# podReferenceScope: agent_node
|
||||
|
||||
dynamicRegistration:
|
||||
## @param dynamicRegistration.enabled Deploys the sidecar helper for dynamic registration
|
||||
@@ -488,7 +497,7 @@ brokerAPI:
|
||||
bindAddress: 0.0.0.0:8788
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the istio-ztunnel
|
||||
## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the spire-ha-agent
|
||||
enabled: false
|
||||
## @param brokerAPI.brokers.spire-ha-agent.idTemplate The default id template
|
||||
idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||
|
||||
@@ -572,7 +572,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `trustSync.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `trustSync.image.repository` | The repository within the registry | `spiffe/spire-ha-agent/spire-trust-sync` |
|
||||
| `trustSync.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.0.21` |
|
||||
| `trustSync.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.2.0` |
|
||||
| `trustSync.resources` | Resource requests and limits | `{}` |
|
||||
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
||||
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
||||
|
||||
@@ -1443,7 +1443,7 @@ trustSync:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-ha-agent/spire-trust-sync
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "0.0.21"
|
||||
tag: "0.2.0"
|
||||
|
||||
## @param trustSync.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
|
||||
Reference in New Issue
Block a user