panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

option to configure agent sds (#479)

Browse Source 
Co-authored-by: Marco Franssen <[email protected]>
This commit is contained in:
grameshtwilio
2023-09-11 11:42:27 +00:00
committed by GitHub
co-authored by Marco Franssen
parent 693ce08425
commit 9ad2ed59b1
3 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+5
View File
@@ -79,6 +79,11 @@ A Helm chart to install the SPIRE agent.
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` | | `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` |
| `sds.defaultSvidName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
| `sds.disableSpiffeCertValidation` | Disable Envoy SDS custom validation | `false` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+7
View File
@@ -12,6 +12,13 @@ agent:
trust_bundle_path: "/run/spire/bundle/bundle.crt" trust_bundle_path: "/run/spire/bundle/bundle.crt"
{{- end }} {{- end }}
trust_domain: {{ include "spire-lib.trust-domain" . | quote }} trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
{{- if .Values.sds.enabled }}
sds:
default_svid_name: {{ .Values.sds.defaultSvidName | quote }}
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
disable_spiffe_cert_validation: {{ .Values.sds.disableSpiffeCertValidation }}
{{- end }}
plugins: plugins:
NodeAttestor: NodeAttestor:
charts/spire/charts/spire-agent/values.yaml
+12
View File
@@ -170,6 +170,18 @@ workloadAttestors:
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
disableContainerSelectors: false disableContainerSelectors: false
sds:
## @param sds.enabled Enables Envoy SDS configuration
enabled: false
## @param sds.defaultSvidName The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS
defaultSvidName: "default"
## @param sds.defaultBundleName The Validation Context resource name to use for the default X.509 bundle with Envoy SDS
defaultBundleName: "ROOTCA"
## @param sds.defaultAllBundlesName The Validation Context resource name to use for all bundles (including federated) with Envoy SDS
defaultAllBundlesName: "ALL"
## @param sds.disableSpiffeCertValidation Disable Envoy SDS custom validation
disableSpiffeCertValidation: false
telemetry: telemetry:
prometheus: prometheus:
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring ## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring