From 9e22d2c303c6a90158d68315b359ec795897f7ef Mon Sep 17 00:00:00 2001 From: Kevin Fox Date: Wed, 8 Mar 2023 16:19:15 -0800 Subject: [PATCH] Make the namespace the bundle is dropped into configurable When the server and agent are not in the same namespace, the bundle needs to be uploadable in the agent's namespace. Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 1 + .../templates/bundle-configmap.yaml | 2 +- .../spire-server/templates/configmap.yaml | 2 +- .../charts/spire-server/templates/roles.yaml | 42 +++++++++++++------ charts/spire/charts/spire-server/values.yaml | 5 +++ 5 files changed, 37 insertions(+), 15 deletions(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index ec8ece3..6e810ef 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -69,6 +69,7 @@ A Helm chart to install the SPIRE server. | nodeAttestor.k8sPsat.enabled | bool | `true` | | | nodeAttestor.k8sPsat.serviceAccountAllowList | list | `[]` | | | nodeSelector | object | `{}` | | +| notifier.k8sbundle.namespace | string | `""` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | | podAnnotations | object | `{}` | | | podSecurityContext | object | `{}` | | | replicaCount | int | `1` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | diff --git a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml index ae55ad4..00443fc 100644 --- a/charts/spire/charts/spire-server/templates/bundle-configmap.yaml +++ b/charts/spire/charts/spire-server/templates/bundle-configmap.yaml @@ -2,4 +2,4 @@ apiVersion: v1 kind: ConfigMap metadata: name: {{ .Values.bundleConfigMap }} - namespace: {{ .Release.Namespace }} + namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 2350363..8b2a628 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -60,7 +60,7 @@ data: Notifier "k8sbundle" { plugin_data { - namespace = {{ .Release.Namespace | quote }} + namespace = {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace | quote }} config_map = {{ .Values.bundleConfigMap | quote }} } } diff --git a/charts/spire/charts/spire-server/templates/roles.yaml b/charts/spire/charts/spire-server/templates/roles.yaml index d200626..a0b0f45 100644 --- a/charts/spire/charts/spire-server/templates/roles.yaml +++ b/charts/spire/charts/spire-server/templates/roles.yaml @@ -1,20 +1,25 @@ -# ClusterRole to allow spire-server node attestor to query Token Review API -# and to be able to push certificate bundles to a configmap +# Role to be able to push certificate bundles to a configmap kind: Role apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire-server.fullname" . }} - namespace: {{ .Release.Namespace }} + name: {{ include "spire-server.fullname" . }}-bundle + namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} rules: - # allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE - # agent bootstrapping, see the spire-bundle ConfigMap below) - apiGroups: [""] resources: [configmaps] resourceNames: [{{ .Values.bundleConfigMap }}] verbs: - get - patch - {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }} +{{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.rbac.create }} +--- +# Role to be able to manage cert requests with Cert-Manager +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }}-cm + namespace: {{ .Release.Namespace }} +rules: - apiGroups: ["cert-manager.io"] resources: - certificaterequests @@ -25,12 +30,11 @@ rules: - delete - patch - update - {{- end }} --- kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: - name: {{ include "spire-server.fullname" . }} + name: {{ include "spire-server.fullname" . }}-cm namespace: {{ .Release.Namespace }} subjects: - kind: ServiceAccount @@ -38,20 +42,32 @@ subjects: namespace: {{ .Release.Namespace }} roleRef: kind: Role - name: {{ include "spire-server.fullname" . }} + name: {{ include "spire-server.fullname" . }}-cm + apiGroup: rbac.authorization.k8s.io +{{- end }} +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "spire-server.fullname" . }}-bundle + namespace: {{ .Values.notifier.k8sbundle.namespace | default .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ include "spire-server.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "spire-server.fullname" . }}-bundle apiGroup: rbac.authorization.k8s.io {{- if and .Values.nodeAttestor.k8sPsat.enabled }} --- # ClusterRole to allow spire-server node attestor to query Token Review API -# and to be able to push certificate bundles to a configmap kind: ClusterRole apiVersion: rbac.authorization.k8s.io/v1 metadata: name: {{ include "spire-server.fullname" . }} rules: - # allow TokenReview requests (to verify service account tokens for PSAT - # attestation) - apiGroups: [authentication.k8s.io] resources: [tokenreviews] verbs: diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index ca5bf5d..92ca35a 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -115,6 +115,11 @@ upstreamAuthority: namespace: "" kube_config_file: "" +notifier: + k8sbundle: + # -- Namespace to push the bundle into, if blank will default to SPIRE Server namespace + namespace: "" + controllerManager: enabled: false