Add aws_pca to the spire-server (#404)
This change allows aws_pca to be configured via values of this chart. __Requires 1.7.1 version__ per [bug](https://github.com/spiffe/spire/issues/4351) - this will not work until 1.7.1 is released. --------- Signed-off-by: Petr McAllister <[email protected]> Signed-off-by: Petr McAllister <[email protected]> Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Petr McAllister
co-authored by
Marco Franssen
kfox1111
Marco Franssen
kfox1111
parent
af13f1fc64
commit
9f4d4ace84
@@ -421,6 +421,14 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| spire-server.tornjak.startupProbe.successThreshold | int | `1` | |
|
||||
| spire-server.tornjak.startupProbe.timeoutSeconds | int | `5` | |
|
||||
| spire-server.trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
||||
| spire-server.upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
|
||||
| spire-server.upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
|
||||
| spire-server.upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
|
||||
| spire-server.upstreamAuthority.awsPCA.enabled | bool | `false` | |
|
||||
| spire-server.upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
|
||||
| spire-server.upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
|
||||
| spire-server.upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
|
||||
| spire-server.upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
|
||||
| spire-server.upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
|
||||
| spire-server.upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
|
||||
| spire-server.upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
|
||||
|
||||
@@ -220,6 +220,14 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| tornjak.startupProbe.successThreshold | int | `1` | |
|
||||
| tornjak.startupProbe.timeoutSeconds | int | `5` | |
|
||||
| trustDomain | string | `"example.org"` | Set the trust domain to be used for the SPIFFE identifiers |
|
||||
| upstreamAuthority.awsPCA.assumeRoleARN | Optional | `""` | ARN of an IAM role to assume |
|
||||
| upstreamAuthority.awsPCA.caSigningTemplateARN | string | `""` | See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values. |
|
||||
| upstreamAuthority.awsPCA.certificateAuthorityARN | string | `""` | ARN of the "upstream" CA certificate |
|
||||
| upstreamAuthority.awsPCA.enabled | bool | `false` | |
|
||||
| upstreamAuthority.awsPCA.endpoint | string | `""` | See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. |
|
||||
| upstreamAuthority.awsPCA.region | string | `""` | AWS Region to use |
|
||||
| upstreamAuthority.awsPCA.signingAlgorithm | string | `""` | See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. |
|
||||
| upstreamAuthority.awsPCA.supplementalBundlePath | Optional | `""` | Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. |
|
||||
| upstreamAuthority.certManager.ca.create | bool | `false` | Creates a Cert-Manager CA |
|
||||
| upstreamAuthority.certManager.ca.duration | string | `"87600h"` | Duration of the CA. Defaults to 10 years. |
|
||||
| upstreamAuthority.certManager.ca.privateKey.algorithm | string | `"ECDSA"` | |
|
||||
|
||||
@@ -99,6 +99,30 @@ plugins:
|
||||
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.awsPCA }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||
UpstreamAuthority:
|
||||
- aws_pca:
|
||||
plugin_data:
|
||||
region: {{ .region | quote }}
|
||||
certificate_authority_arn: {{ .certificateAuthorityARN | quote }}
|
||||
ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }}
|
||||
{{- if ne .signingAlgorithm "" }}
|
||||
signing_algorithm: {{ .signingAlgorithm | quote }}
|
||||
{{- end }}
|
||||
{{- if ne .assumeRoleARN "" }}
|
||||
assume_role_arn: {{ .assumeRoleARN | quote }}
|
||||
{{- end }}
|
||||
{{- if ne .endpoint "" }}
|
||||
endpoint: {{ .endpoint | quote }}
|
||||
{{- end }}
|
||||
{{- if ne .supplementalBundlePath "" }}
|
||||
supplemental_bundle_path: {{ .supplementalBundlePath | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if gt $upstreamAuthorityUsed 1 }}
|
||||
{{- fail "You can only enable a single Upstream Authority." }}
|
||||
{{- end }}
|
||||
|
||||
@@ -188,6 +188,25 @@ upstreamAuthority:
|
||||
certificate: ""
|
||||
key: ""
|
||||
bundle: ""
|
||||
awsPCA:
|
||||
enabled: false
|
||||
# -- AWS Region to use
|
||||
region: ""
|
||||
# -- ARN of the "upstream" CA certificate
|
||||
certificateAuthorityARN: ""
|
||||
# -- (Optional) ARN of an IAM role to assume
|
||||
assumeRoleARN: ""
|
||||
# -- (Optional) ARN of the signing template to use for the server's CA. Defaults to a signing template for end-entity certificates only.
|
||||
# -- See Using Templates (https://docs.aws.amazon.com/acm-pca/latest/userguide/UsingTemplates.html) for possible values.
|
||||
caSigningTemplateARN: ""
|
||||
# -- (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default.
|
||||
# -- See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values.
|
||||
signingAlgorithm: ""
|
||||
# -- (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint.
|
||||
# -- See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information.
|
||||
endpoint: ""
|
||||
# -- (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
||||
supplementalBundlePath: ""
|
||||
certManager:
|
||||
enabled: false
|
||||
rbac:
|
||||
|
||||
Reference in New Issue
Block a user