Add spire-nested chart (#294)
* Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update based on parent pr feedback Signed-off-by: Kevin Fox <[email protected]> * Reformat config file Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Reconfigure kind Signed-off-by: Kevin Fox <[email protected]> * More debugging Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add external spire-controller-managers Only one external controller manager is supported at a time until https://github.com/spiffe/spire/issues/4898 is resolved. Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add Entry ID Prefix support Signed-off-by: Kevin Fox <[email protected]> * Mulitcluster test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Implement cleanup setting too Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Make spire-lib bits into its own library chart. Signed-off-by: Kevin Fox <[email protected]> * Add spire-nested chart Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix lint issue Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add nameOverride option Signed-off-by: Kevin Fox <[email protected]> * Simplify upstream config. Reorder test for faster executation Signed-off-by: Kevin Fox <[email protected]> * Enable service account allow list to calculate namespace Signed-off-by: Kevin Fox <[email protected]> * Add identity type for child servers Signed-off-by: Kevin Fox <[email protected]> * Enable name override setting Signed-off-by: Kevin Fox <[email protected]> * Fix printing Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix name length issue Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Switch to non cluster-admin user Signed-off-by: Kevin Fox <[email protected]> * Test out adding roles Signed-off-by: Kevin Fox <[email protected]> * Namespace needs to exist Signed-off-by: Kevin Fox <[email protected]> * Remove tty Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Add missing role Signed-off-by: Kevin Fox <[email protected]> * Add kind=none to not require extra objects Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Remove unneeded code Signed-off-by: Kevin Fox <[email protected]> * Add security cluster example Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Dont preinstall crds for nested-security Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix address Signed-off-by: Kevin Fox <[email protected]> * Update port Signed-off-by: Kevin Fox <[email protected]> * Update psat setting Signed-off-by: Kevin Fox <[email protected]> * Update psat setting Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Remove older tests that newer tests cover Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix kind logic Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Seems unneeded. Try and remove Signed-off-by: Kevin Fox <[email protected]> * Update the default ports to be more user friendly Signed-off-by: Kevin Fox <[email protected]> * See if we can leave controller manager port alone Signed-off-by: Kevin Fox <[email protected]> * Change the agent default port too Signed-off-by: Kevin Fox <[email protected]> * Bump up test container Signed-off-by: Kevin Fox <[email protected]> * Swith to testing with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix value name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Upgrade to spire-controller-manager 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Try to isolate config differences just to child cluster Signed-off-by: Kevin Fox <[email protected]> * Update for released 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Merge in some of the id prefix pr Signed-off-by: Kevin Fox <[email protected]> * Entry ID Prefix (#287) * Add Entry ID Prefix support Signed-off-by: Kevin Fox <[email protected]> * Mulitcluster test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Implement cleanup setting too Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Bump up test container Signed-off-by: Kevin Fox <[email protected]> * Swith to testing with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix value name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix up doc formatting Signed-off-by: Kevin Fox <[email protected]> * Revert notes Signed-off-by: Kevin Fox <[email protected]> * Use tags for nested chart Signed-off-by: Kevin Fox <[email protected]> * Add missing tag Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix class name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict issue Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback. Switch setting to be externalServer. Signed-off-by: Kevin Fox <[email protected]> * Update nested chart to use new setting Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add docs about which sections are used with which tags Signed-off-by: Kevin Fox <[email protected]> * Update versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,7 @@
|
||||
kind: Cluster
|
||||
apiVersion: kind.x-k8s.io/v1alpha4
|
||||
networking:
|
||||
apiServerAddress: "172.17.0.1"
|
||||
apiServerPort: 7443
|
||||
podSubnet: "10.245.0.0/16"
|
||||
serviceSubnet: "10.97.0.0/16"
|
||||
@@ -0,0 +1,7 @@
|
||||
kind: Cluster
|
||||
apiVersion: kind.x-k8s.io/v1alpha4
|
||||
networking:
|
||||
apiServerAddress: "172.17.0.1"
|
||||
apiServerPort: 5443
|
||||
podSubnet: "10.246.0.0/16"
|
||||
serviceSubnet: "10.98.0.0/16"
|
||||
@@ -0,0 +1,8 @@
|
||||
#global:
|
||||
# spire:
|
||||
# clusterName: changeme
|
||||
# upstreamSpireAddress: spire-server.changeme
|
||||
|
||||
tags:
|
||||
nestedChildFull: true
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
tags:
|
||||
nestedRoot: true
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
ingress:
|
||||
enabled: true
|
||||
|
||||
external-spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
Executable
+137
@@ -0,0 +1,137 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -xe
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
#DEPS="${TESTDIR}/dependencies"
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
print_helm_releases
|
||||
print_spire_workload_status spire-root-server
|
||||
print_spire_workload_status spire-server spire-system
|
||||
|
||||
if [[ "$1" -ne 0 ]]; then
|
||||
get_namespace_details spire-root-server
|
||||
get_namespace_details spire-server spire-system
|
||||
fi
|
||||
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
|
||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
|
||||
# Deploy an ingress controller
|
||||
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
|
||||
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set "controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP,controller.service.externalIPs[0]=$IP" \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
|
||||
# Test the ingress controller. Should 404 as there is no services yet.
|
||||
curl "$IP"
|
||||
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||
kubectl rollout restart -n kube-system deployment/coredns
|
||||
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
|
||||
|
||||
for cluster in child other; do
|
||||
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||
|
||||
kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml"
|
||||
md5sum "${KC}"
|
||||
wc -l "${KC}"
|
||||
|
||||
helm upgrade --kubeconfig "${KC}" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
||||
helm upgrade --kubeconfig "${KC}" --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/child-values.yaml" \
|
||||
--set "global.spire.upstreamSpireAddress=spire-server.production.other" \
|
||||
--set "global.spire.namespaces.create=true" \
|
||||
--set "global.spire.clusterName=${cluster}" \
|
||||
spire charts/spire-nested
|
||||
|
||||
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep hosts || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply --kubeconfig "${KC}" -f -
|
||||
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep production.other || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/hosts/a\ $IP spire-server.production.other\n $IP spire-server.production.other\n" | kubectl apply --kubeconfig "${KC}" -f -
|
||||
kubectl rollout restart --kubeconfig "${KC}" -n kube-system deployment/coredns
|
||||
kubectl rollout status --kubeconfig "${KC}" -n kube-system -w --timeout=1m deploy/coredns
|
||||
done
|
||||
|
||||
docker exec -i child-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/child-spire-root.kubeconfig"
|
||||
docker exec -i other-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/other-spire-root.kubeconfig"
|
||||
CHILD_KCB64="$(base64 < "${SCRIPTPATH}/child-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||
OTHER_KCB64="$(base64 < "${SCRIPTPATH}/other-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/root-values.yaml" \
|
||||
--wait spire charts/spire-nested \
|
||||
--set "global.spire.namespaces.create=true" \
|
||||
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||
--set "external-spire-server.kubeConfigs.child.kubeConfigBase64=${CHILD_KCB64}" \
|
||||
--set "external-spire-server.kubeConfigs.other.kubeConfigBase64=${OTHER_KCB64}"
|
||||
|
||||
for cluster in child other; do
|
||||
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||
kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml
|
||||
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-upstream -n spire-system
|
||||
kubectl --kubeconfig "${KC}" rollout restart statefulset spire-internal-server -n spire-server
|
||||
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system
|
||||
kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server
|
||||
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-upstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-upstream -n spire-system --prefix --all-containers=true
|
||||
kubectl --kubeconfig "${KC}" rollout status statefulset spire-internal-server -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" statefulset/spire-internal-server -n spire-server --prefix --all-containers=true
|
||||
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-downstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-downstream -n spire-system --prefix --all-containers=true
|
||||
kubectl --kubeconfig "${KC}" rollout status deployment spiffe-oidc-discovery-provider -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" deployment/spiffe-oidc-discovery-provider -n spire-server --prefix --all-containers=true
|
||||
|
||||
echo Pods on "${cluster}"
|
||||
kubectl --kubeconfig "${KC}" get pods -A
|
||||
|
||||
ENTRIES="$(kubectl --kubeconfig "${KC}" exec -i -n spire-server spire-internal-server-0 -- spire-server entry show)"
|
||||
|
||||
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||
echo "${ENTRIES}"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
ENTRIES="$(kubectl exec -i -n spire-server spire-external-server-0 -- spire-server entry show)"
|
||||
|
||||
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||
echo "${ENTRIES}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
helm test --namespace spire-mgmt spire
|
||||
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --namespace spire-mgmt spire
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
kind: Cluster
|
||||
apiVersion: kind.x-k8s.io/v1alpha4
|
||||
networking:
|
||||
apiServerAddress: "172.17.0.1"
|
||||
apiServerPort: 7443
|
||||
podSubnet: "10.245.0.0/16"
|
||||
serviceSubnet: "10.97.0.0/16"
|
||||
@@ -0,0 +1,7 @@
|
||||
kind: Cluster
|
||||
apiVersion: kind.x-k8s.io/v1alpha4
|
||||
networking:
|
||||
apiServerAddress: "172.17.0.1"
|
||||
apiServerPort: 5443
|
||||
podSubnet: "10.246.0.0/16"
|
||||
serviceSubnet: "10.98.0.0/16"
|
||||
@@ -0,0 +1,12 @@
|
||||
# global:
|
||||
# spire:
|
||||
# clusterName: changeme
|
||||
|
||||
tags:
|
||||
nestedChildSecurity: true
|
||||
|
||||
# downstream-spire-agent-security:
|
||||
# serviceAccount:
|
||||
# server:
|
||||
# address: spire-server.changeme
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
tags:
|
||||
nestedRoot: true
|
||||
|
||||
spiffe-oidc-discovery-provider:
|
||||
ingress:
|
||||
enabled: true
|
||||
|
||||
external-spire-server:
|
||||
ingress:
|
||||
enabled: true
|
||||
Executable
+126
@@ -0,0 +1,126 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -xe
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
#DEPS="${TESTDIR}/dependencies"
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
print_helm_releases
|
||||
print_spire_workload_status spire-root-server
|
||||
print_spire_workload_status spire-server spire-system
|
||||
|
||||
if [[ "$1" -ne 0 ]]; then
|
||||
get_namespace_details spire-root-server
|
||||
get_namespace_details spire-server spire-system
|
||||
fi
|
||||
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
|
||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
# Update deps
|
||||
helm dep up charts/spire-nested
|
||||
|
||||
# List nodes
|
||||
kubectl get nodes
|
||||
|
||||
# Deploy an ingress controller
|
||||
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
|
||||
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||
--namespace ingress-nginx \
|
||||
--create-namespace \
|
||||
--set "controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP,controller.service.externalIPs[0]=$IP" \
|
||||
--set controller.ingressClassResource.default=true \
|
||||
--wait
|
||||
|
||||
# Test the ingress controller. Should 404 as there is no services yet.
|
||||
curl "$IP"
|
||||
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||
kubectl rollout restart -n kube-system deployment/coredns
|
||||
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
|
||||
|
||||
# The check is being too pedantic.
|
||||
# shellcheck shell=bash disable=SC2043
|
||||
for cluster in child; do
|
||||
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||
|
||||
kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml"
|
||||
md5sum "${KC}"
|
||||
wc -l "${KC}"
|
||||
|
||||
helm upgrade --kubeconfig "${KC}" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
||||
helm upgrade --kubeconfig "${KC}" --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/child-values.yaml" \
|
||||
--set "downstream-spire-agent-security.server.address=spire-server.production.other" \
|
||||
--set "global.spire.namespaces.create=true" \
|
||||
--set "global.spire.clusterName=${cluster}" \
|
||||
spire charts/spire-nested
|
||||
|
||||
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep hosts || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply --kubeconfig "${KC}" -f -
|
||||
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep production.other || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/hosts/a\ $IP spire-server.production.other\n $IP spire-server.production.other\n" | kubectl apply --kubeconfig "${KC}" -f -
|
||||
kubectl rollout restart --kubeconfig "${KC}" -n kube-system deployment/coredns
|
||||
kubectl rollout status --kubeconfig "${KC}" -n kube-system -w --timeout=1m deploy/coredns
|
||||
done
|
||||
|
||||
docker exec -i child-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/child-spire-root.kubeconfig"
|
||||
CHILD_KCB64="$(base64 < "${SCRIPTPATH}/child-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/root-values.yaml" \
|
||||
--wait spire charts/spire-nested \
|
||||
--set "global.spire.namespaces.create=true" \
|
||||
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||
--set "external-spire-server.kubeConfigs.child.kubeConfigBase64=${CHILD_KCB64}"
|
||||
|
||||
# The check is being too pedantic.
|
||||
# shellcheck shell=bash disable=SC2043
|
||||
for cluster in child; do
|
||||
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||
kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml
|
||||
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system
|
||||
kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server
|
||||
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-downstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-downstream -n spire-system --prefix --all-containers=true
|
||||
kubectl --kubeconfig "${KC}" rollout status deployment spiffe-oidc-discovery-provider -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" deployment/spiffe-oidc-discovery-provider -n spire-server --prefix --all-containers=true
|
||||
|
||||
echo Pods on "${cluster}"
|
||||
kubectl --kubeconfig "${KC}" get pods -A
|
||||
done
|
||||
|
||||
ENTRIES="$(kubectl exec -i -n spire-server spire-external-server-0 -- spire-server entry show)"
|
||||
|
||||
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||
echo "${ENTRIES}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
helm test --namespace spire-mgmt spire
|
||||
|
||||
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
# Possible Nesting Configurations
|
||||
|
||||
There are multiple ways of configuring the chart depending on what you want to use nesting for.
|
||||
|
||||
## Nesting across Kubernetes clusters:
|
||||
|
||||
|
||||
## Nesting within a Kubernetes cluster:
|
||||
|
||||
|
||||
@@ -1,61 +0,0 @@
|
||||
digraph G {
|
||||
subgraph cluster_root {
|
||||
label="Cluster: Root K8S";
|
||||
subgraph cluster_root_release {
|
||||
label="Helm Release: Namespace=spire-root Name=spire"
|
||||
spireRoot [label="Root Spire Server"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_nested1 {
|
||||
label="Cluster: K8S Workload 1";
|
||||
subgraph cluster_nested1_release {
|
||||
label="Helm Release: Namespace=spire-server Name=spire"
|
||||
subgraph cluster_nested1_ns1 {
|
||||
label="Namespace: spire-system"
|
||||
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
|
||||
}
|
||||
subgraph cluster_nested1_ns2 {
|
||||
label="Namespace: spire-server"
|
||||
spireServerNested1 [label="Nested Spire Server"];
|
||||
}
|
||||
subgraph cluster_nested1_ns3 {
|
||||
label="Namespace: spire-system"
|
||||
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_nested1_user {
|
||||
label="Namespace: user"
|
||||
userWorkload1 [label="User Workload"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_nested2 {
|
||||
label="Cluster: K8S Workload 2";
|
||||
subgraph cluster_nested2_release {
|
||||
label="Helm Release: Namespace=spire-server Name=spire"
|
||||
subgraph cluster_nested2_ns1 {
|
||||
label="Namespace: spire-system"
|
||||
spireUpstreamAgent2 [label="Upstream Spire Agent/CSI"];
|
||||
}
|
||||
subgraph cluster_nested2_ns2 {
|
||||
label="Namespace: spire-server"
|
||||
spireServerNested2 [label="Nested Spire Server"];
|
||||
}
|
||||
subgraph cluster_nested2_ns3 {
|
||||
label="Namespace: spire-system"
|
||||
spireDownstreamAgent2 [label="Downstream Spire Agent/CSI"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_nested2_user {
|
||||
label="Namespace: user"
|
||||
userWorkload2 [label="Other User Workload"];
|
||||
}
|
||||
}
|
||||
spireRoot -> spireUpstreamAgent1;
|
||||
spireRoot -> spireUpstreamAgent2;
|
||||
spireUpstreamAgent1 -> spireServerNested1;
|
||||
spireServerNested1 -> spireDownstreamAgent1;
|
||||
spireDownstreamAgent1 -> userWorkload1;
|
||||
spireUpstreamAgent2 -> spireServerNested2;
|
||||
spireServerNested2 -> spireDownstreamAgent2;
|
||||
spireDownstreamAgent2 -> userWorkload2;
|
||||
}
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 127 KiB |
@@ -1,61 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -xe
|
||||
|
||||
SCRIPT="$(readlink -f "$0")"
|
||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||
DEPS="${TESTDIR}/dependencies"
|
||||
|
||||
# shellcheck source=/dev/null
|
||||
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||
# shellcheck source=/dev/null
|
||||
source "${TESTDIR}/common.sh"
|
||||
|
||||
CLEANUP=1
|
||||
|
||||
for i in "$@"; do
|
||||
case $i in
|
||||
-c)
|
||||
CLEANUP=0
|
||||
shift # past argument=value
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
teardown() {
|
||||
print_helm_releases
|
||||
print_spire_workload_status spire-root-server
|
||||
print_spire_workload_status spire-server spire-system
|
||||
|
||||
if [[ "$1" -ne 0 ]]; then
|
||||
get_namespace_details spire-root-server
|
||||
get_namespace_details spire-server spire-system
|
||||
fi
|
||||
|
||||
if [ "${CLEANUP}" -eq 1 ]; then
|
||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||
kubectl delete ns spire-server 2>/dev/null || true
|
||||
kubectl delete ns spire-system 2>/dev/null || true
|
||||
|
||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||
|
||||
kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
||||
kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f -
|
||||
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true
|
||||
|
||||
helm upgrade --install --create-namespace spire charts/spire \
|
||||
--namespace spire-root-server \
|
||||
--values "${DEPS}/spire-root-server-values.yaml" \
|
||||
--wait
|
||||
|
||||
helm upgrade --install --create-namespace --namespace spire-server --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
|
||||
--wait spire charts/spire
|
||||
helm test --namespace spire-server spire
|
||||
|
||||
@@ -1,55 +0,0 @@
|
||||
digraph G {
|
||||
subgraph cluster_baremetal {
|
||||
label="(Bare Metal|Virtual) Node"
|
||||
spireDownstreamAgent3 [label="Downstream Spire Agent"];
|
||||
userWorkload3 [label="External User Workload"];
|
||||
}
|
||||
subgraph cluster_k8s {
|
||||
label="Cluster: K8S";
|
||||
subgraph cluster_root_release {
|
||||
label="Helm Release: Namespace=spire-root Name=spire";
|
||||
subgraph cluster_ns_root {
|
||||
label="Namespace: spire-root"
|
||||
spireRoot [label="Root Spire Server"];
|
||||
}
|
||||
subgraph cluster_ns_1_system {
|
||||
label="Namespace: spire-system"
|
||||
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_nested1_release {
|
||||
label="Helm Release: Namespace=spire-server Name=spire"
|
||||
subgraph cluster_ns_nested_server {
|
||||
label="Namespace: spire-server";
|
||||
spireServerNested1 [label="Internal Nested Spire Server"];
|
||||
}
|
||||
subgraph cluster_ns_nested_system {
|
||||
label="Namespace: spire-system";
|
||||
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
|
||||
}
|
||||
}
|
||||
subgraph cluster_ns_nested_system {
|
||||
label="Namespace: user";
|
||||
userWorkload1 [label="User Workload"];
|
||||
}
|
||||
subgraph cluster_ns_nested2_system {
|
||||
label="Namespace: user-other";
|
||||
userWorkload2 [label="Other User Workload"];
|
||||
}
|
||||
subgraph cluster_nested3_release {
|
||||
label="Helm Release: Namespace=spire-external Name=spire"
|
||||
subgraph cluster_ns_nested2_system {
|
||||
label="Namespace: spire-external";
|
||||
spireServerNested2 [label="External Nested Spire Server"];
|
||||
}
|
||||
}
|
||||
spireRoot -> spireUpstreamAgent1;
|
||||
spireUpstreamAgent1 -> spireServerNested1;
|
||||
spireServerNested1 -> spireDownstreamAgent1;
|
||||
spireDownstreamAgent1 -> userWorkload1;
|
||||
spireDownstreamAgent1 -> userWorkload2;
|
||||
spireUpstreamAgent1 -> spireServerNested2;
|
||||
spireServerNested2 -> spireDownstreamAgent3;
|
||||
spireDownstreamAgent3 -> userWorkload3;
|
||||
}
|
||||
}
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 108 KiB |
@@ -1,19 +0,0 @@
|
||||
global:
|
||||
spire:
|
||||
upstreamSpireAddress: spire-server.spire-root-server
|
||||
|
||||
spire-server:
|
||||
upstreamAuthority:
|
||||
spire:
|
||||
enabled: true
|
||||
upstreamDriver: upstream.csi.spiffe.io
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
default:
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
||||
oidc-discovery-provider:
|
||||
autoPopulateDNSNames: false
|
||||
|
||||
upstream:
|
||||
enabled: true
|
||||
Reference in New Issue
Block a user