Add spire-nested chart (#294)
* Complete Server K8S PSAT support Add all the SPIRE Server supported options for the K8S PSAT attestor. This retains the ease of use for configuring local cluster support while adding the ability to configure multiple/external clusters as well. Kubeconfig support is added in its own config block as it will be used/shared with spire-controller-manager support in the future. Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add support for integration tests in the tests/integration dir Signed-off-by: Kevin Fox <[email protected]> * Fix split issue and typo Signed-off-by: Kevin Fox <[email protected]> * Add basic psat test Signed-off-by: Kevin Fox <[email protected]> * Fix linter Signed-off-by: Kevin Fox <[email protected]> * Fix up test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Better encode config Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Add external k8s bundler Adds support to sync the CA bundle to configmaps in external Kubernetes clusters Signed-off-by: Kevin Fox <[email protected]> * Update default Signed-off-by: Kevin Fox <[email protected]> * Fix config file layout. Incorperate feedback. Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update based on parent pr feedback Signed-off-by: Kevin Fox <[email protected]> * Reformat config file Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Reconfigure kind Signed-off-by: Kevin Fox <[email protected]> * More debugging Signed-off-by: Kevin Fox <[email protected]> * Fix up kind Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add external spire-controller-managers Only one external controller manager is supported at a time until https://github.com/spiffe/spire/issues/4898 is resolved. Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add Entry ID Prefix support Signed-off-by: Kevin Fox <[email protected]> * Mulitcluster test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Implement cleanup setting too Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Make spire-lib bits into its own library chart. Signed-off-by: Kevin Fox <[email protected]> * Add spire-nested chart Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix lint issue Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Add nameOverride option Signed-off-by: Kevin Fox <[email protected]> * Simplify upstream config. Reorder test for faster executation Signed-off-by: Kevin Fox <[email protected]> * Enable service account allow list to calculate namespace Signed-off-by: Kevin Fox <[email protected]> * Add identity type for child servers Signed-off-by: Kevin Fox <[email protected]> * Enable name override setting Signed-off-by: Kevin Fox <[email protected]> * Fix printing Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix name length issue Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Switch to non cluster-admin user Signed-off-by: Kevin Fox <[email protected]> * Test out adding roles Signed-off-by: Kevin Fox <[email protected]> * Namespace needs to exist Signed-off-by: Kevin Fox <[email protected]> * Remove tty Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Add missing role Signed-off-by: Kevin Fox <[email protected]> * Add kind=none to not require extra objects Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Remove unneeded code Signed-off-by: Kevin Fox <[email protected]> * Add security cluster example Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Dont preinstall crds for nested-security Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix address Signed-off-by: Kevin Fox <[email protected]> * Update port Signed-off-by: Kevin Fox <[email protected]> * Update psat setting Signed-off-by: Kevin Fox <[email protected]> * Update psat setting Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Remove older tests that newer tests cover Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix kind logic Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Seems unneeded. Try and remove Signed-off-by: Kevin Fox <[email protected]> * Update the default ports to be more user friendly Signed-off-by: Kevin Fox <[email protected]> * See if we can leave controller manager port alone Signed-off-by: Kevin Fox <[email protected]> * Change the agent default port too Signed-off-by: Kevin Fox <[email protected]> * Bump up test container Signed-off-by: Kevin Fox <[email protected]> * Swith to testing with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix value name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Upgrade to spire-controller-manager 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Try to isolate config differences just to child cluster Signed-off-by: Kevin Fox <[email protected]> * Update for released 0.5.0 Signed-off-by: Kevin Fox <[email protected]> * Merge in some of the id prefix pr Signed-off-by: Kevin Fox <[email protected]> * Entry ID Prefix (#287) * Add Entry ID Prefix support Signed-off-by: Kevin Fox <[email protected]> * Mulitcluster test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Implement cleanup setting too Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Bump up test container Signed-off-by: Kevin Fox <[email protected]> * Swith to testing with nightly Signed-off-by: Kevin Fox <[email protected]> * Fix value name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix up doc formatting Signed-off-by: Kevin Fox <[email protected]> * Revert notes Signed-off-by: Kevin Fox <[email protected]> * Use tags for nested chart Signed-off-by: Kevin Fox <[email protected]> * Add missing tag Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix class name Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict issue Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback. Switch setting to be externalServer. Signed-off-by: Kevin Fox <[email protected]> * Update nested chart to use new setting Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Add docs about which sections are used with which tags Signed-off-by: Kevin Fox <[email protected]> * Update versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -1,45 +0,0 @@
|
|||||||
global:
|
|
||||||
spire:
|
|
||||||
clusterName: production
|
|
||||||
trustDomain: production.other
|
|
||||||
|
|
||||||
spire-server:
|
|
||||||
controllerManager:
|
|
||||||
identities:
|
|
||||||
clusterSPIFFEIDs:
|
|
||||||
default:
|
|
||||||
type: raw
|
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
||||||
namespaceSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: "kubernetes.io/metadata.name"
|
|
||||||
operator: In
|
|
||||||
values: [spire-server]
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
release: spire
|
|
||||||
release-namespace: spire-server
|
|
||||||
component: server
|
|
||||||
downstream: true
|
|
||||||
oidc-discovery-provider:
|
|
||||||
enabled: false
|
|
||||||
test-keys:
|
|
||||||
enabled: false
|
|
||||||
nodeAttestor:
|
|
||||||
k8sPsat:
|
|
||||||
serviceAccountAllowList:
|
|
||||||
- spire-system:spire-agent-upstream
|
|
||||||
bundleConfigMap: spire-bundle-upstream
|
|
||||||
notifier:
|
|
||||||
k8sbundle:
|
|
||||||
namespace: spire-system
|
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spire-agent:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spiffe-csi-driver:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
@@ -249,7 +249,7 @@ jobs:
|
|||||||
|
|
||||||
- name: Install and test example
|
- name: Install and test example
|
||||||
run: |
|
run: |
|
||||||
if [ "${{ matrix.example }}" = "examples/federation" ]; then
|
if [ "${{ matrix.example }}" = "examples/federation" -o "${{ matrix.example }}" = "examples/nested-full" -o "${{ matrix.example }}" = "examples/nested-security" ]; then
|
||||||
kubectl create namespace spire-mgmt
|
kubectl create namespace spire-mgmt
|
||||||
helm install -n spire-mgmt spire-crds charts/spire-crds
|
helm install -n spire-mgmt spire-crds charts/spire-crds
|
||||||
else
|
else
|
||||||
|
|||||||
@@ -0,0 +1,24 @@
|
|||||||
|
# Patterns to ignore when building packages.
|
||||||
|
# This supports shell glob matching, relative path matching, and
|
||||||
|
# negation (prefixed with !). Only one pattern per line.
|
||||||
|
.DS_Store
|
||||||
|
# Common VCS dirs
|
||||||
|
.git/
|
||||||
|
.gitignore
|
||||||
|
.bzr/
|
||||||
|
.bzrignore
|
||||||
|
.hg/
|
||||||
|
.hgignore
|
||||||
|
.svn/
|
||||||
|
# Common backup files
|
||||||
|
*.swp
|
||||||
|
*.bak
|
||||||
|
*.tmp
|
||||||
|
*.orig
|
||||||
|
*~
|
||||||
|
# Various IDEs
|
||||||
|
.project
|
||||||
|
.idea/
|
||||||
|
*.tmproj
|
||||||
|
.vscode/
|
||||||
|
ci/
|
||||||
@@ -0,0 +1,116 @@
|
|||||||
|
apiVersion: v2
|
||||||
|
name: spire-nested
|
||||||
|
description: >
|
||||||
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
type: application
|
||||||
|
version: 0.20.0
|
||||||
|
appVersion: "1.9.6"
|
||||||
|
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||||
|
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
|
sources:
|
||||||
|
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||||
|
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||||
|
maintainers:
|
||||||
|
- name: marcofranssen
|
||||||
|
email: [email protected]
|
||||||
|
url: https://marcofranssen.nl
|
||||||
|
- name: kfox1111
|
||||||
|
email: [email protected]
|
||||||
|
- name: faisal-memon
|
||||||
|
email: [email protected]
|
||||||
|
kubeVersion: ">=1.21.0-0"
|
||||||
|
dependencies:
|
||||||
|
- name: spire-lib
|
||||||
|
repository: file://../spire/charts/spire-lib
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-server
|
||||||
|
alias: root-spire-server
|
||||||
|
condition: root-spire-server.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
repository: file://../spire/charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-server
|
||||||
|
alias: external-root-spire-server-full
|
||||||
|
condition: external-root-spire-server-full.enabled
|
||||||
|
tags:
|
||||||
|
- nestedChildFull
|
||||||
|
repository: file://../spire/charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-server
|
||||||
|
alias: external-root-spire-server-security
|
||||||
|
condition: external-root-spire-server-security.enabled
|
||||||
|
tags:
|
||||||
|
- nestedChildSecurity
|
||||||
|
repository: file://../spire/charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-server
|
||||||
|
alias: internal-spire-server
|
||||||
|
condition: internal-spire-server.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
repository: file://../spire/charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-server
|
||||||
|
alias: external-spire-server
|
||||||
|
condition: external-spire-server.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
repository: file://../spire/charts/spire-server
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-agent
|
||||||
|
alias: downstream-spire-agent-full
|
||||||
|
condition: downstream-spire-agent-full.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
repository: file://../spire/charts/spire-agent
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-agent
|
||||||
|
alias: downstream-spire-agent-security
|
||||||
|
condition: downstream-spire-agent-security.enabled
|
||||||
|
tags:
|
||||||
|
- nestedChildSecurity
|
||||||
|
repository: file://../spire/charts/spire-agent
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spire-agent
|
||||||
|
alias: upstream-spire-agent
|
||||||
|
condition: upstream-spire-agent.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
repository: file://../spire/charts/spire-agent
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spiffe-csi-driver
|
||||||
|
alias: downstream-spiffe-csi-driver
|
||||||
|
condition: downstream-spiffe-csi-driver.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
- nestedChildSecurity
|
||||||
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spiffe-csi-driver
|
||||||
|
alias: upstream-spiffe-csi-driver
|
||||||
|
condition: upstream-spiffe-csi-driver.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
repository: file://../spire/charts/spiffe-csi-driver
|
||||||
|
version: 0.1.0
|
||||||
|
- name: spiffe-oidc-discovery-provider
|
||||||
|
condition: spiffe-oidc-discovery-provider.enabled
|
||||||
|
tags:
|
||||||
|
- nestedRoot
|
||||||
|
- nestedChildFull
|
||||||
|
- nestedChildSecurity
|
||||||
|
repository: file://../spire/charts/spiffe-oidc-discovery-provider
|
||||||
|
version: 0.1.0
|
||||||
|
- name: tornjak-frontend
|
||||||
|
condition: tornjak-frontend.enabled
|
||||||
|
repository: file://../spire/charts/tornjak-frontend
|
||||||
|
version: 0.1.0
|
||||||
|
annotations:
|
||||||
|
artifacthub.io/category: security
|
||||||
|
artifacthub.io/license: Apache-2.0
|
||||||
@@ -0,0 +1,201 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright [yyyy] [name of copyright owner]
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
@@ -0,0 +1,352 @@
|
|||||||
|
# spire
|
||||||
|
|
||||||
|
  
|
||||||
|
[](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
|
||||||
|
|
||||||
|
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||||
|
|
||||||
|
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
||||||
|
|
||||||
|
## Install Instructions
|
||||||
|
|
||||||
|
### Non Production
|
||||||
|
To do a quick install suitable for testing in something like minikube:
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
|
||||||
|
helm upgrade --install -n spire-server spire spire-nested --repo https://spiffe.github.io/helm-charts-hardened/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Production
|
||||||
|
|
||||||
|
Preparing a production deployment requires a few steps.
|
||||||
|
|
||||||
|
1. Save the following to your-values.yaml, ideally in your git repo.
|
||||||
|
```yaml
|
||||||
|
global:
|
||||||
|
openshift: false # If running on openshift, set to true
|
||||||
|
spire:
|
||||||
|
recommendations:
|
||||||
|
enabled: true
|
||||||
|
namespaces:
|
||||||
|
create: true
|
||||||
|
ingressControllerType: "" # If not openshift, and want to expose services, set to a supported option [ingress-nginx]
|
||||||
|
# Update these
|
||||||
|
clusterName: example-cluster
|
||||||
|
trustDomain: example.org
|
||||||
|
caSubject:
|
||||||
|
country: ARPA
|
||||||
|
organization: Example
|
||||||
|
commonName: example.org
|
||||||
|
```
|
||||||
|
|
||||||
|
2. If you need a non default storageClass, append the following to the spire-server section and update:
|
||||||
|
```
|
||||||
|
persistence:
|
||||||
|
storageClass: your-storage-class
|
||||||
|
```
|
||||||
|
|
||||||
|
3. If your Kubernetes cluster is OpenShift based, use the output of the following command to update the trustDomain setting:
|
||||||
|
```shell
|
||||||
|
oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//'
|
||||||
|
```
|
||||||
|
|
||||||
|
4. Find any additional values you might want to set based on the documentation below or using the [examples](https://github.com/spiffe/helm-charts-hardened/tree/main/examples)
|
||||||
|
|
||||||
|
In particular, consider using an external database.
|
||||||
|
|
||||||
|
5. Deploy
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm upgrade --install -n spire-mgmt spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
|
||||||
|
helm upgrade --install -n spire-mgmt spire spire-nested --repo https://spiffe.github.io/helm-charts-hardened/ -f your-values.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
## Clean up
|
||||||
|
|
||||||
|
```shell
|
||||||
|
helm -n spire-mgmt uninstall spire-crds
|
||||||
|
helm -n spire-mgmt uninstall spire
|
||||||
|
kubectl -n spire-server delete pvc -l app.kubernetes.io/instance=spire
|
||||||
|
kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeids.spire.spiffe.io clusterstaticentries.spire.spiffe.io
|
||||||
|
```
|
||||||
|
|
||||||
|
## Upgrade notes
|
||||||
|
|
||||||
|
We only support upgrading one major version at a time. Version skipping isn't supported.
|
||||||
|
|
||||||
|
### 0.17.X
|
||||||
|
|
||||||
|
- If you set spire-server.replicaCount > 1, update it to 1 before upgrading and after upgrade you can set it back to its previous value.
|
||||||
|
- The SPIFFE OIDC Discovery Provider now has many new TLS options and defaults to using SPIRE to issue its certificate.
|
||||||
|
- The `spiffe-oidc-discovery-provider.insecureScheme.enabled` flag was removed. If you previously set that flag, remove the setting from your values.yaml and see if the new default of using a SPIRE issued certificate is suitable for your deployment. If it isn't, please consider one of the other options under `spiffe-oidc-discovery-provider.tls`. If all other options are still unsuitable, you can still enable the previous mode by disabling TLS. (`spiffe-oidc-discovery-provider.tls.spire.enabled=false`)
|
||||||
|
|
||||||
|
- The SPIFFE OIDC Discovery Provider is now enabled by default. If you previously chose to have it off, you can disable it explicitly with `spiffe-oidc-discovery-provider.enabled=false`.
|
||||||
|
|
||||||
|
### 0.16.X
|
||||||
|
|
||||||
|
The settings under "spire-server.controllerManager.identities" have all been moved under "spire-server.controllerManager.identities.clusterSPIFFEIDs.default". If you have changed any from the defaults, please update them to the new location during upgrade.
|
||||||
|
|
||||||
|
### 0.15.X
|
||||||
|
|
||||||
|
The spire-crds chart has been updated. Please ensure you have upgraded spire-crds before upgrading the spire chart.
|
||||||
|
|
||||||
|
The chart now supports multiple parallel installs of spire-controller-manager. Each install will handle all custom resources with a matching `className` field. By default this is set to `Release.Namespace-Release.Name` and the controller manager will only pick up custom resources with this `className`.
|
||||||
|
|
||||||
|
If you have not loaded any SPIRE custom resources yourself, the upgrade process will be transparent. If you have loaded your own SPIRE custom resources, set `spire-server.controllerManager.watchClassless=true` until you can update your SPIRE custom resources to have the `className` for the instance specified.
|
||||||
|
|
||||||
|
### 0.14.X
|
||||||
|
|
||||||
|
If coming from a chart version before 0.14.0, you must relabel your crds to switch to using the new spire-crds chart. To migrate to the spire-crds chart
|
||||||
|
run the following:
|
||||||
|
|
||||||
|
Replace the spire-server namespace in the commands below with the namespace you want to install the spire-crds chart in.
|
||||||
|
|
||||||
|
```shell
|
||||||
|
kubectl label crd "clusterfederatedtrustdomains.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||||
|
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||||
|
kubectl annotate crd "clusterfederatedtrustdomains.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||||
|
kubectl label crd "clusterspiffeids.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||||
|
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||||
|
kubectl annotate crd "clusterspiffeids.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||||
|
kubectl label crd "controllermanagerconfigs.spire.spiffe.io" "app.kubernetes.io/managed-by=Helm"
|
||||||
|
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-name=spire-crds"
|
||||||
|
kubectl annotate crd "controllermanagerconfigs.spire.spiffe.io" "meta.helm.sh/release-namespace=spire-server"
|
||||||
|
helm install -n spire-server spire-crds charts/spire-crds
|
||||||
|
```
|
||||||
|
|
||||||
|
## Version support
|
||||||
|
|
||||||
|
> [!Warning]
|
||||||
|
> This Chart is still in development and still subject to change the API (`values.yaml`).
|
||||||
|
> Until we reach a `1.0.0` version of the chart we can't guarantee backwards compatibility although
|
||||||
|
> we do aim for as much stability as possible.
|
||||||
|
|
||||||
|
| Dependency | Supported Versions |
|
||||||
|
|:-----------|:-------------------|
|
||||||
|
| Helm | `3.x` |
|
||||||
|
| Kubernetes | `1.22+` |
|
||||||
|
|
||||||
|
> [!Note]
|
||||||
|
> For Kubernetes, we will officially support the last 3 versions as described in [k8s versioning](https://kubernetes.io/releases/version-skew-policy/#supported-versions). Any version before the last 3 we will try to support as long it doesn't bring security issues or any big maintenance burden.
|
||||||
|
|
||||||
|
## FAQ
|
||||||
|
|
||||||
|
For any issues see our [FAQ](../../FAQ.md)…
|
||||||
|
|
||||||
|
## Usage
|
||||||
|
|
||||||
|
To utilize Spire in your own workloads you should add the following to your workload:
|
||||||
|
|
||||||
|
```diff
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Pod
|
||||||
|
metadata:
|
||||||
|
name: my-app
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: my-app
|
||||||
|
image: "my-app:latest"
|
||||||
|
imagePullPolicy: Always
|
||||||
|
+ volumeMounts:
|
||||||
|
+ - name: spiffe-workload-api
|
||||||
|
+ mountPath: /spiffe-workload-api
|
||||||
|
+ readOnly: true
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 200m
|
||||||
|
memory: 32Mi
|
||||||
|
limits:
|
||||||
|
cpu: 500m
|
||||||
|
memory: 64Mi
|
||||||
|
+ volumes:
|
||||||
|
+ - name: spiffe-workload-api
|
||||||
|
+ csi:
|
||||||
|
+ driver: "csi.spiffe.io"
|
||||||
|
+ readOnly: true
|
||||||
|
```
|
||||||
|
|
||||||
|
Now you can interact with the Spire agent socket from your own application. The socket is mounted on `/spiffe-workload-api/spire-agent.sock`.
|
||||||
|
|
||||||
|
## Maintainers
|
||||||
|
|
||||||
|
| Name | Email | Url |
|
||||||
|
| ---- | ------ | --- |
|
||||||
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||||
|
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||||
|
| faisal-memon | <fymemon@yahoo.com> | |
|
||||||
|
| edwbuck | <edwbuck@gmail.com> | |
|
||||||
|
|
||||||
|
## Source Code
|
||||||
|
|
||||||
|
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire>
|
||||||
|
|
||||||
|
## Requirements
|
||||||
|
|
||||||
|
| Repository | Name | Version |
|
||||||
|
|------------|------|---------|
|
||||||
|
| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
|
||||||
|
| file://./charts/spiffe-csi-driver | upstream-spiffe-csi-driver(spiffe-csi-driver) | 0.1.0 |
|
||||||
|
| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
|
||||||
|
| file://./charts/spire-agent | spire-agent | 0.1.0 |
|
||||||
|
| file://./charts/spire-agent | upstream-spire-agent(spire-agent) | 0.1.0 |
|
||||||
|
| file://./charts/spire-server | spire-server | 0.1.0 |
|
||||||
|
| file://./charts/tornjak-frontend | tornjak-frontend | 0.1.0 |
|
||||||
|
|
||||||
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||||
|
|
||||||
|
## Parameters
|
||||||
|
|
||||||
|
### Global parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- |
|
||||||
|
| `global.k8s.clusterDomain` | Cluster domain name configured for Spire install | `cluster.local` |
|
||||||
|
| `global.spire.clusterName` | The name of the k8s cluster for Spire install | `example-cluster` |
|
||||||
|
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
|
||||||
|
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
|
||||||
|
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
|
||||||
|
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
|
||||||
|
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
|
||||||
|
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
|
||||||
|
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
|
||||||
|
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
|
||||||
|
| `global.spire.recommendations.priorityClassName` | Set to true to use recommended values for Pod Priority Class Names | `true` |
|
||||||
|
| `global.spire.recommendations.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `true` |
|
||||||
|
| `global.spire.recommendations.securityContexts` | Set to true to use recommended values for Pod and Container Security Contexts | `true` |
|
||||||
|
| `global.spire.recommendations.prometheus` | Enable prometheus exporters for monitoring | `true` |
|
||||||
|
| `global.spire.image.registry` | Override all Spire image registries at once | `""` |
|
||||||
|
| `global.spire.namespaces.create` | Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created. | `false` |
|
||||||
|
| `global.spire.namespaces.system.name` | Name of the Spire system Namespace. | `spire-system` |
|
||||||
|
| `global.spire.namespaces.system.create` | Create a Namespace for Spire system resources. | `false` |
|
||||||
|
| `global.spire.namespaces.system.annotations` | Annotations to apply to the Spire system Namespace. | `{}` |
|
||||||
|
| `global.spire.namespaces.system.labels` | Labels to apply to the Spire system Namespace. | `{}` |
|
||||||
|
| `global.spire.namespaces.server.name` | Name of the Spire server Namespace. | `spire-server` |
|
||||||
|
| `global.spire.namespaces.server.create` | Create a Namespace for Spire server resources. | `false` |
|
||||||
|
| `global.spire.namespaces.server.annotations` | Annotations to apply to the Spire server Namespace. | `{}` |
|
||||||
|
| `global.spire.namespaces.server.labels` | Labels to apply to the Spire server Namespace. | `{}` |
|
||||||
|
| `global.spire.strictMode` | Check values, such as trustDomain, are overridden with a suitable value for production. | `false` |
|
||||||
|
| `global.spire.ingressControllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||||
|
| `global.spire.tools.kubectl.tag` | Set to force the tag to use for all kubectl instances | `""` |
|
||||||
|
| `global.installAndUpgradeHooks.enabled` | Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `global.deleteHooks.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||||
|
| `tags.nestedRoot` | Set the chart architecture to root nested | `false` |
|
||||||
|
| `tags.nestedChildFull` | Set the chart mode to a child cluster with its own nested server | `false` |
|
||||||
|
| `tags.nestedChildSecurity` | Set the chart mode to a child cluster for use with a security cluster | `false` |
|
||||||
|
|
||||||
|
### Spire agent parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------- | ------------------------------------------------------------- | ------------------------- |
|
||||||
|
| `downstream-spire-agent-full.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||||
|
| `downstream-spire-agent-full.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||||
|
| `downstream-spire-agent-full.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-downstream` |
|
||||||
|
|
||||||
|
### Spire agent parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ----------------------------------------------------- | ------------------------------------------------------------- | ----------------------- |
|
||||||
|
| `downstream-spire-agent-security.nameOverride` | Overrides the name of Spire agent pods | `agent-downstream` |
|
||||||
|
| `downstream-spire-agent-security.bundleConfigMap` | The name of the configmap that contains the downstream bundle | `spire-bundle-upstream` |
|
||||||
|
| `downstream-spire-agent-security.serviceAccount.name` | The name of the service account to use | `spire-agent-upstream` |
|
||||||
|
|
||||||
|
### Upstream Spire agent parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------ | -------------------------------------------------- | ---------------------------------------------------- |
|
||||||
|
| `upstream-spire-agent.upstream` | Flag for enabling upstream Spire agent | `true` |
|
||||||
|
| `upstream-spire-agent.nameOverride` | Name override for upstream Spire agent | `agent-upstream` |
|
||||||
|
| `upstream-spire-agent.bundleConfigMap` | The configmap name for upstream Spire agent bundle | `spire-bundle-upstream` |
|
||||||
|
| `upstream-spire-agent.socketPath` | Socket path where Spire agent socket is mounted | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||||
|
| `upstream-spire-agent.serviceAccount.name` | Service account name for upstream Spire agent | `spire-agent-upstream` |
|
||||||
|
| `upstream-spire-agent.healthChecks.port` | Health check port number for upstream Spire agent | `9981` |
|
||||||
|
| `upstream-spire-agent.telemetry.prometheus.port` | The port where prometheus metrics are available | `9989` |
|
||||||
|
| `upstream-spire-agent.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||||
|
|
||||||
|
### SPIFFE CSI Driver parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ----------------------------------------------- | ----------------- | ------------------------------ |
|
||||||
|
| `downstream-spiffe-csi-driver.fullnameOverride` | Fullname override | `spiffe-csi-driver-downstream` |
|
||||||
|
|
||||||
|
### Upstream SPIFFE CSI Driver parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ---------------------------------------------- | ----------------------------------------------------------- | ---------------------------------------------------- |
|
||||||
|
| `upstream-spiffe-csi-driver.fullnameOverride` | Fullname override | `spiffe-csi-driver-upstream` |
|
||||||
|
| `upstream-spiffe-csi-driver.pluginName` | The plugin name for configuring upstream Spiffe CSI driver | `upstream.csi.spiffe.io` |
|
||||||
|
| `upstream-spiffe-csi-driver.agentSocketPath` | The socket path where Spiffe CSI driver mounts agent socket | `/run/spire/agent-sockets-upstream/spire-agent.sock` |
|
||||||
|
| `upstream-spiffe-csi-driver.healthChecks.port` | The port where Spiffe CSI driver health checks are exposed | `9810` |
|
||||||
|
|
||||||
|
### SPIFFE oidc discovery provider parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------- | ----------------- | -------------------------------- |
|
||||||
|
| `spiffe-oidc-discovery-provider.fullnameOverride` | Fullname override | `spiffe-oidc-discovery-provider` |
|
||||||
|
|
||||||
|
### Tornjak frontend parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
|
||||||
|
| `tornjak-frontend.enabled` | Enables deployment of Tornjak frontend/UI (Not for production) | `false` |
|
||||||
|
| `root-spire-server.nameOverride` | Name override | `root-server` |
|
||||||
|
| `root-spire-server.crNameOverride` | Custom Resource name override | `root` |
|
||||||
|
| `root-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
| `root-spire-server.controllerManager.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||||
|
| `root-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||||
|
| `root-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-root-server` |
|
||||||
|
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable child servers | `true` |
|
||||||
|
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` |
|
||||||
|
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` |
|
||||||
|
| `root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
|
||||||
|
| `root-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||||
|
| `root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
|
| `root-spire-server.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
|
||||||
|
| `external-root-spire-server-full.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` |
|
||||||
|
| `external-root-spire-server-full.nameOverride` | Name override | `root-server` |
|
||||||
|
| `external-root-spire-server-full.crNameOverride` | Custom Resource name override | `root` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled` | Enable child servers | `true` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default cluster spiffe id | `false` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the test-keys identity | `false` |
|
||||||
|
| `external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
|
||||||
|
| `external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
|
| `external-root-spire-server-full.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
|
||||||
|
| `external-root-spire-server-security.externalServer` | Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers. | `true` |
|
||||||
|
| `external-root-spire-server-security.nameOverride` | Name override | `root-server` |
|
||||||
|
| `external-root-spire-server-security.crNameOverride` | Custom Resource name override | `root` |
|
||||||
|
| `external-root-spire-server-security.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
| `external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||||
|
| `external-root-spire-server-security.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
|
||||||
|
| `external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
|
||||||
|
| `external-root-spire-server-security.bundleConfigMap` | The name of the configmap to store the upstream bundle | `spire-bundle-upstream` |
|
||||||
|
|
||||||
|
### Spire server parameters
|
||||||
|
|
||||||
|
| Name | Description | Value |
|
||||||
|
| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | ---------------------------- |
|
||||||
|
| `internal-spire-server.nameOverride` | Overrides the name of Spire server pods | `internal-server` |
|
||||||
|
| `internal-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
| `internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||||
|
| `internal-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||||
|
| `internal-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||||
|
| `internal-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||||
|
| `internal-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||||
|
| `internal-spire-server.bundleConfigMap` | The name of the configmap to store the downstream bundle | `spire-bundle-downstream` |
|
||||||
|
| `external-spire-server.nameOverride` | Overrides the name of Spire server pods | `external-server` |
|
||||||
|
| `external-spire-server.crNameOverride` | Custom Resource name override | `external` |
|
||||||
|
| `external-spire-server.controllerManager.enabled` | Enable controller manager and provision CRD's | `true` |
|
||||||
|
| `external-spire-server.controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another instance on the k8s cluster with webhooks enabled. | `false` |
|
||||||
|
| `external-spire-server.controllerManager.className` | specify to use an explicit class name. | `spire-mgmt-external-server` |
|
||||||
|
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled` | Enable the default identity | `false` |
|
||||||
|
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled` | Enable the oidc-discovery-provider identity | `false` |
|
||||||
|
| `external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable the test-keys identity | `false` |
|
||||||
|
| `external-spire-server.externalControllerManagers.enabled` | Flag to enable external controller managers | `true` |
|
||||||
|
| `external-spire-server.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||||
|
| `external-spire-server.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream.csi.spiffe.io` |
|
||||||
|
| `external-spire-server.upstreamAuthority.spire.server.nameOverride` | The name override setting of the root SPIRE server | `root-server` |
|
||||||
|
| `external-spire-server.notifier.k8sbundle.enabled` | Enable local k8s bundle uploader | `false` |
|
||||||
|
| `external-spire-server.nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `false` |
|
||||||
|
| `external-spire-server.nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `true` |
|
||||||
@@ -0,0 +1,3 @@
|
|||||||
|
{{- include "spire-lib.namespace.system" . }}
|
||||||
|
---
|
||||||
|
{{- include "spire-lib.namespace.server" . }}
|
||||||
@@ -0,0 +1,388 @@
|
|||||||
|
# Default configuration for Spire chart
|
||||||
|
# SPDX-License-Identifier: APACHE-2.0
|
||||||
|
|
||||||
|
## @section Global parameters
|
||||||
|
## Note: the parameter values specified here will override the chart level values for these parameters.
|
||||||
|
##
|
||||||
|
global:
|
||||||
|
k8s:
|
||||||
|
## @param global.k8s.clusterDomain Cluster domain name configured for Spire install
|
||||||
|
clusterDomain: cluster.local
|
||||||
|
|
||||||
|
spire:
|
||||||
|
## @param global.spire.clusterName The name of the k8s cluster for Spire install
|
||||||
|
clusterName: example-cluster
|
||||||
|
## @param global.spire.jwtIssuer The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset
|
||||||
|
jwtIssuer: ""
|
||||||
|
## @param global.spire.trustDomain The trust domain for Spire install
|
||||||
|
trustDomain: example.org
|
||||||
|
|
||||||
|
## @param global.spire.caSubject.country Country for Spire server CA
|
||||||
|
## @param global.spire.caSubject.organization Organization for Spire server CA
|
||||||
|
## @param global.spire.caSubject.commonName Common Name for Spire server CA
|
||||||
|
caSubject:
|
||||||
|
country: ""
|
||||||
|
organization: ""
|
||||||
|
commonName: ""
|
||||||
|
|
||||||
|
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
|
||||||
|
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
|
||||||
|
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels
|
||||||
|
## @param global.spire.recommendations.priorityClassName Set to true to use recommended values for Pod Priority Class Names
|
||||||
|
## @param global.spire.recommendations.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||||
|
## @param global.spire.recommendations.securityContexts Set to true to use recommended values for Pod and Container Security Contexts
|
||||||
|
## @param global.spire.recommendations.prometheus Enable prometheus exporters for monitoring
|
||||||
|
recommendations:
|
||||||
|
enabled: false
|
||||||
|
namespaceLayout: true
|
||||||
|
namespacePSS: true
|
||||||
|
priorityClassName: true
|
||||||
|
strictMode: true
|
||||||
|
securityContexts: true
|
||||||
|
prometheus: true
|
||||||
|
|
||||||
|
image:
|
||||||
|
## @param global.spire.image.registry Override all Spire image registries at once
|
||||||
|
registry: ""
|
||||||
|
|
||||||
|
namespaces:
|
||||||
|
## @param global.spire.namespaces.create Set to true to Create all namespaces. If this or either of the namespace specific create flags is set, the namespace will be created.
|
||||||
|
create: false
|
||||||
|
system:
|
||||||
|
## @param global.spire.namespaces.system.name Name of the Spire system Namespace.
|
||||||
|
name: "spire-system"
|
||||||
|
## @param global.spire.namespaces.system.create Create a Namespace for Spire system resources.
|
||||||
|
create: false
|
||||||
|
## @param global.spire.namespaces.system.annotations [object] Annotations to apply to the Spire system Namespace.
|
||||||
|
annotations: {}
|
||||||
|
## @param global.spire.namespaces.system.labels [object] Labels to apply to the Spire system Namespace.
|
||||||
|
labels: {}
|
||||||
|
server:
|
||||||
|
## @param global.spire.namespaces.server.name Name of the Spire server Namespace.
|
||||||
|
name: "spire-server"
|
||||||
|
## @param global.spire.namespaces.server.create Create a Namespace for Spire server resources.
|
||||||
|
create: false
|
||||||
|
## @param global.spire.namespaces.server.annotations [object] Annotations to apply to the Spire server Namespace.
|
||||||
|
annotations: {}
|
||||||
|
## @param global.spire.namespaces.server.labels [object] Labels to apply to the Spire server Namespace.
|
||||||
|
labels: {}
|
||||||
|
|
||||||
|
## @param global.spire.strictMode Check values, such as trustDomain, are overridden with a suitable value for production.
|
||||||
|
strictMode: false
|
||||||
|
|
||||||
|
## @param global.spire.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||||
|
ingressControllerType: ""
|
||||||
|
|
||||||
|
tools:
|
||||||
|
kubectl:
|
||||||
|
## @param global.spire.tools.kubectl.tag Set to force the tag to use for all kubectl instances
|
||||||
|
tag: ""
|
||||||
|
|
||||||
|
installAndUpgradeHooks:
|
||||||
|
## @param global.installAndUpgradeHooks.enabled Enable Helm hooks to autofix common install/upgrade issues (should be disabled when using `helm template`)
|
||||||
|
enabled: true
|
||||||
|
deleteHooks:
|
||||||
|
## @param global.deleteHooks.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# telemetry:
|
||||||
|
# prometheus:
|
||||||
|
# enabled: true
|
||||||
|
# podMonitor:
|
||||||
|
# enabled: true
|
||||||
|
# # -- Allows to install the PodMonitor in another namespace then the spire components are installed into.
|
||||||
|
# namespace: "kube-prometheus-system"
|
||||||
|
# labels: {}
|
||||||
|
|
||||||
|
tags:
|
||||||
|
## @param tags.nestedRoot Set the chart architecture to root nested
|
||||||
|
nestedRoot: false
|
||||||
|
## @param tags.nestedChildFull Set the chart mode to a child cluster with its own nested server
|
||||||
|
nestedChildFull: false
|
||||||
|
## @param tags.nestedChildSecurity Set the chart mode to a child cluster for use with a security cluster
|
||||||
|
nestedChildSecurity: false
|
||||||
|
|
||||||
|
## subcharts
|
||||||
|
|
||||||
|
## @section Spire agent parameters
|
||||||
|
## Parameter values for Spire agent
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull]
|
||||||
|
downstream-spire-agent-full:
|
||||||
|
# enabled: true
|
||||||
|
## @param downstream-spire-agent-full.nameOverride Overrides the name of Spire agent pods
|
||||||
|
nameOverride: agent-downstream
|
||||||
|
server:
|
||||||
|
## @param downstream-spire-agent-full.server.nameOverride The name override setting of the internal SPIRE server
|
||||||
|
nameOverride: internal-server
|
||||||
|
## @param downstream-spire-agent-full.bundleConfigMap The name of the configmap that contains the downstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-downstream
|
||||||
|
|
||||||
|
## @section Spire agent parameters
|
||||||
|
## Parameter values for Spire agent
|
||||||
|
##
|
||||||
|
# Used with tags [nestedChildSecurity]
|
||||||
|
downstream-spire-agent-security:
|
||||||
|
# enabled: true
|
||||||
|
## @param downstream-spire-agent-security.nameOverride Overrides the name of Spire agent pods
|
||||||
|
nameOverride: agent-downstream
|
||||||
|
## @param downstream-spire-agent-security.bundleConfigMap The name of the configmap that contains the downstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
serviceAccount:
|
||||||
|
## @param downstream-spire-agent-security.serviceAccount.name The name of the service account to use
|
||||||
|
name: spire-agent-upstream
|
||||||
|
|
||||||
|
## @section Upstream Spire agent parameters
|
||||||
|
## Parameter values for upstream Spire agent
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull]
|
||||||
|
upstream-spire-agent:
|
||||||
|
# enabled: true
|
||||||
|
## @param upstream-spire-agent.upstream Flag for enabling upstream Spire agent
|
||||||
|
upstream: true
|
||||||
|
## @param upstream-spire-agent.nameOverride Name override for upstream Spire agent
|
||||||
|
nameOverride: agent-upstream
|
||||||
|
## @param upstream-spire-agent.bundleConfigMap The configmap name for upstream Spire agent bundle
|
||||||
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
## @param upstream-spire-agent.socketPath Socket path where Spire agent socket is mounted
|
||||||
|
socketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
||||||
|
serviceAccount:
|
||||||
|
## @param upstream-spire-agent.serviceAccount.name Service account name for upstream Spire agent
|
||||||
|
name: spire-agent-upstream
|
||||||
|
healthChecks:
|
||||||
|
## @param upstream-spire-agent.healthChecks.port Health check port number for upstream Spire agent
|
||||||
|
port: 9981
|
||||||
|
telemetry:
|
||||||
|
prometheus:
|
||||||
|
## @param upstream-spire-agent.telemetry.prometheus.port The port where prometheus metrics are available
|
||||||
|
port: 9989
|
||||||
|
server:
|
||||||
|
## @param upstream-spire-agent.server.nameOverride The name override setting of the root SPIRE server
|
||||||
|
nameOverride: root-server
|
||||||
|
|
||||||
|
## @section SPIFFE CSI Driver parameters
|
||||||
|
## Parameter values for spiffe-csi-driver
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
|
||||||
|
downstream-spiffe-csi-driver:
|
||||||
|
# enabled: true
|
||||||
|
## @param downstream-spiffe-csi-driver.fullnameOverride Fullname override
|
||||||
|
fullnameOverride: spiffe-csi-driver-downstream
|
||||||
|
|
||||||
|
## @section Upstream SPIFFE CSI Driver parameters
|
||||||
|
## Parameter values for upstream spiffe-csi-driver
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull]
|
||||||
|
upstream-spiffe-csi-driver:
|
||||||
|
# enabled: true
|
||||||
|
## @param upstream-spiffe-csi-driver.fullnameOverride Fullname override
|
||||||
|
fullnameOverride: spiffe-csi-driver-upstream
|
||||||
|
## @param upstream-spiffe-csi-driver.pluginName The plugin name for configuring upstream Spiffe CSI driver
|
||||||
|
pluginName: upstream.csi.spiffe.io
|
||||||
|
## @param upstream-spiffe-csi-driver.agentSocketPath The socket path where Spiffe CSI driver mounts agent socket
|
||||||
|
agentSocketPath: /run/spire/agent-sockets-upstream/spire-agent.sock
|
||||||
|
healthChecks:
|
||||||
|
## @param upstream-spiffe-csi-driver.healthChecks.port The port where Spiffe CSI driver health checks are exposed
|
||||||
|
port: 9810
|
||||||
|
|
||||||
|
## @section SPIFFE oidc discovery provider parameters
|
||||||
|
## Parameter values for spiffe-oidc-discovery-provider
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull, nestedChildSecurity]
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
# enabled: true
|
||||||
|
## @param spiffe-oidc-discovery-provider.fullnameOverride Fullname override
|
||||||
|
fullnameOverride: spiffe-oidc-discovery-provider
|
||||||
|
|
||||||
|
## @section Tornjak frontend parameters
|
||||||
|
## Parameter values for Tornjak frontend
|
||||||
|
##
|
||||||
|
tornjak-frontend:
|
||||||
|
## @param tornjak-frontend.enabled Enables deployment of Tornjak frontend/UI (Not for production)
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# Used with tags [nestedRoot]
|
||||||
|
root-spire-server:
|
||||||
|
# enabled: true
|
||||||
|
## @param root-spire-server.nameOverride Name override
|
||||||
|
nameOverride: root-server
|
||||||
|
## @param root-spire-server.crNameOverride Custom Resource name override
|
||||||
|
crNameOverride: root
|
||||||
|
controllerManager:
|
||||||
|
## @param root-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
|
enabled: true
|
||||||
|
externalControllerManagers:
|
||||||
|
## @param root-spire-server.controllerManager.externalControllerManagers.enabled Flag to enable external controller managers
|
||||||
|
enabled: true
|
||||||
|
validatingWebhookConfiguration:
|
||||||
|
## @param root-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
||||||
|
enabled: false
|
||||||
|
## @param root-spire-server.controllerManager.className specify to use an explicit class name.
|
||||||
|
className: spire-mgmt-root-server
|
||||||
|
identities:
|
||||||
|
clusterSPIFFEIDs:
|
||||||
|
child-servers:
|
||||||
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
|
||||||
|
enabled: true
|
||||||
|
default:
|
||||||
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
|
||||||
|
enabled: false
|
||||||
|
oidc-discovery-provider:
|
||||||
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
|
||||||
|
enabled: false
|
||||||
|
test-keys:
|
||||||
|
## @param root-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
||||||
|
enabled: false
|
||||||
|
externalControllerManagers:
|
||||||
|
## @param root-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
||||||
|
enabled: true
|
||||||
|
nodeAttestor:
|
||||||
|
k8sPsat:
|
||||||
|
## @param root-spire-server.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||||
|
serviceAccountAllowList:
|
||||||
|
- spire-agent-upstream
|
||||||
|
## @param root-spire-server.bundleConfigMap The name of the configmap to store the upstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
|
||||||
|
# Used with tags [nestedChildFull]
|
||||||
|
external-root-spire-server-full:
|
||||||
|
## @param external-root-spire-server-full.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
|
||||||
|
externalServer: true
|
||||||
|
## @param external-root-spire-server-full.nameOverride Name override
|
||||||
|
nameOverride: root-server
|
||||||
|
## @param external-root-spire-server-full.crNameOverride Custom Resource name override
|
||||||
|
crNameOverride: root
|
||||||
|
controllerManager:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
|
enabled: true
|
||||||
|
validatingWebhookConfiguration:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
||||||
|
enabled: false
|
||||||
|
## @param external-root-spire-server-full.controllerManager.className specify to use an explicit class name.
|
||||||
|
className: spire-mgmt-external-server
|
||||||
|
identities:
|
||||||
|
clusterSPIFFEIDs:
|
||||||
|
child-servers:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.child-servers.enabled Enable child servers
|
||||||
|
enabled: true
|
||||||
|
default:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default cluster spiffe id
|
||||||
|
enabled: false
|
||||||
|
oidc-discovery-provider:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the test-keys identity
|
||||||
|
enabled: false
|
||||||
|
test-keys:
|
||||||
|
## @param external-root-spire-server-full.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
||||||
|
enabled: false
|
||||||
|
nodeAttestor:
|
||||||
|
k8sPsat:
|
||||||
|
## @param external-root-spire-server-full.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||||
|
serviceAccountAllowList:
|
||||||
|
- spire-agent-upstream
|
||||||
|
## @param external-root-spire-server-full.bundleConfigMap The name of the configmap to store the upstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
|
||||||
|
# Used with tags [nestedChildSecurity]
|
||||||
|
external-root-spire-server-security:
|
||||||
|
## @param external-root-spire-server-security.externalServer Set to true to setup the bundle configmap, rbac rules, and identity documents but doesn't deploy the server locally. Useful for external servers.
|
||||||
|
externalServer: true
|
||||||
|
## @param external-root-spire-server-security.nameOverride Name override
|
||||||
|
nameOverride: root-server
|
||||||
|
## @param external-root-spire-server-security.crNameOverride Custom Resource name override
|
||||||
|
crNameOverride: root
|
||||||
|
controllerManager:
|
||||||
|
## @param external-root-spire-server-security.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
|
enabled: true
|
||||||
|
validatingWebhookConfiguration:
|
||||||
|
## @param external-root-spire-server-security.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
||||||
|
enabled: false
|
||||||
|
## @param external-root-spire-server-security.controllerManager.className specify to use an explicit class name.
|
||||||
|
className: spire-mgmt-external-server
|
||||||
|
nodeAttestor:
|
||||||
|
k8sPsat:
|
||||||
|
## @param external-root-spire-server-security.nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
|
||||||
|
serviceAccountAllowList:
|
||||||
|
- spire-agent-upstream
|
||||||
|
## @param external-root-spire-server-security.bundleConfigMap The name of the configmap to store the upstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-upstream
|
||||||
|
|
||||||
|
## @section Spire server parameters
|
||||||
|
## Parameter values for Spire server
|
||||||
|
##
|
||||||
|
# Used with tags [nestedRoot, nestedChildFull]
|
||||||
|
internal-spire-server:
|
||||||
|
# enabled: true
|
||||||
|
## @param internal-spire-server.nameOverride Overrides the name of Spire server pods
|
||||||
|
nameOverride: internal-server
|
||||||
|
controllerManager:
|
||||||
|
## @param internal-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
|
enabled: true
|
||||||
|
identities:
|
||||||
|
clusterSPIFFEIDs:
|
||||||
|
oidc-discovery-provider:
|
||||||
|
## @param internal-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames Auto populate dns entries
|
||||||
|
autoPopulateDNSNames: false
|
||||||
|
externalControllerManagers:
|
||||||
|
## @param internal-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
||||||
|
enabled: true
|
||||||
|
upstreamAuthority:
|
||||||
|
spire:
|
||||||
|
## @param internal-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
||||||
|
enabled: true
|
||||||
|
## @param internal-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
||||||
|
upstreamDriver: upstream.csi.spiffe.io
|
||||||
|
server:
|
||||||
|
## @param internal-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
||||||
|
nameOverride: root-server
|
||||||
|
## @param internal-spire-server.bundleConfigMap The name of the configmap to store the downstream bundle
|
||||||
|
bundleConfigMap: spire-bundle-downstream
|
||||||
|
|
||||||
|
# Used with tags [nestedRoot]
|
||||||
|
external-spire-server:
|
||||||
|
# enabled: true
|
||||||
|
## @param external-spire-server.nameOverride Overrides the name of Spire server pods
|
||||||
|
nameOverride: external-server
|
||||||
|
## @param external-spire-server.crNameOverride Custom Resource name override
|
||||||
|
crNameOverride: external
|
||||||
|
controllerManager:
|
||||||
|
## @param external-spire-server.controllerManager.enabled Enable controller manager and provision CRD's
|
||||||
|
enabled: true
|
||||||
|
validatingWebhookConfiguration:
|
||||||
|
## @param external-spire-server.controllerManager.validatingWebhookConfiguration.enabled Disable only when you have another instance on the k8s cluster with webhooks enabled.
|
||||||
|
enabled: false
|
||||||
|
## @param external-spire-server.controllerManager.className specify to use an explicit class name.
|
||||||
|
className: spire-mgmt-external-server
|
||||||
|
identities:
|
||||||
|
clusterSPIFFEIDs:
|
||||||
|
default:
|
||||||
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.default.enabled Enable the default identity
|
||||||
|
enabled: false
|
||||||
|
oidc-discovery-provider:
|
||||||
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.enabled Enable the oidc-discovery-provider identity
|
||||||
|
enabled: false
|
||||||
|
test-keys:
|
||||||
|
## @param external-spire-server.controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled Enable the test-keys identity
|
||||||
|
enabled: false
|
||||||
|
externalControllerManagers:
|
||||||
|
## @param external-spire-server.externalControllerManagers.enabled Flag to enable external controller managers
|
||||||
|
enabled: true
|
||||||
|
upstreamAuthority:
|
||||||
|
spire:
|
||||||
|
## @param external-spire-server.upstreamAuthority.spire.enabled Enable upstream SPIRE server
|
||||||
|
enabled: true
|
||||||
|
## @param external-spire-server.upstreamAuthority.spire.upstreamDriver Use an upstream driver for authentication
|
||||||
|
upstreamDriver: upstream.csi.spiffe.io
|
||||||
|
server:
|
||||||
|
## @param external-spire-server.upstreamAuthority.spire.server.nameOverride The name override setting of the root SPIRE server
|
||||||
|
nameOverride: root-server
|
||||||
|
notifier:
|
||||||
|
k8sbundle:
|
||||||
|
## @param external-spire-server.notifier.k8sbundle.enabled Enable local k8s bundle uploader
|
||||||
|
enabled: false
|
||||||
|
nodeAttestor:
|
||||||
|
k8sPsat:
|
||||||
|
## @param external-spire-server.nodeAttestor.k8sPsat.enabled Enable Psat k8s nodeattestor
|
||||||
|
enabled: false
|
||||||
|
joinToken:
|
||||||
|
## @param external-spire-server.nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||||
|
enabled: true
|
||||||
@@ -0,0 +1,8 @@
|
|||||||
|
#global:
|
||||||
|
# spire:
|
||||||
|
# clusterName: changeme
|
||||||
|
# upstreamSpireAddress: spire-server.changeme
|
||||||
|
|
||||||
|
tags:
|
||||||
|
nestedChildFull: true
|
||||||
|
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
tags:
|
||||||
|
nestedRoot: true
|
||||||
|
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
external-spire-server:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
Executable
+137
@@ -0,0 +1,137 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -xe
|
||||||
|
|
||||||
|
SCRIPT="$(readlink -f "$0")"
|
||||||
|
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||||
|
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||||
|
#DEPS="${TESTDIR}/dependencies"
|
||||||
|
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
source "${TESTDIR}/common.sh"
|
||||||
|
|
||||||
|
CLEANUP=1
|
||||||
|
|
||||||
|
for i in "$@"; do
|
||||||
|
case $i in
|
||||||
|
-c)
|
||||||
|
CLEANUP=0
|
||||||
|
shift # past argument=value
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
teardown() {
|
||||||
|
print_helm_releases
|
||||||
|
print_spire_workload_status spire-root-server
|
||||||
|
print_spire_workload_status spire-server spire-system
|
||||||
|
|
||||||
|
if [[ "$1" -ne 0 ]]; then
|
||||||
|
get_namespace_details spire-root-server
|
||||||
|
get_namespace_details spire-server spire-system
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "${CLEANUP}" -eq 1 ]; then
|
||||||
|
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-server 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-system 2>/dev/null || true
|
||||||
|
|
||||||
|
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||||
|
|
||||||
|
# Update deps
|
||||||
|
helm dep up charts/spire-nested
|
||||||
|
|
||||||
|
# List nodes
|
||||||
|
kubectl get nodes
|
||||||
|
|
||||||
|
# Deploy an ingress controller
|
||||||
|
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
|
||||||
|
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||||
|
--namespace ingress-nginx \
|
||||||
|
--create-namespace \
|
||||||
|
--set "controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP,controller.service.externalIPs[0]=$IP" \
|
||||||
|
--set controller.ingressClassResource.default=true \
|
||||||
|
--wait
|
||||||
|
|
||||||
|
# Test the ingress controller. Should 404 as there is no services yet.
|
||||||
|
curl "$IP"
|
||||||
|
|
||||||
|
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||||
|
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||||
|
kubectl rollout restart -n kube-system deployment/coredns
|
||||||
|
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
|
||||||
|
|
||||||
|
for cluster in child other; do
|
||||||
|
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||||
|
|
||||||
|
kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml"
|
||||||
|
md5sum "${KC}"
|
||||||
|
wc -l "${KC}"
|
||||||
|
|
||||||
|
helm upgrade --kubeconfig "${KC}" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
||||||
|
helm upgrade --kubeconfig "${KC}" --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/child-values.yaml" \
|
||||||
|
--set "global.spire.upstreamSpireAddress=spire-server.production.other" \
|
||||||
|
--set "global.spire.namespaces.create=true" \
|
||||||
|
--set "global.spire.clusterName=${cluster}" \
|
||||||
|
spire charts/spire-nested
|
||||||
|
|
||||||
|
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep hosts || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply --kubeconfig "${KC}" -f -
|
||||||
|
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep production.other || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/hosts/a\ $IP spire-server.production.other\n $IP spire-server.production.other\n" | kubectl apply --kubeconfig "${KC}" -f -
|
||||||
|
kubectl rollout restart --kubeconfig "${KC}" -n kube-system deployment/coredns
|
||||||
|
kubectl rollout status --kubeconfig "${KC}" -n kube-system -w --timeout=1m deploy/coredns
|
||||||
|
done
|
||||||
|
|
||||||
|
docker exec -i child-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/child-spire-root.kubeconfig"
|
||||||
|
docker exec -i other-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/other-spire-root.kubeconfig"
|
||||||
|
CHILD_KCB64="$(base64 < "${SCRIPTPATH}/child-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||||
|
OTHER_KCB64="$(base64 < "${SCRIPTPATH}/other-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||||
|
|
||||||
|
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/root-values.yaml" \
|
||||||
|
--wait spire charts/spire-nested \
|
||||||
|
--set "global.spire.namespaces.create=true" \
|
||||||
|
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||||
|
--set "external-spire-server.kubeConfigs.child.kubeConfigBase64=${CHILD_KCB64}" \
|
||||||
|
--set "external-spire-server.kubeConfigs.other.kubeConfigBase64=${OTHER_KCB64}"
|
||||||
|
|
||||||
|
for cluster in child other; do
|
||||||
|
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||||
|
kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-upstream -n spire-system
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart statefulset spire-internal-server -n spire-server
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-upstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-upstream -n spire-system --prefix --all-containers=true
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status statefulset spire-internal-server -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" statefulset/spire-internal-server -n spire-server --prefix --all-containers=true
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-downstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-downstream -n spire-system --prefix --all-containers=true
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status deployment spiffe-oidc-discovery-provider -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" deployment/spiffe-oidc-discovery-provider -n spire-server --prefix --all-containers=true
|
||||||
|
|
||||||
|
echo Pods on "${cluster}"
|
||||||
|
kubectl --kubeconfig "${KC}" get pods -A
|
||||||
|
|
||||||
|
ENTRIES="$(kubectl --kubeconfig "${KC}" exec -i -n spire-server spire-internal-server-0 -- spire-server entry show)"
|
||||||
|
|
||||||
|
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||||
|
echo "${ENTRIES}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
ENTRIES="$(kubectl exec -i -n spire-server spire-external-server-0 -- spire-server entry show)"
|
||||||
|
|
||||||
|
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||||
|
echo "${ENTRIES}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
helm test --namespace spire-mgmt spire
|
||||||
|
|
||||||
|
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||||
|
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --namespace spire-mgmt spire
|
||||||
|
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
kind: Cluster
|
||||||
|
apiVersion: kind.x-k8s.io/v1alpha4
|
||||||
|
networking:
|
||||||
|
apiServerAddress: "172.17.0.1"
|
||||||
|
apiServerPort: 7443
|
||||||
|
podSubnet: "10.245.0.0/16"
|
||||||
|
serviceSubnet: "10.97.0.0/16"
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
kind: Cluster
|
||||||
|
apiVersion: kind.x-k8s.io/v1alpha4
|
||||||
|
networking:
|
||||||
|
apiServerAddress: "172.17.0.1"
|
||||||
|
apiServerPort: 5443
|
||||||
|
podSubnet: "10.246.0.0/16"
|
||||||
|
serviceSubnet: "10.98.0.0/16"
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
# global:
|
||||||
|
# spire:
|
||||||
|
# clusterName: changeme
|
||||||
|
|
||||||
|
tags:
|
||||||
|
nestedChildSecurity: true
|
||||||
|
|
||||||
|
# downstream-spire-agent-security:
|
||||||
|
# serviceAccount:
|
||||||
|
# server:
|
||||||
|
# address: spire-server.changeme
|
||||||
|
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
tags:
|
||||||
|
nestedRoot: true
|
||||||
|
|
||||||
|
spiffe-oidc-discovery-provider:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
external-spire-server:
|
||||||
|
ingress:
|
||||||
|
enabled: true
|
||||||
Executable
+126
@@ -0,0 +1,126 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -xe
|
||||||
|
|
||||||
|
SCRIPT="$(readlink -f "$0")"
|
||||||
|
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
||||||
|
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
||||||
|
#DEPS="${TESTDIR}/dependencies"
|
||||||
|
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
||||||
|
# shellcheck source=/dev/null
|
||||||
|
source "${TESTDIR}/common.sh"
|
||||||
|
|
||||||
|
CLEANUP=1
|
||||||
|
|
||||||
|
for i in "$@"; do
|
||||||
|
case $i in
|
||||||
|
-c)
|
||||||
|
CLEANUP=0
|
||||||
|
shift # past argument=value
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
teardown() {
|
||||||
|
print_helm_releases
|
||||||
|
print_spire_workload_status spire-root-server
|
||||||
|
print_spire_workload_status spire-server spire-system
|
||||||
|
|
||||||
|
if [[ "$1" -ne 0 ]]; then
|
||||||
|
get_namespace_details spire-root-server
|
||||||
|
get_namespace_details spire-server spire-system
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "${CLEANUP}" -eq 1 ]; then
|
||||||
|
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-server 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-system 2>/dev/null || true
|
||||||
|
|
||||||
|
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
||||||
|
kubectl delete ns spire-root-server 2>/dev/null || true
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
||||||
|
|
||||||
|
# Update deps
|
||||||
|
helm dep up charts/spire-nested
|
||||||
|
|
||||||
|
# List nodes
|
||||||
|
kubectl get nodes
|
||||||
|
|
||||||
|
# Deploy an ingress controller
|
||||||
|
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
|
||||||
|
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
|
||||||
|
--namespace ingress-nginx \
|
||||||
|
--create-namespace \
|
||||||
|
--set "controller.extraArgs.enable-ssl-passthrough=,controller.admissionWebhooks.enabled=false,controller.service.type=ClusterIP,controller.service.externalIPs[0]=$IP" \
|
||||||
|
--set controller.ingressClassResource.default=true \
|
||||||
|
--wait
|
||||||
|
|
||||||
|
# Test the ingress controller. Should 404 as there is no services yet.
|
||||||
|
curl "$IP"
|
||||||
|
|
||||||
|
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
|
||||||
|
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $IP oidc-discovery.production.other\n $IP spire-server.production.other\n" | kubectl apply -f -
|
||||||
|
kubectl rollout restart -n kube-system deployment/coredns
|
||||||
|
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
|
||||||
|
|
||||||
|
# The check is being too pedantic.
|
||||||
|
# shellcheck shell=bash disable=SC2043
|
||||||
|
for cluster in child; do
|
||||||
|
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||||
|
|
||||||
|
kind create cluster --name "${cluster}" --kubeconfig "${SCRIPTPATH}/kubeconfig-${cluster}" --config "${SCRIPTPATH}/.test-files/${cluster}-kind-config.yaml"
|
||||||
|
md5sum "${KC}"
|
||||||
|
wc -l "${KC}"
|
||||||
|
|
||||||
|
helm upgrade --kubeconfig "${KC}" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
||||||
|
helm upgrade --kubeconfig "${KC}" --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/child-values.yaml" \
|
||||||
|
--set "downstream-spire-agent-security.server.address=spire-server.production.other" \
|
||||||
|
--set "global.spire.namespaces.create=true" \
|
||||||
|
--set "global.spire.clusterName=${cluster}" \
|
||||||
|
spire charts/spire-nested
|
||||||
|
|
||||||
|
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep hosts || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply --kubeconfig "${KC}" -f -
|
||||||
|
kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | grep production.other || kubectl get configmap --kubeconfig "${KC}" -n kube-system coredns -o yaml | sed "/hosts/a\ $IP spire-server.production.other\n $IP spire-server.production.other\n" | kubectl apply --kubeconfig "${KC}" -f -
|
||||||
|
kubectl rollout restart --kubeconfig "${KC}" -n kube-system deployment/coredns
|
||||||
|
kubectl rollout status --kubeconfig "${KC}" -n kube-system -w --timeout=1m deploy/coredns
|
||||||
|
done
|
||||||
|
|
||||||
|
docker exec -i child-control-plane bash -c 'kubeadm kubeconfig user --client-name=spire-root' > "${SCRIPTPATH}/child-spire-root.kubeconfig"
|
||||||
|
CHILD_KCB64="$(base64 < "${SCRIPTPATH}/child-spire-root.kubeconfig" | tr '\n' ' ' | sed 's/ //g')"
|
||||||
|
|
||||||
|
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/root-values.yaml" \
|
||||||
|
--wait spire charts/spire-nested \
|
||||||
|
--set "global.spire.namespaces.create=true" \
|
||||||
|
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||||
|
--set "external-spire-server.kubeConfigs.child.kubeConfigBase64=${CHILD_KCB64}"
|
||||||
|
|
||||||
|
# The check is being too pedantic.
|
||||||
|
# shellcheck shell=bash disable=SC2043
|
||||||
|
for cluster in child; do
|
||||||
|
KC="${SCRIPTPATH}/kubeconfig-${cluster}"
|
||||||
|
kubectl --kubeconfig "${KC}" get configmap -n spire-system spire-bundle-upstream -o yaml
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart daemonset spire-agent-downstream -n spire-system
|
||||||
|
kubectl --kubeconfig "${KC}" rollout restart deployment spiffe-oidc-discovery-provider -n spire-server
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status daemonset spire-agent-downstream -n spire-system --timeout 60s || kubectl logs --kubeconfig "${KC}" daemonset/spire-agent-downstream -n spire-system --prefix --all-containers=true
|
||||||
|
kubectl --kubeconfig "${KC}" rollout status deployment spiffe-oidc-discovery-provider -n spire-server --timeout 60s || kubectl logs --kubeconfig "${KC}" deployment/spiffe-oidc-discovery-provider -n spire-server --prefix --all-containers=true
|
||||||
|
|
||||||
|
echo Pods on "${cluster}"
|
||||||
|
kubectl --kubeconfig "${KC}" get pods -A
|
||||||
|
done
|
||||||
|
|
||||||
|
ENTRIES="$(kubectl exec -i -n spire-server spire-external-server-0 -- spire-server entry show)"
|
||||||
|
|
||||||
|
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||||
|
echo "${ENTRIES}"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
helm test --namespace spire-mgmt spire
|
||||||
|
|
||||||
|
helm test --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --namespace spire-mgmt spire
|
||||||
|
|
||||||
@@ -1,10 +0,0 @@
|
|||||||
# Possible Nesting Configurations
|
|
||||||
|
|
||||||
There are multiple ways of configuring the chart depending on what you want to use nesting for.
|
|
||||||
|
|
||||||
## Nesting across Kubernetes clusters:
|
|
||||||
|
|
||||||
|
|
||||||
## Nesting within a Kubernetes cluster:
|
|
||||||
|
|
||||||
|
|
||||||
@@ -1,61 +0,0 @@
|
|||||||
digraph G {
|
|
||||||
subgraph cluster_root {
|
|
||||||
label="Cluster: Root K8S";
|
|
||||||
subgraph cluster_root_release {
|
|
||||||
label="Helm Release: Namespace=spire-root Name=spire"
|
|
||||||
spireRoot [label="Root Spire Server"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_nested1 {
|
|
||||||
label="Cluster: K8S Workload 1";
|
|
||||||
subgraph cluster_nested1_release {
|
|
||||||
label="Helm Release: Namespace=spire-server Name=spire"
|
|
||||||
subgraph cluster_nested1_ns1 {
|
|
||||||
label="Namespace: spire-system"
|
|
||||||
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
subgraph cluster_nested1_ns2 {
|
|
||||||
label="Namespace: spire-server"
|
|
||||||
spireServerNested1 [label="Nested Spire Server"];
|
|
||||||
}
|
|
||||||
subgraph cluster_nested1_ns3 {
|
|
||||||
label="Namespace: spire-system"
|
|
||||||
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_nested1_user {
|
|
||||||
label="Namespace: user"
|
|
||||||
userWorkload1 [label="User Workload"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_nested2 {
|
|
||||||
label="Cluster: K8S Workload 2";
|
|
||||||
subgraph cluster_nested2_release {
|
|
||||||
label="Helm Release: Namespace=spire-server Name=spire"
|
|
||||||
subgraph cluster_nested2_ns1 {
|
|
||||||
label="Namespace: spire-system"
|
|
||||||
spireUpstreamAgent2 [label="Upstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
subgraph cluster_nested2_ns2 {
|
|
||||||
label="Namespace: spire-server"
|
|
||||||
spireServerNested2 [label="Nested Spire Server"];
|
|
||||||
}
|
|
||||||
subgraph cluster_nested2_ns3 {
|
|
||||||
label="Namespace: spire-system"
|
|
||||||
spireDownstreamAgent2 [label="Downstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_nested2_user {
|
|
||||||
label="Namespace: user"
|
|
||||||
userWorkload2 [label="Other User Workload"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
spireRoot -> spireUpstreamAgent1;
|
|
||||||
spireRoot -> spireUpstreamAgent2;
|
|
||||||
spireUpstreamAgent1 -> spireServerNested1;
|
|
||||||
spireServerNested1 -> spireDownstreamAgent1;
|
|
||||||
spireDownstreamAgent1 -> userWorkload1;
|
|
||||||
spireUpstreamAgent2 -> spireServerNested2;
|
|
||||||
spireServerNested2 -> spireDownstreamAgent2;
|
|
||||||
spireDownstreamAgent2 -> userWorkload2;
|
|
||||||
}
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 127 KiB |
@@ -1,61 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
|
|
||||||
SCRIPT="$(readlink -f "$0")"
|
|
||||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
|
||||||
TESTDIR="${SCRIPTPATH}/../../.github/tests"
|
|
||||||
DEPS="${TESTDIR}/dependencies"
|
|
||||||
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
source "${SCRIPTPATH}/../../.github/scripts/parse-versions.sh"
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
source "${TESTDIR}/common.sh"
|
|
||||||
|
|
||||||
CLEANUP=1
|
|
||||||
|
|
||||||
for i in "$@"; do
|
|
||||||
case $i in
|
|
||||||
-c)
|
|
||||||
CLEANUP=0
|
|
||||||
shift # past argument=value
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
teardown() {
|
|
||||||
print_helm_releases
|
|
||||||
print_spire_workload_status spire-root-server
|
|
||||||
print_spire_workload_status spire-server spire-system
|
|
||||||
|
|
||||||
if [[ "$1" -ne 0 ]]; then
|
|
||||||
get_namespace_details spire-root-server
|
|
||||||
get_namespace_details spire-server spire-system
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "${CLEANUP}" -eq 1 ]; then
|
|
||||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-server 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-system 2>/dev/null || true
|
|
||||||
|
|
||||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
|
||||||
|
|
||||||
kubectl create namespace spire-system --dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
kubectl label namespace spire-system pod-security.kubernetes.io/enforce=privileged || true
|
|
||||||
kubectl create namespace spire-server --dry-run=client -o yaml | kubectl apply -f -
|
|
||||||
kubectl label namespace spire-server pod-security.kubernetes.io/enforce=restricted || true
|
|
||||||
|
|
||||||
helm upgrade --install --create-namespace spire charts/spire \
|
|
||||||
--namespace spire-root-server \
|
|
||||||
--values "${DEPS}/spire-root-server-values.yaml" \
|
|
||||||
--wait
|
|
||||||
|
|
||||||
helm upgrade --install --create-namespace --namespace spire-server --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/values.yaml,${SCRIPTPATH}/../misc/values-node-pod-antiaffinity.yaml" \
|
|
||||||
--wait spire charts/spire
|
|
||||||
helm test --namespace spire-server spire
|
|
||||||
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
digraph G {
|
|
||||||
subgraph cluster_baremetal {
|
|
||||||
label="(Bare Metal|Virtual) Node"
|
|
||||||
spireDownstreamAgent3 [label="Downstream Spire Agent"];
|
|
||||||
userWorkload3 [label="External User Workload"];
|
|
||||||
}
|
|
||||||
subgraph cluster_k8s {
|
|
||||||
label="Cluster: K8S";
|
|
||||||
subgraph cluster_root_release {
|
|
||||||
label="Helm Release: Namespace=spire-root Name=spire";
|
|
||||||
subgraph cluster_ns_root {
|
|
||||||
label="Namespace: spire-root"
|
|
||||||
spireRoot [label="Root Spire Server"];
|
|
||||||
}
|
|
||||||
subgraph cluster_ns_1_system {
|
|
||||||
label="Namespace: spire-system"
|
|
||||||
spireUpstreamAgent1 [label="Upstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_nested1_release {
|
|
||||||
label="Helm Release: Namespace=spire-server Name=spire"
|
|
||||||
subgraph cluster_ns_nested_server {
|
|
||||||
label="Namespace: spire-server";
|
|
||||||
spireServerNested1 [label="Internal Nested Spire Server"];
|
|
||||||
}
|
|
||||||
subgraph cluster_ns_nested_system {
|
|
||||||
label="Namespace: spire-system";
|
|
||||||
spireDownstreamAgent1 [label="Downstream Spire Agent/CSI"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
subgraph cluster_ns_nested_system {
|
|
||||||
label="Namespace: user";
|
|
||||||
userWorkload1 [label="User Workload"];
|
|
||||||
}
|
|
||||||
subgraph cluster_ns_nested2_system {
|
|
||||||
label="Namespace: user-other";
|
|
||||||
userWorkload2 [label="Other User Workload"];
|
|
||||||
}
|
|
||||||
subgraph cluster_nested3_release {
|
|
||||||
label="Helm Release: Namespace=spire-external Name=spire"
|
|
||||||
subgraph cluster_ns_nested2_system {
|
|
||||||
label="Namespace: spire-external";
|
|
||||||
spireServerNested2 [label="External Nested Spire Server"];
|
|
||||||
}
|
|
||||||
}
|
|
||||||
spireRoot -> spireUpstreamAgent1;
|
|
||||||
spireUpstreamAgent1 -> spireServerNested1;
|
|
||||||
spireServerNested1 -> spireDownstreamAgent1;
|
|
||||||
spireDownstreamAgent1 -> userWorkload1;
|
|
||||||
spireDownstreamAgent1 -> userWorkload2;
|
|
||||||
spireUpstreamAgent1 -> spireServerNested2;
|
|
||||||
spireServerNested2 -> spireDownstreamAgent3;
|
|
||||||
spireDownstreamAgent3 -> userWorkload3;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Binary file not shown.
|
Before Width: | Height: | Size: 108 KiB |
@@ -1,19 +0,0 @@
|
|||||||
global:
|
|
||||||
spire:
|
|
||||||
upstreamSpireAddress: spire-server.spire-root-server
|
|
||||||
|
|
||||||
spire-server:
|
|
||||||
upstreamAuthority:
|
|
||||||
spire:
|
|
||||||
enabled: true
|
|
||||||
upstreamDriver: upstream.csi.spiffe.io
|
|
||||||
controllerManager:
|
|
||||||
identities:
|
|
||||||
clusterSPIFFEIDs:
|
|
||||||
default:
|
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/k8s/{{ .ClusterName }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
||||||
oidc-discovery-provider:
|
|
||||||
autoPopulateDNSNames: false
|
|
||||||
|
|
||||||
upstream:
|
|
||||||
enabled: true
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
global:
|
|
||||||
spire:
|
|
||||||
recommendations:
|
|
||||||
enabled: true
|
|
||||||
namespaces:
|
|
||||||
create: true
|
|
||||||
clusterName: production
|
|
||||||
trustDomain: production.other
|
|
||||||
|
|
||||||
spire-server:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spire-agent:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spiffe-csi-drvier:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
|
||||||
enabled: true
|
|
||||||
@@ -1,89 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
set -xe
|
|
||||||
|
|
||||||
SCRIPT="$(readlink -f "$0")"
|
|
||||||
SCRIPTPATH="$(dirname "${SCRIPT}")"
|
|
||||||
TESTDIR="${SCRIPTPATH}/../../../.github/tests"
|
|
||||||
#DEPS="${TESTDIR}/dependencies"
|
|
||||||
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
source "${SCRIPTPATH}/../../../.github/scripts/parse-versions.sh"
|
|
||||||
# shellcheck source=/dev/null
|
|
||||||
source "${TESTDIR}/common.sh"
|
|
||||||
|
|
||||||
CLEANUP=1
|
|
||||||
|
|
||||||
for i in "$@"; do
|
|
||||||
case $i in
|
|
||||||
-c)
|
|
||||||
CLEANUP=0
|
|
||||||
shift # past argument=value
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
teardown() {
|
|
||||||
print_helm_releases
|
|
||||||
print_spire_workload_status spire-root-server
|
|
||||||
print_spire_workload_status spire-server spire-system
|
|
||||||
|
|
||||||
if [[ "$1" -ne 0 ]]; then
|
|
||||||
get_namespace_details spire-root-server
|
|
||||||
get_namespace_details spire-server spire-system
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "${CLEANUP}" -eq 1 ]; then
|
|
||||||
helm uninstall --namespace spire-server spire 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-server 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-system 2>/dev/null || true
|
|
||||||
|
|
||||||
helm uninstall --namespace mysql spire-root-server 2>/dev/null || true
|
|
||||||
kubectl delete ns spire-root-server 2>/dev/null || true
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
trap 'EC=$? && trap - SIGTERM && teardown $EC' SIGINT SIGTERM EXIT
|
|
||||||
|
|
||||||
#helm upgrade --install --create-namespace spire charts/spire \
|
|
||||||
# --namespace spire-root-server \
|
|
||||||
# --values "${DEPS}/spire-root-server-values.yaml" \
|
|
||||||
# --wait
|
|
||||||
|
|
||||||
kind create cluster --name child --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --config "${SCRIPTPATH}/child-kind-config.yaml"
|
|
||||||
md5sum "${SCRIPTPATH}/kubeconfig-child"
|
|
||||||
wc -l "${SCRIPTPATH}/kubeconfig-child"
|
|
||||||
CHILD_KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig-child" | tr '\n' ' ' | sed 's/ //g')"
|
|
||||||
|
|
||||||
helm upgrade --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-child" apply -f "${SCRIPTPATH}/sodp-clusterspiffeid.yaml"
|
|
||||||
helm upgrade --kubeconfig "${SCRIPTPATH}/kubeconfig-child" --install --namespace spire-mgmt --values "${SCRIPTPATH}/child-values.yaml" \
|
|
||||||
spire charts/spire
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-child" create configmap -n spire-system spire-bundle-upstream
|
|
||||||
|
|
||||||
kind create cluster --name other --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --config "${SCRIPTPATH}/other-kind-config.yaml"
|
|
||||||
md5sum "${SCRIPTPATH}/kubeconfig-other"
|
|
||||||
wc -l "${SCRIPTPATH}/kubeconfig-other"
|
|
||||||
OTHER_KCB64="$(base64 < "${SCRIPTPATH}/kubeconfig-other" | tr '\n' ' ' | sed 's/ //g')"
|
|
||||||
|
|
||||||
helm upgrade --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --install --create-namespace --namespace spire-mgmt spire-crds charts/spire-crds
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-other" apply -f "${SCRIPTPATH}/sodp-clusterspiffeid.yaml"
|
|
||||||
helm upgrade --kubeconfig "${SCRIPTPATH}/kubeconfig-other" --install --namespace spire-mgmt --values "${SCRIPTPATH}/child-values.yaml" \
|
|
||||||
spire charts/spire
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-other" create configmap -n spire-system spire-bundle-upstream
|
|
||||||
|
|
||||||
helm upgrade --install --create-namespace --namespace spire-mgmt --values "${SCRIPTPATH}/values.yaml" \
|
|
||||||
--wait spire charts/spire \
|
|
||||||
--set "spire-server.kubeConfigs.child.kubeConfigBase64=${CHILD_KCB64}" \
|
|
||||||
--set "spire-server.kubeConfigs.other.kubeConfigBase64=${OTHER_KCB64}"
|
|
||||||
helm test --namespace spire-mgmt spire
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-child" get configmap -n spire-system spire-bundle-upstream
|
|
||||||
kubectl --kubeconfig "${SCRIPTPATH}/kubeconfig-other" get configmap -n spire-system spire-bundle-upstream
|
|
||||||
|
|
||||||
ENTRIES="$(kubectl exec -i -n spire-server spire-server-0 -- spire-server entry show)"
|
|
||||||
|
|
||||||
if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
|
||||||
echo "${ENTRIES}"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
@@ -1,23 +0,0 @@
|
|||||||
apiVersion: spire.spiffe.io/v1alpha1
|
|
||||||
kind: ClusterSPIFFEID
|
|
||||||
metadata:
|
|
||||||
name: spire-mgmt-spire-oidc-discovery-provider
|
|
||||||
spec:
|
|
||||||
autoPopulateDNSNames: true
|
|
||||||
className: spire-mgmt-spire
|
|
||||||
dnsNameTemplates:
|
|
||||||
- oidc-discovery.{{ .TrustDomain }}
|
|
||||||
namespaceSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: kubernetes.io/metadata.name
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- spire-mgmt
|
|
||||||
- spire-server
|
|
||||||
- spire-system
|
|
||||||
podSelector:
|
|
||||||
matchLabels:
|
|
||||||
component: oidc-discovery-provider
|
|
||||||
release: spire
|
|
||||||
release-namespace: spire-mgmt
|
|
||||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
||||||
@@ -1,30 +0,0 @@
|
|||||||
global:
|
|
||||||
spire:
|
|
||||||
recommendations:
|
|
||||||
enabled: true
|
|
||||||
namespaces:
|
|
||||||
create: true
|
|
||||||
clusterName: production
|
|
||||||
trustDomain: production.other
|
|
||||||
caSubject:
|
|
||||||
country: US
|
|
||||||
organization: Production
|
|
||||||
commonName: production.other
|
|
||||||
|
|
||||||
spire-server:
|
|
||||||
controllerManager:
|
|
||||||
reconcile:
|
|
||||||
clusterSPIFFEIDs: false
|
|
||||||
clusterStaticEntries: true
|
|
||||||
clusterFederatedTrustDomains: true
|
|
||||||
identities:
|
|
||||||
clusterSPIFFEIDs:
|
|
||||||
default:
|
|
||||||
enabled: false
|
|
||||||
oidc-discovery-provider:
|
|
||||||
enabled: false
|
|
||||||
test-keys:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
|
||||||
enabled: false
|
|
||||||
Reference in New Issue
Block a user