panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added support for specifying Kubelet CA Path (#415)

Browse Source 
Signed-off-by: Andrew Block <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
Andrew Block
2024-08-09 04:56:11 +00:00
committed by GitHub
co-authored by Faisal Memon
parent 41dce8c32f
commit abcf01958a
3 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+1
View File
@@ -88,6 +88,7 @@ A Helm chart to install the SPIRE agent.
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.skipKubeletVerification` | If true, kubelet certificate verification is skipped | `true` |
| `workloadAttestors.k8s.kubeletCaPath` | Path to the file containing CA certificates used to verify the kubelet certificate | `/run/secrets/kubernetes.io/serviceaccount/ca.crt` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false | `false` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+1
View File
@@ -110,6 +110,7 @@ plugins:
# Minikube does not have a cert in the cluster CA bundle that
# can authenticate the kubelet cert, so skip validation.
skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
kubelet_ca_path: {{ .Values.workloadAttestors.k8s.kubeletCaPath }}
disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -208,6 +208,8 @@ workloadAttestors:
enabled: true
## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
skipKubeletVerification: true
## @param workloadAttestors.k8s.kubeletCaPath Path to the file containing CA certificates used to verify the kubelet certificate
kubeletCaPath: /run/secrets/kubernetes.io/serviceaccount/ca.crt
## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
disableContainerSelectors: false
## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false