Add support for running spiffe secured discovery provider (default) (#163)
* SPIFFE OIDC Discovery Provider Rework Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151 Signed-off-by: Kevin Fox <[email protected]> * Enhance clusterspiffeid's so the discovery provider is independently configurable Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * Undo Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Try to get output Signed-off-by: Kevin Fox <[email protected]> * Try and get error code Signed-off-by: Kevin Fox <[email protected]> * Fix more logging. Switch port used. Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Fix port Signed-off-by: Kevin Fox <[email protected]> * Fix up logs for nested test and fix values Signed-off-by: Kevin Fox <[email protected]> * Make consistent Signed-off-by: Kevin Fox <[email protected]> * Fix nested test Signed-off-by: Kevin Fox <[email protected]> * Fix insecure mode and test. Signed-off-by: Kevin Fox <[email protected]> * Fix test. Signed-off-by: Kevin Fox <[email protected]> * Fix var scoping issue Signed-off-by: Kevin Fox <[email protected]> * Set the right flags for ingress Signed-off-by: Kevin Fox <[email protected]> * Update dns template Signed-off-by: Kevin Fox <[email protected]> * Use more standard port Signed-off-by: Kevin Fox <[email protected]> * Fix test logging Signed-off-by: Kevin Fox <[email protected]> * Allow reencrypt. Signed-off-by: Kevin Fox <[email protected]> * Remove testing changes Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support. Signed-off-by: Kevin Fox <[email protected]> * Use spiffe-helper as a sidecar. Significant space savings and read only cert dir Signed-off-by: Kevin Fox <[email protected]> * Fix the nested test Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Remove 1.29.0 until deps catch up. Related issue: https://github.com/rancher/kubectl/pull/94 Signed-off-by: Kevin Fox <[email protected]> * Add more error checking Signed-off-by: Kevin Fox <[email protected]> * Remove testing code Signed-off-by: Kevin Fox <[email protected]> * Simplify the ids. Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix logic Signed-off-by: Kevin Fox <[email protected]> * Fix var Signed-off-by: Kevin Fox <[email protected]> * Make cert-manager bits more readable Signed-off-by: Kevin Fox <[email protected]> * Fix template Signed-off-by: Kevin Fox <[email protected]> * Fix openshift ingress Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Add resource spec Signed-off-by: Kevin Fox <[email protected]> * Remove parts that cant merge yet Signed-off-by: Kevin Fox <[email protected]> * Add support for running spiffe secured discovery provider (default) Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Remove defaults Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add missing configurable for the discovery providers csi driver Signed-off-by: Kevin Fox <[email protected]> * Update for changes in spiffe-helper Signed-off-by: Kevin Fox <[email protected]> * Point at upstream Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -230,8 +230,8 @@ Now you can interact with the Spire agent socket from your own application. The
|
|||||||
### SPIFFE oidc discovery provider parameters
|
### SPIFFE oidc discovery provider parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ---------------------------------------- | ------------------------------------------------------------- | ------- |
|
| ---------------------------------------- | ------------------------------------------------------------- | ------ |
|
||||||
| `spiffe-oidc-discovery-provider.enabled` | Flag to enable spiffe-oidc-discovery-provider for the cluster | `false` |
|
| `spiffe-oidc-discovery-provider.enabled` | Flag to enable spiffe-oidc-discovery-provider for the cluster | `true` |
|
||||||
|
|
||||||
### Tornjak frontend parameters
|
### Tornjak frontend parameters
|
||||||
|
|
||||||
|
|||||||
@@ -26,7 +26,7 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
### Chart parameters
|
### Chart parameters
|
||||||
|
|
||||||
| Name | Description | Value |
|
| Name | Description | Value |
|
||||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
| `replicaCount` | Replica count | `1` |
|
| `replicaCount` | Replica count | `1` |
|
||||||
@@ -36,6 +36,11 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
|
| `image.repository` | The repository within the registry | `spiffe/oidc-discovery-provider` |
|
||||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `spiffeHelper.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `spiffeHelper.image.repository` | The repository within the registry | `spiffe/spiffe-helper` |
|
||||||
|
| `spiffeHelper.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `spiffeHelper.image.tag` | Overrides the image tag whose default is the chart appVersion | `nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6` |
|
||||||
|
| `spiffeHelper.resources` | Resource requests and limits | `{}` |
|
||||||
| `resources` | Resource requests and limits | `{}` |
|
| `resources` | Resource requests and limits | `{}` |
|
||||||
| `service.type` | Service type | `ClusterIP` |
|
| `service.type` | Service type | `ClusterIP` |
|
||||||
| `service.ports.http` | Insecure port for the service | `80` |
|
| `service.ports.http` | Insecure port for the service | `80` |
|
||||||
|
|||||||
@@ -1,6 +1,5 @@
|
|||||||
{{- $tlsCount := 0 }}
|
{{- $tlsCount := 0 }}
|
||||||
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
||||||
{{- fail "Built in SPIRE support is not yet supported." }}
|
|
||||||
{{- $tlsCount = add $tlsCount 1 }}
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if and .Values.enabled .Values.tls.externalSecret.enabled }}
|
{{- if and .Values.enabled .Values.tls.externalSecret.enabled }}
|
||||||
@@ -82,3 +81,9 @@ data:
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
spiffe-helper.conf: |
|
||||||
|
agent_address = {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
||||||
|
cert_dir = "/certs"
|
||||||
|
svid_file_name = "tls.crt"
|
||||||
|
svid_key_file_name = "tls.key"
|
||||||
|
svid_bundle_file_name = "ca.pem"
|
||||||
|
|||||||
@@ -38,6 +38,30 @@ spec:
|
|||||||
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
serviceAccountName: {{ include "spiffe-oidc-discovery-provider.serviceAccountName" . }}
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||||
|
initContainers:
|
||||||
|
{{- if .Values.tls.spire.enabled }}
|
||||||
|
- name: init
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.spiffeHelper.resources | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||||
|
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /etc/spiffe-helper.conf
|
||||||
|
- -exitWhenReady
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }}
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-oidc-config
|
||||||
|
mountPath: /etc/spiffe-helper.conf
|
||||||
|
subPath: spiffe-helper.conf
|
||||||
|
readOnly: true
|
||||||
|
- name: certdir
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ .Chart.Name }}
|
- name: {{ .Chart.Name }}
|
||||||
securityContext:
|
securityContext:
|
||||||
@@ -80,6 +104,28 @@ spec:
|
|||||||
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
{{- toYaml .Values.livenessProbe | nindent 12 }}
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml .Values.resources | nindent 12 }}
|
{{- toYaml .Values.resources | nindent 12 }}
|
||||||
|
{{- if .Values.tls.spire.enabled }}
|
||||||
|
- name: spiffe-helper
|
||||||
|
resources:
|
||||||
|
{{- toYaml .Values.spiffeHelper.resources | nindent 12 }}
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||||
|
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- -config
|
||||||
|
- /etc/spiffe-helper.conf
|
||||||
|
volumeMounts:
|
||||||
|
- name: spiffe-workload-api
|
||||||
|
mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }}
|
||||||
|
readOnly: true
|
||||||
|
- name: spire-oidc-config
|
||||||
|
mountPath: /etc/spiffe-helper.conf
|
||||||
|
subPath: spiffe-helper.conf
|
||||||
|
readOnly: true
|
||||||
|
- name: certdir
|
||||||
|
mountPath: /certs
|
||||||
|
{{- end }}
|
||||||
{{- if not $tlsEnabled }}
|
{{- if not $tlsEnabled }}
|
||||||
- name: nginx
|
- name: nginx
|
||||||
securityContext:
|
securityContext:
|
||||||
|
|||||||
@@ -31,6 +31,20 @@ image:
|
|||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
tag: ""
|
tag: ""
|
||||||
|
|
||||||
|
spiffeHelper:
|
||||||
|
image:
|
||||||
|
## @param spiffeHelper.image.registry The OCI registry to pull the image from
|
||||||
|
## @param spiffeHelper.image.repository The repository within the registry
|
||||||
|
## @param spiffeHelper.image.pullPolicy The image pull policy
|
||||||
|
## @param spiffeHelper.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spiffe-helper
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
|
||||||
|
## @param spiffeHelper.resources [object] Resource requests and limits
|
||||||
|
resources: {}
|
||||||
|
|
||||||
## @param resources [object] Resource requests and limits
|
## @param resources [object] Resource requests and limits
|
||||||
resources: {}
|
resources: {}
|
||||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||||
|
|||||||
@@ -162,7 +162,7 @@ upstream-spiffe-csi-driver:
|
|||||||
##
|
##
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster
|
## @param spiffe-oidc-discovery-provider.enabled Flag to enable spiffe-oidc-discovery-provider for the cluster
|
||||||
enabled: false
|
enabled: true
|
||||||
|
|
||||||
## @section Tornjak frontend parameters
|
## @section Tornjak frontend parameters
|
||||||
## Parameter values for Tornjak frontend
|
## Parameter values for Tornjak frontend
|
||||||
|
|||||||
@@ -17,11 +17,5 @@ spire-server:
|
|||||||
oidc-discovery-provider:
|
oidc-discovery-provider:
|
||||||
autoPopulateDNSNames: false
|
autoPopulateDNSNames: false
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
|
||||||
enabled: true
|
|
||||||
tls:
|
|
||||||
spire:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
upstream:
|
upstream:
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|||||||
@@ -2,9 +2,3 @@ global:
|
|||||||
spire:
|
spire:
|
||||||
recommendations:
|
recommendations:
|
||||||
enabled: true
|
enabled: true
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
|
||||||
enabled: true
|
|
||||||
tls:
|
|
||||||
spire:
|
|
||||||
enabled: false
|
|
||||||
|
|||||||
Reference in New Issue
Block a user