panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Agent support for bundle on host path (#478)

Browse Source 
* Agent support for bundle on host path

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spire/charts/spire-agent/values.yaml

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-10-17 15:12:27 -07:00
committed by GitHub
co-authored by Faisal Memon
parent 7b409ed912
commit b08e8bf9b1
4 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-agent/README.md
+1
View File
@@ -53,6 +53,7 @@ A Helm chart to install the SPIRE agent.
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `pem` |
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` |
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `server.address` | Address for Spire server | `""` |
charts/spire/charts/spire-agent/templates/configmap.yaml
+2
View File
@@ -41,6 +41,8 @@ agent:
{{- if ne (len .Values.trustBundleURL) 0 }}
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
{{- else if ne (len .Values.trustBundleHostPath) 0 }}
trust_bundle_path: {{ .Values.trustBundleHostPath | quote }}
{{- else }}
trust_bundle_path: "/run/spire/bundle/bundle.crt"
{{- end }}
charts/spire/charts/spire-agent/templates/daemonset.yaml
+10 -1
View File
@@ -265,8 +265,12 @@ spec:
{{- end }}
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
mountPath: /run/spire/bundle
readOnly: true
{{- if ne (len .Values.trustBundleHostPath) 0 }}
mountPath: {{ .Values.trustBundleHostPath | dir | quote }}
{{- else }}
mountPath: /run/spire/bundle
{{- end }}
{{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: tpm-direct
@@ -348,9 +352,14 @@ spec:
{{- end }}
{{- if eq (len .Values.trustBundleURL) 0 }}
- name: spire-bundle
{{- if ne (len .Values.trustBundleHostPath) 0 }}
hostPath:
path: {{ .Values.trustBundleHostPath | dir | quote }}
{{- else }}
configMap:
name: {{ printf "%s%s" (include "spire-lib.bundle-configmap" .) $nameSuffix | quote }}
{{- end }}
{{- end }}
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
- name: tpm-direct
emptyDir: {}
charts/spire/charts/spire-agent/values.yaml
+2
View File
@@ -95,6 +95,8 @@ trustDomain: example.org
trustBundleURL: ""
## @param trustBundleFormat If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe"
trustBundleFormat: pem
## @param trustBundleHostPath If set, obtain trust bundle from a file on the host instead of from the ConfigMap
trustBundleHostPath: ""
## @param bundleConfigMap Configmap name for Spire bundle
bundleConfigMap: spire-bundle
## @param availabilityTarget The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h.