Enable more forms of kubelet certificate verification (#426)

* Enable kubelet certificate verification by default Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Signed-off-by: kfox1111 <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Fix image Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-08-20 22:08:39 -07:00
parent f92d729137
commit b96e07e349
6 changed files with 196 additions and 114 deletions
@@ -106,10 +106,12 @@ plugins:
  {{- if .Values.workloadAttestors.k8s.enabled }}
    k8s:
      plugin_data:
-        # Defaults to the secure kubelet port by default.
-        # Minikube does not have a cert in the cluster CA bundle that
-        # can authenticate the kubelet cert, so skip validation.
-        skip_kubelet_verification: {{ .Values.workloadAttestors.k8s.skipKubeletVerification }}
+        {{- if eq .Values.workloadAttestors.k8s.verification.type "hostCert" }}
+        kubelet_ca_path: /hostCert/kubelet.crt
+        {{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
+        kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+        {{- end }}
+        skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
        disable_container_selectors: {{ .Values.workloadAttestors.k8s.disableContainerSelectors }}
        use_new_container_locator: {{ .Values.workloadAttestors.k8s.useNewContainerLocator }}
        verbose_container_locator_logs: {{ .Values.workloadAttestors.k8s.verboseContainerLocatorLogs }}