Enable more forms of kubelet certificate verification (#426)

* Enable kubelet certificate verification by default Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/README.md Signed-off-by: kfox1111 <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Fix image Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-08-20 22:08:39 -07:00
parent f92d729137
commit b96e07e349
6 changed files with 196 additions and 114 deletions
@@ -206,8 +206,14 @@ workloadAttestors:
  k8s:
    ## @param workloadAttestors.k8s.enabled Enables the Kubernetes workload attestor
    enabled: true
-    ## @param workloadAttestors.k8s.skipKubeletVerification If true, kubelet certificate verification is skipped
-    skipKubeletVerification: true
+    verification:
+      ## @param workloadAttestors.k8s.verification.type What kind of verification to do against kubelet. Valid options are [hostCert, apiServerCA, skip]
+      type: skip
+      hostCert:
+        ## @param workloadAttestors.k8s.verification.hostCert.basePath Path where kubelet places its certificates
+        basePath: /var/lib/kubelet/pki
+        ## @param workloadAttestors.k8s.verification.hostCert.fileName File name where kubelet places its certificates. If blank, it will be auto detected.
+        fileName: ""
    ## @param workloadAttestors.k8s.disableContainerSelectors Set to true if using holdApplicationUntilProxyStarts in Istio
    disableContainerSelectors: false
    ## @param workloadAttestors.k8s.useNewContainerLocator If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to false
@@ -268,6 +274,21 @@ socketAlternate:
  ## @param socketAlternate.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
  resources: {}

+hostCert:
+  ## @param hostCert.image.registry The OCI registry to pull the image from
+  ## @param hostCert.image.repository The repository within the registry
+  ## @param hostCert.image.pullPolicy The image pull policy
+  ## @param hostCert.image.tag Overrides the image tag whose default is the chart appVersion
+  ##
+  image:
+    registry: cgr.dev
+    repository: chainguard/min-toolkit-debug
+    pullPolicy: IfNotPresent
+    tag: latest@sha256:eb1c3f94b5a2303d74a804c1bfd5adc9c98e55e344bbe1adcd6522d6e80d5733
+
+  ## @param hostCert.resources Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+  resources: {}
+
 ## @param priorityClassName Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName.
 priorityClassName: ""