From bc79f58ab7b90c524b8021ca57adb57a60cfcf98 Mon Sep 17 00:00:00 2001 From: anhpatel <162738027+anhpatel@users.noreply.github.com> Date: Wed, 10 Apr 2024 06:26:10 -0700 Subject: [PATCH] AWS KMS key_identifier upgrade (#314) * Allow use of key_identifier_file or key_identifier_value in place of key_metadata_file Signed-off-by: aniket patel * Change key identifier values to have enabled flags Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update docs Signed-off-by: aniket patel * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> * Update docs Signed-off-by: aniket patel --------- Signed-off-by: aniket patel Signed-off-by: anhpatel <162738027+anhpatel@users.noreply.github.com> Co-authored-by: kfox1111 --- charts/spire/charts/spire-server/README.md | 3 +++ .../spire/charts/spire-server/templates/configmap.yaml | 9 +++++++++ charts/spire/charts/spire-server/values.yaml | 8 ++++++++ 3 files changed, 20 insertions(+) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 8c4cf4b..ae9f458 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` | | `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` | +| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` | +| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` | +| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` | | `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | | | `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` | | `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index a2c7803..2c6e34c 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -35,6 +35,9 @@ {{- if ne $tlsFederationCount 1 }} {{- fail "You must enable one and only one federation TLS configuration" }} {{- end }} +{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }} +{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }} +{{- end }} {{- define "spire-server.yaml-config" -}} {{- $upstreamAuthorityUsed := 0 }} {{- $keyManagerUsed := 0 }} @@ -190,7 +193,13 @@ plugins: aws_kms: plugin_data: region: {{ .region | quote }} + {{- if eq (.keyIdentifierFile.enabled | toString) "true" }} + key_identifier_file: "/run/spire/data/aws-kms-key-identifier" + {{- else if eq (.keyIdentifierValue.enabled | toString) "true" }} + key_identifier_value: {{ .keyIdentifierValue.identifier | quote }} + {{- else }} key_metadata_file: "/run/spire/data/aws-kms-key-metadata" + {{- end }} {{- if ne .accessKeyID "" }} access_key_id: "${AWS_KMS_ACCESS_KEY_ID}" {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 0cc0565..e75fc65 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -307,6 +307,14 @@ keyManager: enabled: false ## @param keyManager.awsKMS.region Specify the region for AWS KMS region: "" + keyIdentifierFile: + ## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage. + enabled: false + keyIdentifierValue: + ## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS + enabled: false + ## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance + identifier: "" ## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used. keyPolicy: ## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.