AWS KMS key_identifier upgrade (#314)
* Allow use of key_identifier_file or key_identifier_value in place of key_metadata_file Signed-off-by: aniket patel <[email protected]> * Change key identifier values to have enabled flags Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update charts/spire/charts/spire-server/templates/configmap.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update docs Signed-off-by: aniket patel <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: kfox1111 <[email protected]> Signed-off-by: anhpatel <[email protected]> * Update docs Signed-off-by: aniket patel <[email protected]> --------- Signed-off-by: aniket patel <[email protected]> Signed-off-by: anhpatel <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
anhpatel
@@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
|
||||||
|
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
|
||||||
|
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
|
||||||
|
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
|
||||||
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
|
||||||
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
|
||||||
|
|||||||
@@ -35,6 +35,9 @@
|
|||||||
{{- if ne $tlsFederationCount 1 }}
|
{{- if ne $tlsFederationCount 1 }}
|
||||||
{{- fail "You must enable one and only one federation TLS configuration" }}
|
{{- fail "You must enable one and only one federation TLS configuration" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
||||||
|
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
||||||
|
{{- end }}
|
||||||
{{- define "spire-server.yaml-config" -}}
|
{{- define "spire-server.yaml-config" -}}
|
||||||
{{- $upstreamAuthorityUsed := 0 }}
|
{{- $upstreamAuthorityUsed := 0 }}
|
||||||
{{- $keyManagerUsed := 0 }}
|
{{- $keyManagerUsed := 0 }}
|
||||||
@@ -190,7 +193,13 @@ plugins:
|
|||||||
aws_kms:
|
aws_kms:
|
||||||
plugin_data:
|
plugin_data:
|
||||||
region: {{ .region | quote }}
|
region: {{ .region | quote }}
|
||||||
|
{{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
|
||||||
|
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
|
||||||
|
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
|
||||||
|
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
|
||||||
|
{{- else }}
|
||||||
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
|
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
|
||||||
|
{{- end }}
|
||||||
{{- if ne .accessKeyID "" }}
|
{{- if ne .accessKeyID "" }}
|
||||||
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -307,6 +307,14 @@ keyManager:
|
|||||||
enabled: false
|
enabled: false
|
||||||
## @param keyManager.awsKMS.region Specify the region for AWS KMS
|
## @param keyManager.awsKMS.region Specify the region for AWS KMS
|
||||||
region: ""
|
region: ""
|
||||||
|
keyIdentifierFile:
|
||||||
|
## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage.
|
||||||
|
enabled: false
|
||||||
|
keyIdentifierValue:
|
||||||
|
## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS
|
||||||
|
enabled: false
|
||||||
|
## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance
|
||||||
|
identifier: ""
|
||||||
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
|
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
|
||||||
keyPolicy:
|
keyPolicy:
|
||||||
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
|
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.
|
||||||
|
|||||||
Reference in New Issue
Block a user