panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AWS KMS key_identifier upgrade (#314)

Browse Source 
* Allow use of key_identifier_file or key_identifier_value in place of key_metadata_file

Signed-off-by: aniket patel <[email protected]>

* Change key identifier values to have enabled flags

Signed-off-by: aniket patel <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>

* Update charts/spire/charts/spire-server/templates/configmap.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>

* Update docs

Signed-off-by: aniket patel <[email protected]>

* Update charts/spire/charts/spire-server/values.yaml

Co-authored-by: kfox1111 <[email protected]>
Signed-off-by: anhpatel <[email protected]>

* Update docs

Signed-off-by: aniket patel <[email protected]>

---------

Signed-off-by: aniket patel <[email protected]>
Signed-off-by: anhpatel <[email protected]>
Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
anhpatel
2024-04-10 06:26:10 -07:00
committed by GitHub
co-authored by kfox1111
parent 7aa8cb360e
commit bc79f58ab7
3 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+3
View File
@@ -174,6 +174,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
| `keyManager.awsKMS.region` | Specify the region for AWS KMS | `""` |
| `keyManager.awsKMS.keyIdentifierFile.enabled` | Enable key identifier data to be stored in a file in persistent storage. | `false` |
| `keyManager.awsKMS.keyIdentifierValue.enabled` | Enable specifying a key identifier value for AWS KMS | `false` |
| `keyManager.awsKMS.keyIdentifierValue.identifier` | Static identifier for the SPIRE server instance | `""` |
| `keyManager.awsKMS.keyPolicy` | Policy to use when creating keys. If no policy is specified, a default policy will be used. | |
| `keyManager.awsKMS.keyPolicy.policy` | Key policy in JSON format. | `""` |
| `keyManager.awsKMS.keyPolicy.existingConfigMap` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. | `""` |
charts/spire/charts/spire-server/templates/configmap.yaml
+9
View File
@@ -35,6 +35,9 @@
{{- if ne $tlsFederationCount 1 }}
{{- fail "You must enable one and only one federation TLS configuration" }}
{{- end }}
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
{{- end }}
{{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }}
@@ -190,7 +193,13 @@ plugins:
aws_kms:
plugin_data:
region: {{ .region | quote }}
{{- if eq (.keyIdentifierFile.enabled | toString) "true" }}
key_identifier_file: "/run/spire/data/aws-kms-key-identifier"
{{- else if eq (.keyIdentifierValue.enabled | toString) "true" }}
key_identifier_value: {{ .keyIdentifierValue.identifier | quote }}
{{- else }}
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
{{- end }}
{{- if ne .accessKeyID "" }}
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
{{- end }}
charts/spire/charts/spire-server/values.yaml
+8
View File
@@ -307,6 +307,14 @@ keyManager:
enabled: false
## @param keyManager.awsKMS.region Specify the region for AWS KMS
region: ""
keyIdentifierFile:
## @param keyManager.awsKMS.keyIdentifierFile.enabled Enable key identifier data to be stored in a file in persistent storage.
enabled: false
keyIdentifierValue:
## @param keyManager.awsKMS.keyIdentifierValue.enabled Enable specifying a key identifier value for AWS KMS
enabled: false
## @param keyManager.awsKMS.keyIdentifierValue.identifier Static identifier for the SPIRE server instance
identifier: ""
## @extra keyManager.awsKMS.keyPolicy Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyPolicy:
## @param keyManager.awsKMS.keyPolicy.policy [nullable] Key policy in JSON format.