feature: add awsSecretsManager upstreamAuthority (#772)
* feature: add awsSecretsManager upstreamAuthority Signed-off-by: gcavalcante8808 <[email protected]> * Bump test chart dependencies (#773) Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <[email protected]> Signed-off-by: gcavalcante8808 <[email protected]> * Fix docs (#1) Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: gcavalcante8808 <[email protected]> --------- Signed-off-by: gcavalcante8808 <[email protected]> Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: spire-helm-version-checker[bot] <161522935+spire-helm-version-checker[bot]@users.noreply.github.com> Co-authored-by: marcofranssen <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Gabriel Abdalla Cavalcante
co-authored by
marcofranssen
spire-helm-version-checker[bot]
kfox1111
marcofranssen
spire-helm-version-checker[bot]
kfox1111
parent
f78c1d4246
commit
bf4bd8199e
@@ -229,6 +229,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
| `upstreamAuthority.awsPCA.signingAlgorithm` | (Optional) Signing algorithm to use for the server's CA. Defaults to the CA's default. See Issue Certificate (https://docs.aws.amazon.com/cli/latest/reference/acm-pca/issue-certificate.html) for possible values. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
| `upstreamAuthority.awsPCA.endpoint` | (Optional) Endpoint as hostname or fully-qualified URI that overrides the default endpoint. See AWS SDK Config docs (https://docs.aws.amazon.com/sdk-for-go/api/aws/#Config) for more information. | `""` |
|
||||||
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
| `upstreamAuthority.awsPCA.supplementalBundlePath` | (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle. | `""` |
|
||||||
|
| `upstreamAuthority.awsSecret.enabled` | Flag to enable upstream authority plugin with AWS Secrets Manager | `false` |
|
||||||
|
| `upstreamAuthority.awsSecret.region` | AWS Region to use | `""` |
|
||||||
|
| `upstreamAuthority.awsSecret.certFileArn` | ARN or name of the secret containing the intermediate CA certificate | `""` |
|
||||||
|
| `upstreamAuthority.awsSecret.keyFileArn` | ARN or name of the secret containing the intermediate CA private key | `""` |
|
||||||
|
| `upstreamAuthority.awsSecret.bundleFileArn` | (Optional) ARN or name of the secret containing the root CA bundle | `""` |
|
||||||
|
| `upstreamAuthority.awsSecret.assumeRoleArn` | (Optional) ARN of an IAM role to assume | `""` |
|
||||||
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
| `upstreamAuthority.certManager.enabled` | Flag to enable upstream authority plugin with cert manager | `false` |
|
||||||
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
| `upstreamAuthority.certManager.rbac.create` | Flag to create RBAC roles | `true` |
|
||||||
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
| `upstreamAuthority.certManager.issuerName` | Defaults to the release name, override if CA is provided outside of the chart | `""` |
|
||||||
|
|||||||
@@ -507,6 +507,23 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.upstreamAuthority.awsSecret }}
|
||||||
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
UpstreamAuthority:
|
||||||
|
awssecret:
|
||||||
|
plugin_data:
|
||||||
|
region: {{ .region | quote }}
|
||||||
|
cert_file_arn: {{ .certFileArn | quote }}
|
||||||
|
key_file_arn: {{ .keyFileArn | quote }}
|
||||||
|
{{- if ne .bundleFileArn "" }}
|
||||||
|
bundle_file_arn: {{ .bundleFileArn | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .assumeRoleArn "" }}
|
||||||
|
assume_role_arn: {{ .assumeRoleArn | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- if gt $upstreamAuthorityUsed 1 }}
|
{{- if gt $upstreamAuthorityUsed 1 }}
|
||||||
{{- fail "You can only enable a single Upstream Authority." }}
|
{{- fail "You can only enable a single Upstream Authority." }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -448,6 +448,19 @@ upstreamAuthority:
|
|||||||
endpoint: ""
|
endpoint: ""
|
||||||
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
## @param upstreamAuthority.awsPCA.supplementalBundlePath (Optional) Path to a file containing PEM-encoded CA certificates that should be additionally included in the bundle.
|
||||||
supplementalBundlePath: ""
|
supplementalBundlePath: ""
|
||||||
|
awsSecret:
|
||||||
|
## @param upstreamAuthority.awsSecret.enabled Flag to enable upstream authority plugin with AWS Secrets Manager
|
||||||
|
enabled: false
|
||||||
|
## @param upstreamAuthority.awsSecret.region AWS Region to use
|
||||||
|
region: ""
|
||||||
|
## @param upstreamAuthority.awsSecret.certFileArn ARN or name of the secret containing the intermediate CA certificate
|
||||||
|
certFileArn: ""
|
||||||
|
## @param upstreamAuthority.awsSecret.keyFileArn ARN or name of the secret containing the intermediate CA private key
|
||||||
|
keyFileArn: ""
|
||||||
|
## @param upstreamAuthority.awsSecret.bundleFileArn (Optional) ARN or name of the secret containing the root CA bundle
|
||||||
|
bundleFileArn: ""
|
||||||
|
## @param upstreamAuthority.awsSecret.assumeRoleArn (Optional) ARN of an IAM role to assume
|
||||||
|
assumeRoleArn: ""
|
||||||
certManager:
|
certManager:
|
||||||
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
|
## @param upstreamAuthority.certManager.enabled Flag to enable upstream authority plugin with cert manager
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
Reference in New Issue
Block a user