SPIRE Agent support for Broker API (#876)
* SPIRE Agent support for Broker API Signed-off-by: Kevin Fox <[email protected]> * SPIRE Agent support for Broker API Signed-off-by: Kevin Fox <[email protected]> * SPIRE Agent support for Broker API Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Co-authored-by: Matheus Pimenta <[email protected]> Signed-off-by: Kevin Fox <[email protected]> * Remove the istio entry Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Co-authored-by: Matheus Pimenta <[email protected]>
This commit is contained in:
kfox1111
co-authored by
Matheus Pimenta
Matheus Pimenta
parent
cc164bad6b
commit
bf6b36c807
@@ -26,7 +26,7 @@ A Helm chart to install the SPIRE agent.
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
||||
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
@@ -172,5 +172,13 @@ A Helm chart to install the SPIRE agent.
|
||||
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
|
||||
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
|
||||
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
|
||||
| `sockets.broker.enabled` | Enable the broker socket. | `false` |
|
||||
| `sockets.broker.mountOnHost` | Enable the broker socket to be visible on the host. | `false` |
|
||||
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
|
||||
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
|
||||
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
|
||||
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the istio-ztunnel | `false` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
|
||||
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
|
||||
|
||||
@@ -81,9 +81,26 @@ agent:
|
||||
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
||||
experimental:
|
||||
broker:
|
||||
{{- if .Values.sockets.broker.enabled }}
|
||||
socket_path: "/tmp/spire-agent/broker/broker.sock" }}
|
||||
{{- end }}
|
||||
{{- if .Values.brokerAPI.tcp.enabled }}
|
||||
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
||||
{{- end }}
|
||||
brokers:
|
||||
{{- range .Values.brokerAPI.brokers }}
|
||||
- id: {{ tpl .idTemplate (dict "trustDomain" $trustDomain) }}
|
||||
{{- with .allowedReferenceTypes }}
|
||||
allowed_reference_types:
|
||||
- type_url: {{ .typeURL | quote }}
|
||||
allow_over_tcp: {{ .allowOverTCP }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.experimental }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
experimental:
|
||||
sync_interval: {{ .syncInterval | quote }}
|
||||
require_pq_kem: {{ .requirePQKEM }}
|
||||
{{- if gt (len .featureFlags) 0 }}
|
||||
@@ -94,6 +111,7 @@ agent:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }}
|
||||
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
|
||||
|
||||
@@ -369,6 +369,11 @@ spec:
|
||||
mountPath: /tmp/spire-agent/private
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if .Values.sockets.broker.enabled }}
|
||||
- name: spire-agent-broker-socket-dir
|
||||
mountPath: /tmp/spire-agent/broker
|
||||
readOnly: false
|
||||
{{- end }}
|
||||
{{- if eq (len .Values.trustBundleURL) 0 }}
|
||||
- name: spire-bundle
|
||||
readOnly: true
|
||||
@@ -494,6 +499,19 @@ spec:
|
||||
- name: spire-agent-admin-socket-dir
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.sockets.broker.mountOnHost }}
|
||||
- name: spire-agent-broker-socket-dir
|
||||
hostPath:
|
||||
{{- if .Values.upstream }}
|
||||
path: {{ printf "%s/upstream.csi.spiffe.io/broker" .Values.sockets.hostBasePath | quote }}
|
||||
{{- else }}
|
||||
path: {{ printf "%s/csi.spiffe.io/broker" .Values.sockets.hostBasePath | quote }}
|
||||
{{- end }}
|
||||
type: DirectoryOrCreate
|
||||
{{- else }}
|
||||
- name: spire-agent-broker-socket-dir
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if eq .Values.persistence.type "hostPath" }}
|
||||
- name: spire-agent-persistence
|
||||
hostPath:
|
||||
|
||||
@@ -467,6 +467,11 @@ sockets:
|
||||
admin:
|
||||
enabled: false
|
||||
mountOnHost: false
|
||||
## @param sockets.broker.enabled Enable the broker socket.
|
||||
## @param sockets.broker.mountOnHost Enable the broker socket to be visible on the host.
|
||||
broker:
|
||||
enabled: false
|
||||
mountOnHost: false
|
||||
|
||||
## @param persistence.type What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors)
|
||||
## @param persistence.hostPath Which path to use on the host when persistence.type = hostPath
|
||||
@@ -474,3 +479,21 @@ sockets:
|
||||
persistence:
|
||||
type: emptyDir
|
||||
hostPath: /var/lib/spire/k8s/agent
|
||||
|
||||
brokerAPI:
|
||||
tcp:
|
||||
## @param brokerAPI.tcp.enabled Enable the broker api endpoint
|
||||
enabled: false
|
||||
## @param brokerAPI.tcp.bindAddress The tcp address to bind to
|
||||
bindAddress: 0.0.0.0:8788
|
||||
brokers:
|
||||
spire-ha-agent:
|
||||
## @param brokerAPI.brokers.spire-ha-agent.enabled Enable the istio-ztunnel
|
||||
enabled: false
|
||||
## @param brokerAPI.brokers.spire-ha-agent.idTemplate The default id template
|
||||
idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
|
||||
allowedReferenceTypes:
|
||||
## @param brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL The type of reference allowed
|
||||
## @param brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP Allow access over TCP
|
||||
- typeURL: "type.googleapis.com/spiffe.broker.WorkloadPIDReference"
|
||||
allowOverTCP: false
|
||||
|
||||
Reference in New Issue
Block a user