From c1deb08ad4be17b712715cae433c388f95a2d295 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 17 Sep 2026 19:11:14 +0000 Subject: [PATCH] =?UTF-8?q?feat:=20=E6=94=AF=E6=8C=81=E6=8C=89=20Pod=20UID?= =?UTF-8?q?=20=E7=94=9F=E6=88=90=20Agent=20ID?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: panxiao81 --- charts/spire/Chart.yaml | 2 +- charts/spire/charts/spire-server/README.md | 2 ++ .../spire-server/templates/configmap.yaml | 2 ++ charts/spire/charts/spire-server/values.yaml | 5 +++ tests/unit/spire_test.go | 35 +++++++++++++++++++ 5 files changed, 45 insertions(+), 1 deletion(-) diff --git a/charts/spire/Chart.yaml b/charts/spire/Chart.yaml index a3f99a9..ab37326 100644 --- a/charts/spire/Chart.yaml +++ b/charts/spire/Chart.yaml @@ -4,7 +4,7 @@ description: > A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. type: application -version: 0.30.2 +version: 0.30.2-ddupan.1 appVersion: "1.15.3" keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 92461b6..4035c53 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -475,11 +475,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` | | `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.k8sPSAT.usePodUIDForAgentID` | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID | `false` | | `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` | | `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` | | `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` | +| `nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID` | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID | `false` | | `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` | | `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 2c4211b..a10ebf2 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -215,6 +215,7 @@ plugins: {{ toYaml .allowedNodeLabelKeys | nindent 14 }} allowed_pod_label_keys: {{ toYaml .allowedPodLabelKeys | nindent 14 }} + use_pod_uid_for_agent_id: {{ .usePodUIDForAgentID }} {{- end }} {{- end }} {{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }} @@ -237,6 +238,7 @@ plugins: {{ if hasKey $clusterSettings "allowedNodeLabelKeys" }}{{ toYaml $clusterSettings.allowedNodeLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedNodeLabelKeys | nindent 14 }}{{ end }} allowed_pod_label_keys: {{ if hasKey $clusterSettings "allowedPodLabelKeys" }}{{ toYaml $clusterSettings.allowedPodLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedPodLabelKeys | nindent 14 }}{{ end }} + use_pod_uid_for_agent_id: {{ if hasKey $clusterSettings "usePodUIDForAgentID" }}{{ $clusterSettings.usePodUIDForAgentID }}{{ else }}{{ $clusterDefaults.usePodUIDForAgentID }}{{ end }} {{- end }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 191623e..453fe21 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1178,6 +1178,8 @@ nodeAttestor: allowedNodeLabelKeys: [] ## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] + ## @param nodeAttestor.k8sPSAT.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID + usePodUIDForAgentID: false externalK8sPSAT: ## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters enabled: true @@ -1190,11 +1192,14 @@ nodeAttestor: allowedNodeLabelKeys: [] ## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors allowedPodLabelKeys: [] + ## @param nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID + usePodUIDForAgentID: false ## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. clusters: {} # clustera: # kubeConfigName: foo # serviceAccountAllowList: ["other-ns:other-agent"] + # usePodUIDForAgentID: true # clusterb: {} joinToken: ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor diff --git a/tests/unit/spire_test.go b/tests/unit/spire_test.go index 6126912..b562db2 100644 --- a/tests/unit/spire_test.go +++ b/tests/unit/spire_test.go @@ -416,6 +416,41 @@ spire-server: Expect(objs[serverTmpl]).Should(ContainSubstring("init-jwt-svid-exec")) }) }) + Describe("spire-server.nodeAttestor.k8sPSAT.usePodUIDForAgentID", func() { + It("renders the local cluster setting", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + nodeAttestor: + k8sPSAT: + usePodUIDForAgentID: true +`) + Expect(err).Should(Succeed()) + serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`)) + }) + + It("allows an external cluster to override the default", func() { + objs, err := ValueStringRender(chart, ` +spire-server: + kubeConfigs: + sandbox: + kubeConfig: | + apiVersion: v1 + kind: Config + nodeAttestor: + externalK8sPSAT: + defaults: + usePodUIDForAgentID: false + clusters: + sandbox: + usePodUIDForAgentID: true +`) + Expect(err).Should(Succeed()) + serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"] + Expect(serverCM).Should(ContainSubstring(`"sandbox": {`)) + Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`)) + }) + }) Describe("spiffe-csi-driver.syncWave", func() { csiTmpl := "spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml" It("renders the default sync-wave annotation on OpenShift", func() {