feat: 支持按 Pod UID 生成 Agent ID
Signed-off-by: panxiao81 <[email protected]>
This commit is contained in:
@@ -4,7 +4,7 @@ description: >
|
||||
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
|
||||
|
||||
type: application
|
||||
version: 0.30.2
|
||||
version: 0.30.2-ddupan.1
|
||||
appVersion: "1.15.3"
|
||||
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
|
||||
|
||||
@@ -475,11 +475,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.k8sPSAT.audience` | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.k8sPSAT.usePodUIDForAgentID` | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID | `false` |
|
||||
| `nodeAttestor.externalK8sPSAT.enabled` | Enable PSAT k8s nodeattestor for external Kubernetes clusters | `true` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList` | Allowed service accounts for PSAT node attestor | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.audience` | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys` | Node label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys` | Pod label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID` | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID | `false` |
|
||||
| `nodeAttestor.externalK8sPSAT.clusters` | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used. | `{}` |
|
||||
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
|
||||
| `nodeAttestor.httpChallenge.enabled` | Enable the http_challenge nodeattesto | `false` |
|
||||
|
||||
@@ -215,6 +215,7 @@ plugins:
|
||||
{{ toYaml .allowedNodeLabelKeys | nindent 14 }}
|
||||
allowed_pod_label_keys:
|
||||
{{ toYaml .allowedPodLabelKeys | nindent 14 }}
|
||||
use_pod_uid_for_agent_id: {{ .usePodUIDForAgentID }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }}
|
||||
@@ -237,6 +238,7 @@ plugins:
|
||||
{{ if hasKey $clusterSettings "allowedNodeLabelKeys" }}{{ toYaml $clusterSettings.allowedNodeLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedNodeLabelKeys | nindent 14 }}{{ end }}
|
||||
allowed_pod_label_keys:
|
||||
{{ if hasKey $clusterSettings "allowedPodLabelKeys" }}{{ toYaml $clusterSettings.allowedPodLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedPodLabelKeys | nindent 14 }}{{ end }}
|
||||
use_pod_uid_for_agent_id: {{ if hasKey $clusterSettings "usePodUIDForAgentID" }}{{ $clusterSettings.usePodUIDForAgentID }}{{ else }}{{ $clusterDefaults.usePodUIDForAgentID }}{{ end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1178,6 +1178,8 @@ nodeAttestor:
|
||||
allowedNodeLabelKeys: []
|
||||
## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors
|
||||
allowedPodLabelKeys: []
|
||||
## @param nodeAttestor.k8sPSAT.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID
|
||||
usePodUIDForAgentID: false
|
||||
externalK8sPSAT:
|
||||
## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters
|
||||
enabled: true
|
||||
@@ -1190,11 +1192,14 @@ nodeAttestor:
|
||||
allowedNodeLabelKeys: []
|
||||
## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors
|
||||
allowedPodLabelKeys: []
|
||||
## @param nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID
|
||||
usePodUIDForAgentID: false
|
||||
## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
|
||||
clusters: {}
|
||||
# clustera:
|
||||
# kubeConfigName: foo
|
||||
# serviceAccountAllowList: ["other-ns:other-agent"]
|
||||
# usePodUIDForAgentID: true
|
||||
# clusterb: {}
|
||||
joinToken:
|
||||
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
|
||||
|
||||
@@ -416,6 +416,41 @@ spire-server:
|
||||
Expect(objs[serverTmpl]).Should(ContainSubstring("init-jwt-svid-exec"))
|
||||
})
|
||||
})
|
||||
Describe("spire-server.nodeAttestor.k8sPSAT.usePodUIDForAgentID", func() {
|
||||
It("renders the local cluster setting", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
k8sPSAT:
|
||||
usePodUIDForAgentID: true
|
||||
`)
|
||||
Expect(err).Should(Succeed())
|
||||
serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
|
||||
Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
|
||||
})
|
||||
|
||||
It("allows an external cluster to override the default", func() {
|
||||
objs, err := ValueStringRender(chart, `
|
||||
spire-server:
|
||||
kubeConfigs:
|
||||
sandbox:
|
||||
kubeConfig: |
|
||||
apiVersion: v1
|
||||
kind: Config
|
||||
nodeAttestor:
|
||||
externalK8sPSAT:
|
||||
defaults:
|
||||
usePodUIDForAgentID: false
|
||||
clusters:
|
||||
sandbox:
|
||||
usePodUIDForAgentID: true
|
||||
`)
|
||||
Expect(err).Should(Succeed())
|
||||
serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
|
||||
Expect(serverCM).Should(ContainSubstring(`"sandbox": {`))
|
||||
Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
|
||||
})
|
||||
})
|
||||
Describe("spiffe-csi-driver.syncWave", func() {
|
||||
csiTmpl := "spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml"
|
||||
It("renders the default sync-wave annotation on OpenShift", func() {
|
||||
|
||||
Reference in New Issue
Block a user