panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enable CA settings via global (#268)

Browse Source 
Adds a global.spire.caSubject section where you can set the CA
subject information for all spire-server instances.

Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-02-28 11:47:24 -08:00
committed by GitHub
parent ac83694970
commit c57017425e
4 changed files with 36 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+7 -6
View File
@@ -34,12 +34,10 @@ global:
# Update these
clusterName: example-cluster
trustDomain: example.org
spire-server:
ca_subject:
# Update these
country: ARPA
organization: Example
common_name: example.org
caSubject:
country: ARPA
organization: Example
commonName: example.org
```
2. If you need a non default storageClass, append the following to the spire-server section and update:
@@ -214,6 +212,9 @@ Now you can interact with the Spire agent socket from your own application. The
| `global.spire.jwtIssuer` | The issuer for Spire JWT tokens. Defaults to oidc-discovery.$trustDomain if unset | `""` |
| `global.spire.trustDomain` | The trust domain for Spire install | `example.org` |
| `global.spire.upstreamServerAddress` | Set what address to use for the upstream server when using nested spire | `""` |
| `global.spire.caSubject.country` | Country for Spire server CA | `""` |
| `global.spire.caSubject.organization` | Organization for Spire server CA | `""` |
| `global.spire.caSubject.commonName` | Common Name for Spire server CA | `""` |
| `global.spire.recommendations.enabled` | Use recommended settings for production deployments. Default is off. | `false` |
| `global.spire.recommendations.namespaceLayout` | Set to true to use recommended values for installing across namespaces | `true` |
| `global.spire.recommendations.namespacePSS` | When chart namespace creation is enabled, label them with preffered Pod Security Standard labels | `true` |
charts/spire/charts/spire-server/templates/_helpers.tpl
+15
View File
@@ -264,3 +264,18 @@ The code below determines what connection type should be used.
{{- .Release.Namespace }}-{{ default .Release.Name .Values.crNameOverride }}
{{- end -}}
{{- end -}}
{{- define "spire-server.ca-subject-country" }}
{{- $g := dig "spire" "caSubject" "country" "" .Values.global }}
{{- default .Values.ca_subject.country $g }}
{{- end }}
{{- define "spire-server.ca-subject-organization" }}
{{- $g := dig "spire" "caSubject" "organization" "" .Values.global }}
{{- default .Values.ca_subject.organization $g }}
{{- end }}
{{- define "spire-server.ca-subject-common-name" }}
{{- $g := dig "spire" "caSubject" "commonName" "" .Values.global }}
{{- default .Values.ca_subject.common_name $g }}
{{- end }}
charts/spire/charts/spire-server/templates/configmap.yaml
+6 -8
View File
@@ -1,9 +1,9 @@
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq (include "spire-lib.trust-domain" .) "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "jwtIssuer must be set" (eq (include "spire-lib.jwt-issuer" .) "https://oidc-discovery.example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq .Values.ca_subject.country "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq .Values.ca_subject.organization "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq .Values.ca_subject.common_name "example.org"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.county must be set" (eq (include "spire-server.ca-subject-country" .) "ARPA"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.organization must be set" (eq (include "spire-server.ca-subject-organization" .) "Example"))}}
{{- include "spire-lib.check-strict-mode" (list . "ca_subject.common_name must be set" (eq (include "spire-server.ca-subject-common-name" .) "example.org"))}}
{{- range $type, $tvals := .Values.customPlugins }}
{{- if not (has $type (list "bundlePublisher" "credentialComposer" "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
@@ -59,11 +59,9 @@ server:
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
ca_subject:
{{- with .Values.ca_subject }}
- country: [{{ .country | quote }}]
organization: [{{ .organization | quote }}]
common_name: {{ .common_name | quote }}
{{- end }}
- country: [{{ include "spire-server.ca-subject-country" . | quote }}]
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
{{- with .Values.federation }}
{{- if eq (.enabled | toString) "true" }}
charts/spire/values.yaml
+8
View File
@@ -21,6 +21,14 @@ global:
## @param global.spire.upstreamServerAddress Set what address to use for the upstream server when using nested spire
upstreamServerAddress: ""
## @param global.spire.caSubject.country Country for Spire server CA
## @param global.spire.caSubject.organization Organization for Spire server CA
## @param global.spire.caSubject.commonName Common Name for Spire server CA
caSubject:
country: ""
organization: ""
commonName: ""
## @param global.spire.recommendations.enabled Use recommended settings for production deployments. Default is off.
## @param global.spire.recommendations.namespaceLayout Set to true to use recommended values for installing across namespaces
## @param global.spire.recommendations.namespacePSS When chart namespace creation is enabled, label them with preffered Pod Security Standard labels