From c7ab1319cc1569b5b93352c198a289d107a2e384 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 16 Jan 2024 14:52:39 -0800 Subject: [PATCH] Add join_token server nodeattestor support (#187) Signed-off-by: Kevin Fox --- charts/spire/charts/spire-server/README.md | 1 + .../spire/charts/spire-server/templates/configmap.yaml | 10 +++++++++- charts/spire/charts/spire-server/values.yaml | 3 +++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 28ecc59..a61bd43 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -270,6 +270,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` | | `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` | | `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` | +| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` | ### Tornjak diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index d631806..a0aca75 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -74,9 +74,10 @@ plugins: plugin_data: {{ include "spire-server.datastore-config" . | nindent 10 }} + {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.joinToken.enabled }} + NodeAttestor: {{- with .Values.nodeAttestor.k8sPsat }} {{- if eq (.enabled | toString) "true" }} - NodeAttestor: k8s_psat: plugin_data: clusters: @@ -84,6 +85,13 @@ plugins: service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.joinToken }} + {{- if eq (.enabled | toString) "true" }} + join_token: + plugin_data: {} + {{- end }} + {{- end }} + {{- end }} {{- with .Values.keyManager.disk }} {{- if eq (.enabled | toString) "true" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index a19d517..8ec0c5e 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -610,6 +610,9 @@ nodeAttestor: enabled: true ## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor serviceAccountAllowList: [] + joinToken: + ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor + enabled: false ## @section Tornjak tornjak: