panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add join_token server nodeattestor support (#187)

Browse Source 
Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
2024-01-16 14:52:39 -08:00
committed by GitHub
parent 81e9523e03
commit c7ab1319cc
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+1
View File
@@ -270,6 +270,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `defaultJwtSvidTTL` | TTL for JWT Svids | `1h` |
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
### Tornjak
charts/spire/charts/spire-server/templates/configmap.yaml
+9 -1
View File
@@ -74,9 +74,10 @@ plugins:
plugin_data:
{{ include "spire-server.datastore-config" . | nindent 10 }}
{{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.joinToken.enabled }}
NodeAttestor:
{{- with .Values.nodeAttestor.k8sPsat }}
{{- if eq (.enabled | toString) "true" }}
NodeAttestor:
k8s_psat:
plugin_data:
clusters:
@@ -84,6 +85,13 @@ plugins:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
{{- end }}
{{- end }}
{{- with .Values.nodeAttestor.joinToken }}
{{- if eq (.enabled | toString) "true" }}
join_token:
plugin_data: {}
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.keyManager.disk }}
{{- if eq (.enabled | toString) "true" }}
charts/spire/charts/spire-server/values.yaml
+3
View File
@@ -610,6 +610,9 @@ nodeAttestor:
enabled: true
## @param nodeAttestor.k8sPsat.serviceAccountAllowList [array] Allowed service accounts for Psat nodeattestor
serviceAccountAllowList: []
joinToken:
## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
enabled: false
## @section Tornjak
tornjak: