panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move spire-server to dedicated subchart

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:10 +01:00
committed by Marco Franssen
parent e312d42350
commit ce9b58e725
24 changed files with 430 additions and 252 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/templates/NOTES.txt
+6
View File
@@ -0,0 +1,6 @@
Installed {{ .Chart.Name }}…
1. Get the currently registered SPIFFE entries from the server:
kubectl exec -n {{ .Release.Namespace }} {{ include "spire-server.fullname" . }}-0 -c spire-server -- \
bin/spire-server entry show -socketPath {{ .Values.socketPath }}
charts/spire/charts/spire-server/templates/_helpers.tpl
+86
View File
@@ -0,0 +1,86 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "spire-server.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "spire-server.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "spire-server.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "spire-server.labels" -}}
helm.sh/chart: {{ include "spire-server.chart" . }}
{{ include "spire-server.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "spire-server.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire-server.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "spire-server.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "spire-server.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "spire-server.image" -}}
{{- if eq (substr 0 7 .image.version) "sha256:" -}}
{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
{{- else if .appVersion -}}
{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
{{- else if .image.version -}}
{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
{{- else -}}
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire-server.upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire.fullname" $root }}-upstream-ca
{{- else -}}
{{ default (include "spire.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
charts/spire/charts/spire-server/templates/bundle-configmap.yaml
+5
View File
@@ -0,0 +1,5 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Values.bundleConfigMap }}
namespace: {{ .Release.Namespace }}
charts/spire/charts/spire-server/templates/configmap.yaml
+83
View File
@@ -0,0 +1,83 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
data:
server.conf: |
server {
bind_address = "0.0.0.0"
bind_port = "8081"
socket_path = {{ .Values.socketPath | quote }}
trust_domain = {{ .Values.trustDomain | quote }}
data_dir = "/run/spire/data"
log_level = "{{ .Values.logLevel }}"
# AWS requires the use of RSA. EC cryptography is not supported
ca_key_type = "rsa-2048"
jwt_issuer = "{{ .Values.jwtIssuer }}"
default_x509_svid_ttl = "1h"
default_jwt_svid_ttl = "1h"
ca_subject = {
{{- with .Values.ca_subject }}
country = [{{ .country | quote }}],
organization = [{{ .organization | quote }}],
common_name = {{ .common_name | quote }},
{{- end }}
}
}
plugins {
DataStore "sql" {
plugin_data {
database_type = "sqlite3"
connection_string = "/run/spire/data/datastore.sqlite3"
}
}
NodeAttestor "k8s_psat" {
plugin_data {
clusters = {
{{ .Values.clusterName | quote }} = {
service_account_allow_list = ["{{ .Release.Namespace }}:spire-agent"]
}
}
}
}
KeyManager "disk" {
plugin_data {
keys_path = "/run/spire/data/keys.json"
}
}
Notifier "k8sbundle" {
plugin_data {
namespace = "{{ .Release.Namespace }}"
config_map = {{ .Values.bundleConfigMap | quote }}
}
}
{{- with .Values.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority "disk" {
plugin_data {
cert_file_path = "/run/spire/upstream_ca/tls.crt"
key_file_path = "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
{{- end }}
}
}
{{- end }}
{{- end }}
}
health_checks {
listener_enabled = true
bind_address = "0.0.0.0"
bind_port = "8080"
live_path = "/live"
ready_path = "/ready"
}
charts/spire/charts/spire-server/templates/hpa.yaml
+28
View File
@@ -0,0 +1,28 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "spire-server.fullname" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "spire-server.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/roles.yaml
+68
View File
@@ -0,0 +1,68 @@
# ClusterRole to allow spire-server node attestor to query Token Review API
# and to be able to push certificate bundles to a configmap
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
rules:
# allow "get" access to pods (to resolve selectors for PSAT attestation)
- apiGroups: [""]
resources: [pods]
verbs: [get]
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
# agent bootstrapping, see the spire-bundle ConfigMap below)
- apiGroups: [""]
resources: [configmaps]
resourceNames: [{{ .Values.bundleConfigMap }}]
verbs:
- get
- patch
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: Role
name: {{ include "spire-server.fullname" . }}
apiGroup: rbac.authorization.k8s.io
---
# ClusterRole to allow spire-server node attestor to query Token Review API
# and to be able to push certificate bundles to a configmap
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}
rules:
# allow TokenReview requests (to verify service account tokens for PSAT
# attestation)
- apiGroups: [authentication.k8s.io]
resources: [tokenreviews]
verbs:
- get
- create
- apiGroups: [""]
resources: [nodes]
verbs:
- get
---
# Binds above cluster role to spire-server service account
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire-server.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ include "spire-server.fullname" . }}
apiGroup: rbac.authorization.k8s.io
charts/spire/charts/spire-server/templates/service.yaml
+20
View File
@@ -0,0 +1,20 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "spire-server.fullname" . }}
namespace: {{ .Release.Namespace }}
{{- with .Values.service.annotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- name: grpc
port: {{ .Values.service.port }}
targetPort: grpc
protocol: TCP
selector:
{{- include "spire-server.selectorLabels" . | nindent 4 }}
charts/spire/charts/spire-server/templates/serviceaccount.yaml
+12
View File
@@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire-server.serviceAccountName" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/charts/spire-server/templates/statefulset.yaml
+121
View File
@@ -0,0 +1,121 @@
{{- $fullname := include "spire-server.fullname" . }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ include "spire-server.fullname" . }}
labels:
{{- include "spire-server.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
serviceName: {{ include "spire-server.fullname" . }}
selector:
matchLabels:
{{- include "spire-server.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire-server.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "spire-server.serviceAccountName" . }}
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire-server.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image) }}
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- -config
- /run/spire/config/server.conf
ports:
- name: grpc
containerPort: 8081
protocol: TCP
livenessProbe:
httpGet:
path: /live
port: 8080
failureThreshold: 2
initialDelaySeconds: 15
periodSeconds: 60
timeoutSeconds: 3
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
resources:
{{- toYaml .Values.resources | nindent 12 }}
volumeMounts:
- name: spire-server-socket
mountPath: /run/spire/server-sockets
readOnly: false
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- name: spire-data
mountPath: /run/spire/data
readOnly: false
{{- end }}
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
mountPath: /run/spire/upstream_ca
readOnly: false
{{ end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: spire-config
configMap:
name: {{ include "spire-server.fullname" . }}
- name: spire-server-socket
hostPath:
path: /run/spire/server-sockets
type: DirectoryOrCreate
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
secret:
secretName: {{ include "spire-server.upstream-ca-secret" . }}
{{- end }}
volumeClaimTemplates:
{{- if eq (.Values.dataStorage.enabled | toString) "true" }}
- metadata:
name: spire-data
spec:
accessModes:
- {{ .Values.dataStorage.accessMode | default "ReadWriteOnce" }}
resources:
requests:
storage: {{ .Values.dataStorage.size }}
{{- if .Values.dataStorage.storageClass }}
storageClassName: {{ .Values.dataStorage.storageClass }}
{{- end }}
{{ end }}
charts/spire/charts/spire-server/templates/tests/test-connection.yaml
+15
View File
@@ -0,0 +1,15 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ include "spire-server.fullname" . }}-test-connection"
labels:
{{- include "spire-server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": test
spec:
containers:
- name: wget
image: busybox
command: ['nc']
args: ['-zvw3', '{{ include "spire-server.fullname" . }}', '{{ .Values.service.port }}']
restartPolicy: Never
charts/spire/charts/spire-server/templates/upstream-ca-secret.yaml
+20
View File
@@ -0,0 +1,20 @@
{{- $root := . }}
{{- with .Values.upstreamAuthority.disk }}
{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire-server.upstream-ca-secret" $root }}
namespace: {{ $root.Release.Namespace }}
labels:
{{- include "spire-server.labels" $root | nindent 4 }}
data:
{{- with .secret.data }}
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
{{- if ne .bundle ""}}
bundle.crt: {{ .bundle | b64enc }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}