panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move spire-server to dedicated subchart

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:10 +01:00
committed by Marco Franssen
parent e312d42350
commit ce9b58e725
24 changed files with 430 additions and 252 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/templates/NOTES.txt
+1 -4
View File
@@ -1,4 +1 @@
1. Get the currently registered SPIFFE entries from the server:
kubectl exec -n {{ .Release.Namespace }} {{ include "spire.fullname" . }}-server-0 -c spire-server -- \
bin/spire-server entry show -socketPath {{ .Values.server.config.socketPath }}
Installed {{ .Chart.Name }}…
charts/spire/templates/_helpers.tpl
-31
View File
@@ -50,26 +50,6 @@ app.kubernetes.io/name: {{ include "spire.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Common server labels
*/}}
{{- define "spire.server.labels" -}}
helm.sh/chart: {{ include "spire.chart" . }}
{{ include "spire.server.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector server labels
*/}}
{{- define "spire.server.selectorLabels" -}}
app.kubernetes.io/name: {{ include "spire.name" . }}-server
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Common oidc labels
*/}}
@@ -112,14 +92,3 @@ Create the name of the service account to use
{{- printf "%s/%s" .image.registry .image.repository -}}
{{- end -}}
{{- end }}
{{- define "spire.server-upstream-ca-secret" -}}
{{- $root := . }}
{{- with .Values.server.config.upstreamAuthority.disk -}}
{{- if eq (.secret.create | toString) "true" -}}
{{ include "spire.fullname" $root }}-upstream-ca
{{- else -}}
{{ default (include "spire.fullname" $root) .secret.name }}
{{- end -}}
{{- end -}}
{{- end }}
charts/spire/templates/server-configmap.yaml
-84
View File
@@ -1,84 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
data:
server.conf: |
server {
bind_address = "0.0.0.0"
bind_port = "8081"
socket_path = {{ .Values.server.config.socketPath | quote }}
trust_domain = {{ .Values.spire.trustDomain | quote }}
data_dir = "/run/spire/data"
log_level = "{{ .Values.server.config.logLevel }}"
# AWS requires the use of RSA. EC cryptography is not supported
ca_key_type = "rsa-2048"
{{- if eq (index .Values "spiffe-oidc-discovery-provider" "enabled" | toString) "true" }}
jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
{{ end }}
default_x509_svid_ttl = "1h"
default_jwt_svid_ttl = "1h"
ca_subject = {
{{- with .Values.server.config.ca_subject }}
country = [{{ .country | quote }}],
organization = [{{ .organization | quote }}],
common_name = {{ .common_name | quote }},
{{- end }}
}
}
plugins {
DataStore "sql" {
plugin_data {
database_type = "sqlite3"
connection_string = "/run/spire/data/datastore.sqlite3"
}
}
NodeAttestor "k8s_psat" {
plugin_data {
clusters = {
{{ .Values.spire.clusterName | quote }} = {
service_account_allow_list = ["{{ .Release.Namespace }}:{{ include "spire.serviceAccountName" . }}-agent"]
}
}
}
}
KeyManager "disk" {
plugin_data {
keys_path = "/run/spire/data/keys.json"
}
}
Notifier "k8sbundle" {
plugin_data {
namespace = "{{ .Release.Namespace }}"
config_map = "{{ include "spire.fullname" . }}-bundle"
}
}
{{- with .Values.server.config.upstreamAuthority.disk }}
{{- if eq (.enabled | toString) "true" }}
UpstreamAuthority "disk" {
plugin_data {
cert_file_path = "/run/spire/upstream_ca/tls.crt"
key_file_path = "/run/spire/upstream_ca/tls.key"
{{- if ne .secret.data.bundle "" }}
bundle_file_path = "/run/spire/upstream_ca/bundle.crt"
{{- end }}
}
}
{{- end }}
{{- end }}
}
health_checks {
listener_enabled = true
bind_address = "0.0.0.0"
bind_port = "8080"
live_path = "/live"
ready_path = "/ready"
}
charts/spire/templates/server-roles.yaml
-68
View File
@@ -1,68 +0,0 @@
# ClusterRole to allow spire-server node attestor to query Token Review API
# and to be able to push certificate bundles to a configmap
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
rules:
# allow "get" access to pods (to resolve selectors for PSAT attestation)
- apiGroups: [""]
resources: [pods]
verbs: [get]
# allow access to "get" and "patch" the spire-bundle ConfigMap (for SPIRE
# agent bootstrapping, see the spire-bundle ConfigMap below)
- apiGroups: [""]
resources: [configmaps]
resourceNames: ["{{ include "spire.fullname" . }}-bundle"]
verbs:
- get
- patch
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire.serviceAccountName" . }}-server
namespace: {{ .Release.Namespace }}
roleRef:
kind: Role
name: {{ include "spire.fullname" . }}-server
apiGroup: rbac.authorization.k8s.io
---
# ClusterRole to allow spire-server node attestor to query Token Review API
# and to be able to push certificate bundles to a configmap
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire.fullname" . }}-server
rules:
# allow TokenReview requests (to verify service account tokens for PSAT
# attestation)
- apiGroups: [authentication.k8s.io]
resources: [tokenreviews]
verbs:
- get
- create
- apiGroups: [""]
resources: [nodes]
verbs:
- get
---
# Binds above cluster role to spire-server service account
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
subjects:
- kind: ServiceAccount
name: {{ include "spire.serviceAccountName" . }}-server
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: {{ include "spire.fullname" . }}-server
apiGroup: rbac.authorization.k8s.io
charts/spire/templates/server-service.yaml
-20
View File
@@ -1,20 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "spire.fullname" . }}-server
namespace: {{ .Release.Namespace }}
{{- with .Values.server.service.annotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire.server.labels" . | nindent 4 }}
spec:
type: {{ .Values.server.service.type }}
ports:
- name: grpc
port: {{ .Values.server.service.port }}
targetPort: grpc
protocol: TCP
selector:
{{- include "spire.server.selectorLabels" . | nindent 4 }}
charts/spire/templates/server-serviceaccount.yaml
-13
View File
@@ -1,13 +0,0 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "spire.serviceAccountName" . }}-server
namespace: {{ .Release.Namespace }}
labels:
{{- include "spire.server.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
charts/spire/templates/server-statefulset.yaml
-125
View File
@@ -1,125 +0,0 @@
{{- $fullname := include "spire.fullname" . }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: {{ $fullname }}-server
labels:
{{- include "spire.server.labels" . | nindent 4 }}
spec:
replicas: {{ .Values.server.replicaCount }}
serviceName: {{ include "spire.fullname" . }}-server
selector:
matchLabels:
{{- include "spire.server.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.server.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "spire.server.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- range . }}
- name: {{ printf "%s-%s" $fullname .name }}
{{- end }}
{{- end }}
serviceAccountName: {{ include "spire.serviceAccountName" . }}-server
shareProcessNamespace: true
securityContext:
{{- toYaml .Values.server.podSecurityContext | nindent 8 }}
{{- with .Values.server.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: {{ .Chart.Name }}-server
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }}
imagePullPolicy: {{ .Values.server.image.pullPolicy }}
args:
- -config
- /run/spire/config/server.conf
ports:
- name: grpc
containerPort: 8081
protocol: TCP
volumeMounts:
- name: spire-server-socket
mountPath: /run/spire/server-sockets
readOnly: false
- name: spire-config
mountPath: /run/spire/config
readOnly: true
{{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
- name: spire-data
mountPath: /run/spire/data
readOnly: false
{{ end }}
{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
mountPath: /run/spire/upstream_ca
readOnly: false
{{- end }}
livenessProbe:
httpGet:
path: /live
port: 8080
failureThreshold: 2
initialDelaySeconds: 15
periodSeconds: 60
timeoutSeconds: 3
readinessProbe:
httpGet:
path: /ready
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
resources:
{{- toYaml .Values.server.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.server.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.server.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.server.topologySpreadConstraints }}
topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
volumes:
- name: spire-config
configMap:
name: {{ include "spire.fullname" . }}-server
- name: spire-server-socket
hostPath:
path: /run/spire/server-sockets
type: DirectoryOrCreate
{{- if eq (.Values.server.config.upstreamAuthority.disk.enabled | toString) "true" }}
- name: upstream-ca
secret:
secretName: {{ include "spire.server-upstream-ca-secret" . }}
{{- end }}
volumeClaimTemplates:
{{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
- metadata:
name: spire-data
spec:
accessModes:
- {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }}
resources:
requests:
storage: {{ .Values.server.dataStorage.size }}
{{- if .Values.server.dataStorage.storageClass }}
storageClassName: {{ .Values.server.dataStorage.storageClass }}
{{- end }}
{{ end }}
charts/spire/templates/spire-bundle-configmap.yaml
-5
View File
@@ -1,5 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire.fullname" . }}-bundle
namespace: {{ .Release.Namespace }}
charts/spire/templates/tests/server-test-connection.yaml
-15
View File
@@ -1,15 +0,0 @@
apiVersion: v1
kind: Pod
metadata:
name: "{{ include "spire.fullname" . }}-server-test-connection"
labels:
{{- include "spire.server.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": test
spec:
containers:
- name: check-port
image: busybox
command: ['nc']
args: ['-zvw3', '{{ include "spire.fullname" . }}-server', '{{ .Values.server.service.port }}']
restartPolicy: Never
charts/spire/templates/upstream-ca-secret.yaml
-20
View File
@@ -1,20 +0,0 @@
{{- $root := . }}
{{- with .Values.server.config.upstreamAuthority.disk }}
{{- if and (eq (.enabled | toString) "true") (eq (.secret.create | toString) "true") }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire.server-upstream-ca-secret" $root }}
namespace: {{ $root.Release.Namespace }}
labels:
{{- include "spire.server.labels" $root | nindent 4 }}
data:
{{- with .secret.data }}
tls.crt: {{ .certificate | b64enc }}
tls.key: {{ .key | b64enc }}
{{- if ne .bundle ""}}
bundle.crt: {{ .bundle | b64enc }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}