Add spire-credentialcomposer-cel support (#587)

* Add spire-credentialcomposer-cel support Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2025-05-21 11:59:26 -07:00
parent ccfb4905e2
commit d6684bce19
6 changed files with 126 additions and 2 deletions
@@ -102,9 +102,21 @@ server:
  {{- end }}

 plugins:
-  {{- if .Values.credentialComposer.uniqueID.enabled }}
+  {{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
  CredentialComposer:
+    {{- if or .Values.credentialComposer.uniqueID.enabled }}
    uniqueid: {}
+    {{- end }}
+    {{- with .Values.credentialComposer.cel }}
+    {{- if .enabled }}
+    cel:
+      plugin_cmd: "/cel/credentialcomposer-cel"
+      plugin_checksum: {{ .checksum }}
+      plugin_data:
+        jwt:
+          expression_string: {{ .jwt.expression | quote }}
+    {{- end }}
+    {{- end }}
  {{- end }}

  DataStore:
@@ -121,8 +121,41 @@ spec:
      securityContext:
        {{- $podSecurityContext | toYaml | nindent 8 }}
      {{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
-      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled $needsChown }}
+      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled .Values.credentialComposer.cel.enabled $needsChown }}
      initContainers:
+        {{- if .Values.credentialComposer.cel.enabled }}
+        - name: init-cel
+          securityContext:
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.busybox.image "global" .Values.global) }}
+          # SPIRE must be able to fork the plugin directly within its container. First copy a busybox so that the plugin can be copied into the right place.
+          command:
+            - busybox
+            - sh
+            - -ec
+            - |
+              cp -a /bin/busybox /cel/busybox
+          volumeMounts:
+            - name: cel
+              mountPath: /cel
+          imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
+        - name: init-cel2
+          securityContext:
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.credentialComposer.cel.image "global" .Values.global) }}
+          # Second, use the previously copied busybox to copy the plugin into a volume that can be mounted where SPIRE can execute it.
+          command:
+            - /cel/busybox
+            - sh
+            - -ec
+            - |
+              /cel/busybox cp -a {{ .Values.credentialComposer.cel.pluginPath }} /cel/credentialcomposer-cel
+              /cel/busybox rm -f /cel/busybox
+          volumeMounts:
+            - name: cel
+              mountPath: /cel
+          imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
+        {{- end }}
        {{- if .Values.nodeAttestor.tpmDirect.enabled }}
        - name: init-tpm-direct
          securityContext:
@@ -302,6 +335,11 @@ spec:
              mountPath: /kubeconfigs
              readOnly: true
            {{- end }}
+            {{- if .Values.credentialComposer.cel.enabled }}
+            - name: cel
+              mountPath: /cel
+              readOnly: true
+            {{- end }}
            {{- if .Values.nodeAttestor.tpmDirect.enabled }}
            - name: tpm-direct
              mountPath: /tpm
@@ -440,6 +478,10 @@ spec:
          secret:
            secretName: {{ include "spire-server.fullname" . }}-kubeconfigs
        {{- end }}
+        {{- if .Values.credentialComposer.cel.enabled }}
+        - name: cel
+          emptyDir: {}
+        {{- end }}
        {{- if .Values.nodeAttestor.tpmDirect.enabled }}
        - name: tpm-direct
          emptyDir: {}