Add spire-credentialcomposer-cel support (#587)
* Add spire-credentialcomposer-cel support Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Bump version Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -9,6 +9,11 @@
|
|||||||
"query": "chown.image",
|
"query": "chown.image",
|
||||||
"filter": "LATESTSHA",
|
"filter": "LATESTSHA",
|
||||||
"sort-flags": []
|
"sort-flags": []
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"query": "tools.bash.image",
|
||||||
|
"filter": "LATESTSHA",
|
||||||
|
"sort-flags": []
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"spire-agent/values.yaml": [
|
"spire-agent/values.yaml": [
|
||||||
|
|||||||
@@ -189,6 +189,14 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
| `caSubject.country` | Country for Spire server CA | `ARPA` |
|
||||||
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
| `caSubject.organization` | Organization for Spire server CA | `Example` |
|
||||||
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
| `caSubject.commonName` | Common Name for Spire server CA | `example.org` |
|
||||||
|
| `credentialComposer.cel.enabled` | Enable the cel based credential composer | `false` |
|
||||||
|
| `credentialComposer.cel.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||||
|
| `credentialComposer.cel.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-cel` |
|
||||||
|
| `credentialComposer.cel.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `credentialComposer.cel.image.tag` | Overrides the image tag | `0.0.2` |
|
||||||
|
| `credentialComposer.cel.checksum` | The sha256 checksum of the plugin binary | `23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4` |
|
||||||
|
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
||||||
|
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
||||||
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
||||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||||
@@ -328,6 +336,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
| `tools.kubectl.image.repository` | The repository within the registry | `rancher/kubectl` |
|
||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
|
||||||
|
| `tools.busybox.image.repository` | The repository within the registry | `busybox` |
|
||||||
|
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
|
||||||
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
||||||
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
|
||||||
|
|||||||
@@ -102,9 +102,21 @@ server:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
plugins:
|
plugins:
|
||||||
{{- if .Values.credentialComposer.uniqueID.enabled }}
|
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
||||||
CredentialComposer:
|
CredentialComposer:
|
||||||
|
{{- if or .Values.credentialComposer.uniqueID.enabled }}
|
||||||
uniqueid: {}
|
uniqueid: {}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.credentialComposer.cel }}
|
||||||
|
{{- if .enabled }}
|
||||||
|
cel:
|
||||||
|
plugin_cmd: "/cel/credentialcomposer-cel"
|
||||||
|
plugin_checksum: {{ .checksum }}
|
||||||
|
plugin_data:
|
||||||
|
jwt:
|
||||||
|
expression_string: {{ .jwt.expression | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
DataStore:
|
DataStore:
|
||||||
|
|||||||
@@ -121,8 +121,41 @@ spec:
|
|||||||
securityContext:
|
securityContext:
|
||||||
{{- $podSecurityContext | toYaml | nindent 8 }}
|
{{- $podSecurityContext | toYaml | nindent 8 }}
|
||||||
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
|
{{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
|
||||||
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled $needsChown }}
|
{{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled .Values.credentialComposer.cel.enabled $needsChown }}
|
||||||
initContainers:
|
initContainers:
|
||||||
|
{{- if .Values.credentialComposer.cel.enabled }}
|
||||||
|
- name: init-cel
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.busybox.image "global" .Values.global) }}
|
||||||
|
# SPIRE must be able to fork the plugin directly within its container. First copy a busybox so that the plugin can be copied into the right place.
|
||||||
|
command:
|
||||||
|
- busybox
|
||||||
|
- sh
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
cp -a /bin/busybox /cel/busybox
|
||||||
|
volumeMounts:
|
||||||
|
- name: cel
|
||||||
|
mountPath: /cel
|
||||||
|
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
||||||
|
- name: init-cel2
|
||||||
|
securityContext:
|
||||||
|
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||||
|
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.credentialComposer.cel.image "global" .Values.global) }}
|
||||||
|
# Second, use the previously copied busybox to copy the plugin into a volume that can be mounted where SPIRE can execute it.
|
||||||
|
command:
|
||||||
|
- /cel/busybox
|
||||||
|
- sh
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
/cel/busybox cp -a {{ .Values.credentialComposer.cel.pluginPath }} /cel/credentialcomposer-cel
|
||||||
|
/cel/busybox rm -f /cel/busybox
|
||||||
|
volumeMounts:
|
||||||
|
- name: cel
|
||||||
|
mountPath: /cel
|
||||||
|
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
||||||
|
{{- end }}
|
||||||
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
||||||
- name: init-tpm-direct
|
- name: init-tpm-direct
|
||||||
securityContext:
|
securityContext:
|
||||||
@@ -302,6 +335,11 @@ spec:
|
|||||||
mountPath: /kubeconfigs
|
mountPath: /kubeconfigs
|
||||||
readOnly: true
|
readOnly: true
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.credentialComposer.cel.enabled }}
|
||||||
|
- name: cel
|
||||||
|
mountPath: /cel
|
||||||
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
||||||
- name: tpm-direct
|
- name: tpm-direct
|
||||||
mountPath: /tpm
|
mountPath: /tpm
|
||||||
@@ -440,6 +478,10 @@ spec:
|
|||||||
secret:
|
secret:
|
||||||
secretName: {{ include "spire-server.fullname" . }}-kubeconfigs
|
secretName: {{ include "spire-server.fullname" . }}-kubeconfigs
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.credentialComposer.cel.enabled }}
|
||||||
|
- name: cel
|
||||||
|
emptyDir: {}
|
||||||
|
{{- end }}
|
||||||
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
{{- if .Values.nodeAttestor.tpmDirect.enabled }}
|
||||||
- name: tpm-direct
|
- name: tpm-direct
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
|
|||||||
@@ -340,6 +340,34 @@ caSubject:
|
|||||||
commonName: example.org
|
commonName: example.org
|
||||||
|
|
||||||
credentialComposer:
|
credentialComposer:
|
||||||
|
cel:
|
||||||
|
## @param credentialComposer.cel.enabled Enable the cel based credential composer
|
||||||
|
enabled: false
|
||||||
|
## @param credentialComposer.cel.image.registry The OCI registry to pull the image from
|
||||||
|
## @param credentialComposer.cel.image.repository The repository within the registry
|
||||||
|
## @param credentialComposer.cel.image.pullPolicy The image pull policy
|
||||||
|
## @param credentialComposer.cel.image.tag Overrides the image tag
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: ghcr.io
|
||||||
|
repository: spiffe/spire-credentialcomposer-cel
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: "0.0.2"
|
||||||
|
## @param credentialComposer.cel.checksum The sha256 checksum of the plugin binary
|
||||||
|
checksum: 23fa1d10f15ad5d5c555930cf82289c664801d7d5609bfd8847f95a0a667e4e4
|
||||||
|
## @param credentialComposer.cel.pluginPath The filename in the container of the plugin
|
||||||
|
pluginPath: /ko-app/cmd
|
||||||
|
jwt:
|
||||||
|
## @param credentialComposer.cel.jwt.expression The expression to use for jwt token composing
|
||||||
|
expression: ""
|
||||||
|
#expression: |
|
||||||
|
# spire.plugin.server.credentialcomposer.v1.ComposeWorkloadJWTSVIDResponse{
|
||||||
|
# attributes: spire.plugin.server.credentialcomposer.v1.JWTSVIDAttributes{
|
||||||
|
# claims: request.attributes.claims.mapOverrideEntries(
|
||||||
|
# {'newclaim': "value"}
|
||||||
|
# )
|
||||||
|
# }
|
||||||
|
# }
|
||||||
uniqueID:
|
uniqueID:
|
||||||
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
||||||
enabled: false
|
enabled: false
|
||||||
@@ -779,6 +807,17 @@ tools:
|
|||||||
repository: rancher/kubectl
|
repository: rancher/kubectl
|
||||||
pullPolicy: IfNotPresent
|
pullPolicy: IfNotPresent
|
||||||
tag: ""
|
tag: ""
|
||||||
|
busybox:
|
||||||
|
## @param tools.busybox.image.registry The OCI registry to pull the image from
|
||||||
|
## @param tools.busybox.image.repository The repository within the registry
|
||||||
|
## @param tools.busybox.image.pullPolicy The image pull policy
|
||||||
|
## @param tools.busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||||
|
##
|
||||||
|
image:
|
||||||
|
registry: ""
|
||||||
|
repository: busybox
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
tag: 1.37.0-uclibc
|
||||||
|
|
||||||
telemetry:
|
telemetry:
|
||||||
prometheus:
|
prometheus:
|
||||||
|
|||||||
@@ -0,0 +1,14 @@
|
|||||||
|
# Details at https://github.com/spiffe/spire-credentialcomposer-cel/blob/main/README.md
|
||||||
|
spire-server:
|
||||||
|
credentialComposer:
|
||||||
|
cel:
|
||||||
|
enabled: true
|
||||||
|
jwt:
|
||||||
|
expression: |
|
||||||
|
spire.plugin.server.credentialcomposer.v1.ComposeWorkloadJWTSVIDResponse{
|
||||||
|
attributes: spire.plugin.server.credentialcomposer.v1.JWTSVIDAttributes{
|
||||||
|
claims: request.attributes.claims.mapOverrideEntries(
|
||||||
|
{'newclaim': "value"}
|
||||||
|
)
|
||||||
|
}
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user