Update the documentation (#172)
* SPIFFE OIDC Discovery Provider Rework Fixes: https://github.com/spiffe/helm-charts-hardened/issues/151 Signed-off-by: Kevin Fox <[email protected]> * Enhance clusterspiffeid's so the discovery provider is independently configurable Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * More fix tests Signed-off-by: Kevin Fox <[email protected]> * Undo Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Try to get output Signed-off-by: Kevin Fox <[email protected]> * Try and get error code Signed-off-by: Kevin Fox <[email protected]> * Fix more logging. Switch port used. Signed-off-by: Kevin Fox <[email protected]> * Fix logging Signed-off-by: Kevin Fox <[email protected]> * Fix port Signed-off-by: Kevin Fox <[email protected]> * Fix up logs for nested test and fix values Signed-off-by: Kevin Fox <[email protected]> * Make consistent Signed-off-by: Kevin Fox <[email protected]> * Fix nested test Signed-off-by: Kevin Fox <[email protected]> * Fix insecure mode and test. Signed-off-by: Kevin Fox <[email protected]> * Fix test. Signed-off-by: Kevin Fox <[email protected]> * Fix var scoping issue Signed-off-by: Kevin Fox <[email protected]> * Set the right flags for ingress Signed-off-by: Kevin Fox <[email protected]> * Update dns template Signed-off-by: Kevin Fox <[email protected]> * Use more standard port Signed-off-by: Kevin Fox <[email protected]> * Fix test logging Signed-off-by: Kevin Fox <[email protected]> * Allow reencrypt. Signed-off-by: Kevin Fox <[email protected]> * Remove testing changes Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Add LetsEncrypt/ACME/cert-manager support. Remove broken ACME support. Signed-off-by: Kevin Fox <[email protected]> * Use spiffe-helper as a sidecar. Significant space savings and read only cert dir Signed-off-by: Kevin Fox <[email protected]> * Fix the nested test Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Remove 1.29.0 until deps catch up. Related issue: https://github.com/rancher/kubectl/pull/94 Signed-off-by: Kevin Fox <[email protected]> * Add more error checking Signed-off-by: Kevin Fox <[email protected]> * Remove testing code Signed-off-by: Kevin Fox <[email protected]> * Simplify the ids. Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix logic Signed-off-by: Kevin Fox <[email protected]> * Fix var Signed-off-by: Kevin Fox <[email protected]> * Make cert-manager bits more readable Signed-off-by: Kevin Fox <[email protected]> * Fix template Signed-off-by: Kevin Fox <[email protected]> * Fix openshift ingress Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> * Add resource spec Signed-off-by: Kevin Fox <[email protected]> * Remove parts that cant merge yet Signed-off-by: Kevin Fox <[email protected]> * Add support for running spiffe secured discovery provider (default) Signed-off-by: Kevin Fox <[email protected]> * Fix tests Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Fix merge conflict Signed-off-by: Kevin Fox <[email protected]> * Remove defaults Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Add missing configurable for the discovery providers csi driver Signed-off-by: Kevin Fox <[email protected]> * Update the documentation Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Add missing file Signed-off-by: Kevin Fox <[email protected]> * Update for changes in spiffe-helper Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -3,13 +3,11 @@ global:
|
||||
upstreamSpireAddress: spire-server.spire-root-server
|
||||
|
||||
spire-server:
|
||||
enabled: true
|
||||
upstreamAuthority:
|
||||
spire:
|
||||
enabled: true
|
||||
upstreamDriver: upstream.csi.spiffe.io
|
||||
controllerManager:
|
||||
enabled: true
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
default:
|
||||
|
||||
@@ -1,80 +0,0 @@
|
||||
# Recommended setup for installing Spire on Openshift
|
||||
|
||||
> [!Note]
|
||||
> This functionality is under development. It works but has no automated testing and will have security tightened in the future.
|
||||
|
||||
This deployment works only with Openshift version 4.13 or higher. Get the Openshift platform here: [try.openshift.com](try.openshift.com)
|
||||
|
||||
To be consistent with the rest of the Spire helm-charts,
|
||||
we deploy Spire across 2 namespaces.
|
||||
|
||||
```shell
|
||||
kubectl create namespace "spire-system"
|
||||
kubectl create namespace "spire-server"
|
||||
|
||||
#Note, the first install requires privilege due to helm ordering issue. After install it can be safely tightened back up.
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=privileged
|
||||
|
||||
kubectl label namespace "spire-system" security.openshift.io/scc.podSecurityLabelSync=false
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/enforce=privileged
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/warn=privileged --overwrite
|
||||
kubectl label namespace "spire-system" pod-security.kubernetes.io/audit=privileged --overwrite
|
||||
|
||||
helm upgrade --install --namespace spire-server spire-crds charts/spire-crds
|
||||
```
|
||||
|
||||
Obtain you ingress subdomain:
|
||||
|
||||
```shell
|
||||
appdomain=$(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//')
|
||||
echo "$appdomain"
|
||||
```
|
||||
|
||||
Update the `example-your-values.yaml` file with your subdomain.
|
||||
|
||||
> [!Note]
|
||||
> The location of the apps subdomain may be different in certain environments_
|
||||
|
||||
## Standard Deployment
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values examples/production/values.yaml \
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
--render-subchart-notes
|
||||
```
|
||||
|
||||
## IBM Cloud Deployment
|
||||
|
||||
Openshift on IBM Cloud requires additional configuration:
|
||||
|
||||
```shell
|
||||
helm upgrade --install --namespace spire-server spire charts/spire \
|
||||
--values examples/production/values.yaml \
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--set spiffe-csi-driver.kubeletPath=/var/data/kubelet \
|
||||
--set spiffe-csi-driver.restrictedScc.enabled=true \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
--render-subchart-notes
|
||||
```
|
||||
|
||||
## Feature Customization
|
||||
|
||||
Additional features such as tornjak can be enabled by including their example values files before --values examples/production/example-your-values.yaml
|
||||
|
||||
For example:
|
||||
|
||||
```shell
|
||||
--values examples/openshift/openshift-values.yaml \
|
||||
--values examples/tornjak/values.yaml \
|
||||
--values examples/production/example-your-values.yaml \
|
||||
```
|
||||
|
||||
## Finish install
|
||||
|
||||
Once installed, the namespace security can be tightened back up.
|
||||
|
||||
```shell
|
||||
kubectl label namespace "spire-server" pod-security.kubernetes.io/enforce=restricted --overwrite
|
||||
```
|
||||
@@ -1,2 +0,0 @@
|
||||
global:
|
||||
openshift: true
|
||||
@@ -0,0 +1,5 @@
|
||||
spiffe-csi-driver:
|
||||
kubeletPath: /var/data/kubelet
|
||||
restrictedScc:
|
||||
enabled: true
|
||||
|
||||
Reference in New Issue
Block a user