From dfe8089160434928a861367f724a77868cdb872e Mon Sep 17 00:00:00 2001 From: Jesper Engberg Date: Wed, 15 Apr 2026 18:33:53 +0200 Subject: [PATCH] feat: add gcp_iit node attestor configuration options (#796) * feat: add gcp_iit node attestor configuration options Signed-off-by: Jesper Engberg * fix: align indentation Signed-off-by: Jesper Engberg * fix: remove unused var Signed-off-by: Jesper Engberg --------- Signed-off-by: Jesper Engberg Co-authored-by: kfox1111 --- charts/spire/charts/spire-agent/README.md | 1 + .../spire-agent/templates/configmap.yaml | 11 ++++++-- charts/spire/charts/spire-agent/values.yaml | 3 +++ charts/spire/charts/spire-server/README.md | 7 ++++++ .../spire-server/templates/configmap.yaml | 25 ++++++++++++++++++- charts/spire/charts/spire-server/values.yaml | 15 +++++++++++ 6 files changed, 59 insertions(+), 3 deletions(-) diff --git a/charts/spire/charts/spire-agent/README.md b/charts/spire/charts/spire-agent/README.md index 7a4bff1..29f86b1 100644 --- a/charts/spire/charts/spire-agent/README.md +++ b/charts/spire/charts/spire-agent/README.md @@ -94,6 +94,7 @@ A Helm chart to install the SPIRE agent. | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | +| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | diff --git a/charts/spire/charts/spire-agent/templates/configmap.yaml b/charts/spire/charts/spire-agent/templates/configmap.yaml index 77be88f..9a5e922 100644 --- a/charts/spire/charts/spire-agent/templates/configmap.yaml +++ b/charts/spire/charts/spire-agent/templates/configmap.yaml @@ -120,13 +120,20 @@ plugins: {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} - {{- with .Values.nodeAttestor.awsIID }} - {{- if eq (.enabled | toString) "true" }} + {{- with .Values.nodeAttestor.awsIID }} + {{- if eq (.enabled | toString) "true" }} aws_iid: plugin_data: {} {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.gcpIIT }} + {{- if eq (.enabled | toString) "true" }} + gcp_iit: + plugin_data: {} + {{- $nodeAttestorUsed = add1 $nodeAttestorUsed }} + {{- end }} + {{- end }} {{- if ne $nodeAttestorUsed 1 }} {{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }} {{- end }} diff --git a/charts/spire/charts/spire-agent/values.yaml b/charts/spire/charts/spire-agent/values.yaml index 4ea5223..8ba9c00 100644 --- a/charts/spire/charts/spire-agent/values.yaml +++ b/charts/spire/charts/spire-agent/values.yaml @@ -216,6 +216,9 @@ nodeAttestor: awsIID: ## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor enabled: false + gcpIIT: + ## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit Node Attestor + enabled: false # workloadAttestors determine a workload's properties and then generate a set of selectors associated with it. workloadAttestors: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index 09eef24..9948353 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -435,6 +435,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` | | `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` | +| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` | +| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` | +| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` | +| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` | +| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` | +| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` | +| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` | | `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` | | `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` | | `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` | diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 5750db9..5bac690 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -159,7 +159,7 @@ plugins: {{- end }} disable_migration: {{ .Values.dataStore.sql.disableMigration }} - {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }} + {{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled }} NodeAttestor: {{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }} {{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }} @@ -248,6 +248,29 @@ plugins: {{- end }} {{- end }} {{- end }} + {{- with .Values.nodeAttestor.gcpIIT }} + {{- if eq (.enabled | toString) "true" }} + gcp_iit: + plugin_data: + projectid_allow_list: + {{ toYaml .projectIDAllowList | nindent 10 }} + use_instance_metadata: {{ .useInstanceMetadata }} + {{- if not (empty .allowedLabelKeys) }} + allowed_label_keys: + {{ toYaml .allowedLabelKeys | nindent 10 }} + {{- end }} + {{- if not (empty .allowedMetadataKeys) }} + allowed_metadata_keys: + {{ toYaml .allowedMetadataKeys | nindent 10 }} + {{- end }} + {{- if ne (int .metadataValueMaxSize) 0 }} + max_metadata_value_size: {{ (int .metadataValueMaxSize) }} + {{- end }} + {{- if ne .agentPathTemplate "" }} + agent_path_template: {{ .agentPathTemplate | quote }} + {{- end }} + {{- end }} + {{- end }} {{- end }} {{- with .Values.keyManager.disk }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 46026f7..c1c417d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -1074,6 +1074,21 @@ nodeAttestor: enabled: false ## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation assumeRole: "" + gcpIIT: + ## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit node attestor + enabled: false + ## @param nodeAttestor.gcpIIT.projectIDAllowList List of ProjectIDs from which nodes can be attested + projectIDAllowList: [] + ## @param nodeAttestor.gcpIIT.useInstanceMetadata If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin + useInstanceMetadata: false + ## @param nodeAttestor.gcpIIT.allowedLabelKeys Instance label keys considered for selectors + allowedLabelKeys: [] + ## @param nodeAttestor.gcpIIT.allowedMetadataKeys Instance metadata keys considered for selectors + allowedMetadataKeys: [] + ## @param nodeAttestor.gcpIIT.metadataValueMaxSize Sets the maximum metadata value size considered by the plugin for selectors + metadataValueMaxSize: 0 + ## @param nodeAttestor.gcpIIT.agentPathTemplate A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. + agentPathTemplate: "" # The secrets needed for this plugin are configured in the secrets: section bundlePublisher: