feat: add gcp_iit node attestor configuration options (#796)
* feat: add gcp_iit node attestor configuration options Signed-off-by: Jesper Engberg <[email protected]> * fix: align indentation Signed-off-by: Jesper Engberg <[email protected]> * fix: remove unused var Signed-off-by: Jesper Engberg <[email protected]> --------- Signed-off-by: Jesper Engberg <[email protected]> Co-authored-by: kfox1111 <[email protected]>
This commit is contained in:
Jesper Engberg
co-authored by
kfox1111
kfox1111
parent
3c1dec3035
commit
dfe8089160
@@ -94,6 +94,7 @@ A Helm chart to install the SPIRE agent.
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` |
|
||||
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
|
||||
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
|
||||
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
|
||||
|
||||
@@ -127,6 +127,13 @@ plugins:
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.gcpIIT }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
gcp_iit:
|
||||
plugin_data: {}
|
||||
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if ne $nodeAttestorUsed 1 }}
|
||||
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
||||
{{- end }}
|
||||
|
||||
@@ -216,6 +216,9 @@ nodeAttestor:
|
||||
awsIID:
|
||||
## @param nodeAttestor.awsIID.enabled Enable the aws_iid Node Attestor
|
||||
enabled: false
|
||||
gcpIIT:
|
||||
## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit Node Attestor
|
||||
enabled: false
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
|
||||
@@ -435,6 +435,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid node attestor | `false` |
|
||||
| `nodeAttestor.awsIID.assumeRole` | AWS IAM Role NAME to use for the attestation | `""` |
|
||||
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit node attestor | `false` |
|
||||
| `nodeAttestor.gcpIIT.projectIDAllowList` | List of ProjectIDs from which nodes can be attested | `[]` |
|
||||
| `nodeAttestor.gcpIIT.useInstanceMetadata` | If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin | `false` |
|
||||
| `nodeAttestor.gcpIIT.allowedLabelKeys` | Instance label keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.allowedMetadataKeys` | Instance metadata keys considered for selectors | `[]` |
|
||||
| `nodeAttestor.gcpIIT.metadataValueMaxSize` | Sets the maximum metadata value size considered by the plugin for selectors | `0` |
|
||||
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
|
||||
@@ -159,7 +159,7 @@ plugins:
|
||||
{{- end }}
|
||||
disable_migration: {{ .Values.dataStore.sql.disableMigration }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -248,6 +248,29 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.gcpIIT }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
gcp_iit:
|
||||
plugin_data:
|
||||
projectid_allow_list:
|
||||
{{ toYaml .projectIDAllowList | nindent 10 }}
|
||||
use_instance_metadata: {{ .useInstanceMetadata }}
|
||||
{{- if not (empty .allowedLabelKeys) }}
|
||||
allowed_label_keys:
|
||||
{{ toYaml .allowedLabelKeys | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if not (empty .allowedMetadataKeys) }}
|
||||
allowed_metadata_keys:
|
||||
{{ toYaml .allowedMetadataKeys | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if ne (int .metadataValueMaxSize) 0 }}
|
||||
max_metadata_value_size: {{ (int .metadataValueMaxSize) }}
|
||||
{{- end }}
|
||||
{{- if ne .agentPathTemplate "" }}
|
||||
agent_path_template: {{ .agentPathTemplate | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.keyManager.disk }}
|
||||
|
||||
@@ -1074,6 +1074,21 @@ nodeAttestor:
|
||||
enabled: false
|
||||
## @param nodeAttestor.awsIID.assumeRole AWS IAM Role NAME to use for the attestation
|
||||
assumeRole: ""
|
||||
gcpIIT:
|
||||
## @param nodeAttestor.gcpIIT.enabled Enable the gcp_iit node attestor
|
||||
enabled: false
|
||||
## @param nodeAttestor.gcpIIT.projectIDAllowList List of ProjectIDs from which nodes can be attested
|
||||
projectIDAllowList: []
|
||||
## @param nodeAttestor.gcpIIT.useInstanceMetadata If true, instance metadata is fetched from the Google Compute Engine API and used to augment the node selectors produced by the plugin
|
||||
useInstanceMetadata: false
|
||||
## @param nodeAttestor.gcpIIT.allowedLabelKeys Instance label keys considered for selectors
|
||||
allowedLabelKeys: []
|
||||
## @param nodeAttestor.gcpIIT.allowedMetadataKeys Instance metadata keys considered for selectors
|
||||
allowedMetadataKeys: []
|
||||
## @param nodeAttestor.gcpIIT.metadataValueMaxSize Sets the maximum metadata value size considered by the plugin for selectors
|
||||
metadataValueMaxSize: 0
|
||||
## @param nodeAttestor.gcpIIT.agentPathTemplate A URL path portion format of Agent's SPIFFE ID. Describe in text/template format.
|
||||
agentPathTemplate: ""
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
|
||||
Reference in New Issue
Block a user