Experimental support for spire-identity-exchange (#860)
* Experimental support for spire-identity-exchange Signed-off-by: Kevin Fox <[email protected]> * Fix image name Signed-off-by: Kevin Fox <[email protected]> * Fix flags Signed-off-by: Kevin Fox <[email protected]> * Fix ghosted section Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Add some missing bits Signed-off-by: Kevin Fox <[email protected]> * Some more implementation Signed-off-by: Kevin Fox <[email protected]> * Update tests Signed-off-by: Kevin Fox <[email protected]> * Add ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fix static entry Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Remove unused change Signed-off-by: Kevin Fox <[email protected]> * Update spire-identity-exchange. Start to test. Signed-off-by: Kevin Fox <[email protected]> * fixes Signed-off-by: Kevin Fox <[email protected]> * Update lock Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix broken test. Correct default dns names. Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,95 @@
|
||||
{{- $tlsCount := 0 }}
|
||||
{{- if .Values.tls.externalSecret.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.certManager.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if ne $tlsCount 1 }}
|
||||
{{- fail "You must have one and only one TLS configuration enabled" }}
|
||||
{{- end }}
|
||||
{{- if lt (len .Values.auth.plugins) 1 }}
|
||||
{{- fail "You must have at least one auth plugin defined" }}
|
||||
{{- end }}
|
||||
{{- if not (or .Values.rest.enabled .Values.grpc.enabled) }}
|
||||
{{- fail "You must have rest and/or grpc enabled" }}
|
||||
{{- end }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
{{- with .Values.configMap.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
six.conf: |
|
||||
name: spire-identity-exchange
|
||||
logLevel: info
|
||||
server:
|
||||
port: 8443
|
||||
restPort: 8444
|
||||
metricsPort: 4950
|
||||
tls:
|
||||
certFile: /secret/tls.crt
|
||||
keyFile: /secret/tls.key
|
||||
spire:
|
||||
agentWorkloadSocketPath: /spiffe-workload-api/spire-agent.sock
|
||||
agentDelegatedSocketPath: /agent/admin.sock
|
||||
trustDomain: {{ $trustDomain }}
|
||||
svidTTL: 1h
|
||||
auth:
|
||||
plugins:
|
||||
{{- toYaml .Values.auth.plugins | nindent 8 }}
|
||||
{{ with .Values.auth.stacks }}
|
||||
stacks:
|
||||
{{- toYaml .Values.auth.stacks | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
six-agent.conf: |
|
||||
agent {
|
||||
log_level = "DEBUG"
|
||||
trust_domain = {{ $trustDomain | quote }}
|
||||
server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }}
|
||||
server_port = {{ .Values.server.port }}
|
||||
trust_bundle_url = "http://localhost/trustbundle"
|
||||
trust_bundle_unix_socket = "/trustbundle/socket"
|
||||
rebootstrap_mode = "always"
|
||||
rebootstrap_delay = "5m"
|
||||
|
||||
data_dir = "/agent-data"
|
||||
admin_socket_path = "/agent/admin.sock"
|
||||
authorized_delegates = ["spiffe://{{ $trustDomain }}/service/spire-identity-exchange"]
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = 8182
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
|
||||
plugins {
|
||||
KeyManager "memory" {
|
||||
plugin_data {}
|
||||
}
|
||||
|
||||
NodeAttestor "x509pop" {
|
||||
plugin_data {
|
||||
spiffe_endpoint_socket = "unix:///spiffe-workload-api/spire-agent.sock"
|
||||
}
|
||||
}
|
||||
|
||||
WorkloadAttestor "unix" {
|
||||
plugin_data {
|
||||
# Only used for delegated api. Can be removed for the broker api in the future.
|
||||
discover_workload_path = true
|
||||
workload_size_limit = -1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user