Experimental support for spire-identity-exchange (#860)
* Experimental support for spire-identity-exchange Signed-off-by: Kevin Fox <[email protected]> * Fix image name Signed-off-by: Kevin Fox <[email protected]> * Fix flags Signed-off-by: Kevin Fox <[email protected]> * Fix ghosted section Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Add some missing bits Signed-off-by: Kevin Fox <[email protected]> * Some more implementation Signed-off-by: Kevin Fox <[email protected]> * Update tests Signed-off-by: Kevin Fox <[email protected]> * Add ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fix static entry Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Remove unused change Signed-off-by: Kevin Fox <[email protected]> * Update spire-identity-exchange. Start to test. Signed-off-by: Kevin Fox <[email protected]> * fixes Signed-off-by: Kevin Fox <[email protected]> * Update lock Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix broken test. Correct default dns names. Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -56,6 +56,9 @@ dependencies:
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
- name: spire-server
|
||||
repository: file://../spire/charts/spire-server
|
||||
version: 0.1.0
|
||||
@@ -68,5 +71,8 @@ dependencies:
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
digest: sha256:31c9c0410c08f27c65d38dc78967699b65ed289aa9064b7167673abfe6d219d6
|
||||
generated: "2026-06-06T08:13:06.564494-07:00"
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
digest: sha256:418e807bf7ff9504d000e3d1bc581faf83c91e0792e05ec7c11aaaa2cb54caf4
|
||||
generated: "2026-06-30T07:46:43.45713065-07:00"
|
||||
|
||||
@@ -153,6 +153,13 @@ dependencies:
|
||||
- bottomTurtleHAA
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
alias: spire-identity-exchange-bottom-turtle-ha-a
|
||||
condition: spire-identity-exchange-bottom-turtle-ha-a.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
tags:
|
||||
- bottomTurtleHAA
|
||||
- name: spire-server
|
||||
alias: internal-spire-server-bottom-turtle-ha-b
|
||||
condition: internal-spire-server-bottom-turtle-ha-b.enabled
|
||||
@@ -181,6 +188,13 @@ dependencies:
|
||||
- bottomTurtleHAB
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
alias: spire-identity-exchange-bottom-turtle-ha-b
|
||||
condition: spire-identity-exchange-bottom-turtle-ha-b.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
tags:
|
||||
- bottomTurtleHAB
|
||||
annotations:
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
|
||||
@@ -398,12 +398,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
||||
@@ -430,12 +431,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
||||
@@ -491,3 +493,15 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.csiDriverName` | CSI driver name to use | `a.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-grpc` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.csiDriverName` | CSI driver name to use | `b.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-grpc` |
|
||||
|
||||
@@ -497,6 +497,10 @@ internal-spire-server-bottom-turtle-ha-a:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -507,13 +511,13 @@ internal-spire-server-bottom-turtle-ha-a:
|
||||
x509POP:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||
enabled: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange/k8s
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
||||
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||
addClusterName:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||
spiffePrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: true
|
||||
upstreamAuthority:
|
||||
@@ -575,6 +579,10 @@ internal-spire-server-bottom-turtle-ha-b:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -585,13 +593,13 @@ internal-spire-server-bottom-turtle-ha-b:
|
||||
x509POP:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||
enabled: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange/k8s
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
||||
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||
addClusterName:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||
spiffePrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: true
|
||||
upstreamAuthority:
|
||||
@@ -755,3 +763,41 @@ downstream-spiffe-csi-driver-bottom-turtle-ha-b:
|
||||
healthChecks:
|
||||
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
|
||||
port: 9816
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-a:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
|
||||
enabled: false
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
|
||||
nameOverride: identity-exchange
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
|
||||
csiDriverName: a.csi.spiffe.io
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-grpc"
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-b:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
|
||||
enabled: false
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
|
||||
nameOverride: identity-exchange
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
|
||||
csiDriverName: b.csi.spiffe.io
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-grpc"
|
||||
|
||||
Reference in New Issue
Block a user