Experimental support for spire-identity-exchange (#860)
* Experimental support for spire-identity-exchange Signed-off-by: Kevin Fox <[email protected]> * Fix image name Signed-off-by: Kevin Fox <[email protected]> * Fix flags Signed-off-by: Kevin Fox <[email protected]> * Fix ghosted section Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Fix working dir Signed-off-by: Kevin Fox <[email protected]> * Add some missing bits Signed-off-by: Kevin Fox <[email protected]> * Some more implementation Signed-off-by: Kevin Fox <[email protected]> * Update tests Signed-off-by: Kevin Fox <[email protected]> * Add ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Fix ci Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Rework x509pop to work shared Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix path Signed-off-by: Kevin Fox <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fix static entry Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Remove unused change Signed-off-by: Kevin Fox <[email protected]> * Update spire-identity-exchange. Start to test. Signed-off-by: Kevin Fox <[email protected]> * fixes Signed-off-by: Kevin Fox <[email protected]> * Update lock Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Update Signed-off-by: Kevin Fox <[email protected]> * Fix broken test. Correct default dns names. Signed-off-by: Kevin Fox <[email protected]> * Fix merge issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -187,7 +187,7 @@ jobs:
|
||||
- name: Run chart-testing (install)
|
||||
run: |
|
||||
helm install -n spire-server spire-crds charts/spire-crds
|
||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib \
|
||||
ct install --config ct.yaml --excluded-charts spire-crds,spiffe-step-ssh,spire-ha-agent,spire-lib,spire-identity-exchange \
|
||||
--target-branch ${{ github.base_ref || inputs.target_branch }}
|
||||
|
||||
- name: Test summary
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: v2
|
||||
name: spire-identity-exchange
|
||||
description: A Helm chart to install the SPIRE Identity Exchange.
|
||||
type: application
|
||||
version: 0.1.0
|
||||
appVersion: "v0.2.0"
|
||||
keywords: ["spiffe", "spire", "identity exchange"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: marcofranssen
|
||||
email: [email protected]
|
||||
url: https://marcofranssen.nl
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
- name: faisal-memon
|
||||
email: [email protected]
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire-lib
|
||||
version: 0.2.0
|
||||
@@ -0,0 +1,126 @@
|
||||
# spire-identity-exchange
|
||||
|
||||
  
|
||||
|
||||
A Helm chart to install the SPIRE Identity Exchange.
|
||||
|
||||
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
||||
|
||||
## Maintainers
|
||||
|
||||
| Name | Email | Url |
|
||||
| ---- | ------ | --- |
|
||||
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
||||
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
||||
| faisal-memon | <fymemon@yahoo.com> | |
|
||||
|
||||
## Source Code
|
||||
|
||||
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
| `replicaCount` | Replica count | `1` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `annotations` | Annotations for the deployment | `{}` |
|
||||
| `labels` | Labels for the deployment | `{}` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` |
|
||||
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `spireServerAttestorSPIFFEWorkloadAPI.resources` | Resource requests and limits | `{}` |
|
||||
| `spireServerAttestorSPIFFEWorkloadAPI.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `spireServerAttestorSPIFFEWorkloadAPI.image.repository` | The repository within the registry | `spiffe/spire-server-attestor-spiffe-workload-api` |
|
||||
| `spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `spireServerAttestorSPIFFEWorkloadAPI.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `spireAgent.resources` | Resource requests and limits | `{}` |
|
||||
| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
||||
| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.1` |
|
||||
| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` |
|
||||
| `resources` | Resource requests and limits | `{}` |
|
||||
| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` |
|
||||
| `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` |
|
||||
| `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` |
|
||||
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
||||
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
||||
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
||||
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
||||
| `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` |
|
||||
| `podLabels` | Labels to add to pods | `{}` |
|
||||
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||
| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
||||
| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
||||
| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
||||
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
||||
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
||||
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
||||
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
||||
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
||||
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
||||
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
||||
| `config.logFormat` | The log format, valid values are "text" and "json" | `text` |
|
||||
| `imagePullSecrets` | Image pull secret names | `[]` |
|
||||
| `nameOverride` | Name override | `""` |
|
||||
| `fullnameOverride` | Full name override | `""` |
|
||||
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
||||
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
||||
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
||||
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
||||
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
||||
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
||||
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
||||
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
||||
| `nodeSelector` | Node selector | `{}` |
|
||||
| `tolerations` | iist of tolerations | `[]` |
|
||||
| `affinity` | Node affinity | `{}` |
|
||||
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
||||
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
||||
| `auth.plugins` | Plugins to load | `{}` |
|
||||
| `auth.stacks` | Stacks to load | `{}` |
|
||||
| `rest.enabled` | Enable the rest service | `true` |
|
||||
| `rest.service.type` | Service type | `ClusterIP` |
|
||||
| `rest.service.port` | port for the service | `443` |
|
||||
| `rest.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `rest.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `rest.ingress.className` | Ingress class name | `""` |
|
||||
| `rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` |
|
||||
| `rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `grpc.enabled` | Enable the grpc service | `false` |
|
||||
| `grpc.service.type` | Service type | `ClusterIP` |
|
||||
| `grpc.service.port` | port for the service | `443` |
|
||||
| `grpc.service.annotations` | Annotations for service resource | `{}` |
|
||||
| `grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
||||
| `grpc.ingress.className` | Ingress class name | `""` |
|
||||
| `grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
||||
| `grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
||||
| `grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` |
|
||||
| `grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||
| `grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||
| `grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
||||
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||
| `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` |
|
||||
| `server.address` | Address for Spire server | `""` |
|
||||
| `server.port` | Port number for Spire server | `443` |
|
||||
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
||||
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|
||||
@@ -0,0 +1,14 @@
|
||||
spire-identity-exchange:
|
||||
enabled: true
|
||||
tls:
|
||||
externalSecret:
|
||||
enabled: true
|
||||
secretName: spire-identity-exchange
|
||||
auth:
|
||||
plugins:
|
||||
- plugin: k8s_psat
|
||||
config:
|
||||
audiences:
|
||||
- spire-identity-exchange
|
||||
allowedServiceAccounts:
|
||||
- default/default
|
||||
@@ -0,0 +1 @@
|
||||
SPIRE Identity Exchange installed…
|
||||
@@ -0,0 +1,133 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.namespace" -}}
|
||||
{{- if .Values.namespaceOverride -}}
|
||||
{{- .Values.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-identity-exchange.podMonitor.namespace" -}}
|
||||
{{- if ne (len .Values.telemetry.prometheus.podMonitor.namespace) 0 }}
|
||||
{{- .Values.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else if ne (len (dig "telemetry" "prometheus" "podMonitor" "namespace" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.telemetry.prometheus.podMonitor.namespace }}
|
||||
{{- else }}
|
||||
{{- include "spire-identity-exchange.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.labels" -}}
|
||||
helm.sh/chart: {{ include "spire-identity-exchange.chart" . }}
|
||||
{{ include "spire-identity-exchange.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spire-identity-exchange.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spire-identity-exchange.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spire-identity-exchange.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-identity-exchange.workload-api-socket-path" -}}
|
||||
{{- printf "/spiffe-workload-api/%s" .Values.agentSocketName }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-identity-exchange.podSecurityContext" -}}
|
||||
{{- $podSecurityContext := include "spire-lib.podsecuritycontext" . | fromYaml }}
|
||||
{{- $openshift := ((.Values).global).openshift | default false }}
|
||||
{{- if not $openshift }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsUser") }}
|
||||
{{- $_ := set $podSecurityContext "runAsUser" 1000 }}
|
||||
{{- end }}
|
||||
{{- if not (hasKey $podSecurityContext "runAsGroup") }}
|
||||
{{- $_ := set $podSecurityContext "runAsGroup" 1000 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- toYaml $podSecurityContext }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-identity-exchange.server.namespace" -}}
|
||||
{{- if .Values.server.namespaceOverride -}}
|
||||
{{- .Values.server.namespaceOverride -}}
|
||||
{{- else if and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "namespaceLayout" true .Values.global) }}
|
||||
{{- if ne (len (dig "spire" "namespaces" "server" "name" "" .Values.global)) 0 }}
|
||||
{{- .Values.global.spire.namespaces.server.name }}
|
||||
{{- else }}
|
||||
{{- printf "spire-server" }}
|
||||
{{- end }}
|
||||
{{- else -}}
|
||||
{{- .Release.Namespace -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "spire-identity-exchange.server-address" }}
|
||||
{{- if and (ne (len (dig "spire" "upstreamSpireAddress" "" .Values.global)) 0) .Values.upstream }}
|
||||
{{- print .Values.global.spire.upstreamSpireAddress }}
|
||||
{{- else if .Values.server.address }}
|
||||
{{- .Values.server.address }}
|
||||
{{- else if .Values.server.nameOverride }}
|
||||
{{ .Release.Name }}-{{ .Values.server.nameOverride }}.{{ include "spire-identity-exchange.server.namespace" . }}
|
||||
{{- else }}
|
||||
{{ .Release.Name }}-server.{{ include "spire-identity-exchange.server.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- define "spire-identity-exchange.cert-manager-default-cert" }}
|
||||
{{- $fullName := include "spire-identity-exchange.fullname" . }}
|
||||
dnsNames:
|
||||
{{- if ne (len .Values.tls.certManager.certificate.dnsNames) 0 }}
|
||||
{{- toYaml .Values.tls.certManager.certificate.dnsNames | nindent 4 }}
|
||||
{{- else }}
|
||||
{{- if .Values.rest.enabled }}
|
||||
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.rest.ingress "Values" .Values) }}
|
||||
{{- end }}
|
||||
{{- if .Values.grpc.enabled }}
|
||||
- {{ include "spire-lib.ingress-calculated-name" (dict "ingress" .Values.grpc.ingress "Values" .Values) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
issuerRef:
|
||||
{{- with .Values.tls.certManager.certificate.issuerRef.group }}
|
||||
group: {{ . }}
|
||||
{{- end }}
|
||||
kind: {{ default "Issuer" .Values.tls.certManager.certificate.issuerRef.kind }}
|
||||
name: {{ default $fullName .Values.tls.certManager.certificate.issuerRef.name }}
|
||||
secretName: {{ $fullName }}-cert
|
||||
{{- end }}
|
||||
{{- if .Values.tls.certManager.enabled }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
spec:
|
||||
{{ merge (include "spire-identity-exchange.cert-manager-default-cert" . | fromYaml) .Values.tls.certManager.certificate | toYaml | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,95 @@
|
||||
{{- $tlsCount := 0 }}
|
||||
{{- if .Values.tls.externalSecret.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tls.certManager.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
{{- end }}
|
||||
{{- if ne $tlsCount 1 }}
|
||||
{{- fail "You must have one and only one TLS configuration enabled" }}
|
||||
{{- end }}
|
||||
{{- if lt (len .Values.auth.plugins) 1 }}
|
||||
{{- fail "You must have at least one auth plugin defined" }}
|
||||
{{- end }}
|
||||
{{- if not (or .Values.rest.enabled .Values.grpc.enabled) }}
|
||||
{{- fail "You must have rest and/or grpc enabled" }}
|
||||
{{- end }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
{{- with .Values.configMap.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
six.conf: |
|
||||
name: spire-identity-exchange
|
||||
logLevel: info
|
||||
server:
|
||||
port: 8443
|
||||
restPort: 8444
|
||||
metricsPort: 4950
|
||||
tls:
|
||||
certFile: /secret/tls.crt
|
||||
keyFile: /secret/tls.key
|
||||
spire:
|
||||
agentWorkloadSocketPath: /spiffe-workload-api/spire-agent.sock
|
||||
agentDelegatedSocketPath: /agent/admin.sock
|
||||
trustDomain: {{ $trustDomain }}
|
||||
svidTTL: 1h
|
||||
auth:
|
||||
plugins:
|
||||
{{- toYaml .Values.auth.plugins | nindent 8 }}
|
||||
{{ with .Values.auth.stacks }}
|
||||
stacks:
|
||||
{{- toYaml .Values.auth.stacks | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
six-agent.conf: |
|
||||
agent {
|
||||
log_level = "DEBUG"
|
||||
trust_domain = {{ $trustDomain | quote }}
|
||||
server_address = {{ include "spire-identity-exchange.server-address" . | trim | quote }}
|
||||
server_port = {{ .Values.server.port }}
|
||||
trust_bundle_url = "http://localhost/trustbundle"
|
||||
trust_bundle_unix_socket = "/trustbundle/socket"
|
||||
rebootstrap_mode = "always"
|
||||
rebootstrap_delay = "5m"
|
||||
|
||||
data_dir = "/agent-data"
|
||||
admin_socket_path = "/agent/admin.sock"
|
||||
authorized_delegates = ["spiffe://{{ $trustDomain }}/service/spire-identity-exchange"]
|
||||
}
|
||||
|
||||
health_checks {
|
||||
listener_enabled = true
|
||||
bind_address = "0.0.0.0"
|
||||
bind_port = 8182
|
||||
live_path = "/live"
|
||||
ready_path = "/ready"
|
||||
}
|
||||
|
||||
plugins {
|
||||
KeyManager "memory" {
|
||||
plugin_data {}
|
||||
}
|
||||
|
||||
NodeAttestor "x509pop" {
|
||||
plugin_data {
|
||||
spiffe_endpoint_socket = "unix:///spiffe-workload-api/spire-agent.sock"
|
||||
}
|
||||
}
|
||||
|
||||
WorkloadAttestor "unix" {
|
||||
plugin_data {
|
||||
# Only used for delegated api. Can be removed for the broker api in the future.
|
||||
discover_workload_path = true
|
||||
workload_size_limit = -1
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,199 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
{{- with .Values.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spire-identity-exchange.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ $configSum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.selectorLabels" . | nindent 8 }}
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spire-identity-exchange
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
shareProcessNamespace: true
|
||||
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||
securityContext:
|
||||
{{- include "spire-identity-exchange.podSecurityContext" . | nindent 8 }}
|
||||
initContainers:
|
||||
- name: spire-server-attestor
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.spireServerAttestorSPIFFEWorkloadAPI.resources | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.spireServerAttestorSPIFFEWorkloadAPI.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy }}
|
||||
restartPolicy: Always
|
||||
args:
|
||||
- /trustbundle/socket
|
||||
env:
|
||||
- name: SPIFFE_ENDPOINT_SOCKET
|
||||
value: "unix:///spiffe-workload-api/spire-agent.sock"
|
||||
- name: SPIFFE_TRUST_DOMAIN
|
||||
value: {{ $trustDomain }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /ko-app/spire-server-attestor-spiffe-workload-api
|
||||
- --healthcheck
|
||||
- /trustbundle/socket
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 10
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: trustbundle
|
||||
mountPath: /trustbundle
|
||||
- name: spire-agent
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.spireAgent.resources | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spireAgent.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spireAgent.image.pullPolicy }}
|
||||
restartPolicy: Always
|
||||
args:
|
||||
- -config
|
||||
- /etc/spire/agent/six-agent.conf
|
||||
- -socketPath
|
||||
- /agent-data/api.sock
|
||||
ports:
|
||||
- containerPort: 8182
|
||||
name: healthz
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /live
|
||||
port: healthz
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: healthz
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: spire-identity-exchange-config
|
||||
mountPath: /etc/spire/agent/six-agent.conf
|
||||
subPath: six-agent.conf
|
||||
readOnly: true
|
||||
- name: spire-agent-socket
|
||||
mountPath: /agent
|
||||
- name: trustbundle
|
||||
mountPath: /trustbundle
|
||||
readOnly: true
|
||||
- name: spire-agent-data
|
||||
mountPath: /agent-data
|
||||
containers:
|
||||
- name: spire-identity-exchange
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
- -config
|
||||
- /etc/spire/identity-exchange/six.conf
|
||||
- -expand-env
|
||||
{{- with .Values.extraEnv }}
|
||||
env:
|
||||
{{- . | toYaml | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- if .Values.rest.enabled }}
|
||||
- containerPort: 8444
|
||||
name: rest
|
||||
{{- end }}
|
||||
{{- if .Values.grpc.enabled }}
|
||||
- containerPort: 8443
|
||||
name: grpc
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: {{ include "spire-identity-exchange.workload-api-socket-path" . | dir }}
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
mountPath: /secret
|
||||
readOnly: true
|
||||
- name: spire-identity-exchange-config
|
||||
mountPath: /etc/spire/identity-exchange/six.conf
|
||||
subPath: six.conf
|
||||
readOnly: true
|
||||
- name: spire-agent-socket
|
||||
mountPath: /agent
|
||||
readOnly: true
|
||||
#readinessProbe:
|
||||
# httpGet:
|
||||
# path: /ready
|
||||
# port: healthz
|
||||
# {- toYaml .Values.readinessProbe | nindent 12 }}
|
||||
#livenessProbe:
|
||||
# httpGet:
|
||||
# path: /live
|
||||
# port: healthz
|
||||
# {- toYaml .Values.livenessProbe | nindent 12 }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "{{ .Values.csiDriverName }}"
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
{{- if .Values.tls.externalSecret.enabled }}
|
||||
secret:
|
||||
secretName: {{ .Values.tls.externalSecret.secretName }}
|
||||
{{- else if .Values.tls.certManager.enabled }}
|
||||
secret:
|
||||
secretName: {{ include "spire-identity-exchange.fullname" . }}-cert
|
||||
{{- end }}
|
||||
- name: spire-agent-socket
|
||||
emptyDir: {}
|
||||
- name: spire-agent-data
|
||||
emptyDir: {}
|
||||
- name: trustbundle
|
||||
emptyDir: {}
|
||||
- name: spire-identity-exchange-config
|
||||
configMap:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.grpc.ingress.enabled -}}
|
||||
{{- $port := .Values.grpc.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.grpc.ingress) }}
|
||||
{{- $fullName := printf "%s-grpc" (include "spire-identity-exchange.fullname" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.grpc.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not (and .Values.grpc.ingress.enabled .Values.grpc.ingress.tlsSecret) }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if and .Values.grpc.ingress.enabled .Values.grpc.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.grpc.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if .Values.grpc.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-grpc
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.grpc.service.type }}
|
||||
{{- if and (eq .Values.grpc.service.type "LoadBalancer") .Values.grpc.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.grpc.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.grpc.service.port }}
|
||||
targetPort: grpc
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "spire-identity-exchange.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,33 @@
|
||||
{{- if .Values.autoscaling.enabled }}
|
||||
apiVersion: {{ include "spire-lib.autoscalingVersion" . }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
minReplicas: {{ .Values.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- define "spire-identity-exchange.cert-manager-default-issuer" }}
|
||||
{{- if not .Values.tls.certManager.issuer.acme.email }}
|
||||
{{- fail "You must specify an email address via certManager.issuer.acme.email" }}
|
||||
{{- end }}
|
||||
email: {{ .Values.tls.certManager.issuer.acme.email | quote}}
|
||||
server: {{ .Values.tls.certManager.issuer.acme.server | quote}}
|
||||
privateKeySecretRef:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-issuer
|
||||
solvers:
|
||||
- http01:
|
||||
ingress: {}
|
||||
{{- end }}
|
||||
{{- if and .Values.tls.certManager.enabled .Values.tls.certManager.issuer.create }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
spec:
|
||||
acme:
|
||||
{{ mergeOverwrite (include "spire-identity-exchange.cert-manager-default-issuer" . | fromYaml) .Values.tls.certManager.issuer.acme | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,83 @@
|
||||
{{- if eq ((dig "deleteHooks" "enabled" .Values.deleteHook.enabled .Values.global) | toString) "true" }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
resourceNames: [{{ include "spire-identity-exchange.fullname" . | quote }}]
|
||||
verbs: ["get", "delete"]
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
annotations:
|
||||
"helm.sh/hook": pre-delete
|
||||
"helm.sh/hook-delete-policy": before-hook-creation, hook-succeeded, hook-failed
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-pre-delete
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
{{- with (coalesce .Values.imagePullSecrets .Values.global.imagePullSecrets) }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spire-identity-exchange.serviceAccountName" . }}-pre-delete
|
||||
securityContext:
|
||||
{{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
|
||||
containers:
|
||||
- name: pre-delete-job
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 10 }}
|
||||
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tools.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||
args:
|
||||
- delete
|
||||
- -n
|
||||
- {{ include "spire-identity-exchange.namespace" . }}
|
||||
- deployment
|
||||
- {{ include "spire-identity-exchange.fullname" . }}
|
||||
- --wait
|
||||
{{- with (((.Values).global).deleteHooks).resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- if .Values.rest.ingress.enabled -}}
|
||||
{{- $port := .Values.rest.service.port }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.rest.ingress) }}
|
||||
{{- $fullName := printf "%s-rest" (include "spire-identity-exchange.fullname" .) }}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.rest.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not (and .Values.rest.ingress.enabled .Values.rest.ingress.tlsSecret) }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if and .Values.rest.ingress.enabled .Values.rest.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- end }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{ include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.rest.ingress "svcName" $fullName "port" $port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,23 @@
|
||||
{{- if .Values.rest.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.fullname" . }}-rest
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
{{- with .Values.rest.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.rest.service.type }}
|
||||
{{- if and (eq .Values.rest.service.type "LoadBalancer") .Values.rest.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.rest.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: {{ .Values.rest.service.port }}
|
||||
targetPort: rest
|
||||
protocol: TCP
|
||||
selector:
|
||||
{{- include "spire-identity-exchange.selectorLabels" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if .Values.clusterRole.create -}}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||
rules:
|
||||
- apiGroups: ["authentication.k8s.io"]
|
||||
resources: ["tokenreviews"]
|
||||
verbs: ["create"]
|
||||
- nonResourceURLs:
|
||||
- /.well-known/openid-configuration
|
||||
- /openid/v1/jwks
|
||||
verbs: ["get"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ .Release.Namespace}}-{{ include "spire-identity-exchange.fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spire-identity-exchange.serviceAccountName" . }}
|
||||
namespace: {{ include "spire-identity-exchange.namespace" . }}
|
||||
labels:
|
||||
{{- include "spire-identity-exchange.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,359 @@
|
||||
# Default configuration for SPIRE Identity Exchange chart
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
## @skip global
|
||||
global: {}
|
||||
|
||||
## @section Chart parameters
|
||||
##
|
||||
## @param agentSocketName The name of the spire-agent unix socket
|
||||
agentSocketName: spire-agent.sock
|
||||
## @param csiDriverName The csi driver to use
|
||||
csiDriverName: csi.spiffe.io
|
||||
|
||||
## @param replicaCount Replica count
|
||||
replicaCount: 1
|
||||
|
||||
## @param namespaceOverride Namespace override
|
||||
namespaceOverride: ""
|
||||
|
||||
## @param annotations [object] Annotations for the deployment
|
||||
annotations: {}
|
||||
|
||||
## @param labels [object] Labels for the deployment
|
||||
labels: {}
|
||||
# if you configured your controller manager to register pods based on labels, you need to add these labels here too
|
||||
# For instance:
|
||||
# spiffe.io/spiffe-id: "true"
|
||||
|
||||
image:
|
||||
## @param image.registry The OCI registry to pull the image from
|
||||
## @param image.repository The repository within the registry
|
||||
## @param image.pullPolicy The image pull policy
|
||||
## @param image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-identity-exchange-server
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
spireServerAttestorSPIFFEWorkloadAPI:
|
||||
## @param spireServerAttestorSPIFFEWorkloadAPI.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
image:
|
||||
## @param spireServerAttestorSPIFFEWorkloadAPI.image.registry The OCI registry to pull the image from
|
||||
## @param spireServerAttestorSPIFFEWorkloadAPI.image.repository The repository within the registry
|
||||
## @param spireServerAttestorSPIFFEWorkloadAPI.image.pullPolicy The image pull policy
|
||||
## @param spireServerAttestorSPIFFEWorkloadAPI.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-server-attestor-spiffe-workload-api
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
spireAgent:
|
||||
## @param spireAgent.resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
image:
|
||||
## @param spireAgent.image.registry The OCI registry to pull the image from
|
||||
## @param spireAgent.image.repository The repository within the registry
|
||||
## @param spireAgent.image.pullPolicy The image pull policy
|
||||
## @param spireAgent.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-agent
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "1.15.1"
|
||||
|
||||
## @param extraEnv [array] Extra environment variables to add to the spire identity exchange
|
||||
extraEnv: []
|
||||
|
||||
## @param resources [object] Resource requests and limits
|
||||
resources: {}
|
||||
# We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# choice for the user. This also increases chances charts run on environments with little
|
||||
# resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# requests:
|
||||
# cpu: 50m
|
||||
# memory: 32Mi
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
configMap:
|
||||
## @param configMap.annotations [object] Annotations to add to the SPIRE Identity Exchange ConfigMap
|
||||
annotations: {}
|
||||
|
||||
## @param podSecurityContext [object] Pod security context for SPIRE Identity Exchange pods
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Security context for SPIRE Identity Exchange deployment
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe
|
||||
## @param readinessProbe.periodSeconds Period seconds for readinessProbe
|
||||
##
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
|
||||
## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe
|
||||
## @param livenessProbe.periodSeconds Period seconds for livenessProbe
|
||||
##
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
|
||||
## @param podAnnotations [object] Pod annotations for SPIRE Identity Exchange
|
||||
podAnnotations: {}
|
||||
|
||||
## @param podLabels [object] Labels to add to pods
|
||||
podLabels: {}
|
||||
|
||||
# Select one of the options below to be the source of certificates for SPIRE Identity Exchange
|
||||
tls:
|
||||
|
||||
externalSecret:
|
||||
## @param tls.externalSecret.enabled Provide your own certificate/key via tls style Kubernetes Secret
|
||||
enabled: false
|
||||
## @param tls.externalSecret.secretName Specify which Secret to use
|
||||
secretName: ""
|
||||
|
||||
certManager:
|
||||
## @param tls.certManager.enabled Use certificateManager to create the certificate
|
||||
enabled: false
|
||||
issuer:
|
||||
## @param tls.certManager.issuer.create Create an issuer to use to issue the certificate
|
||||
create: true
|
||||
acme:
|
||||
## @param tls.certManager.issuer.acme.email Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service
|
||||
email: ""
|
||||
## @param tls.certManager.issuer.acme.server Server to use to get certificate. Defaults to LetsEncrypt
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
# Testing server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
## @param tls.certManager.issuer.acme.solvers [object] Configure the issuer solvers. Defaults to http01 via ingress.
|
||||
solvers: {}
|
||||
# - http01:
|
||||
# ingress:
|
||||
# ingressClassName: nginx
|
||||
certificate:
|
||||
## @param tls.certManager.certificate.dnsNames Override the dnsNames on the certificate request. Defaults to the same settings as Ingress
|
||||
dnsNames: []
|
||||
## @param tls.certManager.certificate.issuerRef.group If you are using an external plugin, specify the group for it here
|
||||
## @param tls.certManager.certificate.issuerRef.kind Kind of the issuer reference. Override if you want to use a ClusterIssuer
|
||||
## @param tls.certManager.certificate.issuerRef.name Name of the issuer to use. If unset, it will use the name of the built in issuer
|
||||
issuerRef:
|
||||
group: ""
|
||||
kind: Issuer
|
||||
name: ""
|
||||
|
||||
config:
|
||||
## @param config.logLevel The log level, valid values are "debug", "info", "warn", and "error"
|
||||
logLevel: info
|
||||
## @param config.logFormat The log format, valid values are "text" and "json"
|
||||
logFormat: text
|
||||
|
||||
## @param imagePullSecrets [array] Image pull secret names
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param fullnameOverride Full name override
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
## @param serviceAccount.annotations Annotations to add to the service account
|
||||
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||
##
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name: ""
|
||||
|
||||
deleteHook:
|
||||
## @param deleteHook.enabled Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`)
|
||||
enabled: true
|
||||
|
||||
## @param autoscaling.enabled Flag to enable autoscaling
|
||||
## @param autoscaling.minReplicas Minimum replicas for autoscaling
|
||||
## @param autoscaling.maxReplicas Maximum replicas for autoscaling
|
||||
## @param autoscaling.targetCPUUtilizationPercentage Target CPU utlization that triggers autoscaling
|
||||
## @param autoscaling.targetMemoryUtilizationPercentage Target Memory utlization that triggers autoscaling
|
||||
##
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 5
|
||||
targetCPUUtilizationPercentage: 80
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
## @param nodeSelector [object] Node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param tolerations [array] iist of tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param affinity [object] Node affinity
|
||||
affinity: {}
|
||||
|
||||
## @param trustDomain Set the trust domain to be used for the SPIFFE identifiers
|
||||
trustDomain: example.org
|
||||
|
||||
## @param clusterDomain The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`)
|
||||
clusterDomain: cluster.local
|
||||
|
||||
auth:
|
||||
## @param auth.plugins [object] Plugins to load
|
||||
plugins: []
|
||||
## @param auth.stacks [object] Stacks to load
|
||||
stacks: []
|
||||
|
||||
rest:
|
||||
## @param rest.enabled Enable the rest service
|
||||
enabled: true
|
||||
## @param rest.service.type Service type
|
||||
## @param rest.service.port port for the service
|
||||
## @param rest.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-rest.example.org
|
||||
## @param rest.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param rest.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param rest.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param rest.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param rest.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
## @param rest.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-identity-exchange-rest"
|
||||
|
||||
## @param rest.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param rest.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-identity-exchange-rest.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param rest.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - spire-identity-exchange-rest.example.org
|
||||
|
||||
grpc:
|
||||
## @param grpc.enabled Enable the grpc service
|
||||
enabled: false
|
||||
## @param grpc.service.type Service type
|
||||
## @param grpc.service.port port for the service
|
||||
## @param grpc.service.annotations Annotations for service resource
|
||||
##
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
annotations: {}
|
||||
# external-dns.alpha.kubernetes.io/hostname: spire-identity-exchange-grpc.example.org
|
||||
## @param grpc.service.loadBalancerIP IP address to assign to load balancer (if supported)
|
||||
loadBalancerIP: ""
|
||||
ingress:
|
||||
## @param grpc.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param grpc.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param grpc.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param grpc.ingress.annotations [object] Annotations for ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
||||
## @param grpc.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spire-identity-exchange-grpc"
|
||||
|
||||
## @param grpc.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param grpc.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spire-identity-exchange-grpc.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param grpc.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - secretName: chart-example-tls
|
||||
# hosts:
|
||||
# - spire-identiy-exchange-grpc.example.org
|
||||
|
||||
tools:
|
||||
kubectl:
|
||||
## @param tools.kubectl.image.registry The OCI registry to pull the image from
|
||||
## @param tools.kubectl.image.repository The repository within the registry
|
||||
## @param tools.kubectl.image.pullPolicy The image pull policy
|
||||
## @param tools.kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: registry.k8s.io
|
||||
repository: kubectl
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
clusterRole:
|
||||
## @param clusterRole.create create a k8s cluster role to allow access to token reviews and oidc discovery
|
||||
create: true
|
||||
|
||||
## @param server.address Address for Spire server
|
||||
## @param server.port Port number for Spire server
|
||||
## @param server.namespaceOverride Override the namespace for Spire server
|
||||
## @param server.nameOverride Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align.
|
||||
##
|
||||
server:
|
||||
address: ""
|
||||
port: 443
|
||||
namespaceOverride: ""
|
||||
nameOverride: ""
|
||||
@@ -56,6 +56,9 @@ dependencies:
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
- name: spire-server
|
||||
repository: file://../spire/charts/spire-server
|
||||
version: 0.1.0
|
||||
@@ -68,5 +71,8 @@ dependencies:
|
||||
- name: spiffe-csi-driver
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
digest: sha256:31c9c0410c08f27c65d38dc78967699b65ed289aa9064b7167673abfe6d219d6
|
||||
generated: "2026-06-06T08:13:06.564494-07:00"
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
digest: sha256:418e807bf7ff9504d000e3d1bc581faf83c91e0792e05ec7c11aaaa2cb54caf4
|
||||
generated: "2026-06-30T07:46:43.45713065-07:00"
|
||||
|
||||
@@ -153,6 +153,13 @@ dependencies:
|
||||
- bottomTurtleHAA
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
alias: spire-identity-exchange-bottom-turtle-ha-a
|
||||
condition: spire-identity-exchange-bottom-turtle-ha-a.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
tags:
|
||||
- bottomTurtleHAA
|
||||
- name: spire-server
|
||||
alias: internal-spire-server-bottom-turtle-ha-b
|
||||
condition: internal-spire-server-bottom-turtle-ha-b.enabled
|
||||
@@ -181,6 +188,13 @@ dependencies:
|
||||
- bottomTurtleHAB
|
||||
repository: file://../spire/charts/spiffe-csi-driver
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
alias: spire-identity-exchange-bottom-turtle-ha-b
|
||||
condition: spire-identity-exchange-bottom-turtle-ha-b.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
tags:
|
||||
- bottomTurtleHAB
|
||||
annotations:
|
||||
artifacthub.io/category: security
|
||||
artifacthub.io/license: Apache-2.0
|
||||
|
||||
@@ -398,12 +398,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-a.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-a.csi.spiffe.io` |
|
||||
@@ -430,12 +431,13 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.autoPopulateDNSNames` | Auto populate dns entries | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.type` | The type of the entry | `oidc-discovery-provider-common` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enables the spire-ha-agent identity | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith` | List of trust domains to federate with | `[]` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.persistence.type` | What type to use for peristence | `emptyDir` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.k8sPSAT.enabled` | Enable the k8s projected access token node attestor | `false` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled` | Enable the x509 pop node attestor | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the spiffePrefix | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.enabled` | Enable upstream SPIRE server | `true` |
|
||||
| `internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.upstreamDriver` | Use an upstream driver for authentication | `upstream-b.csi.spiffe.io` |
|
||||
@@ -491,3 +493,15 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.agentSocketPath` | path to agent socket | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.pluginName` | The name of the plugin instance | `b.csi.spiffe.io` |
|
||||
| `downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port` | The health check port | `9816` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.csiDriverName` | CSI driver name to use | `a.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-a-grpc` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.enabled` | Enable the spire-identity-exchange | `false` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.nameOverride` | name override | `identity-exchange` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.csiDriverName` | CSI driver name to use | `b.csi.spiffe.io` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride` | The name override setting of the internal SPIRE server | `internal-server` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-rest` |
|
||||
| `spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host` | Hostname override for the rest ingress service | `spire-identity-exchange-b-grpc` |
|
||||
|
||||
@@ -497,6 +497,10 @@ internal-spire-server-bottom-turtle-ha-a:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -507,13 +511,13 @@ internal-spire-server-bottom-turtle-ha-a:
|
||||
x509POP:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||
enabled: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange/k8s
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
||||
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||
addClusterName:
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||
spiffePrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-a.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: true
|
||||
upstreamAuthority:
|
||||
@@ -575,6 +579,10 @@ internal-spire-server-bottom-turtle-ha-b:
|
||||
spire-ha-agent:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled Enables the spire-ha-agent identity
|
||||
enabled: true
|
||||
spire-identity-exchange-service:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.controllerManager.identities.spire-identity-exchange-service.federatesWith [array] List of trust domains to federate with
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
persistence:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.persistence.type What type to use for peristence
|
||||
type: emptyDir
|
||||
@@ -585,13 +593,13 @@ internal-spire-server-bottom-turtle-ha-b:
|
||||
x509POP:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.enabled Enable the x509 pop node attestor
|
||||
enabled: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange/k8s
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: /spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: "/{{ .PluginName }}/{{ .SVIDPathTrimmed }}/k8s"
|
||||
agentPathTemplate: "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}"
|
||||
addClusterName:
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the spiffePrefix
|
||||
spiffePrefix: true
|
||||
## @param internal-spire-server-bottom-turtle-ha-b.nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: true
|
||||
upstreamAuthority:
|
||||
@@ -755,3 +763,41 @@ downstream-spiffe-csi-driver-bottom-turtle-ha-b:
|
||||
healthChecks:
|
||||
## @param downstream-spiffe-csi-driver-bottom-turtle-ha-b.healthChecks.port The health check port
|
||||
port: 9816
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-a:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.enabled Enable the spire-identity-exchange
|
||||
enabled: false
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.nameOverride name override
|
||||
nameOverride: identity-exchange
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.csiDriverName CSI driver name to use
|
||||
csiDriverName: a.csi.spiffe.io
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-a-grpc"
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-a.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-b:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.enabled Enable the spire-identity-exchange
|
||||
enabled: false
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.nameOverride name override
|
||||
nameOverride: identity-exchange
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.csiDriverName CSI driver name to use
|
||||
csiDriverName: b.csi.spiffe.io
|
||||
server:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.server.nameOverride The name override setting of the internal SPIRE server
|
||||
nameOverride: internal-server
|
||||
rest:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.rest.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-rest"
|
||||
grpc:
|
||||
ingress:
|
||||
## @param spire-identity-exchange-bottom-turtle-ha-b.grpc.ingress.host Hostname override for the rest ingress service
|
||||
host: "spire-identity-exchange-b-grpc"
|
||||
|
||||
@@ -32,5 +32,8 @@ dependencies:
|
||||
- name: spike-pilot
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
digest: sha256:c93438bb4c5317a25ffef1ce93dbd6c9dbd07295e101377e9a2bb8320ee14622
|
||||
generated: "2026-06-06T08:13:02.92098-07:00"
|
||||
- name: spire-identity-exchange
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
digest: sha256:38b85a4bf147cc86a432ac32dfd3473e27efc6b6a3c1563340444bbe049a4746
|
||||
generated: "2026-06-27T10:53:07.840372246-07:00"
|
||||
|
||||
@@ -68,6 +68,10 @@ dependencies:
|
||||
condition: spike-pilot.enabled
|
||||
repository: file://./charts/spike-pilot
|
||||
version: 0.1.0
|
||||
- name: spire-identity-exchange
|
||||
condition: spire-identity-exchange.enabled
|
||||
repository: file://../spire-identity-exchange
|
||||
version: 0.1.0
|
||||
annotations:
|
||||
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
|
||||
artifacthub.io/category: security
|
||||
|
||||
@@ -79,6 +79,12 @@ kubectl delete crds clusterfederatedtrustdomains.spire.spiffe.io clusterspiffeid
|
||||
|
||||
We only support upgrading one major/minor version at a time. Version skipping isn't supported. Please see <https://spiffe.io/docs/latest/spire-helm-charts-hardened-about/upgrading/> for details.
|
||||
|
||||
### 0.31.X
|
||||
|
||||
- The x509POP plugin in spiffe mode has had its defaults changed. It allows easier and more secure setups. If using and upgrading, please review the settings.
|
||||
- To add the spike entries, you now must also specify spire-server.spike.enabled=true.
|
||||
- Experimental support for the spire-identity-exchange has been added.
|
||||
|
||||
### 0.30.X
|
||||
|
||||
- The OIDC discovery issuer is now set automatically. We do not anticipate any negative impact; however, please verify your OIDC provider's integration with other services during your upgrade testing.
|
||||
@@ -390,5 +396,7 @@ Now you can interact with the Spire agent socket from your own application. The
|
||||
### SPIKE Pilot parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| --------------------- | ------------------------------------------------------ | ------- |
|
||||
| -------------------------------------- | ---------------------------------------------------------------------- | ------------------- |
|
||||
| `spike-pilot.enabled` | Enables deployment of SPIKE Pilot (Not for production) | `false` |
|
||||
| `spire-identity-exchange.enabled` | Enables deployment of the SPIRE Identity Exchange (Not for production) | `false` |
|
||||
| `spire-identity-exchange.nameOverride` | Overrides the name of the SPIRE Identity Exchnage | `identity-exchange` |
|
||||
|
||||
@@ -231,7 +231,7 @@ nodeAttestor:
|
||||
|
||||
# workloadAttestors determine a workload's properties and then generate a set of selectors associated with it.
|
||||
workloadAttestors:
|
||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||
# unix is a workload attestor which generates unix-based selectors like 'uid' and 'gid'.
|
||||
unix:
|
||||
## @param workloadAttestors.unix.enabled Enables the Unix workload attestor
|
||||
enabled: false
|
||||
|
||||
@@ -80,7 +80,7 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
### Chart parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| -------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
||||
| ------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
|
||||
| `replicaCount` | SPIRE server currently runs with a sqlite database. Scaling to multiple instances will not work until we use an external database. | `1` |
|
||||
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `image.repository` | The repository within the registry | `spiffe/spire-server` |
|
||||
@@ -203,6 +203,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `credentialComposer.cel.pluginPath` | The filename in the container of the plugin | `/ko-app/cmd` |
|
||||
| `credentialComposer.cel.jwt.expression` | The expression to use for jwt token composing | `""` |
|
||||
| `credentialComposer.uniqueID.enabled` | Add the x509UniqueIdentifier attribute to workload X509-SVIDs | `false` |
|
||||
| `credentialComposer.spireIdentityExchange.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
||||
| `credentialComposer.spireIdentityExchange.image.repository` | The repository within the registry | `spiffe/spire-credentialcomposer-identity-exchange` |
|
||||
| `credentialComposer.spireIdentityExchange.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `credentialComposer.spireIdentityExchange.image.tag` | Overrides the image tag | `v0.2.0` |
|
||||
| `credentialComposer.spireIdentityExchange.checksum` | The sha256 checksum of the plugin binary | `198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036` |
|
||||
| `credentialComposer.spireIdentityExchange.pluginPath` | The filename in the container of the plugin | `/ko-app/spire-credentialcomposer-identity-exchange` |
|
||||
| `credentialComposer.spireIdentityExchange.prefix` | The prefix to operate on | `""` |
|
||||
| `keyManager.disk.enabled` | Flag to enable keyManager on disk | `true` |
|
||||
| `keyManager.memory.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
| `keyManager.awsKMS.enabled` | Flag to enable keyManager in memory | `false` |
|
||||
@@ -338,23 +345,28 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.oidc-discovery-provider.dnsNameTemplates` | DNS name template for issued identities | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.test-keys.type` | The type of rule this is. | `test-keys` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type` | The type of rule this is. | `spike-keeper` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type` | The type of rule this is. | `spike-nexus` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type` | The type of rule this is. | `spike-bootstrap` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled` | Enable this identity for controller manager | `true` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type` | The type of rule this is. | `spike-pilot` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spike/pilot/role/superuser` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.enabled` | Enable this identity for controller manager | `false` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.type` | The type of rule this is. | `spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-ha-agent.federatesWith` | Federated trust domains to pass to the workload | `["spire-ha"]` |
|
||||
| `controllerManager.identities.clusterStaticEntries` | Specify ClusterStaticEntry objects. | `{}` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate` | The template to use for this rule. | `spiffe://{{ .TrustDomain }}/service/spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type` | The type of rule this is. | `spire-identity-exchange` |
|
||||
| `controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates` | Workload selectors. | `[]` |
|
||||
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange` | Settings for the spire-identity-exchnage | `{}` |
|
||||
| `controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors` | selector | `[]` |
|
||||
| `controllerManager.identities.clusterFederatedTrustDomains` | Specify ClusterFederatedTrustDomain objects. | `{}` |
|
||||
| `controllerManager.validatingWebhookConfiguration.enabled` | Disable only when you have another chart instance on the k8s cluster with webhooks enabled. | `true` |
|
||||
| `controllerManager.validatingWebhookConfiguration.failurePolicy` | Action when identity is not issued | `Fail` |
|
||||
@@ -459,12 +471,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.gcpIIT.agentPathTemplate` | A URL path portion format of Agent's SPIFFE ID. Describe in text/template format. | `""` |
|
||||
| `nodeAttestor.x509POP.enabled` | Enable the x509_popg node attestor | `false` |
|
||||
| `nodeAttestor.x509POP.mode` | What mode to set the plugin to. Currently only spiffe mode is supported | `spiffe` |
|
||||
| `nodeAttestor.x509POP.svidPrefix` | What prefix to use when mode is spiffe | `/spire-exchange` |
|
||||
| `nodeAttestor.x509POP.spiffePrefix` | What prefix to use when mode is spiffe | `/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/` |
|
||||
| `nodeAttestor.x509POP.agentPathTemplate` | Override the default agent path template | `""` |
|
||||
| `nodeAttestor.x509POP.maxIntermediates` | Maximum number of intermediate certificates allowed in the certificate chain | `4` |
|
||||
| `nodeAttestor.x509POP.maxRSAKeySize` | Maximum RSA key size in bits allowed in certificates | `8192` |
|
||||
| `nodeAttestor.x509POP.addClusterName.svidPrefix` | Suffix the cluster name onto the svidPrefix | `false` |
|
||||
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `false` |
|
||||
| `nodeAttestor.x509POP.addClusterName.spiffePrefix` | Suffix the cluster name onto the svidPrefix | `true` |
|
||||
| `nodeAttestor.x509POP.addClusterName.agentPathTemplate` | Suffix the cluster name onto the agentPathTemplate | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.enabled` | Enable local k8s bundle uploader | `true` |
|
||||
| `bundlePublisher.k8sConfigMap.namespace` | Namespace to push the bundle into, if blank will default to SPIRE Server namespace | `""` |
|
||||
| `bundlePublisher.k8sConfigMap.format` | Format of the trust bundle. Can be pem or spiffe | `spiffe` |
|
||||
@@ -578,3 +590,5 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||
| `tests.bash.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
|
||||
| `kubeConfigs` | Manage additional kubeconfig files to talk to external Kubernetes clusters | `{}` |
|
||||
| `spireIdentityExchange.enabled` | Enable the server side of the SPIRE Identity Exchange system | `false` |
|
||||
| `spike.enabled` | Enable the server side of SPIKE | `false` |
|
||||
|
||||
@@ -415,3 +415,11 @@ subjects:
|
||||
{{- end }}
|
||||
{{- toYaml $podSecurityContext }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "spire-server.identity-exchange-spiffe-prefix" -}}
|
||||
{{- $cn := "" }}
|
||||
{{- if .Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" .) }}
|
||||
{{- end }}
|
||||
{{- replace "${HELM_ADD_CLUSTER_NAME}" $cn .Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||
{{- end }}
|
||||
|
||||
@@ -131,7 +131,7 @@ server:
|
||||
{{- end }}
|
||||
|
||||
plugins:
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled }}
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled }}
|
||||
CredentialComposer:
|
||||
{{- if or .Values.credentialComposer.uniqueID.enabled }}
|
||||
uniqueid: {}
|
||||
@@ -139,13 +139,34 @@ plugins:
|
||||
{{- with .Values.credentialComposer.cel }}
|
||||
{{- if .enabled }}
|
||||
cel:
|
||||
plugin_cmd: "/cel/credentialcomposer-cel"
|
||||
plugin_cmd: "/plugins/credentialcomposer-cel"
|
||||
plugin_checksum: {{ .checksum }}
|
||||
plugin_data:
|
||||
jwt:
|
||||
expression_string: {{ .jwt.expression | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.credentialComposer.spireIdentityExchange }}
|
||||
{{- if $root.Values.spireIdentityExchange.enabled }}
|
||||
identityexchange:
|
||||
plugin_cmd: "/plugins/credentialcomposer-identity-exchange"
|
||||
plugin_checksum: {{ .checksum }}
|
||||
plugin_data:
|
||||
{{- $spiffePrefix := $root.Values.nodeAttestor.x509POP.spiffePrefix }}
|
||||
{{- if not (hasSuffix "/" $spiffePrefix) }}
|
||||
{{- $spiffePrefix = printf "%s/" $spiffePrefix }}
|
||||
{{- end }}
|
||||
{{- if eq .prefix "" }}
|
||||
{{- if $root.Values.nodeAttestor.x509POP.addClusterName.spiffePrefix }}
|
||||
prefix: {{ printf "%s%s/spire-identity-exchange/" $spiffePrefix (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- else }}
|
||||
prefix: {{ printf "%s/spire-identity-exchange/" $spiffePrefix | quote }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
prefix: {{ .prefix | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
DataStore:
|
||||
@@ -176,7 +197,7 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled }}
|
||||
{{- if or .Values.nodeAttestor.k8sPSAT.enabled .Values.nodeAttestor.externalK8sPSAT.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.httpChallenge.enabled .Values.nodeAttestor.tpmDirect.enabled .Values.nodeAttestor.awsIID.enabled .Values.nodeAttestor.gcpIIT.enabled .Values.nodeAttestor.x509POP.enabled .Values.spireIdentityExchange.enabled }}
|
||||
NodeAttestor:
|
||||
{{- $clusters := default .Values.kubeConfigs .Values.nodeAttestor.externalK8sPSAT.clusters }}
|
||||
{{- if or (eq (.Values.nodeAttestor.k8sPSAT.enabled | toString) "true") (and (eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true") (gt (len $clusters) 0)) }}
|
||||
@@ -257,24 +278,26 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.x509POP }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- if or (eq (.enabled | toString) "true") $root.Values.spireIdentityExchange.enabled }}
|
||||
x509pop:
|
||||
plugin_data:
|
||||
mode: {{ .mode }}
|
||||
{{- if .addClusterName.svidPrefix }}
|
||||
svid_prefix: {{ printf "%s/%s" .svidPrefix (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- else }}
|
||||
svid_prefix: {{ .svidPrefix | quote }}
|
||||
{{- end }}
|
||||
spiffe_prefix: {{ include "spire-server.identity-exchange-spiffe-prefix" $root | quote }}
|
||||
max_intermediates: {{ .maxIntermediates }}
|
||||
max_rsa_key_size: {{ .maxRSAKeySize }}
|
||||
{{- if ne .agentPathTemplate "" }}
|
||||
{{- if .addClusterName.agentPathTemplate }}
|
||||
agent_path_template: {{ printf "%s/%s" .agentPathTemplate (include "spire-lib.cluster-name" $root) | quote }}
|
||||
{{- $cn := "" }}
|
||||
{{- $agentPathTemplate := .agentPathTemplate }}
|
||||
{{- if (eq $agentPathTemplate "") }}
|
||||
{{- if eq .mode "spiffe" }}
|
||||
{{- $agentPathTemplate = "/{{ .PluginName }}/k8s${HELM_ADD_CLUSTER_NAME}/{{ .SVIDPathTrimmed }}" }}
|
||||
{{- else }}
|
||||
agent_path_template: {{ .agentPathTemplate | quote }}
|
||||
{{- $agentPathTemplate = "/{{ .PluginName }}/{{ .Fingerprint }}" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .addClusterName.agentPathTemplate }}
|
||||
{{- $cn = printf "/%s" (include "spire-lib.cluster-name" $root) }}
|
||||
{{- end }}
|
||||
agent_path_template: {{ replace "${HELM_ADD_CLUSTER_NAME}" $cn $agentPathTemplate | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeAttestor.awsIID }}
|
||||
|
||||
@@ -20,6 +20,11 @@ matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: oidc-discovery-provider
|
||||
{{- else if eq .type "spire-identity-exchange" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
release-namespace: {{ .Release.Namespace }}
|
||||
component: spire-identity-exchange
|
||||
{{- else if eq .type "spike-keeper" }}
|
||||
matchLabels:
|
||||
release: {{ .Release.Name }}
|
||||
@@ -62,10 +67,22 @@ matchLabels:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process := true }}
|
||||
{{- if not (hasKey $value "enabled") }}
|
||||
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- else if and (hasPrefix "spike" $key) (not $root.Values.spike.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $process }}
|
||||
{{- $type := dig "type" "base" $value }}
|
||||
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, test-keys]" $type) }}
|
||||
{{- if not (has $type (list "base" "raw" "spire-ha-agent" "child-servers" "oidc-discovery-provider" "oidc-discovery-provider-common" "spike-keeper" "spike-nexus" "spike-bootstrap" "spike-pilot" "spire-identity-exchange" "test-keys")) }}
|
||||
{{- fail (printf "Type given: %s, must be one of [base, raw, spire-ha-agent, child-servers, oidc-discovery-provider, oidc-discovery-provider-common, spike-keeper, spike-nexus, spike-bootstrap, spike-pilot, spire-identity-exchange, test-keys]" $type) }}
|
||||
{{- end }}
|
||||
{{- $namespaceSelector := deepCopy (dig "namespaceSelector" (dict) $value) }}
|
||||
{{- if ne $type "raw" }}
|
||||
@@ -99,6 +116,9 @@ spec:
|
||||
{{- end }}
|
||||
{{- if and (hasKey $value "spiffeIDTemplate") (ne (len $value.spiffeIDTemplate) 0) }}
|
||||
spiffeIDTemplate: {{ $value.spiffeIDTemplate | quote }}
|
||||
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root }}
|
||||
spiffeIDTemplate: "spiffe://{{ `{{ .TrustDomain }}` }}{{ $iePrefix }}spire-identity-exchange/{{ `{{ .PodMeta.Name }}` }}"
|
||||
{{- else }}
|
||||
spiffeIDTemplate: {{ $root.Values.controllerManager.identities.clusterSPIFFEIDs.default.spiffeIDTemplate | quote }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,5 +1,6 @@
|
||||
{{- define "spire-server.cluster-static-entries" -}}
|
||||
{{- $root := .root }}
|
||||
{{- $trustDomain := include "spire-lib.trust-domain" .root }}
|
||||
{{- $useShortName := .useShortName }}
|
||||
{{- range $key, $value := $root.Values.controllerManager.identities.clusterStaticEntries }}
|
||||
{{- range $skey, $svalue := $value }}
|
||||
@@ -7,13 +8,25 @@
|
||||
{{- fail (printf "Unsupported property specified: %s" $skey) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if not (hasPrefix "spire-identity-exchange" $key) }}
|
||||
{{- range $rprop := list "spiffeID" "selectors" "parentID" }}
|
||||
{{- if not (hasKey $value $rprop) }}
|
||||
{{- fail (printf "Required property %s was not specified" $rprop) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq ($root.Values.controllerManager.enabled | toString) "true" }}
|
||||
{{- if or (not (hasKey $value "enabled")) (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process := true }}
|
||||
{{- if not (hasKey $value "enabled") }}
|
||||
{{- if and (hasPrefix "spire-identity-exchange" $key) (not $root.Values.spireIdentityExchange.enabled) }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- if not (eq ($value.enabled | toString) "true") }}
|
||||
{{- $process = false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $process }}
|
||||
- apiVersion: spire.spiffe.io/v1alpha1
|
||||
kind: ClusterStaticEntry
|
||||
metadata:
|
||||
@@ -32,17 +45,29 @@
|
||||
{{- end }}
|
||||
spec:
|
||||
className: {{ include "spire-server.controller-manager-class-name" $root | quote }}
|
||||
{{- if eq $key "spire-identity-exchange" }}
|
||||
parentID: "spiffe://{{ $trustDomain }}/spire/server"
|
||||
spiffeID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||
{{- else if eq $key "spire-identity-exchange-agent" }}
|
||||
parentID: "spiffe://{{ $trustDomain }}/spire-identity-exchange"
|
||||
spiffeID: "spiffe://{{ $trustDomain }}/service/spire-identity-exchange"
|
||||
{{- else }}
|
||||
parentID: {{ $value.parentID | quote }}
|
||||
spiffeID: {{ $value.spiffeID | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.federatesWith }}
|
||||
federatesWith:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if and (eq $key "spire-identity-exchange") (not (hasKey $value "selectors")) }}
|
||||
{{- $iePrefix := include "spire-server.identity-exchange-spiffe-prefix" $root | trimPrefix "/" }}
|
||||
selectors:
|
||||
- x509pop:subject:cn:{{ $iePrefix }}spire-identity-exchange
|
||||
{{- else }}
|
||||
{{- with $value.selectors }}
|
||||
selectors:
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- with $value.parentID }}
|
||||
parentID: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with $value.dnsNames }}
|
||||
dnsNames:
|
||||
|
||||
@@ -65,7 +65,7 @@
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $pluginsToLoad := include "spire-lib.extract_custom_plugin_images" . | fromYamlArray }}
|
||||
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled (gt (len $pluginsToLoad) 0) }}
|
||||
{{- $pluginLoaderNeeded := or .Values.credentialComposer.cel.enabled .Values.spireIdentityExchange.enabled (gt (len $pluginsToLoad) 0) }}
|
||||
{{- if not .Values.externalServer }}
|
||||
apiVersion: apps/v1
|
||||
{{- if eq .Values.kind "statefulset" }}
|
||||
@@ -159,6 +159,23 @@ spec:
|
||||
mountPath: /plugins
|
||||
imagePullPolicy: {{ .Values.credentialComposer.cel.image.pullPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.spireIdentityExchange.enabled }}
|
||||
- name: init-six
|
||||
securityContext:
|
||||
{{- include "spire-lib.securitycontext" . | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.credentialComposer.spireIdentityExchange.image "global" .Values.global) }}
|
||||
# Second, use the previously copied busybox to copy the plugin into a volume that can be mounted where SPIRE can execute it.
|
||||
command:
|
||||
- /plugins/busybox
|
||||
- sh
|
||||
- -ec
|
||||
- |
|
||||
/plugins/busybox cp -a {{ .Values.credentialComposer.spireIdentityExchange.pluginPath }} /plugins/credentialcomposer-identity-exchange
|
||||
volumeMounts:
|
||||
- name: plugins
|
||||
mountPath: /plugins
|
||||
imagePullPolicy: {{ .Values.credentialComposer.spireIdentityExchange.image.pullPolicy }}
|
||||
{{- end }}
|
||||
{{- range $idx, $plugin := $pluginsToLoad }}
|
||||
- name: {{ printf "init-plugin-%d" $idx }}
|
||||
securityContext:
|
||||
|
||||
@@ -383,6 +383,23 @@ credentialComposer:
|
||||
uniqueID:
|
||||
## @param credentialComposer.uniqueID.enabled Add the x509UniqueIdentifier attribute to workload X509-SVIDs
|
||||
enabled: false
|
||||
spireIdentityExchange:
|
||||
## @param credentialComposer.spireIdentityExchange.image.registry The OCI registry to pull the image from
|
||||
## @param credentialComposer.spireIdentityExchange.image.repository The repository within the registry
|
||||
## @param credentialComposer.spireIdentityExchange.image.pullPolicy The image pull policy
|
||||
## @param credentialComposer.spireIdentityExchange.image.tag Overrides the image tag
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spire-credentialcomposer-identity-exchange
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v0.2.0"
|
||||
## @param credentialComposer.spireIdentityExchange.checksum The sha256 checksum of the plugin binary
|
||||
checksum: 198bfed106794a60e565cb804cb6b360d4633e4542981abbea0c0c669ddd6036
|
||||
## @param credentialComposer.spireIdentityExchange.pluginPath The filename in the container of the plugin
|
||||
pluginPath: /ko-app/spire-credentialcomposer-identity-exchange
|
||||
## @param credentialComposer.spireIdentityExchange.prefix The prefix to operate on
|
||||
prefix: ""
|
||||
|
||||
keyManager:
|
||||
disk:
|
||||
@@ -766,29 +783,21 @@ controllerManager:
|
||||
type: test-keys
|
||||
|
||||
spike-keeper:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.type The type of rule this is.
|
||||
type: spike-keeper
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-keeper.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/keeper/{{ .PodMeta.Name }}
|
||||
spike-nexus:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.type The type of rule this is.
|
||||
type: spike-nexus
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-nexus.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/nexus/{{ .PodMeta.Name }}
|
||||
spike-bootstrap:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.type The type of rule this is.
|
||||
type: spike-bootstrap
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-bootstrap.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/spike/bootstrap/{{ .PodMeta.Name }}
|
||||
spike-pilot:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.enabled Enable this identity for controller manager
|
||||
enabled: true
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.type The type of rule this is.
|
||||
type: spike-pilot
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spike-pilot.spiffeIDTemplate The template to use for this rule.
|
||||
@@ -805,6 +814,29 @@ controllerManager:
|
||||
federatesWith:
|
||||
- spire-ha
|
||||
|
||||
spire-identity-exchange-trustbundle:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/trustbundle-spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-trustbundle.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-server-attestor"
|
||||
spire-identity-exchange-service:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.spiffeIDTemplate The template to use for this rule.
|
||||
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/service/spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-service.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-identity-exchange"
|
||||
spire-identity-exchange-agent:
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.type The type of rule this is.
|
||||
type: spire-identity-exchange
|
||||
## @param controllerManager.identities.clusterSPIFFEIDs.spire-identity-exchange-agent.workloadSelectorTemplates [array] Workload selectors.
|
||||
workloadSelectorTemplates:
|
||||
- "k8s:container-name:spire-agent"
|
||||
|
||||
# You can specify additional ClusterSPIFFEIDs following this example:
|
||||
# foo:
|
||||
# labels:
|
||||
@@ -813,8 +845,14 @@ controllerManager:
|
||||
# namespaceSelector:
|
||||
# matchLabels:
|
||||
# foo: bar
|
||||
## @param controllerManager.identities.clusterStaticEntries Specify ClusterStaticEntry objects.
|
||||
clusterStaticEntries: {}
|
||||
clusterStaticEntries:
|
||||
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange [object] Settings for the spire-identity-exchnage
|
||||
spire-identity-exchange: {}
|
||||
#FIXME Only needed for delegated api. Can remove once spire-identity-exchange switched to the broker api.
|
||||
spire-identity-exchange-agent:
|
||||
## @param controllerManager.identities.clusterStaticEntries.spire-identity-exchange-agent.selectors [array] selector
|
||||
selectors:
|
||||
- unix:path:/ko-app/spire-identity-exchange-server
|
||||
# foo:
|
||||
# labels:
|
||||
# foo: bar
|
||||
@@ -1131,8 +1169,8 @@ nodeAttestor:
|
||||
enabled: false
|
||||
## @param nodeAttestor.x509POP.mode What mode to set the plugin to. Currently only spiffe mode is supported
|
||||
mode: spiffe
|
||||
## @param nodeAttestor.x509POP.svidPrefix What prefix to use when mode is spiffe
|
||||
svidPrefix: /spire-exchange
|
||||
## @param nodeAttestor.x509POP.spiffePrefix What prefix to use when mode is spiffe
|
||||
spiffePrefix: "/spire-exchange/k8s${HELM_ADD_CLUSTER_NAME}/"
|
||||
## @param nodeAttestor.x509POP.agentPathTemplate Override the default agent path template
|
||||
agentPathTemplate: ""
|
||||
## @param nodeAttestor.x509POP.maxIntermediates Maximum number of intermediate certificates allowed in the certificate chain
|
||||
@@ -1140,10 +1178,10 @@ nodeAttestor:
|
||||
## @param nodeAttestor.x509POP.maxRSAKeySize Maximum RSA key size in bits allowed in certificates
|
||||
maxRSAKeySize: 8192
|
||||
addClusterName:
|
||||
## @param nodeAttestor.x509POP.addClusterName.svidPrefix Suffix the cluster name onto the svidPrefix
|
||||
svidPrefix: false
|
||||
## @param nodeAttestor.x509POP.addClusterName.spiffePrefix Suffix the cluster name onto the svidPrefix
|
||||
spiffePrefix: true
|
||||
## @param nodeAttestor.x509POP.addClusterName.agentPathTemplate Suffix the cluster name onto the agentPathTemplate
|
||||
agentPathTemplate: false
|
||||
agentPathTemplate: true
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
@@ -1485,3 +1523,11 @@ kubeConfigs: {}
|
||||
# xxxxx
|
||||
# clusterb:
|
||||
# kubeConfigBase64: eXl5Cnl5eQo=
|
||||
|
||||
spireIdentityExchange:
|
||||
## @param spireIdentityExchange.enabled Enable the server side of the SPIRE Identity Exchange system
|
||||
enabled: false
|
||||
|
||||
spike:
|
||||
## @param spike.enabled Enable the server side of SPIKE
|
||||
enabled: false
|
||||
|
||||
@@ -243,3 +243,9 @@ spike-nexus:
|
||||
spike-pilot:
|
||||
## @param spike-pilot.enabled Enables deployment of SPIKE Pilot (Not for production)
|
||||
enabled: false
|
||||
|
||||
spire-identity-exchange:
|
||||
## @param spire-identity-exchange.enabled Enables deployment of the SPIRE Identity Exchange (Not for production)
|
||||
enabled: false
|
||||
## @param spire-identity-exchange.nameOverride Overrides the name of the SPIRE Identity Exchnage
|
||||
nameOverride: identity-exchange
|
||||
|
||||
@@ -58,6 +58,7 @@ teardown() {
|
||||
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server entry show || true
|
||||
kubectl exec -i -n spire-server spire-a-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
||||
kubectl exec -i -n spire-server spire-b-internal-server-0 -- spire-server agent list -output json | yq e . - -P || true
|
||||
kubectl get pods -A -o wide || true
|
||||
|
||||
print_helm_releases
|
||||
|
||||
@@ -236,10 +237,22 @@ helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COM
|
||||
--set "global.spire.ingressControllerType=ingress-nginx" \
|
||||
--set "spiffe-oidc-discovery-provider.ingress.enabled=true"
|
||||
|
||||
# Create spire-identity-exchange cert for testing.
|
||||
mkdir -p certs
|
||||
openssl req -x509 -newkey rsa:2048 \
|
||||
-keyout certs/server.key \
|
||||
-out certs/server.pem -sha256 -days 365 -nodes \
|
||||
-subj "/CN=localhost" \
|
||||
-addext "basicConstraints=critical,CA:TRUE" \
|
||||
-addext "subjectAltName=DNS:spire-identity-exchange.production.other,DNS:spire-identity-exchange-a.production.other,DNS:spire-identity-exchange-b.production.other"
|
||||
kubectl create secret tls -n spire-server spire-identity-exchange --key=certs/server.key --cert=certs/server.pem
|
||||
|
||||
# Install server side a
|
||||
helm upgrade --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUES},${SCRIPTPATH}/spire-values.yaml" \
|
||||
--wait spire-a charts/spire-nested \
|
||||
--set tags.bottomTurtleHAA=true \
|
||||
--values "${SCRIPTPATH}/spire-identity-exchange-values.yaml" \
|
||||
--set "spire-identity-exchange-bottom-turtle-ha-a.enabled=true" \
|
||||
--set "global.spire.ingressControllerType=ingress-nginx"
|
||||
|
||||
docker exec -i chart-testing-worker /bin/bash -c "more /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/disk-keymanager/keys.json /var/lib/kubelet/pods/*/volumes/kubernetes.io~empty-dir/spire-agent-persistence/agent-data.json | cat"
|
||||
@@ -258,6 +271,8 @@ helm upgrade --install --namespace spire-mgmt --values "${COMMON_TEST_YOUR_VALUE
|
||||
--wait spire-b charts/spire-nested \
|
||||
--set tags.bottomTurtleHAB=true \
|
||||
--set internal-spire-server-bottom-turtle-ha-b.upstreamAuthority.spire.server.port=8082 \
|
||||
--values "${SCRIPTPATH}/spire-identity-exchange-values.yaml" \
|
||||
--set "spire-identity-exchange-bottom-turtle-ha-b.enabled=true" \
|
||||
--set "global.spire.ingressControllerType=ingress-nginx"
|
||||
|
||||
docker ps
|
||||
@@ -278,11 +293,18 @@ if [[ "${ENTRIES}" == "Found 0 entries" ]]; then
|
||||
fi
|
||||
|
||||
kubectl get pods -A -o wide
|
||||
kubectl get ingress -A
|
||||
|
||||
helm test --namespace spire-mgmt spire-a
|
||||
helm test --namespace spire-mgmt spire-b
|
||||
curl -k --resolve "oidc-discovery.production.other:443:$IP" "https://oidc-discovery.production.other/.well-known/openid-configuration" -s --fail
|
||||
|
||||
kubectl apply -f "${SCRIPTPATH}/test-job.yaml"
|
||||
kubectl wait --for=condition=complete --timeout=60s job/test && \
|
||||
TOKEN=$(kubectl logs job/test)
|
||||
curl -f -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-a-rest.production.other:443:$IP" "https://spire-identity-exchange-a-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
|
||||
curl -f -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-b-rest.production.other:443:$IP" "https://spire-identity-exchange-b-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
|
||||
|
||||
#Test out running only on side b since we know already only both servers work together, and that only side a works if we made it this far.
|
||||
helm delete -n spire-mgmt spire-a
|
||||
kubectl rollout restart daemonset -n spire-system spire-ha-agent
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
internal-spire-server-bottom-turtle-ha-a:
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterStaticEntries:
|
||||
test:
|
||||
parentID: spiffe://production.other/spire-identity-exchange
|
||||
spiffeID: spiffe://production.other/k8s-psat/test
|
||||
selectors:
|
||||
- k8s_psat:namespace:default
|
||||
- k8s_psat:service_account_name:default
|
||||
spireIdentityExchange:
|
||||
enabled: true
|
||||
|
||||
internal-spire-server-bottom-turtle-ha-b:
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterStaticEntries:
|
||||
test:
|
||||
parentID: spiffe://production.other/spire-identity-exchange
|
||||
spiffeID: spiffe://production.other/k8s-psat/test
|
||||
selectors:
|
||||
- k8s_psat:namespace:default
|
||||
- k8s_psat:service_account_name:default
|
||||
spireIdentityExchange:
|
||||
enabled: true
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-a:
|
||||
rest:
|
||||
ingress:
|
||||
enabled: true
|
||||
tls:
|
||||
externalSecret:
|
||||
enabled: true
|
||||
secretName: spire-identity-exchange
|
||||
auth:
|
||||
plugins:
|
||||
- plugin: k8s_psat
|
||||
config:
|
||||
audiences:
|
||||
- spire-identity-exchange
|
||||
allowedServiceAccounts:
|
||||
- default/default
|
||||
|
||||
spire-identity-exchange-bottom-turtle-ha-b:
|
||||
rest:
|
||||
ingress:
|
||||
enabled: true
|
||||
tls:
|
||||
externalSecret:
|
||||
enabled: true
|
||||
secretName: spire-identity-exchange
|
||||
auth:
|
||||
plugins:
|
||||
- plugin: k8s_psat
|
||||
config:
|
||||
audiences:
|
||||
- spire-identity-exchange
|
||||
allowedServiceAccounts:
|
||||
- default/default
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: test
|
||||
spec:
|
||||
backoffLimit: 0
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
hostAliases:
|
||||
volumes:
|
||||
- name: token-volume
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
audience: spire-identity-exchange
|
||||
expirationSeconds: 3600
|
||||
containers:
|
||||
- name: main
|
||||
image: curlimages/curl:latest
|
||||
command: ["/bin/sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
cat /var/run/secrets/tokens/token
|
||||
volumeMounts:
|
||||
- name: token-volume
|
||||
mountPath: /var/run/secrets/tokens
|
||||
@@ -15,12 +15,27 @@ func ValueStringRender(chart *helmchart.Chart, values string) (map[string]string
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true}
|
||||
v, err = helmutil.ToRenderValues(chart, v, ro, helmutil.DefaultCapabilities)
|
||||
merged, err := helmutil.CoalesceValues(chart, v)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
objs, err := helmengine.Render(chart, v)
|
||||
testChart := *chart
|
||||
testChart.Values = merged
|
||||
|
||||
var activeDeps []*helmchart.Chart
|
||||
for _, dep := range testChart.Dependencies() {
|
||||
if dep.Name() != "spire-identity-exchange" {
|
||||
activeDeps = append(activeDeps, dep)
|
||||
}
|
||||
}
|
||||
testChart.SetDependencies(activeDeps...)
|
||||
|
||||
ro := helmutil.ReleaseOptions{Name: "spire", Namespace: "spire-server", Revision: 1, IsUpgrade: false, IsInstall: true}
|
||||
v, err = helmutil.ToRenderValues(&testChart, merged, ro, helmutil.DefaultCapabilities)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
objs, err := helmengine.Render(&testChart, v)
|
||||
return objs, err
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user