panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'main' into release

Browse Source
This commit is contained in:
Kevin Fox
2026-09-09 09:55:33 -07:00
parent 752a26565a dc689035c7
commit e5901d68d0
56 changed files with 1916 additions and 346 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/kind/conf/credential-provider-config.yaml
+25
View File
@@ -0,0 +1,25 @@
apiVersion: kubelet.config.k8s.io/v1
kind: CredentialProviderConfig
providers:
- name: k8s-image-cred-spire-identity-exchange
matchImages:
- "zot.production.other"
defaultCacheDuration: "0s"
apiVersion: credentialprovider.kubelet.k8s.io/v1
args:
- "--username=zot"
- "--mode=spire-identity-exchange"
- "--url=https://spire-identity-exchange-rest-spiffe.production.other"
- "--stack=image_pull"
- "--registry-audience=zot"
- "--spiffe-audience=spire-identity-exchange"
- "--spiffe-hint=image-pull"
- "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
- "--timeout=10s"
env:
- name: SPIFFE_ENDPOINT_SOCKET
value: unix:///var/run/spire/agent/sockets/main/public/api.sock
tokenAttributes:
serviceAccountTokenAudience: "spire-identity-exchange"
cacheType: "Token"
requireServiceAccount: true
.github/kind/conf/kind-config.yaml
+99
View File
@@ -30,6 +30,39 @@ nodes:
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
# package installed spire-ha-agent@main listens, so kubelet's configuration in
# the node is the same one a real bare metal node would use.
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
containerPath: /var/run/spire/agent/sockets/main/public
- hostPath: ./.github/kind/conf/credential-providers
containerPath: /credential-plugins
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
containerPath: /etc/kubernetes/credential-provider-config.yaml
kubeadmConfigPatches:
- |
apiVersion: kubeadm.k8s.io/v1beta3
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
image-credential-provider-bin-dir: /credential-plugins
kubeadmConfigPatchesJSON6902:
- group: kubeadm.k8s.io
version: v1beta4
kind: JoinConfiguration
patch: |
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-config
value: /etc/kubernetes/credential-provider-config.yaml
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-bin-dir
value: /credential-plugins
- role: worker - role: worker
extraMounts: extraMounts:
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
@@ -40,6 +73,39 @@ nodes:
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
# package installed spire-ha-agent@main listens, so kubelet's configuration in
# the node is the same one a real bare metal node would use.
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
containerPath: /var/run/spire/agent/sockets/main/public
- hostPath: ./.github/kind/conf/credential-providers
containerPath: /credential-plugins
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
containerPath: /etc/kubernetes/credential-provider-config.yaml
kubeadmConfigPatches:
- |
apiVersion: kubeadm.k8s.io/v1beta3
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
image-credential-provider-bin-dir: /credential-plugins
kubeadmConfigPatchesJSON6902:
- group: kubeadm.k8s.io
version: v1beta4
kind: JoinConfiguration
patch: |
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-config
value: /etc/kubernetes/credential-provider-config.yaml
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-bin-dir
value: /credential-plugins
- role: worker - role: worker
extraMounts: extraMounts:
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public - hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
@@ -50,3 +116,36 @@ nodes:
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public - hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
# package installed spire-ha-agent@main listens, so kubelet's configuration in
# the node is the same one a real bare metal node would use.
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
containerPath: /var/run/spire/agent/sockets/main/public
- hostPath: ./.github/kind/conf/credential-providers
containerPath: /credential-plugins
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
containerPath: /etc/kubernetes/credential-provider-config.yaml
kubeadmConfigPatches:
- |
apiVersion: kubeadm.k8s.io/v1beta3
kind: JoinConfiguration
nodeRegistration:
kubeletExtraArgs:
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
image-credential-provider-bin-dir: /credential-plugins
kubeadmConfigPatchesJSON6902:
- group: kubeadm.k8s.io
version: v1beta4
kind: JoinConfiguration
patch: |
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-config
value: /etc/kubernetes/credential-provider-config.yaml
- op: add
path: /nodeRegistration/kubeletExtraArgs/-
value:
name: image-credential-provider-bin-dir
value: /credential-plugins
.github/scripts/install-image-cred-provider.sh
Executable
+37
View File
@@ -0,0 +1,37 @@
#!/usr/bin/env bash
set -euo pipefail
VERSION="${IMAGE_CRED_PROVIDER_VERSION:-v0.5.0}"
BIN_NAME="k8s-image-cred-spire-identity-exchange"
SCRIPTPATH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
BIN_DIR="${SCRIPTPATH}/../kind/conf/credential-providers"
case "$(uname -m)" in
x86_64|amd64) ARCH="x86_64" ;;
aarch64|arm64) ARCH="arm64" ;;
*) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;;
esac
if [ -x "${BIN_DIR}/${BIN_NAME}" ]; then
echo "${BIN_NAME} already staged in ${BIN_DIR}"
exit 0
fi
BASE_URL="https://github.com/spiffe/spire-identity-exchange/releases/download/${VERSION}"
ARCHIVE="${BIN_NAME}_Linux_${ARCH}.tar.gz"
CHECKSUMS="spire-identity-exchange_${VERSION#v}_checksums.txt"
WORKDIR="$(mktemp -d)"
trap 'rm -rf "${WORKDIR}"' EXIT
curl -fsSL --retry 5 --retry-all-errors -o "${WORKDIR}/${ARCHIVE}" "${BASE_URL}/${ARCHIVE}"
curl -fsSL --retry 5 --retry-all-errors -o "${WORKDIR}/${CHECKSUMS}" "${BASE_URL}/${CHECKSUMS}"
(cd "${WORKDIR}" && grep " ${ARCHIVE}\$" "${CHECKSUMS}" | sha256sum -c -)
tar -xzf "${WORKDIR}/${ARCHIVE}" -C "${WORKDIR}" "${BIN_NAME}"
mkdir -p "${BIN_DIR}"
install -m 0755 "${WORKDIR}/${BIN_NAME}" "${BIN_DIR}/${BIN_NAME}"
echo "Staged ${BIN_NAME} ${VERSION} in ${BIN_DIR}"
.github/tests/charts.json
+5
View File
@@ -13,5 +13,10 @@
"name": "ingress-nginx", "name": "ingress-nginx",
"repo": "https://kubernetes.github.io/ingress-nginx", "repo": "https://kubernetes.github.io/ingress-nginx",
"version": "4.15.1" "version": "4.15.1"
},
{
"name": "zot",
"repo": "https://zotregistry.dev/helm-charts",
"version": "0.1.122"
} }
] ]
.github/workflows/helm-chart-ci-ignore.yaml
+12 -12
View File
@@ -31,9 +31,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
steps: steps:
- run: 'echo "Skipping tests"' - run: 'echo "Skipping tests"'
@@ -75,9 +75,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }} - ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -93,9 +93,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -111,9 +111,9 @@ jobs:
strategy: strategy:
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
steps: steps:
- run: 'echo "Skipping upgrade-test"' - run: 'echo "Skipping upgrade-test"'
.github/workflows/helm-chart-ci.yaml
+26 -12
View File
@@ -17,6 +17,7 @@ on:
- '.github/tests/**/*.sh' - '.github/tests/**/*.sh'
- '.github/tests/**/*.json' - '.github/tests/**/*.json'
- '.github/scripts/check-readme-versions.sh' - '.github/scripts/check-readme-versions.sh'
- '.github/scripts/install-image-cred-provider.sh'
- 'examples/**/*.yaml' - 'examples/**/*.yaml'
- 'examples/**/*.sh' - 'examples/**/*.sh'
- 'tests/**/*' - 'tests/**/*'
@@ -31,6 +32,7 @@ env:
PYTHON_VERSION: 3.11.3 PYTHON_VERSION: 3.11.3
KIND_VERSION: v0.32.0 KIND_VERSION: v0.32.0
CHART_TESTING_VERSION: v3.8.0 CHART_TESTING_VERSION: v3.8.0
IMAGE_CRED_PROVIDER_VERSION: v0.5.0
jobs: jobs:
checks: checks:
@@ -160,9 +162,9 @@ jobs:
# Kubernetes, but can go back farther as long as we don't need heroics # Kubernetes, but can go back farther as long as we don't need heroics
# to pull it off (i.e. kubectl version juggling). # to pull it off (i.e. kubectl version juggling).
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
steps: steps:
- name: Checkout - name: Checkout
@@ -185,6 +187,9 @@ jobs:
with: with:
version: ${{ env.CHART_TESTING_VERSION }} version: ${{ env.CHART_TESTING_VERSION }}
- name: Install image credential provider
run: ./.github/scripts/install-image-cred-provider.sh
- name: Create kind ${{ matrix.k8s }} cluster - name: Create kind ${{ matrix.k8s }} cluster
uses: helm/[email protected] uses: helm/[email protected]
# Only build a kind cluster if there are chart changes to test. # Only build a kind cluster if there are chart changes to test.
@@ -251,9 +256,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
example: example:
- ${{ fromJson(needs.build-matrix.outputs.examples) }} - ${{ fromJson(needs.build-matrix.outputs.examples) }}
@@ -271,6 +276,9 @@ jobs:
with: with:
python-version: ${{ env.PYTHON_VERSION }} python-version: ${{ env.PYTHON_VERSION }}
- name: Install image credential provider
run: ./.github/scripts/install-image-cred-provider.sh
- name: Create kind cluster - name: Create kind cluster
uses: helm/[email protected] uses: helm/[email protected]
# Only build a kind cluster if there are chart changes to test. # Only build a kind cluster if there are chart changes to test.
@@ -306,9 +314,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
integrationtest: integrationtest:
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }} - ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
@@ -326,6 +334,9 @@ jobs:
with: with:
python-version: ${{ env.PYTHON_VERSION }} python-version: ${{ env.PYTHON_VERSION }}
- name: Install image credential provider
run: ./.github/scripts/install-image-cred-provider.sh
- name: Create kind cluster - name: Create kind cluster
uses: helm/[email protected] uses: helm/[email protected]
# Only build a kind cluster if there are chart changes to test. # Only build a kind cluster if there are chart changes to test.
@@ -354,9 +365,9 @@ jobs:
fail-fast: false fail-fast: false
matrix: matrix:
k8s: k8s:
- v1.33.7 - v1.34.8
- v1.34.3 - v1.35.5
- v1.35.1 - v1.36.1
steps: steps:
- name: Checkout - name: Checkout
@@ -372,6 +383,9 @@ jobs:
with: with:
python-version: ${{ env.PYTHON_VERSION }} python-version: ${{ env.PYTHON_VERSION }}
- name: Install image credential provider
run: ./.github/scripts/install-image-cred-provider.sh
- name: Create kind cluster - name: Create kind cluster
uses: helm/[email protected] uses: helm/[email protected]
# Only build a kind cluster if there are chart changes to test. # Only build a kind cluster if there are chart changes to test.
.github/workflows/update-devcontainer-image.yaml
+1 -1
View File
@@ -29,7 +29,7 @@ jobs:
with: with:
cosign-release: v2.2.3 cosign-release: v2.2.3
- name: Install regctl - name: Install regctl
uses: regclient/actions/regctl-installer@78eb729dbdb4ef6480e85ff697b4410e22112583 # main uses: regclient/actions/regctl-installer@ba687069a65d03e9214808f16f3f0b3933c2048b # main
- name: Log in to GHCR - name: Log in to GHCR
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
with: with:
.gitignore
+1
View File
@@ -4,3 +4,4 @@ bin/
*.swp *.swp
charts/**/*.tgz charts/**/*.tgz
.DS_Store .DS_Store
.github/kind/conf/credential-providers/
charts/spiffe-step-ssh/Chart.lock
+3 -3
View File
@@ -1,9 +1,9 @@
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: step-certificates - name: step-certificates
repository: https://smallstep.github.io/helm-charts/ repository: https://smallstep.github.io/helm-charts/
version: 1.27.4 version: 1.27.4
digest: sha256:11d3748666d0c9aa04a77a01ed3cde99553aae715bc9f00b311247e6a9c6ee91 digest: sha256:9b62d2daefc0199e874a43e80127cc1fd75486121d860bd36a5249978fde04ac
generated: "2026-08-21T14:41:49.31784-07:00" generated: "2026-09-04T14:16:46.86151-07:00"
charts/spiffe-step-ssh/Chart.yaml
+2 -2
View File
@@ -13,7 +13,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes # This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version. # to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/) # Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 0.3.1 version: 0.3.2
# This is the version number of the application being deployed. This version number should be # This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to # incremented each time you make changes to the application. Versions are not expected to
# follow Semantic Versioning. They should reflect the version the application is using. # follow Semantic Versioning. They should reflect the version the application is using.
@@ -30,7 +30,7 @@ maintainers:
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: step-certificates - name: step-certificates
alias: step alias: step
repository: https://smallstep.github.io/helm-charts/ repository: https://smallstep.github.io/helm-charts/
charts/spire-ha-agent/Chart.lock
+3 -3
View File
@@ -1,6 +1,6 @@
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
digest: sha256:fd4f15738349c83d9a1c60a1529ecc5cb8df6ecd9af21176df54f61f40d8973e digest: sha256:1360466b9040d3ec4947a299db81a6c1635f5b87042b73cf95c99c1badc4634f
generated: "2026-08-21T14:41:50.554693-07:00" generated: "2026-09-04T14:16:48.082704-07:00"
charts/spire-ha-agent/Chart.yaml
+3 -3
View File
@@ -2,8 +2,8 @@ apiVersion: v2
name: spire-ha-agent name: spire-ha-agent
description: A Helm chart to install the SPIRE HA agent. description: A Helm chart to install the SPIRE HA agent.
type: application type: application
version: 0.3.1 version: 0.3.2
appVersion: "0.3.0" appVersion: "0.5.0"
keywords: ["spiffe", "spire-ha-agent"] keywords: ["spiffe", "spire-ha-agent"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-ha-agent
sources: sources:
@@ -20,4 +20,4 @@ maintainers:
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
charts/spire-ha-agent/README.md
+84 -65
View File
@@ -1,6 +1,6 @@
# spire-ha-agent # spire-ha-agent
![Version: 0.3.1](https://img.shields.io/badge/Version-0.3.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.3.0](https://img.shields.io/badge/AppVersion-0.3.0-informational?style=flat-square) ![Version: 0.3.2](https://img.shields.io/badge/Version-0.3.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0](https://img.shields.io/badge/AppVersion-0.5.0-informational?style=flat-square)
A Helm chart to install the SPIRE HA agent. A Helm chart to install the SPIRE HA agent.
@@ -24,67 +24,86 @@ A Helm chart to install the SPIRE HA agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-ha-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` | | `mode` | If the spire-ha-agent will run in delegated or broker mode | `delegated` |
| `singleSocket` | If in singleSocket mode, only one driver is used | `false` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` | | `singleSocket` | If in singleSocket mode, only one driver is used | `false` |
| `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` | | `sockets.single.admin.hostPath` | Where the admin socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/admin` |
| `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` | | `sockets.a.admin.hostPath` | Where the a admin socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/admin` |
| `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` | | `sockets.b.admin.hostPath` | Where the b admin sockets is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/admin` |
| `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` | | `sockets.single.broker.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent/sockets/main/csi.spiffe.io/broker` |
| `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` | | `sockets.a.broker.hostPath` | Where the a broker socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/broker` |
| `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` | | `sockets.b.broker.hostPath` | Where the b broker socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/broker` |
| `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` | | `sockets.single.workload.hostPath` | Where the broker socket is on disk when in single socket mode | `/var/run/spire/agent-sockets` |
| `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` | | `sockets.a.workload.hostPath` | Where the a workload socket is on disk | `/var/run/spire/agent/sockets/a/csi.spiffe.io/public` |
| `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` | | `sockets.b.workload.hostPath` | Where the b workload socket is on disk | `/var/run/spire/agent/sockets/b/csi.spiffe.io/public` |
| `port` | Port number to listen on | `999` | | `vsock` | Use a vsockets to expose the service rather then a unix socket | `false` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `port` | Port number to listen on | `999` |
| `nameOverride` | Name override | `""` | | `brokerAPI.enabled` | Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker. | `false` |
| `namespaceOverride` | Namespace override | `""` | | `brokerAPI.socket.enabled` | Serve the broker api on a unix socket | `true` |
| `fullnameOverride` | Fullname override | `""` | | `brokerAPI.socket.mountOnHost` | Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod. | `true` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `brokerAPI.socket.hostPath` | Where the served broker socket is made available on the host when mountOnHost is true | `/run/spire/agent/sockets/csi.spiffe.io/broker` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `brokerAPI.tcp.enabled` | Serve the broker api over tcp | `false` |
| `serviceAccount.name` | The name of the service account to use. | `""` | | `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
| `podAnnotations` | Annotations to add to pods | `{}` | | `brokerAPI.brokers.spiffefs.enabled` | Enable spiffefs as a broker. This feature is experimental. | `false` |
| `podLabels` | Labels to add to pods | `{}` | | `brokerAPI.brokers.spiffefs.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spiffefs` |
| `podSecurityContext` | Pod security context | `{}` | | `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
| `securityContext` | Security context | `{}` | | `brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
| `resources` | Resource requests and limits | `{}` | | `upstreamKeepalive.time` | How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection. | `5m` |
| `nodeSelector` | Node selector | `{}` | | `upstreamKeepalive.timeout` | How long to wait for a keepalive ping response before considering the connection dead | `20s` |
| `tolerations` | List of tolerations | `[]` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `affinity` | Node affinity | `{}` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | | `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent | `""` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `nameOverride` | Name override | `""` |
| `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `namespaceOverride` | Namespace override | `""` |
| `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `fullnameOverride` | Fullname override | `""` |
| `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `cid2PID.image.pullPolicy` | The image pull policy | `Always` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` | | `serviceAccount.name` | The name of the service account to use. | `""` |
| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` | | `podAnnotations` | Annotations to add to pods | `{}` |
| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` | | `podLabels` | Labels to add to pods | `{}` |
| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `podSecurityContext` | Pod security context | `{}` |
| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` | | `securityContext` | Security context | `{}` |
| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `resources` | Resource requests and limits | `{}` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `nodeSelector` | Node selector | `{}` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `tolerations` | List of tolerations | `[]` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `affinity` | Node affinity | `{}` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` | | `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `Always` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `fsGroupFix.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `cid2PID.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | | `cid2PID.image.repository` | The repository within the registry | `kfox1111/cid2pid` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | | `cid2PID.image.pullPolicy` | The image pull policy | `Always` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | | `cid2PID.image.tag` | Overrides the image tag whose default is the chart appVersion | `v0.0.3` |
| `cid2PID.busybox.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `cid2PID.busybox.image.repository` | The repository within the registry | `library/busybox` |
| `cid2PID.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `cid2PID.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.36.1-uclibc` |
| `cid2PID.busybox.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `Always` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:ea74a5487d6a76198fb651b48e953a01d13128c68ecf38df3d6e22307f0b93c1` |
| `socketAlternate.resources` | Specify resource needs as per https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ | `{}` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container | `[]` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
charts/spire-ha-agent/templates/_helpers.tpl
+9
View File
@@ -110,6 +110,15 @@ Create the name of the service account to use
{{- end }} {{- end }}
{{- end }} {{- end }}
{{/*
Whether prometheus metrics are on.
*/}}
{{- define "spire-ha-agent.prometheus-enabled" -}}
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
{{- printf "true" }}
{{- end }}
{{- end }}
{{- define "spire-ha-agent.socket-path" -}} {{- define "spire-ha-agent.socket-path" -}}
{{- print .Values.socketPath }} {{- print .Values.socketPath }}
{{- end }} {{- end }}
charts/spire-ha-agent/templates/configmap.yaml
+94
View File
@@ -0,0 +1,94 @@
{{- define "spire-ha-agent.check-config-values" -}}
{{- if not (has .Values.mode (list "delegated" "broker")) }}
{{- fail (printf "mode must be one of [delegated, broker], got: %s" .Values.mode) }}
{{- end }}
{{- if .Values.brokerAPI.enabled }}
{{- if ne .Values.mode "broker" }}
{{- fail "brokerAPI.enabled is true but mode is not broker. The served broker api is only available in broker mode." }}
{{- end }}
{{- if and (not .Values.brokerAPI.socket.enabled) (not .Values.brokerAPI.tcp.enabled) }}
{{- fail "brokerAPI.enabled is true but neither brokerAPI.socket.enabled nor brokerAPI.tcp.enabled is set. At least one listener is required." }}
{{- end }}
{{- $enabledBrokers := 0 }}
{{- range $name, $value := .Values.brokerAPI.brokers }}
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
{{- $enabledBrokers = add1 $enabledBrokers }}
{{- end }}
{{- end }}
{{- if eq $enabledBrokers 0 }}
{{- fail "brokerAPI.enabled is true but no entry in brokerAPI.brokers is enabled. Only listed brokers may connect, so at least one is required." }}
{{- end }}
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set when brokerAPI is enabled, as broker ids are derived from it" (eq (include "spire-lib.trust-domain" .) "example.org")) }}
{{- end }}
{{- end }}
{{/*
The agent reads this config as YAML, so it is emitted directly rather than
going through spire-lib.reformat-and-yaml2json. That helper exists to hand
spire an HCL-compatible JSON document and to reshape its plugins dict into
lists; neither applies here.
*/}}
{{- define "spire-ha-agent.yaml-config" -}}
{{- $trustDomain := include "spire-lib.trust-domain" . | trim -}}
single: {{ eq .Values.singleSocket true }}
{{- if .Values.vsock }}
vsock:
enabled: true
port: {{ .Values.port }}
{{- else }}
socket: /tmp/spire-ha-agent/public/spire-agent.sock
{{- end }}
upstream_a:
broker_address: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
workload_socket: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
{{- if not .Values.singleSocket }}
upstream_b:
broker_address: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
workload_socket: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
{{- end }}
upstream_keepalive:
time: {{ .Values.upstreamKeepalive.time | quote }}
timeout: {{ .Values.upstreamKeepalive.timeout | quote }}
{{- if include "spire-ha-agent.prometheus-enabled" . }}
metrics:
bind_address: {{ printf "%s:%v" .Values.telemetry.prometheus.host .Values.telemetry.prometheus.port | quote }}
{{- end }}
{{- if .Values.brokerAPI.enabled }}
broker_endpoint:
{{- /* Deliberately not under the workload api socket directory: the agent
rejects a socket_path that shares a directory with it. */}}
{{- if .Values.brokerAPI.socket.enabled }}
socket_path: /tmp/spire-ha-agent/broker/broker.sock
{{- end }}
{{- if .Values.brokerAPI.tcp.enabled }}
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
{{- end }}
brokers:
{{- range $name, $value := .Values.brokerAPI.brokers }}
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
- id: {{ tpl $value.idTemplate (dict "TrustDomain" $trustDomain) | quote }}
allowed_reference_types:
{{- range $value.allowedReferenceTypes }}
- type_url: {{ .typeURL | quote }}
allow_over_tcp: {{ eq .allowOverTCP true }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- /* Validation runs for every mode: two of its checks exist precisely to
catch a mode that is not broker. */}}
{{- include "spire-ha-agent.check-config-values" . }}
{{- if eq .Values.mode "broker" }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-ha-agent.fullname" . | quote }}
namespace: {{ include "spire-ha-agent.namespace" . | quote }}
labels:
{{- include "spire-ha-agent.labels" . | nindent 4 }}
data:
config.yaml: |
{{- include "spire-ha-agent.yaml-config" . | nindent 4 }}
{{- end }}
charts/spire-ha-agent/templates/daemonset.yaml
+55 -22
View File
@@ -2,6 +2,7 @@
{{- $mainSecurityContext := deepCopy .Values.securityContext }} {{- $mainSecurityContext := deepCopy .Values.securityContext }}
{{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }} {{- $socketAlternateNames := index (include "spire-ha-agent.socket-alternate-names" . | fromYaml) "names" }}
{{- $socketPath := include "spire-ha-agent.socket-path" . }} {{- $socketPath := include "spire-ha-agent.socket-path" . }}
{{- $configSum := (include (print $.Template.BasePath "/configmap.yaml") . | sha256sum) }}
apiVersion: apps/v1 apiVersion: apps/v1
kind: DaemonSet kind: DaemonSet
metadata: metadata:
@@ -30,6 +31,12 @@ spec:
metadata: metadata:
annotations: annotations:
kubectl.kubernetes.io/default-container: spire-ha-agent kubectl.kubernetes.io/default-container: spire-ha-agent
{{- if eq .Values.mode "broker" }}
checksum/config: {{ $configSum | quote }}
{{- end }}
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels: labels:
{{- include "spire-ha-agent.selectorLabels" . | nindent 8 }} {{- include "spire-ha-agent.selectorLabels" . | nindent 8 }}
app.kubernetes.io/component: spire-ha-agent app.kubernetes.io/component: spire-ha-agent
@@ -122,53 +129,51 @@ spec:
args: args:
- "-mode" - "-mode"
- {{ .Values.mode | quote }} - {{ .Values.mode | quote }}
{{- if eq .Values.mode "broker" }}
- "-config"
- "/opt/spire-ha-agent/conf/config.yaml"
{{- end }}
securityContext: securityContext:
privileged: true privileged: true
#FIXME read permission to api socket #FIXME read permission to api socket
runAsUser: 0 runAsUser: 0
runAsGroup: 0 runAsGroup: 0
#{- $mainSecurityContext | toYaml | nindent 12 }} #{- $mainSecurityContext | toYaml | nindent 12 }}
{{- /* Broker mode is configured entirely by the rendered config
file, so it has nothing to put here unless the user supplied
extraEnvVars. Emitting a bare env: would render env: null. */}}
{{- if or (eq .Values.mode "delegated") (gt (len .Values.extraEnvVars) 0) }}
env: env:
{{- if eq .Values.mode "delegated" }}
- name: SPIRE_HA_AGENT_SOCK - name: SPIRE_HA_AGENT_SOCK
value: /tmp/spire-ha-agent/public/spire-agent.sock value: /tmp/spire-ha-agent/public/spire-agent.sock
{{- if .Values.singleSocket }} {{- if .Values.singleSocket }}
- name: SPIRE_HA_AGENT_SINGLE - name: SPIRE_HA_AGENT_SINGLE
value: enabled value: enabled
{{- if eq .Values.mode "delegated" }}
- name: SPIRE_HA_AGENT_SOCKET - name: SPIRE_HA_AGENT_SOCKET
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
{{- else }} {{- else }}
- name: SPIRE_HA_AGENT_BROKER
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
{{- end }}
{{- else }}
{{- if eq .Values.mode "delegated" }}
- name: SPIRE_HA_AGENT_SOCKET_A - name: SPIRE_HA_AGENT_SOCKET_A
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/admin/admin.sock
- name: SPIRE_HA_AGENT_SOCKET_B - name: SPIRE_HA_AGENT_SOCKET_B
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/admin/admin.sock
{{- else }} {{- end }}
- name: SPIRE_HA_AGENT_BROKER_A {{- if .Values.vsock }}
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/broker/broker.sock
- name: SPIRE_HA_AGENT_BROKER_B
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/broker/broker.sock
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_A
value: unix:///var/run/spire/agent/sockets/a/csi.spiffe.io/public/spire-agent.sock
- name: SPIRE_HA_AGENT_WORKLOAD_SOCKET_B
value: unix:///var/run/spire/agent/sockets/b/csi.spiffe.io/public/spire-agent.sock
{{- end }}
{{- end }}
{{- if .Values.vsock }}
- name: SPIRE_HA_AGENT_VSOCK - name: SPIRE_HA_AGENT_VSOCK
value: enabled value: enabled
- name: SPIRE_HA_AGENT_PORT - name: SPIRE_HA_AGENT_PORT
value: {{ .Values.port | quote }} value: {{ .Values.port | quote }}
{{- end }}
{{- end }} {{- end }}
{{- with .Values.extraEnvVars }} {{- with .Values.extraEnvVars }}
{{- toYaml . | nindent 12 }} {{- toYaml . | nindent 12 }}
{{- end }} {{- end }}
{{- end }}
{{- if include "spire-ha-agent.prometheus-enabled" . }}
ports:
- containerPort: {{ .Values.telemetry.prometheus.port }}
name: prom
{{- end }}
volumeMounts: volumeMounts:
# - name: spire-ha-agent-persistence # - name: spire-ha-agent-persistence
# mountPath: /var/lib/spire # mountPath: /var/lib/spire
@@ -201,6 +206,18 @@ spec:
mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public mountPath: /var/run/spire/agent/sockets/b/csi.spiffe.io/public
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq .Values.mode "broker" }}
- name: spire-ha-agent-config
mountPath: /opt/spire-ha-agent/conf
readOnly: true
{{- if .Values.brokerAPI.enabled }}
{{- if .Values.brokerAPI.socket.enabled }}
- name: spire-ha-agent-broker-socket-dir
mountPath: /tmp/spire-ha-agent/broker
readOnly: false
{{- end }}
{{- end }}
{{- end }}
- name: dev - name: dev
mountPath: /dev mountPath: /dev
{{- if gt (len .Values.extraVolumeMounts) 0 }} {{- if gt (len .Values.extraVolumeMounts) 0 }}
@@ -261,6 +278,22 @@ spec:
type: DirectoryOrCreate type: DirectoryOrCreate
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- if eq .Values.mode "broker" }}
- name: spire-ha-agent-config
configMap:
name: {{ include "spire-ha-agent.fullname" . | quote }}
{{- if and .Values.brokerAPI.enabled .Values.brokerAPI.socket.enabled }}
{{- if .Values.brokerAPI.socket.mountOnHost }}
- name: spire-ha-agent-broker-socket-dir
hostPath:
path: {{ .Values.brokerAPI.socket.hostPath | quote }}
type: DirectoryOrCreate
{{- else }}
- name: spire-ha-agent-broker-socket-dir
emptyDir: {}
{{- end }}
{{- end }}
{{- end }}
- name: dev - name: dev
hostPath: hostPath:
path: /dev path: /dev
charts/spire-ha-agent/templates/podmonitor.yaml
+27
View File
@@ -0,0 +1,27 @@
{{- if (dig "telemetry" "prometheus" "podMonitor" "enabled" .Values.telemetry.prometheus.podMonitor.enabled .Values.global) }}
{{- $namespace := include "spire-ha-agent.podMonitor.namespace" . }}
{{- $podNamespace := ( include "spire-ha-agent.namespace" . ) }}
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: {{ include "spire-ha-agent.fullname" . }}
namespace: {{ $namespace | quote }}
labels:
{{- include "spire-ha-agent.labels" . | nindent 4 }}
{{- if ne (len (dig "telemetry" "prometheus" "podMonitor" "labels" (dict) .Values.global)) 0 }}
{{- .Values.global.telemetry.prometheus.podMonitor.labels | toYaml | nindent 4 }}
{{- end }}
{{- with .Values.telemetry.prometheus.podMonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
selector:
matchLabels:
{{- include "spire-ha-agent.selectorLabels" . | nindent 6 }}
podMetricsEndpoints:
- port: prom
{{- if ne $namespace $podNamespace }}
namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace | quote }}
{{- end }}
{{- end }}
charts/spire-ha-agent/values.yaml
+55
View File
@@ -20,6 +20,9 @@ image:
## @param mode If the spire-ha-agent will run in delegated or broker mode ## @param mode If the spire-ha-agent will run in delegated or broker mode
mode: delegated mode: delegated
## @param trustDomain The trust domain to be used for the SPIFFE identifiers
trustDomain: example.org
## @param singleSocket If in singleSocket mode, only one driver is used ## @param singleSocket If in singleSocket mode, only one driver is used
singleSocket: false singleSocket: false
@@ -61,6 +64,58 @@ vsock: false
## @param port Port number to listen on ## @param port Port number to listen on
port: 999 port: 999
brokerAPI:
## @param brokerAPI.enabled Serve the SPIFFE Broker API to downstream consumers. Only supported when mode is broker.
enabled: false
socket:
## @param brokerAPI.socket.enabled Serve the broker api on a unix socket
enabled: true
## @param brokerAPI.socket.mountOnHost Make the served broker socket visible on the host, so consumers running in other pods on the node can reach it. When false the socket stays in an emptyDir, reachable only from this pod.
mountOnHost: true
## @param brokerAPI.socket.hostPath Where the served broker socket is made available on the host when mountOnHost is true
hostPath: /run/spire/agent/sockets/csi.spiffe.io/broker
tcp:
## @param brokerAPI.tcp.enabled Serve the broker api over tcp
enabled: false
## @param brokerAPI.tcp.bindAddress The tcp address to bind to
bindAddress: 0.0.0.0:8788
## Brokers allowed to use the served broker api, keyed by name. At least one
## must be enabled when brokerAPI.enabled is true. Add your own alongside
## these following the same shape.
brokers:
spiffefs:
## @param brokerAPI.brokers.spiffefs.enabled Enable spiffefs as a broker. This feature is experimental.
enabled: false
## @param brokerAPI.brokers.spiffefs.idTemplate The default id template
idTemplate: spiffe://{{ .TrustDomain }}/spiffefs
allowedReferenceTypes:
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].typeURL The type of reference allowed
## @param brokerAPI.brokers.spiffefs.allowedReferenceTypes[0].allowOverTCP Allow access over TCP
- typeURL: "type.googleapis.com/spiffe.broker.WorkloadPIDReference"
allowOverTCP: false
upstreamKeepalive:
## @param upstreamKeepalive.time How often to ping an upstream broker to notice a connection that died silently. 0 disables. Do not lower below 5m: a spire-agent that does not configure a keepalive enforcement policy answers more frequent pings with GOAWAY too_many_pings and drops the connection.
time: 5m
## @param upstreamKeepalive.timeout How long to wait for a keepalive ping response before considering the connection dead
timeout: 20s
telemetry:
prometheus:
## @param telemetry.prometheus.enabled Flag to enable prometheus monitoring
enabled: false
## @param telemetry.prometheus.port Port for prometheus metrics
port: 9988
## @param telemetry.prometheus.host Host for prometheus metrics
host: "0.0.0.0"
podMonitor:
## @param telemetry.prometheus.podMonitor.enabled Enable podMonitor for prometheus
enabled: false
## @param telemetry.prometheus.podMonitor.namespace Override where to install the podMonitor, if not set will use the same namespace as the spire-ha-agent
namespace: ""
## @param telemetry.prometheus.podMonitor.labels [object] Pod labels to filter for prometheus monitoring
labels: {}
## @param imagePullSecrets [array] Pull secrets for images ## @param imagePullSecrets [array] Pull secrets for images
imagePullSecrets: [] imagePullSecrets: []
charts/spire-identity-exchange/Chart.lock
+3 -3
View File
@@ -1,6 +1,6 @@
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
digest: sha256:fd4f15738349c83d9a1c60a1529ecc5cb8df6ecd9af21176df54f61f40d8973e digest: sha256:1360466b9040d3ec4947a299db81a6c1635f5b87042b73cf95c99c1badc4634f
generated: "2026-08-21T14:41:50.632935-07:00" generated: "2026-09-04T14:16:48.149156-07:00"
charts/spire-identity-exchange/Chart.yaml
+2 -2
View File
@@ -2,7 +2,7 @@ apiVersion: v2
name: spire-identity-exchange name: spire-identity-exchange
description: A Helm chart to install the SPIRE Identity Exchange. description: A Helm chart to install the SPIRE Identity Exchange.
type: application type: application
version: 0.2.1 version: 0.2.2
appVersion: "v0.5.0" appVersion: "v0.5.0"
keywords: ["spiffe", "spire", "identity exchange"] keywords: ["spiffe", "spire", "identity exchange"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange
@@ -20,4 +20,4 @@ maintainers:
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
charts/spire-identity-exchange/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# spire-identity-exchange # spire-identity-exchange
![Version: 0.2.1](https://img.shields.io/badge/Version-0.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.5.0](https://img.shields.io/badge/AppVersion-v0.5.0-informational?style=flat-square) ![Version: 0.2.2](https://img.shields.io/badge/Version-0.2.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.5.0](https://img.shields.io/badge/AppVersion-v0.5.0-informational?style=flat-square)
A Helm chart to install the SPIRE Identity Exchange. A Helm chart to install the SPIRE Identity Exchange.
charts/spire-lib/Chart.yaml
+1 -1
View File
@@ -2,7 +2,7 @@ apiVersion: v2
name: spire-lib name: spire-lib
description: A library of helper templates for SPIRE charts. description: A library of helper templates for SPIRE charts.
type: library type: library
version: 0.3.1 version: 0.3.2
appVersion: "0.1.0" appVersion: "0.1.0"
keywords: ["spiffe", "spire", "library"] keywords: ["spiffe", "spire", "library"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-lib
charts/spire-lib/README.md
+1 -1
View File
@@ -7,7 +7,7 @@ A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for gro
```yaml ```yaml
dependencies: dependencies:
- name: spire-lib - name: spire-lib
version: 0.3.1 version: 0.3.2
repository: https://spiffe.github.io/helm-charts-hardened/ repository: https://spiffe.github.io/helm-charts-hardened/
``` ```
charts/spire-lib/templates/_helpers.tpl
+4
View File
@@ -589,6 +589,10 @@ metadata:
{{- end }} {{- end }}
spec: spec:
gatewayClassName: {{ required "gatewayAPI.gateway.className is required to render the shared Gateway" $obj.className | quote }} gatewayClassName: {{ required "gatewayAPI.gateway.className is required to render the shared Gateway" $obj.className | quote }}
{{- with $obj.infrastructure }}
infrastructure:
{{- toYaml . | nindent 4 }}
{{- end }}
allowedListeners: allowedListeners:
namespaces: namespaces:
from: {{ default "All" $obj.allowedListenersNamespaces }} from: {{ default "All" $obj.allowedListenersNamespaces }}
charts/spire-nested/Chart.lock
+6 -6
View File
@@ -1,7 +1,7 @@
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: spire-server - name: spire-server
repository: file://../spire/charts/spire-server repository: file://../spire/charts/spire-server
version: 0.1.0 version: 0.1.0
@@ -43,7 +43,7 @@ dependencies:
version: 0.1.0 version: 0.1.0
- name: spire-ha-agent - name: spire-ha-agent
repository: file://../spire-ha-agent repository: file://../spire-ha-agent
version: 0.3.1 version: 0.3.2
- name: spire-server - name: spire-server
repository: file://../spire/charts/spire-server repository: file://../spire/charts/spire-server
version: 0.1.0 version: 0.1.0
@@ -58,7 +58,7 @@ dependencies:
version: 0.1.0 version: 0.1.0
- name: spire-identity-exchange - name: spire-identity-exchange
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
- name: spire-server - name: spire-server
repository: file://../spire/charts/spire-server repository: file://../spire/charts/spire-server
version: 0.1.0 version: 0.1.0
@@ -73,6 +73,6 @@ dependencies:
version: 0.1.0 version: 0.1.0
- name: spire-identity-exchange - name: spire-identity-exchange
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
digest: sha256:bd10aa2236190a29056e5b32300d16883bc01635d2446a32c91ead2639b98f1d digest: sha256:b107601c95dca75c1bc8be08699d8051200fc3e83d12c392c1853936cffe74ce
generated: "2026-08-21T14:41:50.936953-07:00" generated: "2026-09-04T14:16:48.37985-07:00"
charts/spire-nested/Chart.yaml
+5 -5
View File
@@ -4,7 +4,7 @@ description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.30.1 version: 0.30.2
appVersion: "1.15.3" appVersion: "1.15.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
@@ -23,7 +23,7 @@ kubeVersion: ">=1.21.0-0"
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: spire-server - name: spire-server
alias: root-spire-server alias: root-spire-server
condition: root-spire-server.enabled condition: root-spire-server.enabled
@@ -121,7 +121,7 @@ dependencies:
- haAgentCommon - haAgentCommon
- name: spire-ha-agent - name: spire-ha-agent
repository: file://../spire-ha-agent repository: file://../spire-ha-agent
version: 0.3.1 version: 0.3.2
condition: spire-ha-agent.enabled condition: spire-ha-agent.enabled
tags: tags:
- haAgentCommon - haAgentCommon
@@ -157,7 +157,7 @@ dependencies:
alias: spire-identity-exchange-bottom-turtle-ha-a alias: spire-identity-exchange-bottom-turtle-ha-a
condition: spire-identity-exchange-bottom-turtle-ha-a.enabled condition: spire-identity-exchange-bottom-turtle-ha-a.enabled
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
tags: tags:
- bottomTurtleHAA - bottomTurtleHAA
- name: spire-server - name: spire-server
@@ -192,7 +192,7 @@ dependencies:
alias: spire-identity-exchange-bottom-turtle-ha-b alias: spire-identity-exchange-bottom-turtle-ha-b
condition: spire-identity-exchange-bottom-turtle-ha-b.enabled condition: spire-identity-exchange-bottom-turtle-ha-b.enabled
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
tags: tags:
- bottomTurtleHAB - bottomTurtleHAB
annotations: annotations:
charts/spire-nested/README.md
+2 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.30.1](https://img.shields.io/badge/Version-0.30.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square) ![Version: 0.30.2](https://img.shields.io/badge/Version-0.30.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -243,6 +243,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` | | `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` | | `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` | | `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
| `gatewayAPI.gateway.infrastructure` | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB. | `{}` |
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` | | `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` | | `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` | | `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
charts/spire-nested/values.yaml
+2
View File
@@ -138,6 +138,8 @@ gatewayAPI:
className: "" className: ""
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
annotations: {} annotations: {}
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
infrastructure: {}
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
allowedListenersNamespaces: All allowedListenersNamespaces: All
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
charts/spire/Chart.lock
+4 -4
View File
@@ -1,7 +1,7 @@
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: spire-server - name: spire-server
repository: file://./charts/spire-server repository: file://./charts/spire-server
version: 0.1.0 version: 0.1.0
@@ -34,6 +34,6 @@ dependencies:
version: 0.1.0 version: 0.1.0
- name: spire-identity-exchange - name: spire-identity-exchange
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
digest: sha256:2916c04b61f4813e2e107b84a2168fdf141c67086658e1adbb9501b8425cd6e1 digest: sha256:f2df7c3ec6008984f9987f181764c4773a8d8d2b3786656170f0dc45fd20b9d2
generated: "2026-08-21T14:41:50.353186-07:00" generated: "2026-09-04T14:16:47.91006-07:00"
charts/spire/Chart.yaml
+3 -3
View File
@@ -4,7 +4,7 @@ description: >
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
type: application type: application
version: 0.30.1 version: 0.30.2
appVersion: "1.15.3" appVersion: "1.15.3"
keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"] keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire
@@ -25,7 +25,7 @@ kubeVersion: ">=1.21.0-0"
dependencies: dependencies:
- name: spire-lib - name: spire-lib
repository: file://../spire-lib repository: file://../spire-lib
version: 0.3.1 version: 0.3.2
- name: spire-server - name: spire-server
condition: spire-server.enabled condition: spire-server.enabled
repository: file://./charts/spire-server repository: file://./charts/spire-server
@@ -71,7 +71,7 @@ dependencies:
- name: spire-identity-exchange - name: spire-identity-exchange
condition: spire-identity-exchange.enabled condition: spire-identity-exchange.enabled
repository: file://../spire-identity-exchange repository: file://../spire-identity-exchange
version: 0.2.1 version: 0.2.2
annotations: annotations:
org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened org.opencontainers.image.source: https://github.com/spiffe/helm-charts-hardened
artifacthub.io/category: security artifacthub.io/category: security
charts/spire/README.md
+2 -1
View File
@@ -1,6 +1,6 @@
# spire # spire
![Version: 0.30.1](https://img.shields.io/badge/Version-0.30.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square) ![Version: 0.30.2](https://img.shields.io/badge/Version-0.30.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.15.3](https://img.shields.io/badge/AppVersion-1.15.3-informational?style=flat-square)
[![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development) [![Development Phase](https://github.com/spiffe/spiffe/blob/main/.img/maturity/dev.svg)](https://github.com/spiffe/spiffe/blob/main/MATURITY.md#development)
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager. A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
@@ -328,6 +328,7 @@ Now you can interact with the Spire agent socket from your own application. The
| `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` | | `gatewayAPI.gateway.enabled` | Render the shared Gateway object | `false` |
| `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` | | `gatewayAPI.gateway.className` | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled. | `""` |
| `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` | | `gatewayAPI.gateway.annotations` | Annotations for the Gateway object | `{}` |
| `gatewayAPI.gateway.infrastructure` | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB. | `{}` |
| `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` | | `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. | `All` |
| `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` | | `gatewayAPI.gateway.allowedRoutesNamespaces` | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All` |
| `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` | | `gatewayAPI.gateway.extraListeners` | Additional listeners to add to the Gateway | `[]` |
charts/spire/charts/spire-agent/README.md
+160 -159
View File
@@ -25,162 +25,163 @@ A Helm chart to install the SPIRE agent.
### Chart parameters ### Chart parameters
| Name | Description | Value | | Name | Description | Value |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | | ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- |
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `image.repository` | The repository within the registry | `spiffe/spire-agent` | | `image.repository` | The repository within the registry | `spiffe/spire-agent` |
| `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `imagePullSecrets` | Pull secrets for images | `[]` | | `imagePullSecrets` | Pull secrets for images | `[]` |
| `nameOverride` | Name override | `""` | | `nameOverride` | Name override | `""` |
| `namespaceOverride` | Namespace override | `""` | | `namespaceOverride` | Namespace override | `""` |
| `fullnameOverride` | Fullname override | `""` | | `fullnameOverride` | Fullname override | `""` |
| `serviceAccount.create` | Specifies whether a service account should be created | `true` | | `serviceAccount.create` | Specifies whether a service account should be created | `true` |
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` | | `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
| `serviceAccount.name` | The name of the service account to use. | `""` | | `serviceAccount.name` | The name of the service account to use. | `""` |
| `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` | | `configMap.annotations` | Annotations to add to the SPIRE Agent ConfigMap | `{}` |
| `podAnnotations` | Annotations to add to pods | `{}` | | `podAnnotations` | Annotations to add to pods | `{}` |
| `podLabels` | Labels to add to pods | `{}` | | `podLabels` | Labels to add to pods | `{}` |
| `podSecurityContext` | Pod security context | `{}` | | `podSecurityContext` | Pod security context | `{}` |
| `securityContext` | Security context | `{}` | | `securityContext` | Security context | `{}` |
| `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` | | `resources` | Resource requests and limits for the spire-agent container and all its initContainers | `{}` |
| `nodeSelector` | Node selector | `{}` | | `nodeSelector` | Node selector | `{}` |
| `tolerations` | List of tolerations | `[]` | | `tolerations` | List of tolerations | `[]` |
| `affinity` | Node affinity | `{}` | | `affinity` | Node affinity | `{}` |
| `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` | | `authorizedDelegates` | A list of the authorized delegates SPIFFE IDs. See Delegated Identity API for more information. | `[]` |
| `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` | | `logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
| `logFormat` | The log format, valid values are "text" and "json" | `text` | | `logFormat` | The log format, valid values are "text" and "json" | `text` |
| `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` | | `clusterName` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `example-cluster` |
| `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` | | `trustDomain` | The trust domain to be used for the SPIFFE identifiers | `example.org` |
| `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` | | `trustBundleURL` | If set, obtain trust bundle from url instead of Kubernetes ConfigMap | `""` |
| `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` | | `trustBundleFormat` | If using trustBundleURL, what format is the url. Choices are "pem" and "spiffe" | `spiffe` |
| `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` | | `trustBundleHostPath` | If set, obtain trust bundle from a file on the host instead of from the ConfigMap | `""` |
| `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` | | `bundleConfigMap` | Configmap name for Spire bundle | `spire-bundle` |
| `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` | | `availabilityTarget` | The minimum amount of time desired to gracefully handle SPIRE Server or Agent downtime. This configurable influences how aggressively X509 SVIDs should be rotated. If set, must be at least 24h. | `""` |
| `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` | | `rebootstrapMode` | How the agent will behave when seeing an unknown x509 cert from the server. It can be set to never, auto, or always | `always` |
| `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` | | `rebootstrapDelay` | The agent will rebootstrap after configured amount of time on unknown x509 cert from the server | `10m` |
| `server.address` | Address for Spire server | `""` | | `server.address` | Address for Spire server | `""` |
| `server.port` | Port number for Spire server | `443` | | `server.port` | Port number for Spire server | `443` |
| `server.namespaceOverride` | Override the namespace for Spire server | `""` | | `server.namespaceOverride` | Override the namespace for Spire server | `""` |
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `healthChecks.port` | override the host port used for health checking | `9982` | | `healthChecks.port` | override the host port used for health checking | `9982` |
| `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` | | `updateStrategy.type` | The update strategy to use to replace existing DaemonSet pods with new pods. Can be RollingUpdate or OnDelete. | `RollingUpdate` |
| `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` | | `updateStrategy.rollingUpdate.maxUnavailable` | Max unavailable pods during update. Can be a number or a percentage. | `1` |
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` | | `livenessProbe.initialDelaySeconds` | Initial delay seconds for probe | `15` |
| `livenessProbe.periodSeconds` | Period seconds for probe | `60` | | `livenessProbe.periodSeconds` | Period seconds for probe | `60` |
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` | | `readinessProbe.initialDelaySeconds` | Initial delay seconds for probe | `10` |
| `readinessProbe.periodSeconds` | Period seconds for probe | `30` | | `readinessProbe.periodSeconds` | Period seconds for probe | `30` |
| `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `fsGroupFix.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` | | `fsGroupFix.image.repository` | The repository within the registry | `chainguard/bash` |
| `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `fsGroupFix.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `fsGroupFix.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
| `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` | | `keyManager.memory.enabled` | Enable the memory based Key Manager | `true` |
| `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` | | `keyManager.disk.enabled` | Enable the disk based Key Manager (must have persistence.type set to hostPath when enabled) | `false` |
| `keyManager.disk.mode` | Where to store the data. Supported options are hostPath and emptyDir | `hostPath` | | `keyManager.disk.mode` | Where to store the data. Supported options are hostPath and emptyDir | `hostPath` |
| `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` | | `nodeAttestor.k8sPSAT.enabled` | Enable PSAT k8s Node Attestor | `true` |
| `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` | | `nodeAttestor.httpChallenge.enabled` | Enable the http challenge Node Attestor | `false` |
| `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` | | `nodeAttestor.httpChallenge.agentname` | Name of this agent. Useful if you have multiple agents bound to different spire servers on the same host and sharing the same port. | `default` |
| `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` | | `nodeAttestor.httpChallenge.port` | The port to listen on. If 0, a random value will be used. | `0` |
| `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` | | `nodeAttestor.httpChallenge.advertisedPort` | The port to tell the server to call back on. Set only if your using an http proxy on the hosts. If 0, will use the port setting. | `0` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` | | `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `nodeAttestor.tpmDirect.plugin.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` | | `nodeAttestor.tpmDirect.plugin.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-tpm-attestor-agent` |
| `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.plugin.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.tpmDirect.plugin.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` | | `nodeAttestor.tpmDirect.plugin.checksum` | The sha256 checksum of the plugin binary | `22f67063f1699330e70cdedc9b923e517688f5ae71085a26bd9b83b3060ee86e` |
| `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` | | `nodeAttestor.tpmDirect.plugin.path` | The filename in the container of the plugin | `/app/tpm_attestor_agent` |
| `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` | | `nodeAttestor.tpmDirect.pubHash.enabled` | Display pubhash in logs | `true` |
| `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `nodeAttestor.tpmDirect.pubHash.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` | | `nodeAttestor.tpmDirect.pubHash.image.repository` | The repository within the registry | `spiffe/spire-tpm-plugin-get-tpm-pubhash` |
| `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `nodeAttestor.tpmDirect.pubHash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` | | `nodeAttestor.tpmDirect.pubHash.image.tag` | Overrides the image tag | `v1.9.0` |
| `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` | | `nodeAttestor.awsIID.enabled` | Enable the aws_iid Node Attestor | `false` |
| `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` | | `nodeAttestor.gcpIIT.enabled` | Enable the gcp_iit Node Attestor | `false` |
| `nodeAttestor.x509POP.enabled` | Enable the x509_pop Node Attestor | `false` | | `nodeAttestor.x509POP.enabled` | Enable the x509_pop Node Attestor | `false` |
| `nodeAttestor.x509POP.mode` | Which mode to use. Currently only spiffe is supported | `spiffe` | | `nodeAttestor.x509POP.mode` | Which mode to use. Currently only spiffe is supported | `spiffe` |
| `nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent/public/api.sock` | | `nodeAttestor.x509POP.spiffeEndpointSocket` | Where the socket is to use for mode spiffe | `/var/run/spiffe/socat/unix/k8s-spire-agent/public/api.sock` |
| `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` | | `workloadAttestors.unix.enabled` | Enables the Unix workload attestor | `false` |
| `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` | | `workloadAttestors.k8s.enabled` | Enables the Kubernetes workload attestor | `true` |
| `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` | | `workloadAttestors.k8s.verification.type` | What kind of verification to do against kubelet. auto will first attempt to use hostCert, and then fall back to apiServerCA. Valid options are [auto, hostCert, apiServerCA, skip] | `skip` |
| `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` | | `workloadAttestors.k8s.verification.hostCert.basePath` | Path where kubelet places its certificates | `/var/lib/kubelet/pki` |
| `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` | | `workloadAttestors.k8s.verification.hostCert.fileName` | File name where kubelet places its certificates. If blank, it will be auto detected. | `""` |
| `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` | | `workloadAttestors.k8s.disableContainerSelectors` | Set to true if using holdApplicationUntilProxyStarts in Istio | `false` |
| `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` | | `workloadAttestors.k8s.useNewContainerLocator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true | `true` |
| `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` | | `workloadAttestors.k8s.verboseContainerLocatorLogs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false | `false` |
| `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: enforced, permissive | `enforced` | | `workloadAttestors.k8s.brokerAPI.accessPolicy` | Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise. | `auto` |
| `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` | | `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled` | Enables the broker api | `false` |
| `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` | | `workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly` | Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced. | `auto` |
| `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` | | `dynamicRegistration.enabled` | Deploys the sidecar helper for dynamic registration | `false` |
| `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` | | `dynamicRegistration.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
| `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `dynamicRegistration.image.repository` | The repository within the registry | `spiffe/spire-controller-manager-dynamic-registration/spire-controller-manager-dynamic-registration-agent` |
| `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` | | `dynamicRegistration.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `dynamicRegistration.audience` | The audience to get the k8s psat for | `spire-controller-manager-dynamic-registration` | | `dynamicRegistration.image.tag` | Overrides the image tag to be whatever you need it to be. It will always be the flag you set without modifications | `0.1.0` |
| `dynamicRegistration.serverSPIFFEID` | Expected SPIFFE ID of the server. If blank, it will use a sane default. | `""` | | `dynamicRegistration.audience` | The audience to get the k8s psat for | `spire-controller-manager-dynamic-registration` |
| `dynamicRegistration.address` | Address for Spire server | `""` | | `dynamicRegistration.serverSPIFFEID` | Expected SPIFFE ID of the server. If blank, it will use a sane default. | `""` |
| `dynamicRegistration.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` | | `dynamicRegistration.address` | Address for Spire server | `""` |
| `dynamicRegistration.securityContext` | Security context | `{}` | | `dynamicRegistration.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
| `sds.enabled` | Enables Envoy SDS configuration | `false` | | `dynamicRegistration.securityContext` | Security context | `{}` |
| `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` | | `sds.enabled` | Enables Envoy SDS configuration | `false` |
| `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` | | `sds.defaultSVIDName` | The TLS Certificate resource name to use for the default X509-SVID with Envoy SDS | `default` |
| `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` | | `sds.defaultBundleName` | The Validation Context resource name to use for the default X.509 bundle with Envoy SDS | `ROOTCA` |
| `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` | | `sds.defaultAllBundlesName` | The Validation Context resource name to use for all bundles (including federated) with Envoy SDS | `ALL` |
| `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` | | `sds.disableSPIFFECertValidation` | Disable Envoy SDS custom validation | `false` |
| `telemetry.prometheus.port` | Port for prometheus metrics | `9988` | | `telemetry.prometheus.enabled` | Flag to enable prometheus monitoring | `false` |
| `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` | | `telemetry.prometheus.port` | Port for prometheus metrics | `9988` |
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` | | `telemetry.prometheus.host` | Host for prometheus metrics | `0.0.0.0` |
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` | | `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` | | `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the spire-agent | `""` |
| `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` | | `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
| `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` | | `telemetry.datadog.enabled` | Flag to enable datadog monitoring | `false` |
| `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` | | `telemetry.datadog.address` | The address of the datadog service to send metrics to. The default URL for services are `<service-name>.<namespace>.svc` | `datadog.kube-system.svc` |
| `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` | | `telemetry.datadog.port` | The port of the datadog service to send metrics to | `8125` |
| `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` | | `kubeletConnectByHostname` | (DEPRECATED) Use kubeletAddress.mode instead. If true, connect to kubelet using the nodes hostname. If false, uses localhost. If unset, defaults to true on OpenShift and false otherwise. | `""` |
| `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` | | `kubeletAddress.mode` | How to connect to kubelet for workload attestation | `auto` |
| `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` | | `hostNetwork` | Enable hostNetwork for the DaemonSet. If auto or empty, auto-disables when kubeletAddress.mode is hostname/hostip. Set true/false to override. | `""` |
| `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` | | `dnsPolicy` | DNS policy for the DaemonSet. If empty, uses ClusterFirstWithHostNet when hostNetwork is enabled. See https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy | `""` |
| `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` | | `socketPath` | The unix socket path to the spire-agent | `/run/spire/agent-sockets/spire-agent.sock` |
| `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.names` | List of alternate names for the socket that workloads might expect to be able to access in the driver mount. | `["socket","spire-agent.sock","api.sock"]` |
| `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` | | `socketAlternate.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `socketAlternate.image.repository` | The repository within the registry | `chainguard/bash` |
| `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` | | `socketAlternate.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `socketAlternate.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:90041f375e30f41aa7e0390075d8a69dc61900771d52fa98d63ee5d03d866a58` |
| `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` | | `hostCert.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
| `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `hostCert.image.repository` | The repository within the registry | `chainguard/min-toolkit-debug` |
| `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` | | `hostCert.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` | | `hostCert.image.tag` | Overrides the image tag whose default is the chart appVersion | `latest@sha256:9e45e6836c28489a6e57ca1210ec66927e88eca2409e403616a1278e210e86c9` |
| `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` | | `priorityClassName` | Priority class assigned to daemonset pods. Can be auto set with global.recommendations.priorityClassName. | `""` |
| `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` | | `extraEnvVars` | Extra environment variables to be added to the Spire Agent container and init containers | `[]` |
| `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` | | `extraVolumes` | Extra volumes to be mounted on Spire Agent pods | `[]` |
| `extraContainers` | Additional containers to create with Spire Agent pods | `[]` | | `extraVolumeMounts` | Extra volume mounts for Spire Agent pods | `[]` |
| `initContainers` | Additional init containers to create with Spire Agent pods | `[]` | | `extraContainers` | Additional containers to create with Spire Agent pods | `[]` |
| `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` | | `initContainers` | Additional init containers to create with Spire Agent pods | `[]` |
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | | `hostAliases` | Customize /etc/hosts file as described here https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ | `[]` |
| `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
| `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` | | `customPlugins.nodeAttestor` | Custom plugins of type NodeAttestor are configured here | `{}` |
| `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` | | `customPlugins.svidStore` | Custom plugins of type SVIDStore are configured here | `{}` |
| `experimental.enabled` | Allow configuration of experimental features | `false` | | `customPlugins.workloadAttestor` | Custom plugins of type WorkloadAttestor are configured here | `{}` |
| `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` | | `experimental.enabled` | Allow configuration of experimental features | `false` |
| `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` | | `experimental.syncInterval` | Sync interval with SPIRE server with exponential backoff | `5s` |
| `experimental.featureFlags` | List of developer feature flags | `[]` | | `experimental.requirePQKEM` | Require use of a post-quantum-safe key exchange method for TLS handshakes. | `false` |
| `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` | | `experimental.featureFlags` | List of developer feature flags | `[]` |
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` | | `agents` | Configure multiple agent DaemonSets. Useful when you have different node types and nodeAttestors | `{}` |
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` | | `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
| `tools.busybox.image.repository` | The repository within the registry | `busybox` | | `tools.busybox.image.registry` | The OCI registry to pull the image from | `""` |
| `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.busybox.image.repository` | The repository within the registry | `busybox` |
| `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` | | `tools.busybox.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` | | `tools.busybox.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.37.0-uclibc` |
| `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` | | `sockets.hostBasePath` | Path on which the agent socket is made available when admin.mountOnHost is true | `/run/spire/agent/sockets` |
| `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` | | `sockets.admin.enabled` | Enable the admin socket. Useful for admin tasks or the Delegated Identity API. | `false` |
| `sockets.broker.enabled` | Enable the broker socket. | `false` | | `sockets.admin.mountOnHost` | Enable the admin socket to be visible on the host. | `false` |
| `sockets.broker.mountOnHost` | Enable the broker socket to be visible on the host. | `false` | | `sockets.broker.enabled` | Enable the broker socket. | `false` |
| `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` | | `sockets.broker.mountOnHost` | Enable the broker socket to be visible on the host. | `false` |
| `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` | | `persistence.type` | What type of volume to use for persistence. Valid options emptyDir (reattestable node attestors) or hostPath (nonr-reattestable node attestors) | `emptyDir` |
| `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` | | `persistence.hostPath` | Which path to use on the host when persistence.type = hostPath | `/var/lib/spire/k8s/agent` |
| `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` | | `brokerAPI.tcp.enabled` | Enable the broker api endpoint | `false` |
| `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` | | `brokerAPI.tcp.bindAddress` | The tcp address to bind to | `0.0.0.0:8788` |
| `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` | | `brokerAPI.brokers.spire-ha-agent.enabled` | Enable the spire-ha-agent | `false` |
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` | | `brokerAPI.brokers.spire-ha-agent.idTemplate` | The default id template | `spiffe://{{ .TrustDomain }}/spire-ha-agent` |
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` | | `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].typeURL` | The type of reference allowed | `type.googleapis.com/spiffe.broker.WorkloadPIDReference` |
| `brokerAPI.brokers.spire-ha-agent.allowedReferenceTypes[0].allowOverTCP` | Allow access over TCP | `false` |
charts/spire/charts/spire-agent/templates/_helpers.tpl
+46
View File
@@ -199,3 +199,49 @@ Kept for backward compatibility
names: names:
{{ $l | toYaml }} {{ $l | toYaml }}
{{- end }} {{- end }}
{{/*
Resolve workloadAttestors.k8s.brokerAPI.accessPolicy to one of the two values
spire itself accepts. "auto" picks permissive only when every enabled broker is
confined to references that cannot name anything off this node, and enforced
otherwise -- including for anything unrecognized, so it fails closed.
The enforced triggers, in order below: a cluster pod reference scope, which lets
a pod reference fall through to the apiserver; an absent or empty
allowedReferenceTypes, which is the case spire treats as "no policy" and leaves
every reference type open over unix; any reference type other than a pid; and
any type reachable over tcp. The types are looked up with dig rather than index
so a broker missing from brokerAPI.brokers resolves to enforced instead of
erroring.
*/}}
{{- define "spire-agent.broker-access-policy" -}}
{{- $configured := .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | toString }}
{{- if and (ne $configured "auto") (ne $configured "") }}
{{- if not (has $configured (list "enforced" "permissive")) }}
{{- fail (printf "workloadAttestors.k8s.brokerAPI.accessPolicy must be one of [auto, enforced, permissive], got: %s" $configured) }}
{{- end }}
{{- $configured }}
{{- else }}
{{- $policy := "permissive" }}
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
{{- if eq (dig "podReferenceScope" "" $value | toString) "cluster" }}
{{- $policy = "enforced" }}
{{- end }}
{{- $types := dig $key "allowedReferenceTypes" (list) $.Values.brokerAPI.brokers }}
{{- if not $types }}
{{- $policy = "enforced" }}
{{- end }}
{{- range $types }}
{{- if ne (.typeURL | toString) "type.googleapis.com/spiffe.broker.WorkloadPIDReference" }}
{{- $policy = "enforced" }}
{{- end }}
{{- if eq (.allowOverTCP | toString) "true" }}
{{- $policy = "enforced" }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}
{{- $policy }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/templates/configmap.yaml
+1 -1
View File
@@ -217,7 +217,7 @@ plugins:
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }} {{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
experimental: experimental:
broker: broker:
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }} access_policy: {{ include "spire-agent.broker-access-policy" . | quote }}
brokers: brokers:
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }} {{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
{{- if or (not (hasKey $value "enabled")) $value.enabled }} {{- if or (not (hasKey $value "enabled")) $value.enabled }}
charts/spire/charts/spire-agent/templates/roles.yaml
+55
View File
@@ -1,3 +1,5 @@
{{- $brokerEndpoint := or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
{{- $enforced := and $brokerEndpoint (eq (include "spire-agent.broker-access-policy" .) "enforced") }}
# Required cluster role to allow spire-agent to query k8s API server # Required cluster role to allow spire-agent to query k8s API server
kind: ClusterRole kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: rbac.authorization.k8s.io/v1
@@ -10,6 +12,14 @@ rules:
- nodes - nodes
- nodes/proxy - nodes/proxy
verbs: ["get"] verbs: ["get"]
{{- if $enforced }}
{{- /* The enforced broker access policy asks the cluster's authorizer whether
a broker may speak for the pod it named, which the agent does by
creating a SubjectAccessReview on its behalf. */}}
- apiGroups: ["authorization.k8s.io"]
resources: ["subjectaccessreviews"]
verbs: ["create"]
{{- end }}
--- ---
# Binds above cluster role to spire-agent service account # Binds above cluster role to spire-agent service account
kind: ClusterRoleBinding kind: ClusterRoleBinding
@@ -24,3 +34,48 @@ roleRef:
kind: ClusterRole kind: ClusterRole
name: {{ include "spire-agent.fullname" . | quote }} name: {{ include "spire-agent.fullname" . | quote }}
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
{{- if $enforced }}
{{- $trustDomain := include "spire-lib.trust-domain" . }}
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
{{- /* Defaulting to false, not auto, is deliberate: a broker someone adds
themselves gets no grant unless they ask for one. */}}
{{- $imp := dig "impersonation" "clusterWidePodsOnly" false $value | toString }}
{{- $grant := ternary $enforced (eq $imp "true") (eq $imp "auto") }}
{{- if and (or (not (hasKey $value "enabled")) $value.enabled) $grant }}
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
{{- if hasKey $value "idTemplate" }}
{{- $idTemplate = $value.idTemplate }}
{{- end }}
{{- $name := printf "%s-broker-impersonation-%s" (include "spire-agent.fullname" $) $key | trunc 63 | trimSuffix "-" }}
---
# What the SubjectAccessReview above asks about for this broker. The review
# names the broker's SPIFFE ID as the user, so the grant is bound to that name
# rather than to any service account. A pair per broker, because a future grant
# covering more than pods needs rules of its own.
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ $name | quote }}
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["impersonate-via-spire"]
---
# Cluster wide: a broker serves whatever pods land on its node, so the set of
# namespaces is not known ahead of time.
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ $name | quote }}
subjects:
- kind: User
name: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) | quote }}
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: {{ $name | quote }}
apiGroup: rbac.authorization.k8s.io
{{- end }}
{{- end }}
{{- end }}
charts/spire/charts/spire-agent/values.yaml
+5 -2
View File
@@ -253,12 +253,15 @@ workloadAttestors:
## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false ## @param workloadAttestors.k8s.verboseContainerLocatorLogs If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false
verboseContainerLocatorLogs: false verboseContainerLocatorLogs: false
brokerAPI: brokerAPI:
## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: enforced, permissive ## @param workloadAttestors.k8s.brokerAPI.accessPolicy Which access policy to use. Supported values: auto, enforced, permissive. auto uses permissive while all broker access is node local, and enforced otherwise.
accessPolicy: enforced accessPolicy: auto
brokers: brokers:
spire-ha-agent: spire-ha-agent:
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api ## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.enabled Enables the broker api
enabled: false enabled: false
impersonation:
## @param workloadAttestors.k8s.brokerAPI.brokers.spire-ha-agent.impersonation.clusterWidePodsOnly Grant this broker the impersonate-via-spire verb on pods cluster wide. auto grants it when the resolved accessPolicy is enforced.
clusterWidePodsOnly: auto
# idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent # idTemplate: spiffe://{{ .TrustDomain }}/spire-ha-agent
# podReferenceScope: agent_node # podReferenceScope: agent_node
charts/spire/charts/spire-server/templates/_controller-manager-container.tpl
+72 -25
View File
@@ -1,3 +1,72 @@
{{/* 15-char-safe port-name suffix for a controller-manager cluster name ("" -> ""). Shared by container ports and the PodMonitor so they cannot drift. */}}
{{- define "spire-controller-manager.portSuffix" -}}
{{- $name := . -}}
{{- $portSuffix := "" -}}
{{- if ne $name "" -}}
{{- $portSuffix = printf "-%s" $name -}}
{{- if gt (len $name) 9 -}}
{{- $numberMatch := regexFind "[-]?[0-9]{1,2}$" $name -}}
{{- if $numberMatch -}}
{{- $numLen := len $numberMatch -}}
{{- $baseLen := sub (len $name) $numLen | int -}}
{{- $baseName := substr 0 $baseLen $name -}}
{{- if not (hasPrefix "-" $numberMatch) -}}
{{- $numberMatch = printf "-%s" $numberMatch -}}
{{- end -}}
{{- $maxBase := sub 9 (len $numberMatch) | int -}}
{{- $baseName = $baseName | trunc $maxBase | trimSuffix "-" -}}
{{- $portSuffix = printf "-%s%s" $baseName $numberMatch -}}
{{- else -}}
{{- $hash := sha256sum $name | trunc 3 -}}
{{- $portSuffix = printf "-%s-%s" ($name | trunc 5 | trimSuffix "-") $hash -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{- $portSuffix -}}
{{- end -}}
{{/* Resolve a port name: override wins, else prefix+suffix. dict: prefix, portSuffix, override */}}
{{- define "spire-controller-manager.portName" -}}
{{- if and (hasKey . "override") (ne (.override | toString) "") -}}
{{- .override -}}
{{- else -}}
{{- printf "%s%s" .prefix .portSuffix -}}
{{- end -}}
{{- end -}}
{{/* Prometheus port name for one controller-manager. dict: name (""=main), settings (may hold prometheusPortName) */}}
{{- define "spire-controller-manager.promPortName" -}}
{{- $override := "" -}}
{{- if hasKey .settings "prometheusPortName" -}}
{{- $override = .settings.prometheusPortName -}}
{{- end -}}
{{- include "spire-controller-manager.portName" (dict "prefix" "pm-cm" "portSuffix" (include "spire-controller-manager.portSuffix" .name) "override" $override) -}}
{{- end -}}
{{/* List of prometheus port names for every controller-manager that renders one. Consumed by the PodMonitor. */}}
{{- define "spire-controller-manager.prometheusPortNames" -}}
{{- $root := . -}}
{{- $names := list -}}
{{- if eq (.Values.controllerManager.enabled | toString) "true" -}}
{{- $names = append $names (include "spire-controller-manager.promPortName" (dict "name" "" "settings" .Values.controllerManager)) -}}
{{- end -}}
{{- if .Values.externalControllerManagers.enabled -}}
{{- $clusters := default .Values.kubeConfigs .Values.externalControllerManagers.clusters -}}
{{- range $name, $_ := $clusters -}}
{{- $clusterSettings := dict -}}
{{- if hasKey $root.Values.externalControllerManagers.clusters $name -}}
{{- $clusterSettings = index $root.Values.externalControllerManagers.clusters $name -}}
{{- end -}}
{{- $pmName := include "spire-controller-manager.promPortName" (dict "name" $name "settings" $clusterSettings) -}}
{{- if has $pmName $names -}}
{{- fail (printf "controller-manager prometheus port name %q collides for cluster %q; set a distinct prometheusPortName override" $pmName $name) -}}
{{- end -}}
{{- $names = append $names $pmName -}}
{{- end -}}
{{- end -}}
{{- $names | toYaml -}}
{{- end -}}
{{- define "spire-controller-manager.containers" }} {{- define "spire-controller-manager.containers" }}
{{- $root := . }} {{- $root := . }}
{{- $settings := dict }} {{- $settings := dict }}
@@ -41,23 +110,7 @@ Auto-generation preserves trailing numbers from cluster names or uses hash for u
{{- $prometheusPortName = $clusterSettings.prometheusPortName }} {{- $prometheusPortName = $clusterSettings.prometheusPortName }}
{{- end }} {{- end }}
{{- if or (eq $healthPortName "") (eq $prometheusPortName "") }} {{- if or (eq $healthPortName "") (eq $prometheusPortName "") }}
{{- if gt (len $name) 9 }} {{- $portSuffix = include "spire-controller-manager.portSuffix" $name }}
{{- $numberMatch := regexFind "[-]?[0-9]{1,2}$" $name }}
{{- if $numberMatch }}
{{- $numLen := len $numberMatch }}
{{- $baseLen := sub (len $name) $numLen | int }}
{{- $baseName := substr 0 $baseLen $name }}
{{- if not (hasPrefix "-" $numberMatch) }}
{{- $numberMatch = printf "-%s" $numberMatch }}
{{- end }}
{{- $maxBase := sub 9 (len $numberMatch) | int }}
{{- $baseName = $baseName | trunc $maxBase | trimSuffix "-" }}
{{- $portSuffix = printf "-%s%s" $baseName $numberMatch }}
{{- else }}
{{- $hash := sha256sum $name | trunc 3 }}
{{- $portSuffix = printf "-%s-%s" ($name | trunc 5 | trimSuffix "-") $hash }}
{{- end }}
{{- end }}
{{- end }} {{- end }}
{{- $startPort = add $startPort 2 }} {{- $startPort = add $startPort 2 }}
@@ -127,17 +180,11 @@ Auto-generation preserves trailing numbers from cluster names or uses hash for u
containerPort: 9443 containerPort: 9443
protocol: TCP protocol: TCP
{{- end }} {{- end }}
{{- $hpName := .healthPortName }} {{- $hpName := include "spire-controller-manager.portName" (dict "prefix" "hp-cm" "portSuffix" .portSuffix "override" .healthPortName) }}
{{- if eq $hpName "" }}
{{- $hpName = printf "hp-cm%s" .portSuffix }}
{{- end }}
- containerPort: {{ $healthPort }} - containerPort: {{ $healthPort }}
name: {{ $hpName }} name: {{ $hpName }}
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }} {{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
{{- $pmName := .prometheusPortName }} {{- $pmName := include "spire-controller-manager.portName" (dict "prefix" "pm-cm" "portSuffix" .portSuffix "override" .prometheusPortName) }}
{{- if eq $pmName "" }}
{{- $pmName = printf "pm-cm%s" .portSuffix }}
{{- end }}
- containerPort: {{ $promPort }} - containerPort: {{ $promPort }}
name: {{ $pmName }} name: {{ $pmName }}
{{- end }} {{- end }}
charts/spire/charts/spire-server/templates/podmonitor.yaml
+4 -2
View File
@@ -21,10 +21,12 @@ spec:
{{- include "spire-server.selectorLabels" . | nindent 6 }} {{- include "spire-server.selectorLabels" . | nindent 6 }}
podMetricsEndpoints: podMetricsEndpoints:
- port: prom - port: prom
- port: prom-cm {{- range (include "spire-controller-manager.prometheusPortNames" . | fromYamlArray) }}
- port: {{ . }}
{{- end }}
{{- if ne $namespace $podNamespace }} {{- if ne $namespace $podNamespace }}
namespaceSelector: namespaceSelector:
kubernetes.io/metadata.name: {{ $podNamespace }} kubernetes.io/metadata.name: {{ $podNamespace }}
{{- end }} {{- end }}
{{- end }} {{- end }}
{{- end }} {{- end }}
charts/spire/values.yaml
+2
View File
@@ -159,6 +159,8 @@ gatewayAPI:
className: "" className: ""
## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
annotations: {} annotations: {}
## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
infrastructure: {}
## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector. ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
allowedListenersNamespaces: All allowedListenersNamespaces: All
## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.
examples/bottom-turtle-ha/README.md
+75
View File
@@ -136,3 +136,78 @@ helm upgrade --install --namespace spire-mgmt --values "spire-values.yaml" \
--set tags.bottomTurtleHAB=true \ --set tags.bottomTurtleHAB=true \
--set "global.spire.ingressControllerType=ingress-nginx" --set "global.spire.ingressControllerType=ingress-nginx"
``` ```
## Host services on the bottom turtle
The diagrams above show a `spire-ha-agent` on each host, fed by `spire-agent@a` and
`spire-agent@b`, serving host services such as sshd and kubelet. That is what makes a host
service's identity survive one root server going away: the ha-agent merges both sides into
a single Workload API and answers from whichever side is up.
It attests every caller by pid, so one ha-agent can serve many callers with different
identities. Register the caller against the root servers and it gets its own SVID:
```
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node1-spire-ha-agent
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/spire-ha-agent
selectors:
- systemd:id:spire-ha-agent@main.service
federatesWith:
- spire-ha
```
The packaged `spire-agent` config already names `spiffe://${SPIFFE_TRUST_DOMAIN}/spire-ha-agent`
in its `authorized_delegates`, so no agent configuration is needed, only the entry.
## Registry image pull
Kubelet can use that host identity to pull images, without any pull secret. On seeing an
image from the registry, kubelet runs an image credential provider on the node, which
presents two credentials to the spire-identity-exchange: the pod's projected service
account token and the node's own JWT-SVID from the ha-agent. The exchange mints a registry
token, and the registry authorizes by SPIFFE ID.
The registry in this example is zot, deployed with the upstream chart. Its serving
certificate is a SPIRE SVID delivered by `spiffe-helper` as an init container plus a
sidecar, so nothing carries a long lived key. The identity needs an explicit DNS name,
because an X509-SVID has only a URI SAN by default and containerd validates the registry
by hostname:
```
zot:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/zot
podSelector:
matchLabels:
app.kubernetes.io/name: zot
dnsNameTemplates:
- zot.{{ .TrustDomain }}
```
Push and pull share one exchange stack. They are kept apart by their registration entries,
whose selectors are disjoint, and by the registry's own access control, which grants the
push identity write and the pull identity read only.
### How the test deviates from the diagrams
The test runs a single VM behind several virtual Kubernetes nodes, so a few things differ
from what you would deploy. Worth knowing if you are using this as a reference:
* One `spire-ha-agent` is shared by every virtual node, with a `spiffe-socat-unix` bridge
per node in front of it. On a real host kubelet talks to its local ha-agent directly.
Each bridge is mounted into its node at `/var/run/spire/agent/sockets/main/public`, which
is where a package installed ha-agent listens, so kubelet's own configuration is not a
deviation: what you see here is what you would deploy.
* The registration entries do deviate. Because the caller the ha-agent attests by pid is the
bridge, they select on the socat unit rather than on kubelet's own unit. On a real host
that selector is the only line that changes.
* One ha-agent behind every node means the test covers a root server failing, which is the
part that matters here, but not a single node's ha-agent failing.
* The credential provider binary and its configuration are staged into every kind cluster
by `.github/scripts/install-image-cred-provider.sh` before the cluster is created.
Kubelet refuses to start when a provider named in its configuration is missing, so this
cannot be deferred to the test itself.
examples/bottom-turtle-ha/example-manifests/node1-spire-ha-agent.yaml
+11
View File
@@ -0,0 +1,11 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node1-spire-ha-agent
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/spire-ha-agent
selectors:
- systemd:id:[email protected]
federatesWith:
- spire-ha
examples/bottom-turtle-ha/example-manifests/node2-image-pull.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node2-image-pull
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet
hint: image-pull
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/example-manifests/node2-kubelet.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node2-kubelet
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet/node2.${SPIFFE_TRUST_DOMAIN}
hint: kubelet
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/example-manifests/node3-image-pull.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node3-image-pull
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet
hint: image-pull
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/example-manifests/node3-kubelet.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node3-kubelet
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet/node3.${SPIFFE_TRUST_DOMAIN}
hint: kubelet
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/example-manifests/node4-image-pull.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node4-image-pull
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet
hint: image-pull
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/example-manifests/node4-kubelet.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: spire.spiffe.io/v1alpha1
kind: ClusterStaticEntry
metadata:
name: node4-kubelet
spec:
parentID: spiffe://${SPIFFE_TRUST_DOMAIN}/agent/node1
spiffeID: spiffe://${SPIFFE_TRUST_DOMAIN}/kubelet/node4.${SPIFFE_TRUST_DOMAIN}
hint: kubelet
selectors:
- systemd:id:[email protected]
examples/bottom-turtle-ha/image-pull-job.yaml
+34
View File
@@ -0,0 +1,34 @@
# Pulls the image zot only serves to an exchange-minted identity.
apiVersion: v1
kind: ServiceAccount
metadata:
name: zot-pull
---
apiVersion: batch/v1
kind: Job
metadata:
name: image-pull
spec:
backoffLimit: 0
template:
metadata:
labels:
app: image-pull
spec:
serviceAccountName: zot-pull
restartPolicy: Never
containers:
- name: main
image: zot.production.other/test/busybox:latest
imagePullPolicy: Always
command: ["sh", "-c", "echo IMAGE-PULL-OK"]
# The node authorizer only lets kubelet mint a service account token for an audience
# that appears in the pod spec. This must be here to work, even if it looks unused.
volumes:
- name: spire-token-gate
projected:
sources:
- serviceAccountToken:
path: token
audience: spire-identity-exchange
expirationSeconds: 3600
examples/bottom-turtle-ha/image-push-denied-job.yaml
+122
View File
@@ -0,0 +1,122 @@
# Negative control: the pull identity must not be able to write. Identical to image-push-job.yaml except the service account
apiVersion: batch/v1
kind: Job
metadata:
name: image-push-denied
spec:
backoffLimit: 0
template:
metadata:
labels:
app: image-push-denied
spec:
serviceAccountName: zot-pull
restartPolicy: Never
initContainers:
- name: static-busybox
# Replaced by run-tests.sh with the image from the spiffe-oidc-discovery-provider chart
image: IMAGE_BUSYBOX
command: ["sh", "-c", "cp /bin/busybox /data/busybox && chmod +x /data/busybox"]
volumeMounts:
- name: data-volume
mountPath: /data
- name: fetch-svid
# Replaced by run-tests.sh with the image from the spire-agent chart
image: IMAGE_SPIRE_AGENT
command:
- /data/busybox
- sh
- -xec
- |
SOCK=/spire-agent/spire-agent.sock
i=0
while [ "$i" -lt 30 ]; do
if /opt/spire/bin/spire-agent api fetch x509 -socketPath "$SOCK" -write /data -timeout 5s &&
/opt/spire/bin/spire-agent api fetch jwt -audience spire-identity-exchange -socketPath "$SOCK" -timeout 5s > /data/jwt.txt; then
break
fi
i=$((i+1))
/data/busybox sleep 2
done
if [ ! -s /data/jwt.txt ]; then
echo "no SVID for this pod after ${i} attempts"
exit 1
fi
/data/busybox grep -A1 'token(' /data/jwt.txt | /data/busybox tail -1 | /data/busybox tr -d '[:space:]' > /data/svid.jwt
test -s /data/svid.jwt
volumeMounts:
- name: data-volume
mountPath: /data
- name: spire-api
mountPath: /spire-agent
readOnly: true
- name: exchange
# Replaced by run-tests.sh with the toolkit image from the spiffe-oidc-discovery-provider chart
image: IMAGE_TOOLKIT
command:
- sh
- -xec
- |
cat /etc/ssl/certs/ca-certificates.crt /data/bundle.0.pem > /data/ca-bundle.pem
PSAT="$(cat /var/run/secrets/tokens/token)"
SVID="$(cat /data/svid.jwt)"
# This must still succeed. A separate registration entry matches this pod's
# credentials and mints the read only identity, so the exchange hands back a
# token; it is zot that refuses the write.
TOKEN="$(curl -k -sS --fail-with-body --max-time 60 --connect-timeout 10 -X POST \
-H "Authorization: Bearer k8s_psat=${PSAT}:spiffe=${SVID}" \
-H "Content-Type: application/json" \
-d '{"audiences": ["zot"]}' \
"https://spire-identity-exchange-rest.production.other/api/v1/svid/image_pull/jwt" \
| sed -n 's/.*"token":"\([^"]*\)".*/\1/p')"
test -n "${TOKEN}"
AUTH="$(printf 'zot:%s' "${TOKEN}" | base64 | tr -d '\n')"
printf '{"auths":{"zot.production.other":{"auth":"%s"}}}' "${AUTH}" > /docker-config/config.json
volumeMounts:
- name: data-volume
mountPath: /data
- name: docker-config
mountPath: /docker-config
- name: psat
mountPath: /var/run/secrets/tokens
readOnly: true
containers:
- name: push
image: gcr.io/go-containerregistry/crane:v0.21.9
env:
- name: DOCKER_CONFIG
value: /docker-config
- name: SSL_CERT_FILE
value: /data/ca-bundle.pem
# The crane image is distroless, so borrow the static busybox copied out earlier.
command: ["/data/busybox", "sh", "-c"]
args:
- |
if /ko-app/crane copy docker.io/library/busybox:latest zot.production.other/test/denied:latest; then
echo "PUSH-SHOULD-HAVE-BEEN-DENIED"
exit 1
fi
echo PUSH-DENIED-OK
volumeMounts:
- name: data-volume
mountPath: /data
- name: docker-config
mountPath: /docker-config
volumes:
- name: data-volume
emptyDir: {}
- name: docker-config
emptyDir: {}
- name: spire-api
csi:
driver: csi.spiffe.io
readOnly: true
- name: psat
projected:
sources:
- serviceAccountToken:
path: token
audience: spire-identity-exchange
expirationSeconds: 3600
examples/bottom-turtle-ha/image-push-job.yaml
+121
View File
@@ -0,0 +1,121 @@
# Pushes an image into zot using an identity minted by the spire-identity-exchange.
apiVersion: v1
kind: ServiceAccount
metadata:
name: zot-push
---
apiVersion: batch/v1
kind: Job
metadata:
name: image-push
spec:
backoffLimit: 0
template:
metadata:
labels:
app: image-push
spec:
serviceAccountName: zot-push
restartPolicy: Never
initContainers:
- name: static-busybox
# Replaced by run-tests.sh with the image from the spiffe-oidc-discovery-provider chart
image: IMAGE_BUSYBOX
command: ["sh", "-c", "cp /bin/busybox /data/busybox && chmod +x /data/busybox"]
volumeMounts:
- name: data-volume
mountPath: /data
- name: fetch-svid
# Replaced by run-tests.sh with the image from the spire-agent chart
image: IMAGE_SPIRE_AGENT
command:
- /data/busybox
- sh
- -xec
- |
SOCK=/spire-agent/spire-agent.sock
i=0
while [ "$i" -lt 30 ]; do
if /opt/spire/bin/spire-agent api fetch x509 -socketPath "$SOCK" -write /data -timeout 5s &&
/opt/spire/bin/spire-agent api fetch jwt -audience spire-identity-exchange -socketPath "$SOCK" -timeout 5s > /data/jwt.txt; then
break
fi
i=$((i+1))
/data/busybox sleep 2
done
if [ ! -s /data/jwt.txt ]; then
echo "no SVID for this pod after ${i} attempts"
exit 1
fi
/data/busybox grep -A1 'token(' /data/jwt.txt | /data/busybox tail -1 | /data/busybox tr -d '[:space:]' > /data/svid.jwt
test -s /data/svid.jwt
volumeMounts:
- name: data-volume
mountPath: /data
- name: spire-api
mountPath: /spire-agent
readOnly: true
- name: exchange
# Replaced by run-tests.sh with the toolkit image from the spiffe-oidc-discovery-provider chart
image: IMAGE_TOOLKIT
command:
- sh
- -xec
- |
# crane talks to both docker.io and zot, so it needs the public roots and the
# SPIRE bundle in one file.
cat /etc/ssl/certs/ca-certificates.crt /data/bundle.0.pem > /data/ca-bundle.pem
PSAT="$(cat /var/run/secrets/tokens/token)"
SVID="$(cat /data/svid.jwt)"
TOKEN="$(curl -k -sS --fail-with-body --max-time 60 --connect-timeout 10 -X POST \
-H "Authorization: Bearer k8s_psat=${PSAT}:spiffe=${SVID}" \
-H "Content-Type: application/json" \
-d '{"audiences": ["zot"]}' \
"https://spire-identity-exchange-rest.production.other/api/v1/svid/image_pull/jwt" \
| sed -n 's/.*"token":"\([^"]*\)".*/\1/p')"
test -n "${TOKEN}"
AUTH="$(printf 'zot:%s' "${TOKEN}" | base64 | tr -d '\n')"
printf '{"auths":{"zot.production.other":{"auth":"%s"}}}' "${AUTH}" > /docker-config/config.json
volumeMounts:
- name: data-volume
mountPath: /data
- name: docker-config
mountPath: /docker-config
- name: psat
mountPath: /var/run/secrets/tokens
readOnly: true
containers:
- name: push
image: gcr.io/go-containerregistry/crane:v0.21.9
env:
- name: DOCKER_CONFIG
value: /docker-config
- name: SSL_CERT_FILE
value: /data/ca-bundle.pem
args:
- copy
- docker.io/library/busybox:latest
- zot.production.other/test/busybox:latest
volumeMounts:
- name: data-volume
mountPath: /data
- name: docker-config
mountPath: /docker-config
volumes:
- name: data-volume
emptyDir: {}
- name: docker-config
emptyDir: {}
- name: spire-api
csi:
driver: csi.spiffe.io
readOnly: true
- name: psat
projected:
sources:
- serviceAccountToken:
path: token
audience: spire-identity-exchange
expirationSeconds: 3600
examples/bottom-turtle-ha/run-tests.sh
+255 -2
View File
@@ -74,6 +74,10 @@ teardown() {
sudo systemctl status spire-server@other || true sudo systemctl status spire-server@other || true
kubectl describe job federation-test || true kubectl describe job federation-test || true
kubectl logs job/federation-test || true kubectl logs job/federation-test || true
sudo systemctl status spire-ha-agent@main || true
sudo systemctl status spiffe-socat-unix@k8s-kubelet-2 || true
sudo systemctl status spiffe-socat-unix@k8s-kubelet-3 || true
sudo systemctl status spiffe-socat-unix@k8s-kubelet-4 || true
sudo spire-server entry show -instance a || true sudo spire-server entry show -instance a || true
sudo spire-server entry show -instance b || true sudo spire-server entry show -instance b || true
sudo systemctl status spire-controller-manager@a || true sudo systemctl status spire-controller-manager@a || true
@@ -107,10 +111,20 @@ teardown() {
if [[ "$1" -ne 0 ]]; then if [[ "$1" -ne 0 ]]; then
get_namespace_details spire-server spire-system get_namespace_details spire-server spire-system
kubectl describe pod -n spire-system kubectl describe pod -n spire-system
# Only on failure: these are verbose, and the kubelet journal in particular is what
# tells you why an image pull came back anonymous rather than using the plugin.
for JOB in image-push image-pull image-push-denied; do
dump_job "${JOB}"
done
dump_zot
dump_kubelet_all
fi fi
if [ "${CLEANUP}" -eq 1 ]; then if [ "${CLEANUP}" -eq 1 ]; then
kubectl delete job federation-test 2>/dev/null || true kubectl delete job federation-test 2>/dev/null || true
kubectl delete job image-push image-pull image-push-denied 2>/dev/null || true
helm uninstall --namespace zot zot 2>/dev/null || true
kubectl delete ns zot 2>/dev/null || true
helm uninstall --namespace spire-mgmt spire-b 2>/dev/null || true helm uninstall --namespace spire-mgmt spire-b 2>/dev/null || true
helm uninstall --namespace spire-mgmt spire-a 2>/dev/null || true helm uninstall --namespace spire-mgmt spire-a 2>/dev/null || true
helm uninstall --namespace spire-mgmt spire 2>/dev/null || true helm uninstall --namespace spire-mgmt spire 2>/dev/null || true
@@ -154,6 +168,120 @@ wait_for_trust_sync() {
return 1 return 1
} }
# Dump everything useful about a job in one block. The trace goes to stderr while command
# output goes to stdout, and the two are separate streams in the CI log, so anything printed
# here can interleave or drop. Suspend the trace, merge each command's streams, and bracket
# the whole thing so it stays readable.
dump_job() {
local job="$1"
set +x
echo "===== BEGIN ${job} ====="
kubectl get pods -l "job-name=${job}" -o wide 2>&1 || true
kubectl describe job "${job}" 2>&1 || true
# Pod events are where image pull and volume failures show up; the job has none of this.
kubectl describe pod -l "job-name=${job}" 2>&1 || true
# --prefix labels each line with its container. These jobs have three init containers and
# the interesting output is rarely the last one.
kubectl logs "job/${job}" --all-containers --prefix 2>&1 || true
# Everything kubelet said about this pod on the node that ran it. Filtering on the image
# misses the credential provider path, which names the pod and service account instead,
# and only the first pull attempt carries the real error; the retries are all backoff.
local pod node
for pod in $(kubectl get pods -l "job-name=${job}" -o name 2>/dev/null | cut -d/ -f2); do
node="$(kubectl get pod "${pod}" -o jsonpath='{.spec.nodeName}' 2>/dev/null)"
[ -n "${node}" ] || continue
echo "----- kubelet ${node} for pod ${pod} -----"
# Only this pod. A broader filter matches every provider line since boot and the
# window fills long before the pull happens.
docker exec -i "${node}" journalctl -u kubelet --no-pager 2>&1 \
| grep -F "${pod}" | head -60 || true
# The plugin exec is logged against the image and plugin name, not the pod, so a pod
# filter hides exactly the line that says whether it ran and what it returned.
echo "----- kubelet ${node} credential provider decisions -----"
docker exec -i "${node}" journalctl -u kubelet --no-pager 2>&1 \
| grep -E 'exec plugin|image credentials|k8s-image-cred|without credentials|zot\.production\.other|[Ss]ervice account' \
| tail -40 || true
done
echo "===== END ${job} ====="
set -x
}
# Same treatment as dump_job. zot logs at debug, and its rejection reason for a bearer
# token only appears there, so take the whole log rather than a tail.
dump_zot() {
set +x
echo "===== BEGIN zot ====="
kubectl get pods -n zot -o wide 2>&1 || true
kubectl describe pod -n zot -l app.kubernetes.io/name=zot 2>&1 || true
kubectl logs -n zot -l app.kubernetes.io/name=zot --all-containers --prefix 2>&1 || true
echo "===== END zot ====="
set -x
}
# Whether kubelet was configured with the image credential provider at all, and whether it
# ran it. The kubeadm patch landing is the whole question when a pull comes back anonymous.
dump_kubelet() {
local node="$1"
set +x
echo "===== BEGIN kubelet ${node} ====="
docker exec -i "${node}" cat /var/lib/kubelet/kubeadm-flags.env 2>&1 || true
docker exec -i "${node}" ps ax 2>&1 | grep '[k]ubelet' || true
docker exec -i "${node}" ls -l /credential-plugins /etc/kubernetes/credential-provider-config.yaml 2>&1 || true
# The plugin reaches the workload API through this bridge. If the socket is absent the
# plugin fails immediately, kubelet falls back to anonymous, and the pull 401s.
docker exec -i "${node}" ls -l /var/run/spire/agent/sockets/main/public/ 2>&1 || true
# Only the registry we care about. A broad credential grep is pure noise at v=4, which
# logs a provider line for every image pull on the node.
docker exec -i "${node}" journalctl -u kubelet --no-pager 2>&1 \
| grep -E 'zot\.production\.other' -A3 | tail -60 || true
echo "===== END kubelet ${node} ====="
set -x
}
dump_kubelet_all() {
for NODE in $(kubectl get nodes -o name 2>/dev/null | cut -d/ -f2); do
dump_kubelet "${NODE}"
done
}
# kubectl wait --for=condition=complete blocks the full timeout when a job has already
# failed, which makes every failure look like a hang and delays the dump by minutes. Poll
# both terminal conditions instead.
wait_for_job() {
local job="$1"
local timeout="${2:-120}"
local count=0
while [ "$count" -lt "$timeout" ]; do
if kubectl get job "$job" -o jsonpath='{.status.conditions[?(@.type=="Complete")].status}' 2>/dev/null | grep -q True; then
return 0
fi
if kubectl get job "$job" -o jsonpath='{.status.conditions[?(@.type=="Failed")].status}' 2>/dev/null | grep -q True; then
echo "job/$job failed"
dump_job "$job"
return 1
fi
sleep 1
((count++)) || true
done
echo "job/$job did not finish within ${timeout}s"
dump_job "$job"
return 1
}
wait_for_socket() {
local socket="$1"
local timeout=30
local count=0
while [ "$count" -lt "$timeout" ]; do
if [ -S "$socket" ]; then
return 0
fi
sleep 1
((count++)) || true
done
return 1
}
wait_for_jwt() { wait_for_jwt() {
local socket="$1" local socket="$1"
local timeout=30 local timeout=30
@@ -199,11 +327,19 @@ run_federation_test_job() {
# Get the package repo and install the packages # Get the package repo and install the packages
sudo curl -s -o /etc/apt/sources.list.d/spire-examples.list https://raw.githubusercontent.com/spiffe/spire-examples/refs/heads/main/examples/debs/amd64/spire-examples.list sudo curl -s -o /etc/apt/sources.list.d/spire-examples.list https://raw.githubusercontent.com/spiffe/spire-examples/refs/heads/main/examples/debs/amd64/spire-examples.list
sudo apt-get update sudo apt-get update
sudo apt-get install -y spire-common spire-agent spire-server spire-controller-manager spiffe-socat-unix socat spire-trust-sync spiffe-helper sudo apt-get install -y spire-common spire-agent spire-server spire-controller-manager spiffe-socat-unix socat spire-trust-sync spiffe-helper spire-ha-agent
# Set our testing trust domain # Set our testing trust domain
sudo sed -i 's/example.org/production.other/' /etc/spiffe/default-trust-domain.env sudo sed -i 's/example.org/production.other/' /etc/spiffe/default-trust-domain.env
# A trust domain has one OIDC discovery endpoint, but the packaged root server config
# advertises oidc-discovery-provider.<trust domain> while the charts advertise
# oidc-discovery.<trust domain>. The identity exchange checks the iss claim by exact string,
# so a JWT-SVID minted by a root server, which is what kubelet's credential provider
# presents, is rejected unless the two agree. Align the roots with the charts.
sudo sed -i 's|jwt_issuer = "https://oidc-discovery-provider\.|jwt_issuer = "https://oidc-discovery.|' /etc/spire/server/default.conf
grep jwt_issuer /etc/spire/server/default.conf
if [ "${BROKER}" -eq 1 ]; then if [ "${BROKER}" -eq 1 ]; then
# Pull the federation test job images out of the charts so they always sync up. # Pull the federation test job images out of the charts so they always sync up.
AGENT_IMAGE=$(helm template t charts/spire -s charts/spire-agent/templates/daemonset.yaml --values "${COMMON_TEST_YOUR_VALUES}" --set spire-agent.enabled=true | yq e 'select(.kind=="DaemonSet") | .spec.template.spec.containers[] | select(.name=="spire-agent") | .image' -) AGENT_IMAGE=$(helm template t charts/spire -s charts/spire-agent/templates/daemonset.yaml --values "${COMMON_TEST_YOUR_VALUES}" --set spire-agent.enabled=true | yq e 'select(.kind=="DaemonSet") | .spec.template.spec.containers[] | select(.name=="spire-agent") | .image' -)
@@ -317,6 +453,36 @@ wait_for_jwt /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public/api.sock
wait_for_jwt /var/run/spiffe/socat/unix/k8s-spire-agent-4-a/public/api.sock wait_for_jwt /var/run/spiffe/socat/unix/k8s-spire-agent-4-a/public/api.sock
wait_for_jwt /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public/api.sock wait_for_jwt /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public/api.sock
# Start the host spire-ha-agent. It merges the two root agents into one workload API, which is
# what lets host services keep their identity when a single root server goes away. The compiled
# in defaults already point at /var/run/spire/agent/sockets/{a,b}/private/admin.sock and listen
# on the main instance socket, and the packaged agent config already lists the ha-agent in its
# authorized_delegates, so no configuration is needed.
sudo systemctl start spire-ha-agent@main
# Not wait_for_healthcheck: that calls the grpc.health.v1 service, which the ha-agent does
# not serve, so it always reports "unable to determine health". Not wait_for_jwt either:
# the ha-agent attests callers by pid, and the cli invoking it is in no registered unit.
# Readiness is proven through the bridges below, where the caller does have an entry.
wait_for_socket /var/run/spire/agent/sockets/main/public/api.sock
# Bridge the merged workload API into each virtual node for kubelet's image credential provider.
# A real deployment runs one ha-agent per host and kubelet talks to it directly. Here a single VM
# backs three virtual nodes, so we put one socat instance in front of the shared ha-agent per
# node. The ha-agent attests each caller by pid, so every bridge resolves to its own entry and
# each node still gets a distinct identity. Each bridge is mounted into its node at
# /var/run/spire/agent/sockets/main/public, where a package installed ha-agent listens, so
# kubelet's configuration inside the node is the same one a real host would use.
sudo /bin/bash -c "echo SPIFFE_INSTANCE=main > /etc/spiffe/socat/unix/k8s-kubelet-2.conf"
sudo /bin/bash -c "echo SPIFFE_INSTANCE=main > /etc/spiffe/socat/unix/k8s-kubelet-3.conf"
sudo /bin/bash -c "echo SPIFFE_INSTANCE=main > /etc/spiffe/socat/unix/k8s-kubelet-4.conf"
sudo systemctl start spiffe-socat-unix@k8s-kubelet-2 spiffe-socat-unix@k8s-kubelet-3 spiffe-socat-unix@k8s-kubelet-4
# These front the ha-agent rather than a spire-agent, so healthcheck does not apply here
# either. Fetching an svid is the real signal: it exercises the bridge, the ha-agent and
# whichever root agent answered.
wait_for_jwt /var/run/spiffe/socat/unix/k8s-kubelet-2/public/api.sock
wait_for_jwt /var/run/spiffe/socat/unix/k8s-kubelet-3/public/api.sock
wait_for_jwt /var/run/spiffe/socat/unix/k8s-kubelet-4/public/api.sock
# Deploy an ingress controller # Deploy an ingress controller
IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}') IP=$(kubectl get nodes chart-testing-control-plane -o go-template='{{ range .status.addresses }}{{ if eq .type "InternalIP" }}{{ .address }}{{ end }}{{ end }}')
helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \ helm upgrade --install ingress-nginx ingress-nginx --version "$VERSION_INGRESS_NGINX" --repo "$HELM_REPO_INGRESS_NGINX" \
@@ -332,7 +498,7 @@ common_test_url "$IP"
# Get the host IP And add spire-server-[ab].${trust_domain} records to it so the spire-servers can talk back to root servers running on the host # Get the host IP And add spire-server-[ab].${trust_domain} records to it so the spire-servers can talk back to root servers running on the host
HOSTIP=$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1) HOSTIP=$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d/ -f1)
kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep hosts || kubectl get configmap -n kube-system coredns -o yaml | sed "/ready/a\ hosts {\n fallthrough\n }" | kubectl apply -f -
kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $HOSTIP spire-server-a.production.other\n $IP oidc-discovery.production.other\n $HOSTIP spire-server-b.production.other\n 127.0.0.1 $FEDERATION_ENDPOINT_HOST\n" | kubectl apply -f - kubectl get configmap -n kube-system coredns -o yaml | grep production.other || kubectl get configmap -n kube-system coredns -o yaml | sed "/hosts/a\ $HOSTIP spire-server-a.production.other\n $IP oidc-discovery.production.other\n $HOSTIP spire-server-b.production.other\n $IP zot.production.other\n $IP spire-identity-exchange-rest.production.other\n 127.0.0.1 $FEDERATION_ENDPOINT_HOST\n" | kubectl apply -f -
kubectl rollout restart -n kube-system deployment/coredns kubectl rollout restart -n kube-system deployment/coredns
kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns kubectl rollout status -n kube-system -w --timeout=1m deploy/coredns
@@ -343,6 +509,10 @@ helm upgrade --install --create-namespace --namespace spire-mgmt --values "${COM
--set "global.spire.namespaces.create=true" \ --set "global.spire.namespaces.create=true" \
--set "global.spire.ingressControllerType=ingress-nginx" \ --set "global.spire.ingressControllerType=ingress-nginx" \
--set "spiffe-oidc-discovery-provider.ingress.enabled=true" \ --set "spiffe-oidc-discovery-provider.ingress.enabled=true" \
--set "spireIdentityExchange.tls.rest.enabled=true" \
--set "spireIdentityExchange.tls.rest.ingress.enabled=true" \
--set "spireIdentityExchange.spiffe.rest.enabled=true" \
--set "spireIdentityExchange.spiffe.rest.ingress.enabled=true" \
"${BROKER_MODE_ARGS[@]}" "${BROKER_MODE_ARGS[@]}"
# Create spire-identity-exchange cert for testing. # Create spire-identity-exchange cert for testing.
@@ -422,6 +592,80 @@ TOKEN=$(kubectl logs job/test)
curl --fail-with-body -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-a-rest.production.other:443:$IP" "https://spire-identity-exchange-a-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q curl --fail-with-body -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-a-rest.production.other:443:$IP" "https://spire-identity-exchange-a-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
curl --fail-with-body -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-b-rest.production.other:443:$IP" "https://spire-identity-exchange-b-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q curl --fail-with-body -H "Authorization: Bearer ${TOKEN}" -X POST --resolve "spire-identity-exchange-b-rest.production.other:443:$IP" "https://spire-identity-exchange-b-rest.production.other/api/v1/svid/k8s_psat/x509" -k -sS -q
# Registry image pull. zot serves a SPIRE issued certificate, an in cluster job pushes an
# image with an identity minted by the exchange, and kubelet pulls it back through the
# image credential provider staged on every node by .github/scripts.
# Nodes are not cluster DNS clients, so coredns does nothing for containerd. Give each
# node the name directly, and a hosts.toml so it trusts the registry's SPIRE certificate.
# The bundle has to carry both roots: after a failover the certificate is issued by the
# other side's chain.
sudo spire-server bundle show -socketPath /run/spire/server/sockets/a/private/api.sock | sudo tee /tmp/zot-ca.pem > /dev/null
sudo spire-server bundle show -socketPath /run/spire/server/sockets/b/private/api.sock | sudo tee -a /tmp/zot-ca.pem > /dev/null
for NODE in $(kubectl get nodes -o name | cut -d/ -f2); do
# The credential provider runs on the node, not in a pod, so it resolves the registry
# and the exchange here rather than through coredns.
docker exec -i "${NODE}" /bin/bash -c "grep -q zot.production.other /etc/hosts || echo '$IP zot.production.other spire-identity-exchange-rest-spiffe.production.other' >> /etc/hosts"
docker exec -i "${NODE}" /bin/bash -c "mkdir -p /etc/containerd/certs.d/zot.production.other"
docker exec -i "${NODE}" /bin/bash -c "cat > /etc/containerd/certs.d/zot.production.other/zot-ca.pem" < /tmp/zot-ca.pem
docker exec -i "${NODE}" /bin/bash -c "cat > /etc/containerd/certs.d/zot.production.other/hosts.toml" <<EOF
server = "https://zot.production.other"
[host."https://zot.production.other"]
capabilities = ["pull", "resolve"]
ca = "/etc/containerd/certs.d/zot.production.other/zot-ca.pem"
EOF
done
helm upgrade --install zot zot --version "$VERSION_ZOT" --repo "$HELM_REPO_ZOT" \
--namespace zot --create-namespace \
--values "${SCRIPTPATH}/zot-values.yaml" \
--wait --timeout 5m
# Pull the job images out of the charts so they always sync up.
BUSYBOX_IMAGE=$(helm template t charts/spire -s charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml --values "${COMMON_TEST_YOUR_VALUES}" --set spiffe-oidc-discovery-provider.enabled=true | yq e 'select(.kind=="Pod") | .spec.initContainers[] | select(.name=="static-busybox") | .image' -)
AGENT_IMAGE=$(helm template t charts/spire -s charts/spire-agent/templates/daemonset.yaml --values "${COMMON_TEST_YOUR_VALUES}" --set spire-agent.enabled=true | yq e 'select(.kind=="DaemonSet") | .spec.template.spec.containers[] | select(.name=="spire-agent") | .image' -)
TOOLKIT_IMAGE=$(helm template t charts/spire -s charts/spiffe-oidc-discovery-provider/templates/tests/test-keys.yaml --values "${COMMON_TEST_YOUR_VALUES}" --set spiffe-oidc-discovery-provider.enabled=true | yq e 'select(.kind=="Pod") | .spec.containers[] | select(.name=="verify-keys") | .image' -)
echo "image pull job images: ${BUSYBOX_IMAGE} ${AGENT_IMAGE} ${TOOLKIT_IMAGE}"
# Substitute rather than rewrite. yq edits the document structure, which is version
# dependent and on a multi document file can graft fields onto the wrong document; sed
# cannot restructure anything. Writing to a file first also keeps the applied manifest
# inspectable and avoids the pipeline trap, since this script sets -e but not -o pipefail.
apply_registry_job() {
local rendered
rendered="/tmp/$(basename "$1")"
sed -e "s|IMAGE_BUSYBOX|${BUSYBOX_IMAGE}|g" \
-e "s|IMAGE_SPIRE_AGENT|${AGENT_IMAGE}|g" \
-e "s|IMAGE_TOOLKIT|${TOOLKIT_IMAGE}|g" \
"$1" > "${rendered}"
# Fail loudly rather than applying a half substituted manifest.
if grep -q 'IMAGE_BUSYBOX\|IMAGE_SPIRE_AGENT\|IMAGE_TOOLKIT' "${rendered}"; then
echo "unsubstituted image placeholder left in ${rendered}"
exit 1
fi
kubectl apply -f "${rendered}"
}
# Push with the writer identity.
apply_registry_job "${SCRIPTPATH}/image-push-job.yaml"
wait_for_job image-push
# Pull it back. Nothing in the job fetches a credential; kubelet runs the plugin, which is
# the whole point of the test.
kubectl apply -f "${SCRIPTPATH}/image-pull-job.yaml"
wait_for_job image-pull
# Completing at all is the assertion: zot grants no anonymous access, so the image only
# comes down if kubelet ran the plugin and the exchange minted a token zot accepted. The
# kubelet log line naming the plugin needs -v=4, which is not worth turning on for every
# example, so teardown prints it as a diagnostic rather than asserting on it.
kubectl logs job/image-pull | grep IMAGE-PULL-OK
# The pull identity is read only. This job completes only when zot refuses the write.
apply_registry_job "${SCRIPTPATH}/image-push-denied-job.yaml"
wait_for_job image-push-denied
kubectl logs job/image-push-denied | grep PUSH-DENIED-OK
if [ "${BROKER}" -eq 1 ]; then if [ "${BROKER}" -eq 1 ]; then
# Verify a workload on the ha-agent socket receives the other.invalid federated trust bundles, # Verify a workload on the ha-agent socket receives the other.invalid federated trust bundles,
# x509 and jwt, merged from both sides. # x509 and jwt, merged from both sides.
@@ -441,3 +685,12 @@ if [ "${BROKER}" -eq 1 ]; then
run_federation_test_job run_federation_test_job
fi fi
# The image pull path has to survive losing a side too. Everything it depends on is HA:
# the node's identity comes from the host spire-ha-agent, and the credential provider
# talks to the combined exchange endpoint rather than either side directly. Delete the
# job first so this is a genuine second pull rather than a cached result.
kubectl delete job image-pull
kubectl apply -f "${SCRIPTPATH}/image-pull-job.yaml"
wait_for_job image-pull
kubectl logs job/image-pull | grep IMAGE-PULL-OK
examples/bottom-turtle-ha/spire-identity-exchange-values.yaml
+43
View File
@@ -1,6 +1,14 @@
internal-spire-server-bottom-turtle-ha-a: &server internal-spire-server-bottom-turtle-ha-a: &server
controllerManager: controllerManager:
identities: identities:
clusterSPIFFEIDs:
zot:
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/zot
podSelector:
matchLabels:
app.kubernetes.io/name: zot
dnsNameTemplates:
- zot.{{ .TrustDomain }}
clusterStaticEntries: clusterStaticEntries:
test: test:
parentID: spiffe://production.other/spire-identity-exchange parentID: spiffe://production.other/spire-identity-exchange
@@ -8,6 +16,33 @@ internal-spire-server-bottom-turtle-ha-a: &server
selectors: selectors:
- k8s_psat:namespace:default - k8s_psat:namespace:default
- k8s_psat:service_account_name:default - k8s_psat:service_account_name:default
image-push:
parentID: spiffe://production.other/spire-identity-exchange
spiffeID: spiffe://production.other/image-push
selectors:
- k8s_psat:namespace:default
- k8s_psat:service_account_name:zot-push
- spiffe:source_path:/ns/default/sa/zot-push
- spire_identity_exchange:stack:name:image_pull
image-pull:
parentID: spiffe://production.other/spire-identity-exchange
spiffeID: spiffe://production.other/image-pull
selectors:
- k8s_psat:namespace:default
- k8s_psat:service_account_name:zot-pull
- spiffe:source_path:/kubelet
- spire_identity_exchange:stack:name:image_pull
image-pull-from-pod:
parentID: spiffe://production.other/spire-identity-exchange
spiffeID: spiffe://production.other/image-pull
selectors:
- k8s_psat:namespace:default
- k8s_psat:service_account_name:zot-pull
- spiffe:source_path:/ns/default/sa/zot-pull
- spire_identity_exchange:stack:name:image_pull
spireIdentityExchange: spireIdentityExchange:
enabled: true enabled: true
@@ -30,6 +65,14 @@ spire-identity-exchange-bottom-turtle-ha-a: &six
config: config:
allowedServiceAccounts: allowedServiceAccounts:
- default/default - default/default
- default/zot-push
- default/zot-pull
spiffe:
config:
pathPatterns:
- "^/kubelet$"
- "^/ns/default/sa/zot-push$"
- "^/ns/default/sa/zot-pull$"
#Set the same settings on the B side #Set the same settings on the B side
spire-identity-exchange-bottom-turtle-ha-b: *six spire-identity-exchange-bottom-turtle-ha-b: *six
examples/bottom-turtle-ha/zot-values.yaml
+154
View File
@@ -0,0 +1,154 @@
# zot registry with a SPIRE issued serving certificate.
image:
tag: v2.1.20
initContainers:
- name: spiffe-helper-init
image: ghcr.io/spiffe/spiffe-helper:0.11.0
args: ["-config", "/etc/spiffe-helper.conf", "-daemon-mode=false"]
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: zot-config
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: spire-svid
mountPath: /svid
extraContainers:
- name: spiffe-helper
image: ghcr.io/spiffe/spiffe-helper:0.11.0
args: ["-config", "/etc/spiffe-helper.conf"]
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
readOnlyRootFilesystem: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
volumeMounts:
- name: spiffe-workload-api
mountPath: /spiffe-workload-api
readOnly: true
- name: zot-config
mountPath: /etc/spiffe-helper.conf
subPath: spiffe-helper.conf
readOnly: true
- name: spire-svid
mountPath: /svid
extraVolumes:
- name: spire-svid
emptyDir: {}
- name: spiffe-workload-api
csi:
driver: csi.spiffe.io
readOnly: true
extraVolumeMounts:
- name: spire-svid
mountPath: /svid
readOnly: true
podSecurityContext:
fsGroupChangePolicy: OnRootMismatch
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
securityContext:
allowPrivilegeEscalation: false
runAsNonRoot: true
capabilities:
drop: [ALL]
seccompProfile:
type: RuntimeDefault
resources: {}
httpGet:
scheme: HTTPS
port: 5000
startupProbe:
initialDelaySeconds: 5
periodSeconds: 10
failureThreshold: 30
mountConfig: true
configFiles:
spiffe-helper.conf: |-
agent_address = "/spiffe-workload-api/spire-agent.sock"
cert_dir = "/svid"
svid_file_name = "tls.crt"
svid_key_file_name = "tls.key"
svid_bundle_file_name = "ca.pem"
config.json: |-
{
"storage": { "rootDirectory": "/var/lib/registry" },
"http": {
"address": "0.0.0.0",
"port": "5000",
"compat": ["docker2s2"],
"tls": { "cert": "/svid/tls.crt", "key": "/svid/tls.key" },
"realm": "zot",
"auth": {
"bearer": {
"realm": "https://zot.production.other/zot/auth/token",
"service": "https://zot.production.other",
"oidc": [
{
"issuer": "https://oidc-discovery.production.other",
"audiences": ["zot"],
"certificateAuthorityFile": "/svid/ca.pem",
"claimMapping": { "username": "claims.sub" }
}
]
}
},
"accessControl": {
"repositories": {
"**": {
"policies": [
{
"users": ["spiffe://production.other/image-push"],
"actions": ["read", "create", "update", "delete"]
},
{
"users": ["spiffe://production.other/image-pull"],
"actions": ["read"]
}
]
}
}
}
},
"log": { "level": "debug" }
}
service:
type: ClusterIP
ingress:
enabled: true
className: nginx
pathtype: Prefix
annotations:
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
hosts:
- host: zot.production.other
paths:
- path: /
tests/go.mod
+2 -2
View File
@@ -4,8 +4,9 @@ go 1.26.0
require ( require (
github.com/onsi/ginkgo/v2 v2.32.1 github.com/onsi/ginkgo/v2 v2.32.1
github.com/onsi/gomega v1.42.1 github.com/onsi/gomega v1.43.0
helm.sh/helm/v3 v3.21.4 helm.sh/helm/v3 v3.21.4
k8s.io/apimachinery v0.36.2
) )
require ( require (
@@ -59,7 +60,6 @@ require (
gopkg.in/yaml.v3 v3.0.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/api v0.36.2 // indirect k8s.io/api v0.36.2 // indirect
k8s.io/apiextensions-apiserver v0.36.2 // indirect k8s.io/apiextensions-apiserver v0.36.2 // indirect
k8s.io/apimachinery v0.36.2 // indirect
k8s.io/client-go v0.36.2 // indirect k8s.io/client-go v0.36.2 // indirect
k8s.io/klog/v2 v2.140.0 // indirect k8s.io/klog/v2 v2.140.0 // indirect
k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect
tests/go.sum
+2 -2
View File
@@ -91,8 +91,8 @@ github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw= github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw=
github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44= github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I= github.com/onsi/gomega v1.43.0 h1:VlG/1FxqNxhSO+lq/OHBNaaqwiBK/mO8JbVkX9Y+FeU=
github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg= github.com/onsi/gomega v1.43.0/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
tests/unit/spire_test.go
+115
View File
@@ -810,6 +810,104 @@ spire-server:
} }
}) })
}) })
Describe("spire-server.telemetry.podMonitor controller-manager ports", func() {
podMonitorTmpl := "spire/charts/spire-server/templates/podmonitor.yaml"
serverTmpl := "spire/charts/spire-server/templates/server-resource.yaml"
It("targets the real main controller-manager port name, not the legacy prom-cm", func() {
objs, err := ValueStringRender(chart, `
spire-server:
controllerManager:
enabled: true
telemetry:
prometheus:
enabled: true
podMonitor:
enabled: true
`)
Expect(err).Should(Succeed())
podMonitor := objs[podMonitorTmpl]
Expect(podMonitor).Should(ContainSubstring("- port: prom"))
Expect(podMonitor).Should(ContainSubstring("- port: pm-cm"))
// Regression: the PodMonitor used to hardcode a port name the container never renders.
Expect(podMonitor).ShouldNot(ContainSubstring("prom-cm"))
// The endpoint must match the actual container port.
Expect(objs[serverTmpl]).Should(ContainSubstring("name: pm-cm"))
})
It("enumerates external controller-managers, honouring auto-suffix and prometheusPortName override", func() {
objs, err := ValueStringRender(chart, `
spire-server:
controllerManager:
enabled: true
telemetry:
prometheus:
enabled: true
podMonitor:
enabled: true
kubeConfigs:
child01:
kubeConfig: |
apiVersion: v1
kind: Config
verylongclustername:
kubeConfig: |
apiVersion: v1
kind: Config
externalControllerManagers:
enabled: true
clusters:
child01:
kubeConfigName: child01
verylongclustername:
kubeConfigName: verylongclustername
prometheusPortName: prom-ext2
`)
Expect(err).Should(Succeed())
podMonitor := objs[podMonitorTmpl]
server := objs[serverTmpl]
// Auto-suffixed external CM and the overridden one must both be scraped,
// and each endpoint must match a real container port name.
for _, port := range []string{"pm-cm", "pm-cm-child01", "prom-ext2"} {
Expect(podMonitor).Should(ContainSubstring("- port: " + port))
Expect(server).Should(ContainSubstring("name: " + port))
}
})
It("derives external controller-managers from kubeConfigs when clusters is the default {}", func() {
objs, err := ValueStringRender(chart, `
spire-server:
controllerManager:
enabled: true
telemetry:
prometheus:
enabled: true
podMonitor:
enabled: true
kubeConfigs:
child01:
kubeConfig: |
apiVersion: v1
kind: Config
child02:
kubeConfig: |
apiVersion: v1
kind: Config
externalControllerManagers:
enabled: true
clusters: {}
`)
Expect(err).Should(Succeed())
podMonitor := objs[podMonitorTmpl]
server := objs[serverTmpl]
// clusters={} (the chart default) falls back to kubeConfigs, so each
// kubeConfig-derived controller-manager must be scraped and match its port.
for _, port := range []string{"pm-cm", "pm-cm-child01", "pm-cm-child02"} {
Expect(podMonitor).Should(ContainSubstring("- port: " + port))
Expect(server).Should(ContainSubstring("name: " + port))
}
})
})
Describe("spire-server.dataStore.sql.postgres passwordless", func() { Describe("spire-server.dataStore.sql.postgres passwordless", func() {
It("omits password and the -dbpw Secret for cert auth with an empty password", func() { It("omits password and the -dbpw Secret for cert auth with an empty password", func() {
objs, err := ValueStringRender(chart, ` objs, err := ValueStringRender(chart, `
@@ -887,4 +985,21 @@ spire-server:
Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret")) Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret"))
}) })
}) })
Describe("gatewayAPI.gateway.infrastructure", func() {
It("passes infrastructure through to the shared Gateway spec when set", func() {
objs, err := ValueStringRender(chart, `
gatewayAPI:
gateway:
enabled: true
className: istio
infrastructure:
annotations:
service.beta.kubernetes.io/aws-load-balancer-scheme: internal
`)
Expect(err).Should(Succeed())
gateway := objs["spire/templates/gateway.yaml"]
Expect(gateway).Should(ContainSubstring("infrastructure:"))
Expect(gateway).Should(ContainSubstring("service.beta.kubernetes.io/aws-load-balancer-scheme: internal"))
})
})
}) })