From e72b94fc138fec3774aea89510345355d6d6f01e Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Tue, 27 Aug 2024 12:35:23 -0700 Subject: [PATCH] Add all built in BundlePublishers (#430) * Add all built in BundlePublishers Signed-off-by: Kevin Fox * Add secret management Signed-off-by: Kevin Fox * Fix typo Signed-off-by: Kevin Fox * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon Signed-off-by: kfox1111 --------- Signed-off-by: Kevin Fox Signed-off-by: kfox1111 Co-authored-by: Faisal Memon --- charts/spire/charts/spire-server/README.md | 15 +++++++ .../templates/aws-kms-secret.yaml | 17 -------- .../spire-server/templates/cloud-secret.yaml | 24 +++++++++++ .../spire-server/templates/configmap.yaml | 25 ++++++++++++ .../templates/server-resource.yaml | 25 +++++++++++- charts/spire/charts/spire-server/values.yaml | 40 +++++++++++++++++++ 6 files changed, 127 insertions(+), 19 deletions(-) delete mode 100644 charts/spire/charts/spire-server/templates/aws-kms-secret.yaml create mode 100644 charts/spire/charts/spire-server/templates/cloud-secret.yaml diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index a3d6f07..b062814 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -348,6 +348,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` | | `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` | | `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` | +| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` | +| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` | +| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` | +| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` | +| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` | +| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` | +| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` | +| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` | +| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` | +| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` | +| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` | +| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` | ### Tornjak @@ -387,6 +399,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` | | `tornjak.resources` | Resource requests and limits | `{}` | | `tornjak.securityContext` | Security Context to use | `{}` | +| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` | +| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` | +| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` | | `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` | | `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` | | `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` | diff --git a/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml b/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml deleted file mode 100644 index 3477dcc..0000000 --- a/charts/spire/charts/spire-server/templates/aws-kms-secret.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{- $root := . }} -{{- with .Values.keyManager.awsKMS }} -{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "spire-server.fullname" $root }}-aws-kms - namespace: {{ include "spire-server.namespace" $root }} -data: - {{- if ne .accessKeyID "" }} - AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }} - {{- end }} - {{- if ne .secretAccessKey "" }} - AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }} - {{- end }} -{{- end }} -{{- end }} diff --git a/charts/spire/charts/spire-server/templates/cloud-secret.yaml b/charts/spire/charts/spire-server/templates/cloud-secret.yaml new file mode 100644 index 0000000..4b408f2 --- /dev/null +++ b/charts/spire/charts/spire-server/templates/cloud-secret.yaml @@ -0,0 +1,24 @@ +{{- $root := . }} +{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "spire-server.fullname" $root }}-cloud + namespace: {{ include "spire-server.namespace" $root }} +data: + {{- if ne .Values.keyManager.awsKMS.accessKeyID "" }} + AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }} + {{- end }} + {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }} + AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }} + {{- end }} + {{- if ne .Values.secrets.aws.accessKeyID "" }} + AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }} + {{- end }} + {{- if ne .Values.secrets.aws.secretAccessKey "" }} + AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }} + {{- end }} + {{- if ne .Values.secrets.gcp.applicationCredentials "" }} + GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }} + {{- end }} +{{- end }} diff --git a/charts/spire/charts/spire-server/templates/configmap.yaml b/charts/spire/charts/spire-server/templates/configmap.yaml index 0744d9d..5cc1e4b 100644 --- a/charts/spire/charts/spire-server/templates/configmap.yaml +++ b/charts/spire/charts/spire-server/templates/configmap.yaml @@ -247,6 +247,31 @@ plugins: {{- end }} {{- end }} + {{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }} + BundlePublisher: + {{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }} + aws_rolesanywhere_trustanchor: + plugin_data: + region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }} + trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }} + {{- end }} + {{- if .Values.bundlePublisher.awsS3.enabled }} + aws_s3: + plugin_data: + region: {{ .Values.bundlePublisher.awsS3.region | quote }} + bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }} + object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }} + format: {{ .Values.bundlePublisher.awsS3.format | quote }} + {{- end }} + {{- if .Values.bundlePublisher.gcpCloudStorage.enabled }} + gcp_cloudstorage: + plugin_data: + bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }} + object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }} + format: {{ .Values.bundlePublisher.awsS3.format | quote }} + {{- end }} + {{- end }} + {{- with .Values.upstreamAuthority.disk }} {{- if eq (.enabled | toString) "true" }} {{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }} diff --git a/charts/spire/charts/spire-server/templates/server-resource.yaml b/charts/spire/charts/spire-server/templates/server-resource.yaml index 8e3ecc7..1a52494 100644 --- a/charts/spire/charts/spire-server/templates/server-resource.yaml +++ b/charts/spire/charts/spire-server/templates/server-resource.yaml @@ -174,16 +174,37 @@ spec: - name: AWS_KMS_ACCESS_KEY_ID valueFrom: secretKeyRef: - name: {{ $fullname }}-aws-kms + name: {{ $fullname }}-cloud key: AWS_KMS_ACCESS_KEY_ID {{- end }} {{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }} - name: AWS_KMS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: - name: {{ $fullname }}-aws-kms + name: {{ $fullname }}-cloud key: AWS_KMS_SECRET_ACCESS_KEY {{- end }} + {{- if ne .Values.secrets.aws.accessKeyID "" }} + - name: AWS_ACCESS_KEY_ID + valueFrom: + secretKeyRef: + name: {{ $fullname }}-cloud + key: AWS_ACCESS_KEY_ID + {{- end }} + {{- if ne .Values.secrets.aws.secretAccessKey "" }} + - name: AWS_SECRET_ACCESS_KEY + valueFrom: + secretKeyRef: + name: {{ $fullname }}-cloud + key: AWS_SECRET_ACCESS_KEY + {{- end }} + {{- if ne .Values.secrets.gcp.applicationCredentials "" }} + - name: GOOGLE_APPLICATION_CREDENTIALS + valueFrom: + secretKeyRef: + name: {{ $fullname }}-cloud + key: GOOGLE_APPLICATION_CREDENTIALS + {{- end }} ports: - name: grpc containerPort: 8081 diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 5967557..601453d 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -849,6 +849,36 @@ nodeAttestor: ## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect. hashes: [] +# The secrets needed for this plugin are configured in the secrets: section +bundlePublisher: + awsRolesAnywhereTrustAnchor: + ## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher + enabled: false + ## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle + region: "" + ## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to + trustAnchorID: "" + awsS3: + ## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher + enabled: false + ## @param bundlePublisher.awsS3.region AWS region to store the trust bundle + region: "" + ## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded + bucket: "" + ## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket + objectKey: "" + ## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] + format: "" + gcpCloudStorage: + ## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher + enabled: false + ## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded + bucketName: "" + ## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name + objectName: "" + ## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] + format: "" + ## @section Tornjak tornjak: ## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production) @@ -964,6 +994,16 @@ tornjak: ## @param tornjak.securityContext [object] Security Context to use securityContext: {} +secrets: + aws: + ## @param secrets.aws.accessKeyID AWS Access Key ID + accessKeyID: "" + ## @param secrets.aws.secretAccessKey AWS Secret Access Key + secretAccessKey: "" + gcp: + ## @param secrets.gcp.applicationCredentials Google Application Credentials + applicationCredentials: "" + # NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart. # Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we # can prioritize proper support.