Add all built in BundlePublishers (#430)
* Add all built in BundlePublishers Signed-off-by: Kevin Fox <[email protected]> * Add secret management Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -348,6 +348,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||||
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||||
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||||
|
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||||
|
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||||
|
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||||
|
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||||
|
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||||
|
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||||
|
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||||
|
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||||
|
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||||
|
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||||
|
|
||||||
### Tornjak
|
### Tornjak
|
||||||
|
|
||||||
@@ -387,6 +399,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||||
| `tornjak.securityContext` | Security Context to use | `{}` |
|
| `tornjak.securityContext` | Security Context to use | `{}` |
|
||||||
|
| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` |
|
||||||
|
| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` |
|
||||||
|
| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` |
|
||||||
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
||||||
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
||||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||||
|
|||||||
@@ -1,17 +0,0 @@
|
|||||||
{{- $root := . }}
|
|
||||||
{{- with .Values.keyManager.awsKMS }}
|
|
||||||
{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: {{ include "spire-server.fullname" $root }}-aws-kms
|
|
||||||
namespace: {{ include "spire-server.namespace" $root }}
|
|
||||||
data:
|
|
||||||
{{- if ne .accessKeyID "" }}
|
|
||||||
AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if ne .secretAccessKey "" }}
|
|
||||||
AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
{{- $root := . }}
|
||||||
|
{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: {{ include "spire-server.fullname" $root }}-cloud
|
||||||
|
namespace: {{ include "spire-server.namespace" $root }}
|
||||||
|
data:
|
||||||
|
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
||||||
|
AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||||
|
AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||||
|
AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||||
|
AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||||
|
GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@@ -247,6 +247,31 @@ plugins:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||||
|
BundlePublisher:
|
||||||
|
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
||||||
|
aws_rolesanywhere_trustanchor:
|
||||||
|
plugin_data:
|
||||||
|
region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
|
||||||
|
trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.bundlePublisher.awsS3.enabled }}
|
||||||
|
aws_s3:
|
||||||
|
plugin_data:
|
||||||
|
region: {{ .Values.bundlePublisher.awsS3.region | quote }}
|
||||||
|
bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
|
||||||
|
object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
|
||||||
|
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||||
|
gcp_cloudstorage:
|
||||||
|
plugin_data:
|
||||||
|
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
|
||||||
|
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
|
||||||
|
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.upstreamAuthority.disk }}
|
{{- with .Values.upstreamAuthority.disk }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
{{- if eq (.enabled | toString) "true" }}
|
||||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||||
|
|||||||
@@ -174,16 +174,37 @@ spec:
|
|||||||
- name: AWS_KMS_ACCESS_KEY_ID
|
- name: AWS_KMS_ACCESS_KEY_ID
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: {{ $fullname }}-aws-kms
|
name: {{ $fullname }}-cloud
|
||||||
key: AWS_KMS_ACCESS_KEY_ID
|
key: AWS_KMS_ACCESS_KEY_ID
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||||
- name: AWS_KMS_SECRET_ACCESS_KEY
|
- name: AWS_KMS_SECRET_ACCESS_KEY
|
||||||
valueFrom:
|
valueFrom:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
name: {{ $fullname }}-aws-kms
|
name: {{ $fullname }}-cloud
|
||||||
key: AWS_KMS_SECRET_ACCESS_KEY
|
key: AWS_KMS_SECRET_ACCESS_KEY
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||||
|
- name: AWS_ACCESS_KEY_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ $fullname }}-cloud
|
||||||
|
key: AWS_ACCESS_KEY_ID
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||||
|
- name: AWS_SECRET_ACCESS_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ $fullname }}-cloud
|
||||||
|
key: AWS_SECRET_ACCESS_KEY
|
||||||
|
{{- end }}
|
||||||
|
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||||
|
- name: GOOGLE_APPLICATION_CREDENTIALS
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: {{ $fullname }}-cloud
|
||||||
|
key: GOOGLE_APPLICATION_CREDENTIALS
|
||||||
|
{{- end }}
|
||||||
ports:
|
ports:
|
||||||
- name: grpc
|
- name: grpc
|
||||||
containerPort: 8081
|
containerPort: 8081
|
||||||
|
|||||||
@@ -849,6 +849,36 @@ nodeAttestor:
|
|||||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||||
hashes: []
|
hashes: []
|
||||||
|
|
||||||
|
# The secrets needed for this plugin are configured in the secrets: section
|
||||||
|
bundlePublisher:
|
||||||
|
awsRolesAnywhereTrustAnchor:
|
||||||
|
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
|
||||||
|
enabled: false
|
||||||
|
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle
|
||||||
|
region: ""
|
||||||
|
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to
|
||||||
|
trustAnchorID: ""
|
||||||
|
awsS3:
|
||||||
|
## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher
|
||||||
|
enabled: false
|
||||||
|
## @param bundlePublisher.awsS3.region AWS region to store the trust bundle
|
||||||
|
region: ""
|
||||||
|
## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded
|
||||||
|
bucket: ""
|
||||||
|
## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket
|
||||||
|
objectKey: ""
|
||||||
|
## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||||
|
format: ""
|
||||||
|
gcpCloudStorage:
|
||||||
|
## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher
|
||||||
|
enabled: false
|
||||||
|
## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded
|
||||||
|
bucketName: ""
|
||||||
|
## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name
|
||||||
|
objectName: ""
|
||||||
|
## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||||
|
format: ""
|
||||||
|
|
||||||
## @section Tornjak
|
## @section Tornjak
|
||||||
tornjak:
|
tornjak:
|
||||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||||
@@ -964,6 +994,16 @@ tornjak:
|
|||||||
## @param tornjak.securityContext [object] Security Context to use
|
## @param tornjak.securityContext [object] Security Context to use
|
||||||
securityContext: {}
|
securityContext: {}
|
||||||
|
|
||||||
|
secrets:
|
||||||
|
aws:
|
||||||
|
## @param secrets.aws.accessKeyID AWS Access Key ID
|
||||||
|
accessKeyID: ""
|
||||||
|
## @param secrets.aws.secretAccessKey AWS Secret Access Key
|
||||||
|
secretAccessKey: ""
|
||||||
|
gcp:
|
||||||
|
## @param secrets.gcp.applicationCredentials Google Application Credentials
|
||||||
|
applicationCredentials: ""
|
||||||
|
|
||||||
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
||||||
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
||||||
# can prioritize proper support.
|
# can prioritize proper support.
|
||||||
|
|||||||
Reference in New Issue
Block a user