Add all built in BundlePublishers (#430)
* Add all built in BundlePublishers Signed-off-by: Kevin Fox <[email protected]> * Add secret management Signed-off-by: Kevin Fox <[email protected]> * Fix typo Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-server/values.yaml Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -348,6 +348,18 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
|
||||
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
|
||||
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID` | AWS trust anchor ID to publish to | `""` |
|
||||
| `bundlePublisher.awsS3.enabled` | Enable the AWS S3 bundle publisher | `false` |
|
||||
| `bundlePublisher.awsS3.region` | AWS region to store the trust bundle | `""` |
|
||||
| `bundlePublisher.awsS3.bucket` | AWS S3 bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.awsS3.objectKey` | AWS S3 object key inside the bucket | `""` |
|
||||
| `bundlePublisher.awsS3.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.enabled` | Enable the Google Cloud Storage bundle publisher | `false` |
|
||||
| `bundlePublisher.gcpCloudStorage.bucketName` | Google Cloud Storage bucket name to which the trust bundle is uploaded | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.objectName` | Google Cloud Storage object name | `""` |
|
||||
| `bundlePublisher.gcpCloudStorage.format` | Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem] | `""` |
|
||||
|
||||
### Tornjak
|
||||
|
||||
@@ -387,6 +399,9 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
||||
| `tornjak.config.clientCA.name` | Name of the resource secret or configMap with user CA for TLS | `tornjak-client-ca` |
|
||||
| `tornjak.resources` | Resource requests and limits | `{}` |
|
||||
| `tornjak.securityContext` | Security Context to use | `{}` |
|
||||
| `secrets.aws.accessKeyID` | AWS Access Key ID | `""` |
|
||||
| `secrets.aws.secretAccessKey` | AWS Secret Access Key | `""` |
|
||||
| `secrets.gcp.applicationCredentials` | Google Application Credentials | `""` |
|
||||
| `customPlugins.bundlePublisher` | Custom plugins of type BundlePublisher are configured here | `{}` |
|
||||
| `customPlugins.credentialComposer` | Custom plugins of type CredentialComposer are configured here | `{}` |
|
||||
| `customPlugins.keyManager` | Custom plugins of type KeyManager are configured here | `{}` |
|
||||
|
||||
@@ -1,17 +0,0 @@
|
||||
{{- $root := . }}
|
||||
{{- with .Values.keyManager.awsKMS }}
|
||||
{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" $root }}-aws-kms
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
data:
|
||||
{{- if ne .accessKeyID "" }}
|
||||
AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .secretAccessKey "" }}
|
||||
AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- $root := . }}
|
||||
{{- if or (ne .Values.keyManager.awsKMS.accessKeyID "") (ne .Values.keyManager.awsKMS.secretAccessKey "") (ne .Values.secrets.aws.accessKeyID "") (ne .Values.secrets.aws.secretAccessKey "") (ne .Values.secrets.gcp.applicationCredentials "") }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spire-server.fullname" $root }}-cloud
|
||||
namespace: {{ include "spire-server.namespace" $root }}
|
||||
data:
|
||||
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
|
||||
AWS_KMS_ACCESS_KEY_ID: {{ .Values.keyManager.awsKMS.accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||
AWS_KMS_SECRET_ACCESS_KEY: {{ .Values.keyManager.awsKMS.secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||
AWS_ACCESS_KEY_ID: {{ .Values.secrets.aws.accessKeyID | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||
AWS_SECRET_ACCESS_KEY: {{ .Values.secrets.aws.secretAccessKey | b64enc }}
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||
GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.secrets.gcp.applicationCredentials | b64enc }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -247,6 +247,31 @@ plugins:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if or .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled .Values.bundlePublisher.awsS3.enabled .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
BundlePublisher:
|
||||
{{- if .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.enabled }}
|
||||
aws_rolesanywhere_trustanchor:
|
||||
plugin_data:
|
||||
region: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.region | quote }}
|
||||
trust_anchor_id: {{ .Values.bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.awsS3.enabled }}
|
||||
aws_s3:
|
||||
plugin_data:
|
||||
region: {{ .Values.bundlePublisher.awsS3.region | quote }}
|
||||
bucket: {{ .Values.bundlePublisher.awsS3.bucket | quote }}
|
||||
object_key: {{ .Values.bundlePublisher.awsS3.objectKey | quote }}
|
||||
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.bundlePublisher.gcpCloudStorage.enabled }}
|
||||
gcp_cloudstorage:
|
||||
plugin_data:
|
||||
bucket_name: {{ .Values.bundlePublisher.gcpCloudStorage.bucketName | quote }}
|
||||
object_name: {{ .Values.bundlePublisher.gcpCloudStorage.objectName | quote }}
|
||||
format: {{ .Values.bundlePublisher.awsS3.format | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.upstreamAuthority.disk }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
||||
|
||||
@@ -174,16 +174,37 @@ spec:
|
||||
- name: AWS_KMS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-aws-kms
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_KMS_ACCESS_KEY_ID
|
||||
{{- end }}
|
||||
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
|
||||
- name: AWS_KMS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-aws-kms
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_KMS_SECRET_ACCESS_KEY
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.accessKeyID "" }}
|
||||
- name: AWS_ACCESS_KEY_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.aws.secretAccessKey "" }}
|
||||
- name: AWS_SECRET_ACCESS_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
{{- end }}
|
||||
{{- if ne .Values.secrets.gcp.applicationCredentials "" }}
|
||||
- name: GOOGLE_APPLICATION_CREDENTIALS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ $fullname }}-cloud
|
||||
key: GOOGLE_APPLICATION_CREDENTIALS
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: 8081
|
||||
|
||||
@@ -849,6 +849,36 @@ nodeAttestor:
|
||||
## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
|
||||
hashes: []
|
||||
|
||||
# The secrets needed for this plugin are configured in the secrets: section
|
||||
bundlePublisher:
|
||||
awsRolesAnywhereTrustAnchor:
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.enabled Enable the AWS S3 bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.region AWS region to store the trust bundle
|
||||
region: ""
|
||||
## @param bundlePublisher.awsRolesAnywhereTrustAnchor.trustAnchorID AWS trust anchor ID to publish to
|
||||
trustAnchorID: ""
|
||||
awsS3:
|
||||
## @param bundlePublisher.awsS3.enabled Enable the AWS S3 bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.awsS3.region AWS region to store the trust bundle
|
||||
region: ""
|
||||
## @param bundlePublisher.awsS3.bucket AWS S3 bucket name to which the trust bundle is uploaded
|
||||
bucket: ""
|
||||
## @param bundlePublisher.awsS3.objectKey AWS S3 object key inside the bucket
|
||||
objectKey: ""
|
||||
## @param bundlePublisher.awsS3.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||
format: ""
|
||||
gcpCloudStorage:
|
||||
## @param bundlePublisher.gcpCloudStorage.enabled Enable the Google Cloud Storage bundle publisher
|
||||
enabled: false
|
||||
## @param bundlePublisher.gcpCloudStorage.bucketName Google Cloud Storage bucket name to which the trust bundle is uploaded
|
||||
bucketName: ""
|
||||
## @param bundlePublisher.gcpCloudStorage.objectName Google Cloud Storage object name
|
||||
objectName: ""
|
||||
## @param bundlePublisher.gcpCloudStorage.format Format in which the trust bundle is stored. Valid options [spiffe, jwks, pem]
|
||||
format: ""
|
||||
|
||||
## @section Tornjak
|
||||
tornjak:
|
||||
## @param tornjak.enabled Deploys Tornjak API (backend) (Not for production)
|
||||
@@ -964,6 +994,16 @@ tornjak:
|
||||
## @param tornjak.securityContext [object] Security Context to use
|
||||
securityContext: {}
|
||||
|
||||
secrets:
|
||||
aws:
|
||||
## @param secrets.aws.accessKeyID AWS Access Key ID
|
||||
accessKeyID: ""
|
||||
## @param secrets.aws.secretAccessKey AWS Secret Access Key
|
||||
secretAccessKey: ""
|
||||
gcp:
|
||||
## @param secrets.gcp.applicationCredentials Google Application Credentials
|
||||
applicationCredentials: ""
|
||||
|
||||
# NOTE: This is unsupported and only to configure currently supported spire built in plugins but plugins unsupported by the chart.
|
||||
# Upgrades wont be tested for anything under this config. If you need this, please let the chart developers know your needs so we
|
||||
# can prioritize proper support.
|
||||
|
||||
Reference in New Issue
Block a user