panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Align config across components

Browse Source 
Signed-off-by: Marco Franssen <[email protected]>
This commit is contained in:
Marco Franssen
2023-02-18 13:04:05 +01:00
committed by Marco Franssen
parent 10f0138a25
commit e770a14629
5 changed files with 76 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/README.md
+13 -12
View File
@@ -48,6 +48,7 @@ Kubernetes: `>=1.21.0-0`
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| agent.config.logLevel | string | `"info"` | |
| agent.image.pullPolicy | string | `"IfNotPresent"` | |
| agent.image.registry | string | `"ghcr.io"` | |
| agent.image.repository | string | `"spiffe/spire-agent"` | |
@@ -71,15 +72,14 @@ Kubernetes: `>=1.21.0-0`
| nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | |
| nodeDriverRegistrar.image.version | string | `"v2.0.1"` | |
| nodeDriverRegistrar.resources | object | `{}` | |
| oidc.acme.cacheDir | string | `"/run/spire"` | |
| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
| oidc.acme.emailAddress | string | `"[email protected]"` | |
| oidc.acme.tosAccepted | bool | `false` | |
| oidc.affinity | object | `{}` | |
| oidc.domains[0] | string | `"localhost"` | |
| oidc.domains[1] | string | `"spire-oidc.spire"` | |
| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | |
| oidc.domains[3] | string | `"oidc-discovery.example.org"` | |
| oidc.config.acme.cacheDir | string | `"/run/spire"` | |
| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | |
| oidc.config.acme.emailAddress | string | `"[email protected]"` | |
| oidc.config.acme.tosAccepted | bool | `false` | |
| oidc.config.domains[0] | string | `"localhost"` | |
| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` | |
| oidc.config.logLevel | string | `"info"` | |
| oidc.enabled | bool | `false` | |
| oidc.image.pullPolicy | string | `"IfNotPresent"` | |
| oidc.image.registry | string | `"ghcr.io"` | |
@@ -90,8 +90,6 @@ Kubernetes: `>=1.21.0-0`
| oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | |
| oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | |
| oidc.insecureScheme.nginx.image.version | float | `1.23` | |
| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | |
| oidc.logLevel | string | `"INFO"` | |
| oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | |
| oidc.podAnnotations | object | `{}` | |
| oidc.podSecurityContext | object | `{}` | |
@@ -102,6 +100,11 @@ Kubernetes: `>=1.21.0-0`
| oidc.service.port | int | `80` | |
| oidc.service.type | string | `"NodePort"` | |
| oidc.tolerations | list | `[]` | |
| server.config.ca_subject.common_name | string | `"example.org"` | |
| server.config.ca_subject.country | string | `"NL"` | |
| server.config.ca_subject.organization | string | `"Example"` | |
| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | |
| server.config.logLevel | string | `"info"` | |
| server.dataStorage.accessMode | string | `"ReadWriteOnce"` | |
| server.dataStorage.enabled | bool | `true` | |
| server.dataStorage.size | string | `"1Gi"` | |
@@ -120,9 +123,7 @@ Kubernetes: `>=1.21.0-0`
| serviceAccount.annotations | object | `{}` | |
| serviceAccount.create | bool | `true` | |
| serviceAccount.name | string | `""` | |
| spire.agent.logLevel | string | `"info"` | |
| spire.clusterName | string | `"example-cluster"` | |
| spire.server.logLevel | string | `"info"` | |
| spire.trustDomain | string | `"example.org"` | |
| waitForIt.image.pullPolicy | string | `"IfNotPresent"` | |
| waitForIt.image.registry | string | `"gcr.io"` | |
charts/spire/templates/agent-configmap.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ data:
agent.conf: |
agent {
data_dir = "/run/spire"
log_level = "{{ .Values.spire.agent.logLevel }}"
log_level = "{{ .Values.agent.config.logLevel }}"
server_address = "{{ include "spire.fullname" . }}-server"
server_port = "{{ .Values.server.service.port }}"
socket_path = "/run/spire/agent-sockets/agent.sock"
charts/spire/templates/oidc-dp-configmap.yaml
+7 -7
View File
@@ -6,13 +6,13 @@ metadata:
namespace: {{ .Release.Namespace }}
data:
oidc-discovery-provider.conf: |
log_level = "{{ .Values.oidc.logLevel }}"
log_level = "{{ .Values.oidc.config.logLevel }}"
domains = [
"spire-oidc.{{ .Release.Namespace }}",
"spire-oidc.{{ .Release.Namespace }}.svc.cluster.local",
{{- if gt (len .Values.oidc.domains) 0 }}
"{{- join "\",\n \"" .Values.oidc.domains }}"
{{- if gt (len .Values.oidc.config.domains) 0 }}
"{{- join "\",\n \"" .Values.oidc.config.domains }}"
{{- end }}
]
@@ -21,10 +21,10 @@ data:
listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock"
{{- else }}
acme {
directory_url = "{{ .Values.oidc.acme.directoryUrl }}"
cache_dir = "{{ .Values.oidc.acme.cacheDir }}"
tos_accepted = {{ .Values.oidc.acme.tosAccepted }}
email = "{{ .Values.oidc.acme.emailAddress }}"
directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}"
cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}"
tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }}
email = "{{ .Values.oidc.config.acme.emailAddress }}"
}
{{- end }}
charts/spire/templates/server-configmap.yaml
+8 -6
View File
@@ -11,19 +11,21 @@ data:
socket_path = "/run/spire/server-sockets/registration.sock"
trust_domain = {{ .Values.spire.trustDomain | quote }}
data_dir = "/run/spire/data"
log_level = "{{ .Values.spire.server.logLevel }}"
#AWS requires the use of RSA. EC cryptography is not supported
log_level = "{{ .Values.server.config.logLevel }}"
# AWS requires the use of RSA. EC cryptography is not supported
ca_key_type = "rsa-2048"
{{- if eq (.Values.oidc.enabled | toString) "true" }}
jwt_issuer = "{{ .Values.oidc.jwtIssuer }}"
jwt_issuer = "{{ .Values.server.config.jwtIssuer }}"
{{ end }}
default_x509_svid_ttl = "1h"
default_jwt_svid_ttl = "1h"
ca_subject = {
country = ["NL"],
organization = ["EXAMPLE"],
common_name = "",
{{- with .Values.server.config.ca_subject }}
country = [{{ .country | quote }}],
organization = [{{ .organization | quote }}],
common_name = {{ .common_name | quote }},
{{- end }}
}
}
charts/spire/values.yaml
+47 -41
View File
@@ -75,6 +75,43 @@ server:
# runAsNonRoot: true
# runAsUser: 1000
config:
logLevel: info
jwtIssuer: oidc-discovery.example.org
ca_subject:
country: NL
organization: Example
common_name: example.org
agent:
image:
# registry: gcr.io
# repository: spiffe-io/spire-agent
registry: ghcr.io
repository: spiffe/spire-agent
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 64Mi
# limits:
# cpu: 100m
# memory: 128Mi
config:
logLevel: info
csiDriver:
image:
registry: ghcr.io
@@ -138,20 +175,12 @@ oidc:
# cpu: 100m
# memory: 64Mi
logLevel: INFO
service:
type: NodePort
port: 80
annotations: {}
# external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org
jwtIssuer: oidc-discovery.example.org
domains:
- localhost
- oidc-discovery.example.org
podSecurityContext: {}
# fsGroup: 2000
@@ -178,36 +207,17 @@ oidc:
pullPolicy: IfNotPresent
version: 1.23
acme:
tosAccepted: false
cacheDir: /run/spire
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
emailAddress: [email protected]
config:
logLevel: info
domains:
- localhost
- oidc-discovery.example.org
agent:
image:
# registry: gcr.io
# repository: spiffe-io/spire-agent
registry: ghcr.io
repository: spiffe/spire-agent
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
version: ""
nodeSelector:
kubernetes.io/arch: amd64
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
# choice for the user. This also increases chances charts run on environments with little
# resources, such as Minikube. If you do want to specify resources, uncomment the following
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
# requests:
# cpu: 50m
# memory: 64Mi
# limits:
# cpu: 100m
# memory: 128Mi
acme:
tosAccepted: false
cacheDir: /run/spire
directoryUrl: https://acme-v02.api.letsencrypt.org/directory
emailAddress: [email protected]
imagePullSecrets: []
# - name: my-docker-registry
@@ -236,7 +246,3 @@ autoscaling:
spire:
clusterName: "example-cluster"
trustDomain: "example.org"
agent:
logLevel: info
server:
logLevel: info