From e770a1462935b1720ed6b5909b6c3db1d113bad5 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Sun, 6 Nov 2022 14:00:33 +0100 Subject: [PATCH] Align config across components Signed-off-by: Marco Franssen --- charts/spire/README.md | 25 +++--- charts/spire/templates/agent-configmap.yaml | 2 +- charts/spire/templates/oidc-dp-configmap.yaml | 14 +-- charts/spire/templates/server-configmap.yaml | 14 +-- charts/spire/values.yaml | 88 ++++++++++--------- 5 files changed, 76 insertions(+), 67 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 9f14f38..484b019 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -48,6 +48,7 @@ Kubernetes: `>=1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| +| agent.config.logLevel | string | `"info"` | | | agent.image.pullPolicy | string | `"IfNotPresent"` | | | agent.image.registry | string | `"ghcr.io"` | | | agent.image.repository | string | `"spiffe/spire-agent"` | | @@ -71,15 +72,14 @@ Kubernetes: `>=1.21.0-0` | nodeDriverRegistrar.image.repository | string | `"k8scsi/csi-node-driver-registrar"` | | | nodeDriverRegistrar.image.version | string | `"v2.0.1"` | | | nodeDriverRegistrar.resources | object | `{}` | | -| oidc.acme.cacheDir | string | `"/run/spire"` | | -| oidc.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | -| oidc.acme.emailAddress | string | `"letsencrypt@example.org"` | | -| oidc.acme.tosAccepted | bool | `false` | | | oidc.affinity | object | `{}` | | -| oidc.domains[0] | string | `"localhost"` | | -| oidc.domains[1] | string | `"spire-oidc.spire"` | | -| oidc.domains[2] | string | `"spire-oidc.spire.svc.cluster.local"` | | -| oidc.domains[3] | string | `"oidc-discovery.example.org"` | | +| oidc.config.acme.cacheDir | string | `"/run/spire"` | | +| oidc.config.acme.directoryUrl | string | `"https://acme-v02.api.letsencrypt.org/directory"` | | +| oidc.config.acme.emailAddress | string | `"letsencrypt@example.org"` | | +| oidc.config.acme.tosAccepted | bool | `false` | | +| oidc.config.domains[0] | string | `"localhost"` | | +| oidc.config.domains[1] | string | `"oidc-discovery.example.org"` | | +| oidc.config.logLevel | string | `"info"` | | | oidc.enabled | bool | `false` | | | oidc.image.pullPolicy | string | `"IfNotPresent"` | | | oidc.image.registry | string | `"ghcr.io"` | | @@ -90,8 +90,6 @@ Kubernetes: `>=1.21.0-0` | oidc.insecureScheme.nginx.image.registry | string | `"cgr.dev"` | | | oidc.insecureScheme.nginx.image.repository | string | `"chainguard/nginx"` | | | oidc.insecureScheme.nginx.image.version | float | `1.23` | | -| oidc.jwtIssuer | string | `"oidc-discovery.example.org"` | | -| oidc.logLevel | string | `"INFO"` | | | oidc.nodeSelector."kubernetes.io/arch" | string | `"amd64"` | | | oidc.podAnnotations | object | `{}` | | | oidc.podSecurityContext | object | `{}` | | @@ -102,6 +100,11 @@ Kubernetes: `>=1.21.0-0` | oidc.service.port | int | `80` | | | oidc.service.type | string | `"NodePort"` | | | oidc.tolerations | list | `[]` | | +| server.config.ca_subject.common_name | string | `"example.org"` | | +| server.config.ca_subject.country | string | `"NL"` | | +| server.config.ca_subject.organization | string | `"Example"` | | +| server.config.jwtIssuer | string | `"oidc-discovery.example.org"` | | +| server.config.logLevel | string | `"info"` | | | server.dataStorage.accessMode | string | `"ReadWriteOnce"` | | | server.dataStorage.enabled | bool | `true` | | | server.dataStorage.size | string | `"1Gi"` | | @@ -120,9 +123,7 @@ Kubernetes: `>=1.21.0-0` | serviceAccount.annotations | object | `{}` | | | serviceAccount.create | bool | `true` | | | serviceAccount.name | string | `""` | | -| spire.agent.logLevel | string | `"info"` | | | spire.clusterName | string | `"example-cluster"` | | -| spire.server.logLevel | string | `"info"` | | | spire.trustDomain | string | `"example.org"` | | | waitForIt.image.pullPolicy | string | `"IfNotPresent"` | | | waitForIt.image.registry | string | `"gcr.io"` | | diff --git a/charts/spire/templates/agent-configmap.yaml b/charts/spire/templates/agent-configmap.yaml index fd5d41b..e0fb6e1 100644 --- a/charts/spire/templates/agent-configmap.yaml +++ b/charts/spire/templates/agent-configmap.yaml @@ -7,7 +7,7 @@ data: agent.conf: | agent { data_dir = "/run/spire" - log_level = "{{ .Values.spire.agent.logLevel }}" + log_level = "{{ .Values.agent.config.logLevel }}" server_address = "{{ include "spire.fullname" . }}-server" server_port = "{{ .Values.server.service.port }}" socket_path = "/run/spire/agent-sockets/agent.sock" diff --git a/charts/spire/templates/oidc-dp-configmap.yaml b/charts/spire/templates/oidc-dp-configmap.yaml index e14d627..18e1fdd 100644 --- a/charts/spire/templates/oidc-dp-configmap.yaml +++ b/charts/spire/templates/oidc-dp-configmap.yaml @@ -6,13 +6,13 @@ metadata: namespace: {{ .Release.Namespace }} data: oidc-discovery-provider.conf: | - log_level = "{{ .Values.oidc.logLevel }}" + log_level = "{{ .Values.oidc.config.logLevel }}" domains = [ "spire-oidc.{{ .Release.Namespace }}", "spire-oidc.{{ .Release.Namespace }}.svc.cluster.local", - {{- if gt (len .Values.oidc.domains) 0 }} - "{{- join "\",\n \"" .Values.oidc.domains }}" + {{- if gt (len .Values.oidc.config.domains) 0 }} + "{{- join "\",\n \"" .Values.oidc.config.domains }}" {{- end }} ] @@ -21,10 +21,10 @@ data: listen_socket_path = "/run/spire/oidc-sockets/oidc-server.sock" {{- else }} acme { - directory_url = "{{ .Values.oidc.acme.directoryUrl }}" - cache_dir = "{{ .Values.oidc.acme.cacheDir }}" - tos_accepted = {{ .Values.oidc.acme.tosAccepted }} - email = "{{ .Values.oidc.acme.emailAddress }}" + directory_url = "{{ .Values.oidc.config.acme.directoryUrl }}" + cache_dir = "{{ .Values.oidc.config.acme.cacheDir }}" + tos_accepted = {{ .Values.oidc.config.acme.tosAccepted }} + email = "{{ .Values.oidc.config.acme.emailAddress }}" } {{- end }} diff --git a/charts/spire/templates/server-configmap.yaml b/charts/spire/templates/server-configmap.yaml index b358189..78ccb53 100644 --- a/charts/spire/templates/server-configmap.yaml +++ b/charts/spire/templates/server-configmap.yaml @@ -11,19 +11,21 @@ data: socket_path = "/run/spire/server-sockets/registration.sock" trust_domain = {{ .Values.spire.trustDomain | quote }} data_dir = "/run/spire/data" - log_level = "{{ .Values.spire.server.logLevel }}" - #AWS requires the use of RSA. EC cryptography is not supported + log_level = "{{ .Values.server.config.logLevel }}" + # AWS requires the use of RSA. EC cryptography is not supported ca_key_type = "rsa-2048" {{- if eq (.Values.oidc.enabled | toString) "true" }} - jwt_issuer = "{{ .Values.oidc.jwtIssuer }}" + jwt_issuer = "{{ .Values.server.config.jwtIssuer }}" {{ end }} default_x509_svid_ttl = "1h" default_jwt_svid_ttl = "1h" ca_subject = { - country = ["NL"], - organization = ["EXAMPLE"], - common_name = "", + {{- with .Values.server.config.ca_subject }} + country = [{{ .country | quote }}], + organization = [{{ .organization | quote }}], + common_name = {{ .common_name | quote }}, + {{- end }} } } diff --git a/charts/spire/values.yaml b/charts/spire/values.yaml index 65993eb..bbcc2f2 100644 --- a/charts/spire/values.yaml +++ b/charts/spire/values.yaml @@ -75,6 +75,43 @@ server: # runAsNonRoot: true # runAsUser: 1000 + config: + logLevel: info + jwtIssuer: oidc-discovery.example.org + + ca_subject: + country: NL + organization: Example + common_name: example.org + +agent: + image: + # registry: gcr.io + # repository: spiffe-io/spire-agent + registry: ghcr.io + repository: spiffe/spire-agent + pullPolicy: IfNotPresent + # Overrides the image tag whose default is the chart appVersion. + version: "" + + nodeSelector: + kubernetes.io/arch: amd64 + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # requests: + # cpu: 50m + # memory: 64Mi + # limits: + # cpu: 100m + # memory: 128Mi + + config: + logLevel: info + csiDriver: image: registry: ghcr.io @@ -138,20 +175,12 @@ oidc: # cpu: 100m # memory: 64Mi - logLevel: INFO - service: type: NodePort port: 80 annotations: {} # external-dns.alpha.kubernetes.io/hostname: oidc-discovery.example.org - jwtIssuer: oidc-discovery.example.org - - domains: - - localhost - - oidc-discovery.example.org - podSecurityContext: {} # fsGroup: 2000 @@ -178,36 +207,17 @@ oidc: pullPolicy: IfNotPresent version: 1.23 - acme: - tosAccepted: false - cacheDir: /run/spire - directoryUrl: https://acme-v02.api.letsencrypt.org/directory - emailAddress: letsencrypt@example.org + config: + logLevel: info + domains: + - localhost + - oidc-discovery.example.org -agent: - image: - # registry: gcr.io - # repository: spiffe-io/spire-agent - registry: ghcr.io - repository: spiffe/spire-agent - pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. - version: "" - - nodeSelector: - kubernetes.io/arch: amd64 - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # requests: - # cpu: 50m - # memory: 64Mi - # limits: - # cpu: 100m - # memory: 128Mi + acme: + tosAccepted: false + cacheDir: /run/spire + directoryUrl: https://acme-v02.api.letsencrypt.org/directory + emailAddress: letsencrypt@example.org imagePullSecrets: [] # - name: my-docker-registry @@ -236,7 +246,3 @@ autoscaling: spire: clusterName: "example-cluster" trustDomain: "example.org" - agent: - logLevel: info - server: - logLevel: info