spiffe-step-ssh server (#198)
* Initial prototype of spire-step-ssh integration Signed-off-by: Kevin Fox <[email protected]> * Ingress work, image cleanup and misc cleanup Signed-off-by: Kevin Fox <[email protected]> * More values rework Signed-off-by: Kevin Fox <[email protected]> * Rename chart spiffe-step-ssh Signed-off-by: Kevin Fox <[email protected]> * Update to use shared lib Signed-off-by: Kevin Fox <[email protected]> * Update spiffe-helper Signed-off-by: Kevin Fox <[email protected]> * Use URLSAN rather then CN Signed-off-by: Kevin Fox <[email protected]> * Lookup the sans. Signed-off-by: Kevin Fox <[email protected]> * Make trust domain configurable Signed-off-by: Kevin Fox <[email protected]> * Add flag Signed-off-by: Kevin Fox <[email protected]> * Make driver configurable Signed-off-by: Kevin Fox <[email protected]> * Add more configurables. Fix up docs to pass test. Signed-off-by: Kevin Fox <[email protected]> * Add some metadata Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Add default values for lint Signed-off-by: Kevin Fox <[email protected]> * Forgot values updates Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Start working on integration test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix names Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * Fix name conflict. Align naming Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Add more logging Signed-off-by: Kevin Fox <[email protected]> * Disable unneeded test. Add missing file. Signed-off-by: Kevin Fox <[email protected]> * Setup more things Signed-off-by: Kevin Fox <[email protected]> * Add missing conf file Signed-off-by: Kevin Fox <[email protected]> * Fix multiple svids Signed-off-by: Kevin Fox <[email protected]> * Fix ci defaults Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Try and get the linter to stop complaining... Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * More logs Signed-off-by: Kevin Fox <[email protected]> * More setup Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Add wait Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Test ssh Signed-off-by: Kevin Fox <[email protected]> * Restart fetchca on updates too Signed-off-by: Kevin Fox <[email protected]> * Fix formating Signed-off-by: Kevin Fox <[email protected]> * Add missing file flag Signed-off-by: Kevin Fox <[email protected]> * Increase timeout Signed-off-by: Kevin Fox <[email protected]> * More flags Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Finish end to end test Signed-off-by: Kevin Fox <[email protected]> * Fix ingress setting Signed-off-by: Kevin Fox <[email protected]> * More logging/tests Signed-off-by: Kevin Fox <[email protected]> * More testing Signed-off-by: Kevin Fox <[email protected]> * Fix namespace Signed-off-by: Kevin Fox <[email protected]> * Fetch correct bundle Signed-off-by: Kevin Fox <[email protected]> * Chart testing will fail as it depends on spire to be preinstalled. Weird dependency loop. Signed-off-by: Kevin Fox <[email protected]> * Dont skip tls for testing Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * Pass intermediates Signed-off-by: Kevin Fox <[email protected]> * Fix trustdomain Signed-off-by: Kevin Fox <[email protected]> * Add ca authority prefix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * ci test is just broken. Revert trying to fix it. Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/files/ssh_x5c.tpl Signed-off-by: kfox1111 <[email protected]> * Self review feedback Signed-off-by: Kevin Fox <[email protected]> * Switch ingress to our more functional/easy type Signed-off-by: Kevin Fox <[email protected]> * Simplify the template Signed-off-by: Kevin Fox <[email protected]> * Add cast Signed-off-by: Kevin Fox <[email protected]> * Add install notes Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update tests for updated client Signed-off-by: Kevin Fox <[email protected]> * Fix logging and entry Signed-off-by: Kevin Fox <[email protected]> * Add missing dir Signed-off-by: Kevin Fox <[email protected]> * Fix file location Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/README.md Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,42 @@
|
||||
apiVersion: v2
|
||||
name: spiffe-step-ssh
|
||||
description: sshd signed host certificates using SPIFFE for trust and step CA
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.0.1
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
|
||||
keywords: ["spiffe", "step", "step-ca", "ssh"]
|
||||
home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spiffe-step-ssh
|
||||
sources:
|
||||
- https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spiffe-step-ssh
|
||||
icon: https://spiffe.io/img/logos/spire/icon/color/spire-icon-color.png
|
||||
maintainers:
|
||||
- name: kfox1111
|
||||
email: [email protected]
|
||||
|
||||
dependencies:
|
||||
- name: spire-lib
|
||||
repository: file://../spire/charts/spire-lib
|
||||
version: 0.1.0
|
||||
- name: step-certificates
|
||||
alias: step
|
||||
repository: https://smallstep.github.io/helm-charts/
|
||||
version: 1.27.4
|
||||
@@ -0,0 +1,65 @@
|
||||
spire-values.yaml
|
||||
```
|
||||
spire-server:
|
||||
nodeAttestor:
|
||||
httpChallenge:
|
||||
enabled: true
|
||||
controllerManager:
|
||||
identities:
|
||||
clusterSPIFFEIDs:
|
||||
spiffe-step-ssh-config:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spiffe-step-ssh-fetchca:
|
||||
type: raw
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
"kubernetes.io/metadata.name": default
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
dnsNameTemplates:
|
||||
- "spiffe-step-ssh-fetchca.{{ .TrustDomain }}"
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace
|
||||
helm upgrade --install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/ -f spire-values.yaml --set global.spire.ingressControllerType=ingress-nginx,spire-server.ingress.enabled=true
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install ingress-nginx ingress-nginx -n ingress-nginx --create-namespace --repo https://kubernetes.github.io/ingress-nginx --set controller.service.type=ClusterIP,controller.service.externalIPs[0]=$(minikube ip) --set controller.watchIngressWithoutClass=true --set controller.extraArgs.enable-ssl-passthrough=
|
||||
```
|
||||
|
||||
```shell
|
||||
PASSWORD=$(openssl rand -base64 48)
|
||||
echo "$PASSWORD" > spiffe-step-ssh-password.txt
|
||||
step ca init --helm --deployment-type=Standalone --name='My CA' --dns spiffe-step-ssh.example.org --ssh --address :8443 --provisioner default --password-file spiffe-step-ssh-password.txt > spiffe-step-ssh-values.yaml
|
||||
```
|
||||
|
||||
ingress-values.yaml
|
||||
```yaml
|
||||
global:
|
||||
spiffe:
|
||||
ingressControllerType: ingress-nginx
|
||||
stepIngress:
|
||||
enabled: true
|
||||
fetchCA:
|
||||
ingress:
|
||||
enabled: true
|
||||
```
|
||||
|
||||
```shell
|
||||
helm upgrade --install spiffe-step-ssh . --set caPassword=`cat spiffe-step-ssh-password.txt` -f spiffe-step-ssh-values.yaml -f ingress-values.yaml --set trustDomain=example.org
|
||||
```
|
||||
|
||||
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
||||
|
||||
## Parameters
|
||||
@@ -0,0 +1 @@
|
||||
trustDomain: example.org
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if eq (len .AuthorizationCrt.URIs) 1 }}
|
||||
{{- $san := printf "%s" (index .AuthorizationCrt.URIs 0) }}
|
||||
{{- if hasPrefix "spiffe://@TRUST_DOMAIN@/@PREFIX@/" $san }}
|
||||
{{- $name := trimPrefix "spiffe://@TRUST_DOMAIN@/@PREFIX@/" $san }}
|
||||
{
|
||||
"type": {{ toJson .Type }},
|
||||
"keyId": {{ toJson $name }},
|
||||
"principals": [{{ toJson $name }}],
|
||||
"extensions": {{ toJson .Extensions }},
|
||||
"criticalOptions": {{ toJson .CriticalOptions }}
|
||||
}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,5 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
|
||||
Configure your ssh clients with known_hosts file with:
|
||||
|
||||
@cert-authority *.{{ .Values.trustDomain }} {{ .Values.inject.certificates.ssh_host_ca }}
|
||||
@@ -0,0 +1,83 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-step-ssh.chart" . }}
|
||||
{{ include "spiffe-step-ssh.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-step-ssh.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-step-ssh.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spiffe" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spiffe.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else if (dig "openshift" false .global) }}
|
||||
{{- $type = "openshift" }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "sh"
|
||||
cmd_args = "/config-deployment/update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
export ROOTS=$(base64 /certs/ca.pem | tr '\n' ' ' | sed 's/ //g')
|
||||
echo Updating Roots to "$ROOTS"
|
||||
cat /config/ca.json > /work/ca.json
|
||||
yq e -i -ojson '.authority.provisioners |= map(select(.name == "x5c@spiffe").roots = env(ROOTS))' /work/ca.json
|
||||
/helper/kubectl create configmap {{ include "spiffe-step-ssh.fullname" . }}-config -n "{{ .Release.Namespace }}" --from-file=/work/ca.json --from-file=/config/defaults.json --from-file=/config/ssh_x5c.tpl --dry-run=client -o yaml | /helper/kubectl apply -f -
|
||||
/helper/kubectl rollout restart statefulset {{ include "spiffe-step-ssh.fullname" . }} -n "{{ .Release.Namespace }}"
|
||||
echo $?
|
||||
@@ -0,0 +1,143 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/config-configmap.yaml") . | sha256sum) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ $configSum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: setup-volume-p1
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p2
|
||||
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||
imagePullPolicy: {{ .Values.kubectl.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /bin/kubectl /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p3
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /spiffe-helper /helper && /helper/busybox rm -f /helper/busybox'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.yq.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.yq.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/spiffe-helper
|
||||
- -config
|
||||
- /config-deployment/spiffe-helper.conf
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
mountPath: /config-deployment
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: workdir
|
||||
mountPath: /work
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
- name: certdir
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper-config
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper
|
||||
emptyDir: {}
|
||||
- name: workdir
|
||||
emptyDir: {}
|
||||
{{- with .Values.config.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-config]
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [statefulsets]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [deployments]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-fetchca]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
component: config
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper-init.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = ""
|
||||
cmd_args = ""
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
spiffe-helper-sidecar.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "/busybox/busybox"
|
||||
cmd_args = "sh /update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
/busybox/busybox kill -HUP `/busybox/busybox busybox cat /pid/pid`
|
||||
@@ -0,0 +1,182 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
{{- if not .Values.fetchCA.autoscaling.enabled }}
|
||||
replicas: {{ .Values.fetchCA.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
shareProcessNamespace: true
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: busybox-volume
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /busybox'
|
||||
volumeMounts:
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
- name: init-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
- -daemon-mode=false
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-init.conf
|
||||
readOnly: true
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.nginx.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
echo $$$$ > /pid/pid
|
||||
cat > /etc/nginx/conf.d/ssl.conf <<EOF
|
||||
server {
|
||||
listen 8443 ssl;
|
||||
server_name localhost;
|
||||
ssl_certificate /certs/tls.crt;
|
||||
ssl_certificate_key /certs/tls.key;
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
index root_ca.crt index.html index.htm;
|
||||
}
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
exec nginx -g "daemon off;"
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
- name: share
|
||||
mountPath: /usr/share/nginx/html
|
||||
- name: update-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-sidecar.conf
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /update.sh
|
||||
subPath: update.sh
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
readOnly: true
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
readOnly: true
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: certs
|
||||
emptyDir: {}
|
||||
- name: pid
|
||||
emptyDir: {}
|
||||
- name: busybox
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: share
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
{{- with .Values.fetchCA.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.fetchCA.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchCA
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
minReplicas: {{ .Values.fetchCA.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.fetchCA.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.fetchCA.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.fetchCA.ingress) }}
|
||||
{{- $fullName := printf "%s-fetchca" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.fetchCA.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.fetchCA.ingress "svcName" $fullName "port" .Values.fetchCA.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
type: {{ .Values.fetchCA.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.fetchCA.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certificate-issuer-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"root_ca.crt": |
|
||||
{{- .Values.inject.certificates.root_ca | nindent 4}}
|
||||
"intermediate_ca.crt": |
|
||||
{{ .Values.inject.certificates.intermediate_ca | nindent 4}}
|
||||
"ssh_host_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_host_ca | nindent 4 }}
|
||||
"ssh_user_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_user_ca | nindent 4 }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- define "spiffe-step-ssh.config-provisioners" }}
|
||||
type: X5C
|
||||
name: "x5c@spiffe"
|
||||
roots: ""
|
||||
claims:
|
||||
maxTLSCertDuration: {{ .Values.maxTLSCertDuration | quote }}
|
||||
defaultTLSCertDuration: {{ .Values.defaultTLSCertDuration | quote }}
|
||||
disableRenewal: true
|
||||
enableSSHCA: true
|
||||
disableCustomSANs: true
|
||||
options:
|
||||
ssh:
|
||||
templateFile: /home/step/config/ssh_x5c.tpl
|
||||
{{- end }}
|
||||
{{ $ca := deepCopy (index .Values.inject.config.files "ca.json") }}
|
||||
{{ $_ := set $ca.authority "provisioners" (list (include "spiffe-step-ssh.config-provisioners" . | fromYaml )) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"ca.json": |
|
||||
{{- $ca | toPrettyJson | nindent 4 }}
|
||||
"defaults.json": |
|
||||
{{- index .Values.inject.config.files "defaults.json" | toPrettyJson | nindent 4 }}
|
||||
{{- if eq .Values.trustDomain "" }}
|
||||
{{- fail "You must set trustDomain" }}
|
||||
{{- end }}
|
||||
"ssh_x5c.tpl": |
|
||||
{{- .Files.Get "files/ssh_x5c.tpl" | replace "@TRUST_DOMAIN@" .Values.trustDomain | replace "@PREFIX@" .Values.prefix | nindent 4}}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.stepIngress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.stepIngress) }}
|
||||
{{- $fullName := printf "%s" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.stepIngress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.stepIngress "svcName" $fullName "port" .Values.step.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-secrets
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
root_ca_key: {{ .Values.inject.secrets.x509.root_ca_key | b64enc }}
|
||||
intermediate_ca_key: {{ .Values.inject.secrets.x509.intermediate_ca_key | b64enc }}
|
||||
ssh_host_ca_key: {{ .Values.inject.secrets.ssh.host_ca_key | b64enc }}
|
||||
ssh_user_ca_key: {{ .Values.inject.secrets.ssh.user_ca_key | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-host-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-user-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,292 @@
|
||||
# Default values for spiffe-step-ssh.
|
||||
# SPDX-License-Identifier: APACHE-2.0
|
||||
|
||||
global:
|
||||
spiffe:
|
||||
## @param global.spiffe.ingressControllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
ingressControllerType: ""
|
||||
|
||||
## @param trustDomain The trust domain for SPIRE
|
||||
trustDomain: ""
|
||||
## @param caPassword Password securing the SSH CA
|
||||
caPassword: ""
|
||||
## @param maxTLSCertDuration The maximum duration the X5C traded cert is valid for.
|
||||
maxTLSCertDuration: 24h
|
||||
## @param defaultTLSCertDuration The default duration the X5C traded cert is valid for.
|
||||
defaultTLSCertDuration: 1h
|
||||
## @param prefix Prefix where hosts show up that are allowed to get ssh host certs
|
||||
prefix: sshd
|
||||
## @param csiDriver The csi driver to use
|
||||
csiDriver: csi.spiffe.io
|
||||
|
||||
## @skip inject
|
||||
## These will be generated by the step-ca tool
|
||||
inject:
|
||||
secrets:
|
||||
x509:
|
||||
root_ca_key: ""
|
||||
intermediate_ca_key: ""
|
||||
ssh:
|
||||
host_ca_key: ""
|
||||
user_ca_key: ""
|
||||
config:
|
||||
files:
|
||||
ca.json:
|
||||
authority: {}
|
||||
certificates:
|
||||
root_ca: ""
|
||||
intermediate_ca: ""
|
||||
ssh_host_ca: ""
|
||||
ssh_user_ca: ""
|
||||
|
||||
stepIngress:
|
||||
## @param stepIngress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param stepIngress.className Ingress class name
|
||||
className: ""
|
||||
## @param stepIngress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param stepIngress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param stepIngress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spiffe-step-ssh"
|
||||
|
||||
## @param stepIngress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param stepIngress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spiffe-step-ssh.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param stepIngress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spiffe-step-ssh.example.org
|
||||
|
||||
## @skip step
|
||||
step:
|
||||
service:
|
||||
port: 443
|
||||
targetPort: 8443
|
||||
inject:
|
||||
enabled: false
|
||||
bootstrap:
|
||||
enabled: false
|
||||
configmaps: false
|
||||
secrets: false
|
||||
existingSecrets:
|
||||
enabled: true
|
||||
ca: true
|
||||
issuer: true
|
||||
certsAsSecret: false
|
||||
configAsSecret: false
|
||||
sshHostCa: true
|
||||
sshUserCa: true
|
||||
|
||||
spiffeHelper:
|
||||
## @param spiffeHelper.image.registry The OCI registry to pull the image from
|
||||
## @param spiffeHelper.image.repository The repository within the registry
|
||||
## @param spiffeHelper.image.pullPolicy The image pull policy
|
||||
## @param spiffeHelper.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: ghcr.io
|
||||
repository: spiffe/spiffe-helper
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 0.8.0
|
||||
|
||||
nginx:
|
||||
## @param nginx.image.registry The OCI registry to pull the image from
|
||||
## @param nginx.image.repository The repository within the registry
|
||||
## @param nginx.image.pullPolicy The image pull policy
|
||||
## @param nginx.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: nginxinc/nginx-unprivileged
|
||||
pullPolicy: IfNotPresent
|
||||
tag: 1.25.3-alpine
|
||||
|
||||
kubectl:
|
||||
## @param kubectl.image.registry The OCI registry to pull the image from
|
||||
## @param kubectl.image.repository The repository within the registry
|
||||
## @param kubectl.image.pullPolicy The image pull policy
|
||||
## @param kubectl.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: rancher/kubectl
|
||||
pullPolicy: IfNotPresent
|
||||
tag: ""
|
||||
|
||||
yq:
|
||||
## @param yq.image.registry The OCI registry to pull the image from
|
||||
## @param yq.image.repository The repository within the registry
|
||||
## @param yq.image.pullPolicy The image pull policy
|
||||
## @param yq.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: mikefarah/yq
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "4.40.5"
|
||||
|
||||
busybox:
|
||||
## @param busybox.image.registry The OCI registry to pull the image from
|
||||
## @param busybox.image.repository The repository within the registry
|
||||
## @param busybox.image.pullPolicy The image pull policy
|
||||
## @param busybox.image.tag Overrides the image tag whose default is the chart appVersion
|
||||
##
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: busybox
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "1.36.1-uclibc"
|
||||
|
||||
## @param imagePullSecrets [array] Pull secrets for images
|
||||
imagePullSecrets: []
|
||||
|
||||
## @param nameOverride Name override
|
||||
nameOverride: ""
|
||||
|
||||
## @param fullnameOverride Fullname override
|
||||
fullnameOverride: ""
|
||||
|
||||
## @param serviceAccount.create Specifies whether a service account should be created
|
||||
## @param serviceAccount.annotations [object] Annotations to add to the service account
|
||||
## @param serviceAccount.name The name of the service account to use. If not set and create is true, a name is generated.
|
||||
##
|
||||
serviceAccount:
|
||||
create: true
|
||||
annotations: {}
|
||||
name: ""
|
||||
|
||||
## @param podAnnotations [object] Additional pod annotations to add
|
||||
podAnnotations: {}
|
||||
## @param podLabels [object] Additional pod labels to add
|
||||
podLabels: {}
|
||||
|
||||
## @param podSecurityContext [object} Specify pod security context settings
|
||||
podSecurityContext: {}
|
||||
# fsGroup: 2000
|
||||
|
||||
## @param securityContext [object] Specify container security context settings
|
||||
securityContext:
|
||||
# capabilities:
|
||||
# drop:
|
||||
# - ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
# FIXME
|
||||
runAsUser: 0
|
||||
|
||||
fetchCA:
|
||||
## @param fetchCA.replicaCount Number of replicas to launch
|
||||
replicaCount: 1
|
||||
|
||||
## @param fetchCA.service.type The type of service to deploy
|
||||
## @param fetchCA.service.port The port number of the service port
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 443
|
||||
|
||||
ingress:
|
||||
## @param fetchCA.ingress.enabled Flag to enable ingress
|
||||
enabled: false
|
||||
## @param fetchCA.ingress.className Ingress class name
|
||||
className: ""
|
||||
## @param fetchCA.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""].
|
||||
controllerType: ""
|
||||
## @param fetchCA.ingress.annotations [object] Annotations for the ingress object
|
||||
annotations: {}
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: "true"
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
# If Profile Type == https_spiffe:
|
||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
|
||||
## @param fetchCA.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||
host: "spiffe-step-ssh-fetchca"
|
||||
|
||||
## @param fetchCA.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||
tlsSecret: ""
|
||||
|
||||
## @param fetchCA.ingress.hosts [array] Host paths for ingress object. If empty, rules will be built based on the host var.
|
||||
hosts: []
|
||||
# - host: spiffe-step-ssh-fetchca.example.org
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
|
||||
## @param fetchCA.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If empty, rules will be built based on the host and tlsSecret vars.
|
||||
tls: []
|
||||
# - hosts:
|
||||
# - spiffe-step-ssh-fetchca.example.org
|
||||
|
||||
## @param fetchCA.autoscaling.enabled Enable autoscaling
|
||||
## @param fetchCA.autoscaling.minReplicas Minimum number of replicas to deploy
|
||||
## @param fetchCA.autoscaling.maxReplicas Maximum number of replicas to deploy
|
||||
## @param fetchCA.autoscaling.targetCPUUtilizationPercentage Target CPU utilization to use for autoscaling
|
||||
autoscaling:
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
maxReplicas: 100
|
||||
targetCPUUtilizationPercentage: 80
|
||||
# targetMemoryUtilizationPercentage: 80
|
||||
|
||||
## @param fetchCA.resources [object] Specify resources
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
spiffeHelper:
|
||||
## @param fetchCA.spiffeHelper.resources [object] Specify resources for the SPIFFE helper
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param fetchCA.nodeSelector [object] Specify node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param fetchCA.tolerations [array] Specify tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param fetchCA.affinity [object] Specify affinity
|
||||
affinity: {}
|
||||
|
||||
config:
|
||||
## @param config.resources [object] Specify resources
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 128Mi
|
||||
|
||||
## @param config.nodeSelector [object] Specify node selector
|
||||
nodeSelector: {}
|
||||
|
||||
## @param config.tolerations [array] Specify tolerations
|
||||
tolerations: []
|
||||
|
||||
## @param config.affinity [object] Specify affinity
|
||||
affinity: {}
|
||||
Reference in New Issue
Block a user