spiffe-step-ssh server (#198)
* Initial prototype of spire-step-ssh integration Signed-off-by: Kevin Fox <[email protected]> * Ingress work, image cleanup and misc cleanup Signed-off-by: Kevin Fox <[email protected]> * More values rework Signed-off-by: Kevin Fox <[email protected]> * Rename chart spiffe-step-ssh Signed-off-by: Kevin Fox <[email protected]> * Update to use shared lib Signed-off-by: Kevin Fox <[email protected]> * Update spiffe-helper Signed-off-by: Kevin Fox <[email protected]> * Use URLSAN rather then CN Signed-off-by: Kevin Fox <[email protected]> * Lookup the sans. Signed-off-by: Kevin Fox <[email protected]> * Make trust domain configurable Signed-off-by: Kevin Fox <[email protected]> * Add flag Signed-off-by: Kevin Fox <[email protected]> * Make driver configurable Signed-off-by: Kevin Fox <[email protected]> * Add more configurables. Fix up docs to pass test. Signed-off-by: Kevin Fox <[email protected]> * Add some metadata Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Add default values for lint Signed-off-by: Kevin Fox <[email protected]> * Forgot values updates Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Start working on integration test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix names Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * Fix name conflict. Align naming Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Add more logging Signed-off-by: Kevin Fox <[email protected]> * Disable unneeded test. Add missing file. Signed-off-by: Kevin Fox <[email protected]> * Setup more things Signed-off-by: Kevin Fox <[email protected]> * Add missing conf file Signed-off-by: Kevin Fox <[email protected]> * Fix multiple svids Signed-off-by: Kevin Fox <[email protected]> * Fix ci defaults Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Try and get the linter to stop complaining... Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * More logs Signed-off-by: Kevin Fox <[email protected]> * More setup Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Add wait Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Test ssh Signed-off-by: Kevin Fox <[email protected]> * Restart fetchca on updates too Signed-off-by: Kevin Fox <[email protected]> * Fix formating Signed-off-by: Kevin Fox <[email protected]> * Add missing file flag Signed-off-by: Kevin Fox <[email protected]> * Increase timeout Signed-off-by: Kevin Fox <[email protected]> * More flags Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Finish end to end test Signed-off-by: Kevin Fox <[email protected]> * Fix ingress setting Signed-off-by: Kevin Fox <[email protected]> * More logging/tests Signed-off-by: Kevin Fox <[email protected]> * More testing Signed-off-by: Kevin Fox <[email protected]> * Fix namespace Signed-off-by: Kevin Fox <[email protected]> * Fetch correct bundle Signed-off-by: Kevin Fox <[email protected]> * Chart testing will fail as it depends on spire to be preinstalled. Weird dependency loop. Signed-off-by: Kevin Fox <[email protected]> * Dont skip tls for testing Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * Pass intermediates Signed-off-by: Kevin Fox <[email protected]> * Fix trustdomain Signed-off-by: Kevin Fox <[email protected]> * Add ca authority prefix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * ci test is just broken. Revert trying to fix it. Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/files/ssh_x5c.tpl Signed-off-by: kfox1111 <[email protected]> * Self review feedback Signed-off-by: Kevin Fox <[email protected]> * Switch ingress to our more functional/easy type Signed-off-by: Kevin Fox <[email protected]> * Simplify the template Signed-off-by: Kevin Fox <[email protected]> * Add cast Signed-off-by: Kevin Fox <[email protected]> * Add install notes Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update tests for updated client Signed-off-by: Kevin Fox <[email protected]> * Fix logging and entry Signed-off-by: Kevin Fox <[email protected]> * Add missing dir Signed-off-by: Kevin Fox <[email protected]> * Fix file location Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/README.md Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,5 @@
|
||||
Installed {{ .Chart.Name }}…
|
||||
|
||||
Configure your ssh clients with known_hosts file with:
|
||||
|
||||
@cert-authority *.{{ .Values.trustDomain }} {{ .Values.inject.certificates.ssh_host_ca }}
|
||||
@@ -0,0 +1,83 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-step-ssh.chart" . }}
|
||||
{{ include "spiffe-step-ssh.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-step-ssh.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-step-ssh.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spiffe" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spiffe.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else if (dig "openshift" false .global) }}
|
||||
{{- $type = "openshift" }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "sh"
|
||||
cmd_args = "/config-deployment/update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
export ROOTS=$(base64 /certs/ca.pem | tr '\n' ' ' | sed 's/ //g')
|
||||
echo Updating Roots to "$ROOTS"
|
||||
cat /config/ca.json > /work/ca.json
|
||||
yq e -i -ojson '.authority.provisioners |= map(select(.name == "x5c@spiffe").roots = env(ROOTS))' /work/ca.json
|
||||
/helper/kubectl create configmap {{ include "spiffe-step-ssh.fullname" . }}-config -n "{{ .Release.Namespace }}" --from-file=/work/ca.json --from-file=/config/defaults.json --from-file=/config/ssh_x5c.tpl --dry-run=client -o yaml | /helper/kubectl apply -f -
|
||||
/helper/kubectl rollout restart statefulset {{ include "spiffe-step-ssh.fullname" . }} -n "{{ .Release.Namespace }}"
|
||||
echo $?
|
||||
@@ -0,0 +1,143 @@
|
||||
{{- $configSum := (include (print $.Template.BasePath "/config-configmap.yaml") . | sha256sum) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ $configSum }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: config
|
||||
spec:
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: setup-volume-p1
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p2
|
||||
image: {{ template "spire-lib.kubectl-image" (dict "appVersion" $.Chart.AppVersion "image" .Values.kubectl.image "global" .Values.global "KubeVersion" .Capabilities.KubeVersion.Version) }}
|
||||
imagePullPolicy: {{ .Values.kubectl.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /bin/kubectl /helper'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
- name: setup-volume-p3
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/busybox
|
||||
- sh
|
||||
- -c
|
||||
- '/helper/busybox cp -a /spiffe-helper /helper && /helper/busybox rm -f /helper/busybox'
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.yq.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.yq.image.pullPolicy }}
|
||||
command:
|
||||
- /helper/spiffe-helper
|
||||
- -config
|
||||
- /config-deployment/spiffe-helper.conf
|
||||
resources:
|
||||
{{- toYaml .Values.config.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: spiffe-helper
|
||||
mountPath: /helper
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
mountPath: /config-deployment
|
||||
readOnly: true
|
||||
- name: certdir
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: workdir
|
||||
mountPath: /work
|
||||
volumes:
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: config-deployment
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-deployment
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
- name: certdir
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper-config
|
||||
emptyDir: {}
|
||||
- name: spiffe-helper
|
||||
emptyDir: {}
|
||||
- name: workdir
|
||||
emptyDir: {}
|
||||
{{- with .Values.config.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.config.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,41 @@
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups: [""]
|
||||
resources: [configmaps]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-config]
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [statefulsets]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- apiGroups: ["apps"]
|
||||
resources: [deployments]
|
||||
resourceNames: [{{ include "spiffe-step-ssh.fullname" . }}-fetchca]
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
---
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-svc-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,13 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-svc-config
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
component: config
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
spiffe-helper-init.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = ""
|
||||
cmd_args = ""
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
spiffe-helper-sidecar.conf: |
|
||||
agent_address = "/spiffe-workload-api/spire-agent.sock"
|
||||
cmd = "/busybox/busybox"
|
||||
cmd_args = "sh /update.sh"
|
||||
cert_dir = "/certs"
|
||||
svid_file_name = "tls.crt"
|
||||
svid_key_file_name = "tls.key"
|
||||
svid_bundle_file_name = "ca.pem"
|
||||
add_intermediates_to_bundle = false
|
||||
update.sh: |
|
||||
#!/bin/sh
|
||||
/busybox/busybox kill -HUP `/busybox/busybox busybox cat /pid/pid`
|
||||
@@ -0,0 +1,182 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
{{- if not .Values.fetchCA.autoscaling.enabled }}
|
||||
replicas: {{ .Values.fetchCA.replicaCount }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
template:
|
||||
metadata:
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
shareProcessNamespace: true
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
initContainers:
|
||||
- name: busybox-volume
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp -a /bin/busybox /busybox'
|
||||
volumeMounts:
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
- name: init-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
- -daemon-mode=false
|
||||
volumeMounts:
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-init.conf
|
||||
readOnly: true
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-fetchca
|
||||
securityContext:
|
||||
{{- toYaml .Values.securityContext | nindent 12 }}
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.nginx.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
echo $$$$ > /pid/pid
|
||||
cat > /etc/nginx/conf.d/ssl.conf <<EOF
|
||||
server {
|
||||
listen 8443 ssl;
|
||||
server_name localhost;
|
||||
ssl_certificate /certs/tls.crt;
|
||||
ssl_certificate_key /certs/tls.key;
|
||||
location / {
|
||||
root /usr/share/nginx/html;
|
||||
index root_ca.crt index.html index.htm;
|
||||
}
|
||||
error_page 500 502 503 504 /50x.html;
|
||||
location = /50x.html {
|
||||
root /usr/share/nginx/html;
|
||||
}
|
||||
}
|
||||
EOF
|
||||
exec nginx -g "daemon off;"
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTPS
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
- name: share
|
||||
mountPath: /usr/share/nginx/html
|
||||
- name: update-tls
|
||||
image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
|
||||
command:
|
||||
- /spiffe-helper
|
||||
- -config
|
||||
- /etc/spiffe-helper.conf
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /certs
|
||||
- name: spiffe-workload-api
|
||||
mountPath: /spiffe-workload-api
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /etc/spiffe-helper.conf
|
||||
subPath: spiffe-helper-sidecar.conf
|
||||
readOnly: true
|
||||
- name: config
|
||||
mountPath: /update.sh
|
||||
subPath: update.sh
|
||||
readOnly: true
|
||||
- name: pid
|
||||
mountPath: /pid
|
||||
readOnly: true
|
||||
- name: busybox
|
||||
mountPath: /busybox
|
||||
readOnly: true
|
||||
resources:
|
||||
{{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
|
||||
volumes:
|
||||
- name: certs
|
||||
emptyDir: {}
|
||||
- name: pid
|
||||
emptyDir: {}
|
||||
- name: busybox
|
||||
emptyDir: {}
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: {{ .Values.csiDriver | quote }}
|
||||
readOnly: true
|
||||
- name: share
|
||||
configMap:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
{{- with .Values.fetchCA.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.fetchCA.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if .Values.fetchCA.autoscaling.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchCA
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
minReplicas: {{ .Values.fetchCA.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.fetchCA.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetCPUUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- if .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.fetchCA.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.fetchCA.ingress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.fetchCA.ingress) }}
|
||||
{{- $fullName := printf "%s-fetchca" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.fetchCA.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.fetchCA.ingress "svcName" $fullName "port" .Values.fetchCA.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
app: spiffe-step-ssh
|
||||
component: fetchca
|
||||
spec:
|
||||
type: {{ .Values.fetchCA.service.type }}
|
||||
ports:
|
||||
- port: {{ .Values.fetchCA.service.port }}
|
||||
targetPort: http
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
{{- include "spiffe-step-ssh.selectorLabels" . | nindent 4 }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certificate-issuer-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-certs
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"root_ca.crt": |
|
||||
{{- .Values.inject.certificates.root_ca | nindent 4}}
|
||||
"intermediate_ca.crt": |
|
||||
{{ .Values.inject.certificates.intermediate_ca | nindent 4}}
|
||||
"ssh_host_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_host_ca | nindent 4 }}
|
||||
"ssh_user_ca_key.pub": |
|
||||
{{ .Values.inject.certificates.ssh_user_ca | nindent 4 }}
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- define "spiffe-step-ssh.config-provisioners" }}
|
||||
type: X5C
|
||||
name: "x5c@spiffe"
|
||||
roots: ""
|
||||
claims:
|
||||
maxTLSCertDuration: {{ .Values.maxTLSCertDuration | quote }}
|
||||
defaultTLSCertDuration: {{ .Values.defaultTLSCertDuration | quote }}
|
||||
disableRenewal: true
|
||||
enableSSHCA: true
|
||||
disableCustomSANs: true
|
||||
options:
|
||||
ssh:
|
||||
templateFile: /home/step/config/ssh_x5c.tpl
|
||||
{{- end }}
|
||||
{{ $ca := deepCopy (index .Values.inject.config.files "ca.json") }}
|
||||
{{ $_ := set $ca.authority "provisioners" (list (include "spiffe-step-ssh.config-provisioners" . | fromYaml )) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-config-raw
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
"ca.json": |
|
||||
{{- $ca | toPrettyJson | nindent 4 }}
|
||||
"defaults.json": |
|
||||
{{- index .Values.inject.config.files "defaults.json" | toPrettyJson | nindent 4 }}
|
||||
{{- if eq .Values.trustDomain "" }}
|
||||
{{- fail "You must set trustDomain" }}
|
||||
{{- end }}
|
||||
"ssh_x5c.tpl": |
|
||||
{{- .Files.Get "files/ssh_x5c.tpl" | replace "@TRUST_DOMAIN@" .Values.trustDomain | replace "@PREFIX@" .Values.prefix | nindent 4}}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- if .Values.stepIngress.enabled -}}
|
||||
{{- $ingressControllerType := include "spiffe-step-ssh.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.stepIngress) }}
|
||||
{{- $fullName := printf "%s" (include "spiffe-step-ssh.fullname" .) -}}
|
||||
{{- $path := "/" }}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{- $annotations := deepCopy .Values.stepIngress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ $fullName }}
|
||||
labels:
|
||||
{{ include "spiffe-step-ssh.labels" . | nindent 4}}
|
||||
{{- with $annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.stepIngress "svcName" $fullName "port" .Values.step.service.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-secrets
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
root_ca_key: {{ .Values.inject.secrets.x509.root_ca_key | b64enc }}
|
||||
intermediate_ca_key: {{ .Values.inject.secrets.x509.intermediate_ca_key | b64enc }}
|
||||
ssh_host_ca_key: {{ .Values.inject.secrets.ssh.host_ca_key | b64enc }}
|
||||
ssh_user_ca_key: {{ .Values.inject.secrets.ssh.user_ca_key | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-host-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ include "spiffe-step-ssh.fullname" . }}-ssh-user-ca-password
|
||||
labels:
|
||||
{{- include "spiffe-step-ssh.labels" . | nindent 4 }}
|
||||
data:
|
||||
password: {{ .Values.caPassword | b64enc }}
|
||||
Reference in New Issue
Block a user