spiffe-step-ssh server (#198)
* Initial prototype of spire-step-ssh integration Signed-off-by: Kevin Fox <[email protected]> * Ingress work, image cleanup and misc cleanup Signed-off-by: Kevin Fox <[email protected]> * More values rework Signed-off-by: Kevin Fox <[email protected]> * Rename chart spiffe-step-ssh Signed-off-by: Kevin Fox <[email protected]> * Update to use shared lib Signed-off-by: Kevin Fox <[email protected]> * Update spiffe-helper Signed-off-by: Kevin Fox <[email protected]> * Use URLSAN rather then CN Signed-off-by: Kevin Fox <[email protected]> * Lookup the sans. Signed-off-by: Kevin Fox <[email protected]> * Make trust domain configurable Signed-off-by: Kevin Fox <[email protected]> * Add flag Signed-off-by: Kevin Fox <[email protected]> * Make driver configurable Signed-off-by: Kevin Fox <[email protected]> * Add more configurables. Fix up docs to pass test. Signed-off-by: Kevin Fox <[email protected]> * Add some metadata Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Add default values for lint Signed-off-by: Kevin Fox <[email protected]> * Forgot values updates Signed-off-by: Kevin Fox <[email protected]> * Fix metadata Signed-off-by: Kevin Fox <[email protected]> * Start working on integration test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Test Signed-off-by: Kevin Fox <[email protected]> * Fix names Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More test bits Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * Fix name conflict. Align naming Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Add more logging Signed-off-by: Kevin Fox <[email protected]> * Disable unneeded test. Add missing file. Signed-off-by: Kevin Fox <[email protected]> * Setup more things Signed-off-by: Kevin Fox <[email protected]> * Add missing conf file Signed-off-by: Kevin Fox <[email protected]> * Fix multiple svids Signed-off-by: Kevin Fox <[email protected]> * Fix ci defaults Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Try and get the linter to stop complaining... Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * More logs Signed-off-by: Kevin Fox <[email protected]> * More setup Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Fixes Signed-off-by: Kevin Fox <[email protected]> * Add wait Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Test ssh Signed-off-by: Kevin Fox <[email protected]> * Restart fetchca on updates too Signed-off-by: Kevin Fox <[email protected]> * Fix formating Signed-off-by: Kevin Fox <[email protected]> * Add missing file flag Signed-off-by: Kevin Fox <[email protected]> * Increase timeout Signed-off-by: Kevin Fox <[email protected]> * More flags Signed-off-by: Kevin Fox <[email protected]> * Fix name Signed-off-by: Kevin Fox <[email protected]> * Finish end to end test Signed-off-by: Kevin Fox <[email protected]> * Fix ingress setting Signed-off-by: Kevin Fox <[email protected]> * More logging/tests Signed-off-by: Kevin Fox <[email protected]> * More testing Signed-off-by: Kevin Fox <[email protected]> * Fix namespace Signed-off-by: Kevin Fox <[email protected]> * Fetch correct bundle Signed-off-by: Kevin Fox <[email protected]> * Chart testing will fail as it depends on spire to be preinstalled. Weird dependency loop. Signed-off-by: Kevin Fox <[email protected]> * Dont skip tls for testing Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * More debug Signed-off-by: Kevin Fox <[email protected]> * Pass intermediates Signed-off-by: Kevin Fox <[email protected]> * Fix trustdomain Signed-off-by: Kevin Fox <[email protected]> * Add ca authority prefix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * fix Signed-off-by: Kevin Fox <[email protected]> * ci test is just broken. Revert trying to fix it. Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/files/ssh_x5c.tpl Signed-off-by: kfox1111 <[email protected]> * Self review feedback Signed-off-by: Kevin Fox <[email protected]> * Switch ingress to our more functional/easy type Signed-off-by: Kevin Fox <[email protected]> * Simplify the template Signed-off-by: Kevin Fox <[email protected]> * Add cast Signed-off-by: Kevin Fox <[email protected]> * Add install notes Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Update tests for updated client Signed-off-by: Kevin Fox <[email protected]> * Fix logging and entry Signed-off-by: Kevin Fox <[email protected]> * Add missing dir Signed-off-by: Kevin Fox <[email protected]> * Fix file location Signed-off-by: Kevin Fox <[email protected]> * Update timeout Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix filename Signed-off-by: Kevin Fox <[email protected]> * Fix perms Signed-off-by: Kevin Fox <[email protected]> * Update charts/spiffe-step-ssh/README.md Signed-off-by: kfox1111 <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,83 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.labels" -}}
|
||||
helm.sh/chart: {{ include "spiffe-step-ssh.chart" . }}
|
||||
{{ include "spiffe-step-ssh.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "spiffe-step-ssh.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "spiffe-step-ssh.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/* Takes in a dictionary with keys:
|
||||
* global - the standard global object
|
||||
* ingress - a standard format ingress config object
|
||||
*/}}
|
||||
{{- define "spiffe-step-ssh.ingress-controller-type" }}
|
||||
{{- $type := "" }}
|
||||
{{- if ne (len (dig "spiffe" "ingressControllerType" "" .global)) 0 }}
|
||||
{{- $type = .global.spiffe.ingressControllerType }}
|
||||
{{- else if ne .ingress.controllerType "" }}
|
||||
{{- $type = .ingress.controllerType }}
|
||||
{{- else if (dig "openshift" false .global) }}
|
||||
{{- $type = "openshift" }}
|
||||
{{- else }}
|
||||
{{- $type = "other" }}
|
||||
{{- end }}
|
||||
{{- if not (has $type (list "ingress-nginx" "openshift" "other")) }}
|
||||
{{- fail "Unsupported ingress controller type specified. Must be one of [ingress-nginx, openshift, other]" }}
|
||||
{{- end }}
|
||||
{{- $type }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user