Add option to configure TLS/mTLS endpoint for Tornjak (#338)

Co-authored-by: Marco Franssen <[email protected]>

charts/spire/charts/spire-server/templates/NOTES.txt

@@ -15,9 +15,23 @@ Tornjak runs without authentication and is therefore NOT suitable to run in prod
 Only use in test environments!
 
 Access Tornjak:
+   kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.servicename" . }} {{ .Values.tornjak.service.portHttp }}:10080
+{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
+  Open browser to: http://localhost:{{ .Values.tornjak.service.portHttp }}
+{{- else if eq (include "spire-tornjak.connectionType" .) "tls" }}
+  Open browser to: https://localhost:{{ .Values.tornjak.service.portHttps }}
 
-    kubectl -n {{ include "spire-server.namespace" . }} port-forward service/{{ include "spire-tornjak.backend" . }} {{ .Values.tornjak.service.port }}:10000
+  *** NOTE: You might get a security warning if using self-signed certificate
+  or use curl:
 
-Open browser to: http://localhost:{{ .Values.tornjak.service.port }}
+    curl --cacert certs/ca.crt https://localhost:{{ .Values.tornjak.service.portHttps }}
+  {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
 
+  Or provide a client certificate and key to use mTLS authentication:
+
+    curl --cacert certs/ca.crt --key client.key --cert client.crt https://localhost:{{ .Values.tornjak.service.portHttps }}
+  {{- end }}
+{{- else }}
+  ERROR! Incorrect value selected for "Values.tornjak.config.connectionType"
+{{- end }}
 {{- end }}

charts/spire/charts/spire-server/templates/_helpers.tpl

@@ -168,3 +168,29 @@ Tornjak specific section
 {{- define "spire-tornjak.backend" -}}
 {{ include "spire-tornjak.fullname" . }}-backend
 {{- end }}
+
+{{/*
+Tornjak automatically determines the connection type based on provided configuration.
+When TLS Secret is provided, it enables TLS connection.
+When TLS Secret and User CA Secret (or ConfigMap) are provided, it enables mTLS connection.
+Otherwise it starts HTTP Connection
+The code below determines what connection type should be used.
+*/}}
+{{- define "spire-tornjak.connectionType" -}}
+
+{{- if (lookup "v1" "Secret" (include "spire-server.namespace" .) .Values.tornjak.config.tlsSecret) -}}
+
+{{- $caType := default "INVALID" .Values.tornjak.config.userCA.type }}
+{{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.userCA.name) -}}
+{{- printf "mtls" -}}
+{{- else }}
+{{- printf "tls" -}}
+{{- end -}}
+{{- else -}}
+{{- printf "http" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "spire-tornjak.servicename" -}}
+{{- include "spire-tornjak.backend" . -}}
+{{- end -}}

charts/spire/charts/spire-server/templates/statefulset.yaml

@@ -175,20 +175,25 @@ spec:
             {{- toYaml .Values.controllerManager.securityContext | nindent 12 }}
           image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.tornjak.image "global" .Values.global) }}
           imagePullPolicy: {{ .Values.tornjak.image.pullPolicy }}
+          {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
           startupProbe:
             httpGet:
               scheme: HTTP
               path: /api/tornjak/serverinfo
-              port: 10000
+              port: 10080
             {{- toYaml .Values.tornjak.startupProbe | nindent 12 }}
+          {{- end }}
           args:
             - --spire-config
             - /run/spire/config/server.conf
             - --tornjak-config
             - /run/spire/tornjak-config/server.conf
           ports:
-            - name: tornjak
-              containerPort: 10000
+            - name: tornjak-http
+              containerPort: 10080
+              protocol: TCP
+            - name: tornjak-https
+              containerPort: 10443
               protocol: TCP
           resources:
             {{- toYaml .Values.tornjak.resources | nindent 12 }}
@@ -204,6 +209,14 @@ spec:
             - name: spire-data
               mountPath: /run/spire/data
               readOnly: false
+            {{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
+            - name: server-cert
+              mountPath: /opt/spire/server
+            {{- end }}
+            {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
+            - name: user-cert
+              mountPath: /opt/spire/user
+            {{- end }}
         {{- end }}
 
         {{- if gt (len .Values.extraContainers) 0 }}
@@ -233,6 +246,24 @@ spec:
           emptyDir: {}
         - name: spire-controller-manager-tmp
           emptyDir: {}
+        {{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
+        - name: server-cert
+          secret:
+            defaultMode: 256
+            secretName: {{ .Values.tornjak.config.tlsSecret }}
+        {{- end }}
+        {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
+        {{- if eq .Values.tornjak.config.userCA.type "Secret" }}
+        - name: user-cert
+          secret:
+            defaultMode: 256
+            secretName: {{ .Values.tornjak.config.userCA.name }}
+        {{- else if eq .Values.tornjak.config.userCA.type "ConfigMap" }}
+        - name: user-cert
+          configMap:
+            name: {{ .Values.tornjak.config.userCA.name }}
+        {{- end }}
+        {{- end }}
         {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
         - name: upstream-ca
           secret:

charts/spire/charts/spire-server/templates/tests/test-tornjak-connection.yaml

@@ -1,4 +1,5 @@
 {{- if eq (.Values.tornjak.enabled | toString) "true" }}
+{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
 apiVersion: v1
 kind: Pod
 metadata:
@@ -15,14 +16,15 @@ spec:
     - name: curl-tornjak-backend
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
-      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}/api/tornjak/serverinfo']
+      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.portHttp }}/api/tornjak/serverinfo']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
     - name: curl-tornjak-backend-and-spire
       image: {{ template "spire-lib.image" (dict "image" .Values.tests.bash.image "global" .Values.global) }}
       command: ['curl']
-      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.backend" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.port }}/api/healthcheck']
+      args: ['-k', '-s', '-f', 'http://{{ include "spire-tornjak.servicename" . }}.{{ include "spire-server.namespace" . }}.svc.{{ include "spire-lib.cluster-domain" . }}:{{ .Values.tornjak.service.portHttp }}/api/healthcheck']
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
   restartPolicy: Never
 {{- end }}
+{{- end }}

charts/spire/charts/spire-server/templates/tornjak-config.yaml

@@ -8,11 +8,29 @@ data:
   server.conf: |
     server {
       spire_socket_path = "unix:///tmp/spire-server/private/api.sock" # socket to communicate with SPIRE server
-
+      {{- if eq (include "spire-tornjak.connectionType" .) "http" }}
       http {
         enabled = true # if true, opens HTTP server
-        port = "10000" # if HTTP enabled, opens HTTP listen port at container port 10000
+        port = "10080" # if HTTP enabled, opens HTTP listen port at specified container port
       }
+      {{- end }}
+      {{- if eq (include "spire-tornjak.connectionType" .) "tls" }}
+      tls {
+        enabled = true
+        port = "10443" # container port for TLS connection
+        cert = "/opt/spire/server/tls.crt" # TLS server cert
+        key  = "/opt/spire/server/tls.key"  # TLS server key
+      }
+      {{- end }}
+      {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }}
+      mtls {
+        enabled = true
+        port = "10443" # container port for mTLS connection
+        cert = "/opt/spire/server/tls.crt" # mTLS server cert
+        key  = "/opt/spire/server/tls.key"  # mTLS server key
+        ca   = "/opt/spire/user/ca.crt"  # mTLS user CA
+      }
+      {{- end }}
     }
 
     plugins {

charts/spire/charts/spire-server/templates/tornjak-service.yaml

@@ -3,7 +3,7 @@ apiVersion: v1
 kind: Service
 metadata:
   namespace: {{ include "spire-server.namespace" . }}
-  name: {{ include "spire-tornjak.backend" . }}
+  name: {{ include "spire-tornjak.servicename" . }}
   {{- with .Values.tornjak.service.annotations }}
   annotations:
     {{- toYaml . | nindent 8 }}
@@ -15,8 +15,12 @@ spec:
   selector:
    {{- include "spire-server.selectorLabels" . | nindent 4 }}
   ports:
-    - name: {{ include "spire-tornjak.backend" . }}
-      port: {{ .Values.tornjak.service.port }}
-      targetPort: tornjak
+    - name: tornjak-srv-http
+      port: {{ .Values.tornjak.service.portHttp }}
+      targetPort: tornjak-http
+      protocol: TCP
+    - name: tornjak-srv-https
+      port: {{ .Values.tornjak.service.portHttps }}
+      targetPort: tornjak-https
       protocol: TCP
 {{- end }}