Enable running the oidc discovery provider without cluster-admin/CSI (#570)
* Update for 1.12.3 Signed-off-by: Kevin Fox <[email protected]> * Fix typo. Use test image Signed-off-by: Kevin Fox <[email protected]> * Fix lint Signed-off-by: Kevin Fox <[email protected]> * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox <[email protected]> * Fix role Signed-off-by: Kevin Fox <[email protected]> * Update rbac Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix format Signed-off-by: Kevin Fox <[email protected]> * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox <[email protected]> * Update key Signed-off-by: Kevin Fox <[email protected]> * Fix test rather then reconfigure Signed-off-by: Kevin Fox <[email protected]> * Add namespace Signed-off-by: Kevin Fox <[email protected]> * Update to follow the new patch Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Update filename based on format Signed-off-by: Kevin Fox <[email protected]> * Add upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Enable running the oidc discovery provider without cluster-admin/CSI Signed-off-by: Kevin Fox <[email protected]> * Calm lint Signed-off-by: Kevin Fox <[email protected]> * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update for final release Signed-off-by: Kevin Fox <[email protected]> * Update for final 1.12.4 release Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -29,6 +29,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||
| `bundleSource` | Configure where to fetch the trust bundle from. Must be CSI or ConfigMap. | `CSI` |
|
||||
| `bundleConfigMap` | ConfigMap name for SPIRE bundle when bundleSource is ConfigMap | `spire-bundle` |
|
||||
| `replicaCount` | Replica count | `1` |
|
||||
| `namespaceOverride` | Namespace override | `""` |
|
||||
| `annotations` | Annotations for the deployment | `{}` |
|
||||
|
||||
@@ -1,3 +1,6 @@
|
||||
{{- if and (ne .Values.bundleSource "ConfigMap") (ne .Values.bundleSource "CSI") }}
|
||||
{{- fail "Bundle source must be CSI or ConfigmMap" }}
|
||||
{{- end }}
|
||||
{{- $tlsCount := 0 }}
|
||||
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
||||
{{- $tlsCount = add $tlsCount 1 }}
|
||||
@@ -44,9 +47,14 @@ serving_cert_file:
|
||||
jwks_uri: {{ .Values.config.jwksUri | quote }}
|
||||
{{- end }}
|
||||
|
||||
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||
file:
|
||||
path: /bundle/bundle.spiffe
|
||||
{{- else }}
|
||||
workload_api:
|
||||
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
||||
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
||||
{{- end }}
|
||||
|
||||
health_checks:
|
||||
bind_port: "8008"
|
||||
|
||||
@@ -86,9 +86,15 @@ spec:
|
||||
name: https
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||
- name: spiffe-bundle
|
||||
mountPath: /bundle
|
||||
readOnly: true
|
||||
{{- else }}
|
||||
- name: spiffe-workload-api
|
||||
mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- name: spire-oidc-sockets
|
||||
mountPath: /run/spire/oidc-sockets
|
||||
readOnly: false
|
||||
@@ -171,10 +177,17 @@ spec:
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if or .Values.tls.spire.enabled (eq .Values.bundleSource "CSI") }}
|
||||
- name: spiffe-workload-api
|
||||
csi:
|
||||
driver: "{{ .Values.csiDriverName }}"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||
- name: spiffe-bundle
|
||||
configMap:
|
||||
name: {{ include "spire-lib.bundle-configmap" . }}
|
||||
{{- end }}
|
||||
- name: spire-oidc-sockets
|
||||
emptyDir: {}
|
||||
- name: spire-oidc-config
|
||||
|
||||
@@ -11,6 +11,12 @@ agentSocketName: spire-agent.sock
|
||||
## @param csiDriverName The csi driver to use
|
||||
csiDriverName: csi.spiffe.io
|
||||
|
||||
## @param bundleSource Configure where to fetch the trust bundle from. Must be CSI or ConfigMap.
|
||||
bundleSource: CSI
|
||||
|
||||
## @param bundleConfigMap ConfigMap name for SPIRE bundle when bundleSource is ConfigMap
|
||||
bundleConfigMap: spire-bundle
|
||||
|
||||
## @param replicaCount Replica count
|
||||
replicaCount: 1
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ spire-server:
|
||||
selectors:
|
||||
- tpm:pub_hash:12345
|
||||
foo-kubelet:
|
||||
parentID: spiffe://example.org/foo
|
||||
parentID: spiffe://example.org/hosts/foo
|
||||
spiffeID: spiffe://example.org/k8s/one/node/foo
|
||||
selectors:
|
||||
- systemd:id:kubelet.service
|
||||
@@ -28,4 +28,8 @@ spire-agent:
|
||||
spiffe-csi-driver:
|
||||
enabled: false
|
||||
spiffe-oidc-discovery-provider:
|
||||
enabled: false
|
||||
enabled: true
|
||||
bundleSource: ConfigMap
|
||||
tls:
|
||||
spire:
|
||||
enabled: false
|
||||
|
||||
Reference in New Issue
Block a user