Enable running the oidc discovery provider without cluster-admin/CSI (#570)
* Update for 1.12.3 Signed-off-by: Kevin Fox <[email protected]> * Fix typo. Use test image Signed-off-by: Kevin Fox <[email protected]> * Fix lint Signed-off-by: Kevin Fox <[email protected]> * Fix format flag. Update config location for k8s configmap bp Signed-off-by: Kevin Fox <[email protected]> * Fix role Signed-off-by: Kevin Fox <[email protected]> * Update rbac Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix format Signed-off-by: Kevin Fox <[email protected]> * Fix the bundle format for the fetchca bits Signed-off-by: Kevin Fox <[email protected]> * Update key Signed-off-by: Kevin Fox <[email protected]> * Fix test rather then reconfigure Signed-off-by: Kevin Fox <[email protected]> * Add namespace Signed-off-by: Kevin Fox <[email protected]> * Update to follow the new patch Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Fix formatting Signed-off-by: Kevin Fox <[email protected]> * Update filename based on format Signed-off-by: Kevin Fox <[email protected]> * Add upgrade notes Signed-off-by: Kevin Fox <[email protected]> * Enable running the oidc discovery provider without cluster-admin/CSI Signed-off-by: Kevin Fox <[email protected]> * Calm lint Signed-off-by: Kevin Fox <[email protected]> * Switch to testing nightly. Dont manage bundle configmap. Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update permissions Signed-off-by: Kevin Fox <[email protected]> * Update for final release Signed-off-by: Kevin Fox <[email protected]> * Update for final 1.12.4 release Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Update docs Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -29,6 +29,8 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
|
||||||
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
||||||
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
||||||
|
| `bundleSource` | Configure where to fetch the trust bundle from. Must be CSI or ConfigMap. | `CSI` |
|
||||||
|
| `bundleConfigMap` | ConfigMap name for SPIRE bundle when bundleSource is ConfigMap | `spire-bundle` |
|
||||||
| `replicaCount` | Replica count | `1` |
|
| `replicaCount` | Replica count | `1` |
|
||||||
| `namespaceOverride` | Namespace override | `""` |
|
| `namespaceOverride` | Namespace override | `""` |
|
||||||
| `annotations` | Annotations for the deployment | `{}` |
|
| `annotations` | Annotations for the deployment | `{}` |
|
||||||
|
|||||||
@@ -1,3 +1,6 @@
|
|||||||
|
{{- if and (ne .Values.bundleSource "ConfigMap") (ne .Values.bundleSource "CSI") }}
|
||||||
|
{{- fail "Bundle source must be CSI or ConfigmMap" }}
|
||||||
|
{{- end }}
|
||||||
{{- $tlsCount := 0 }}
|
{{- $tlsCount := 0 }}
|
||||||
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
{{- if and .Values.enabled .Values.tls.spire.enabled }}
|
||||||
{{- $tlsCount = add $tlsCount 1 }}
|
{{- $tlsCount = add $tlsCount 1 }}
|
||||||
@@ -44,9 +47,14 @@ serving_cert_file:
|
|||||||
jwks_uri: {{ .Values.config.jwksUri | quote }}
|
jwks_uri: {{ .Values.config.jwksUri | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||||
|
file:
|
||||||
|
path: /bundle/bundle.spiffe
|
||||||
|
{{- else }}
|
||||||
workload_api:
|
workload_api:
|
||||||
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
socket_path: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | quote }}
|
||||||
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
health_checks:
|
health_checks:
|
||||||
bind_port: "8008"
|
bind_port: "8008"
|
||||||
|
|||||||
@@ -86,9 +86,15 @@ spec:
|
|||||||
name: https
|
name: https
|
||||||
{{- end }}
|
{{- end }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
|
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||||
|
- name: spiffe-bundle
|
||||||
|
mountPath: /bundle
|
||||||
|
readOnly: true
|
||||||
|
{{- else }}
|
||||||
- name: spiffe-workload-api
|
- name: spiffe-workload-api
|
||||||
mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }}
|
mountPath: {{ include "spiffe-oidc-discovery-provider.workload-api-socket-path" . | dir }}
|
||||||
readOnly: true
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
- name: spire-oidc-sockets
|
- name: spire-oidc-sockets
|
||||||
mountPath: /run/spire/oidc-sockets
|
mountPath: /run/spire/oidc-sockets
|
||||||
readOnly: false
|
readOnly: false
|
||||||
@@ -171,10 +177,17 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
volumes:
|
volumes:
|
||||||
|
{{- if or .Values.tls.spire.enabled (eq .Values.bundleSource "CSI") }}
|
||||||
- name: spiffe-workload-api
|
- name: spiffe-workload-api
|
||||||
csi:
|
csi:
|
||||||
driver: "{{ .Values.csiDriverName }}"
|
driver: "{{ .Values.csiDriverName }}"
|
||||||
readOnly: true
|
readOnly: true
|
||||||
|
{{- end }}
|
||||||
|
{{- if eq .Values.bundleSource "ConfigMap" }}
|
||||||
|
- name: spiffe-bundle
|
||||||
|
configMap:
|
||||||
|
name: {{ include "spire-lib.bundle-configmap" . }}
|
||||||
|
{{- end }}
|
||||||
- name: spire-oidc-sockets
|
- name: spire-oidc-sockets
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
- name: spire-oidc-config
|
- name: spire-oidc-config
|
||||||
|
|||||||
@@ -11,6 +11,12 @@ agentSocketName: spire-agent.sock
|
|||||||
## @param csiDriverName The csi driver to use
|
## @param csiDriverName The csi driver to use
|
||||||
csiDriverName: csi.spiffe.io
|
csiDriverName: csi.spiffe.io
|
||||||
|
|
||||||
|
## @param bundleSource Configure where to fetch the trust bundle from. Must be CSI or ConfigMap.
|
||||||
|
bundleSource: CSI
|
||||||
|
|
||||||
|
## @param bundleConfigMap ConfigMap name for SPIRE bundle when bundleSource is ConfigMap
|
||||||
|
bundleConfigMap: spire-bundle
|
||||||
|
|
||||||
## @param replicaCount Replica count
|
## @param replicaCount Replica count
|
||||||
replicaCount: 1
|
replicaCount: 1
|
||||||
|
|
||||||
|
|||||||
@@ -17,7 +17,7 @@ spire-server:
|
|||||||
selectors:
|
selectors:
|
||||||
- tpm:pub_hash:12345
|
- tpm:pub_hash:12345
|
||||||
foo-kubelet:
|
foo-kubelet:
|
||||||
parentID: spiffe://example.org/foo
|
parentID: spiffe://example.org/hosts/foo
|
||||||
spiffeID: spiffe://example.org/k8s/one/node/foo
|
spiffeID: spiffe://example.org/k8s/one/node/foo
|
||||||
selectors:
|
selectors:
|
||||||
- systemd:id:kubelet.service
|
- systemd:id:kubelet.service
|
||||||
@@ -28,4 +28,8 @@ spire-agent:
|
|||||||
spiffe-csi-driver:
|
spiffe-csi-driver:
|
||||||
enabled: false
|
enabled: false
|
||||||
spiffe-oidc-discovery-provider:
|
spiffe-oidc-discovery-provider:
|
||||||
|
enabled: true
|
||||||
|
bundleSource: ConfigMap
|
||||||
|
tls:
|
||||||
|
spire:
|
||||||
enabled: false
|
enabled: false
|
||||||
|
|||||||
Reference in New Issue
Block a user