Support federation bundle endpoint profile http_web certificates (#469)
* Support federation bundle endpoint profile http_web certificates Signed-off-by: Kevin Fox <[email protected]> * Fix var Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -298,7 +298,7 @@ The code below determines what connection type should be used.
|
||||
{{- end }}
|
||||
{{- $args = append $args (printf "https://%s/" $host) }}
|
||||
{{- else }}
|
||||
{{- $args = append $args (printf "http://%s/" $host) }}
|
||||
{{- $args = append $args (printf "-k -L http://%s/" $host) }}
|
||||
{{- end }}
|
||||
{{ $args | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
@@ -38,9 +38,6 @@
|
||||
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
||||
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
||||
{{- end }}
|
||||
{{- if hasKey .Values.federation.bundleEndpoint "profile" }}
|
||||
{{- fail "Configuring the federation bundle endpoint profile directly isn't supported. You can specify the settings via federation.tls" }}
|
||||
{{- end }}
|
||||
{{- define "spire-server.yaml-config" -}}
|
||||
{{- $upstreamAuthorityUsed := 0 }}
|
||||
{{- $keyManagerUsed := 0 }}
|
||||
@@ -69,12 +66,24 @@ server:
|
||||
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
|
||||
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
|
||||
|
||||
{{- with .Values.federation }}
|
||||
{{- if eq (.enabled | toString) "true" }}
|
||||
{{- if eq (.Values.federation.enabled | toString) "true" }}
|
||||
federation:
|
||||
bundle_endpoint:
|
||||
- {{ .bundleEndpoint | toYaml | nindent 8 }}
|
||||
{{- end }}
|
||||
address: {{ .Values.federation.bundleEndpoint.address | quote }}
|
||||
port: {{ .Values.federation.bundleEndpoint.port }}
|
||||
refresh_hint: {{ .Values.federation.bundleEndpoint.refreshHint | quote }}
|
||||
profile:
|
||||
{{- if .Values.federation.tls.spire.enabled }}
|
||||
- https_spiffe: {}
|
||||
{{ else }}
|
||||
- https_web:
|
||||
serving_cert_file:
|
||||
file_sync_interval: {{ .Values.federation.bundleEndpoint.profile.httpWeb.fileSyncInterval }}
|
||||
{{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }}
|
||||
cert_file_path: /bundle-endpoint-tls/tls.crt
|
||||
key_file_path: /bundle-endpoint-tls/tls.key
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- with .Values.experimental }}
|
||||
|
||||
@@ -4,33 +4,18 @@
|
||||
{{- $path := "/"}}
|
||||
{{- $pathType := "Prefix" }}
|
||||
{{- $tlsSection := true }}
|
||||
{{/* Until https://github.com/spiffe/spire/issues/2202 is resolved, use ingress to implement cert-manager and externalSecret support. */}}
|
||||
{{- $federationIngress := deepCopy .Values.federation.ingress }}
|
||||
{{- if .Values.federation.tls.certManager.enabled }}
|
||||
{{- $secret := printf "%s-federation-cert" $svcName }}
|
||||
{{- $_ := set $federationIngress "tlsSecret" $secret }}
|
||||
{{- end }}
|
||||
{{- if .Values.federation.tls.externalSecret.enabled }}
|
||||
{{- $_ := set $federationIngress "tlsSecret" .Values.federation.tls.externalSecret.secretName }}
|
||||
{{- end }}
|
||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
||||
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||
{{- if not .Values.federation.ingress.tlsSecret }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- end }}
|
||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||
{{- else if eq $ingressControllerType "openshift" }}
|
||||
{{- if $federationIngress.tlsSecret }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
||||
{{- else }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||
{{- $path = "" }}
|
||||
{{- $pathType = "ImplementationSpecific" }}
|
||||
{{- $tlsSection = false }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
@@ -44,6 +29,6 @@ metadata:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" $federationIngress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -315,6 +315,10 @@ spec:
|
||||
mountPath: /tmp-direct-hashes
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }}
|
||||
- name: bundle-endpoint-tls
|
||||
mountPath: /bundle-endpoint-tls
|
||||
{{- end }}
|
||||
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||
- name: upstream-ca
|
||||
mountPath: /run/spire/upstream_ca
|
||||
@@ -450,6 +454,16 @@ spec:
|
||||
name: {{ include "spire-server.fullname" . }}-tpm-direct-hash
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.federation.tls.certManager.enabled }}
|
||||
- name: bundle-endpoint-tls
|
||||
secret:
|
||||
secretName: {{ printf "%s-federation-cert" (include "spire-server.fullname" .) }}
|
||||
{{- end }}
|
||||
{{- if .Values.federation.tls.externalSecret.enabled }}
|
||||
- name: bundle-endpoint-tls
|
||||
secret:
|
||||
secretName: {{ .Values.federation.tls.externalSecret.secretName }}
|
||||
{{- end }}
|
||||
{{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
|
||||
- name: server-cert
|
||||
secret:
|
||||
|
||||
Reference in New Issue
Block a user