Support federation bundle endpoint profile http_web certificates (#469)
* Support federation bundle endpoint profile http_web certificates Signed-off-by: Kevin Fox <[email protected]> * Fix var Signed-off-by: Kevin Fox <[email protected]> * Fix key Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
This commit is contained in:
kfox1111
@@ -163,7 +163,8 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `federation.enabled` | Flag to enable federation | `false` |
|
| `federation.enabled` | Flag to enable federation | `false` |
|
||||||
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
| `federation.bundleEndpoint.port` | Port value for trust bundle federation | `8443` |
|
||||||
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
| `federation.bundleEndpoint.address` | Address for trust bundle federation | `0.0.0.0` |
|
||||||
| `federation.bundleEndpoint.refresh_hint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
| `federation.bundleEndpoint.refreshHint` | Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server. | `5m` |
|
||||||
|
| `federation.bundleEndpoint.profile.httpWeb.fileSyncInterval` | Interval on which to reload the certificate/key from disk | `1h` |
|
||||||
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
| `federation.tls.spire.enabled` | Use spire to secure the federation bundle endpoint | `true` |
|
||||||
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
| `federation.tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
||||||
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
| `federation.tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
||||||
|
|||||||
@@ -298,7 +298,7 @@ The code below determines what connection type should be used.
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- $args = append $args (printf "https://%s/" $host) }}
|
{{- $args = append $args (printf "https://%s/" $host) }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
{{- $args = append $args (printf "http://%s/" $host) }}
|
{{- $args = append $args (printf "-k -L http://%s/" $host) }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{ $args | toYaml }}
|
{{ $args | toYaml }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
|
|||||||
@@ -38,9 +38,6 @@
|
|||||||
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
{{- if and (eq (.Values.keyManager.awsKMS.keyIdentifierFile.enabled | toString) "true") (eq (.Values.keyManager.awsKMS.keyIdentifierValue.enabled | toString ) "true") }}
|
||||||
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
{{- fail "You can only enable one of keyIdentifierFile or keyIdentifierValue at a time" }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if hasKey .Values.federation.bundleEndpoint "profile" }}
|
|
||||||
{{- fail "Configuring the federation bundle endpoint profile directly isn't supported. You can specify the settings via federation.tls" }}
|
|
||||||
{{- end }}
|
|
||||||
{{- define "spire-server.yaml-config" -}}
|
{{- define "spire-server.yaml-config" -}}
|
||||||
{{- $upstreamAuthorityUsed := 0 }}
|
{{- $upstreamAuthorityUsed := 0 }}
|
||||||
{{- $keyManagerUsed := 0 }}
|
{{- $keyManagerUsed := 0 }}
|
||||||
@@ -69,12 +66,24 @@ server:
|
|||||||
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
|
organization: [{{ include "spire-server.ca-subject-organization" . | quote }}]
|
||||||
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
|
common_name: {{ include "spire-server.ca-subject-common-name" . | quote }}
|
||||||
|
|
||||||
{{- with .Values.federation }}
|
{{- if eq (.Values.federation.enabled | toString) "true" }}
|
||||||
{{- if eq (.enabled | toString) "true" }}
|
|
||||||
federation:
|
federation:
|
||||||
bundle_endpoint:
|
bundle_endpoint:
|
||||||
- {{ .bundleEndpoint | toYaml | nindent 8 }}
|
address: {{ .Values.federation.bundleEndpoint.address | quote }}
|
||||||
{{- end }}
|
port: {{ .Values.federation.bundleEndpoint.port }}
|
||||||
|
refresh_hint: {{ .Values.federation.bundleEndpoint.refreshHint | quote }}
|
||||||
|
profile:
|
||||||
|
{{- if .Values.federation.tls.spire.enabled }}
|
||||||
|
- https_spiffe: {}
|
||||||
|
{{ else }}
|
||||||
|
- https_web:
|
||||||
|
serving_cert_file:
|
||||||
|
file_sync_interval: {{ .Values.federation.bundleEndpoint.profile.httpWeb.fileSyncInterval }}
|
||||||
|
{{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }}
|
||||||
|
cert_file_path: /bundle-endpoint-tls/tls.crt
|
||||||
|
key_file_path: /bundle-endpoint-tls/tls.key
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
{{- with .Values.experimental }}
|
{{- with .Values.experimental }}
|
||||||
|
|||||||
@@ -4,33 +4,18 @@
|
|||||||
{{- $path := "/"}}
|
{{- $path := "/"}}
|
||||||
{{- $pathType := "Prefix" }}
|
{{- $pathType := "Prefix" }}
|
||||||
{{- $tlsSection := true }}
|
{{- $tlsSection := true }}
|
||||||
{{/* Until https://github.com/spiffe/spire/issues/2202 is resolved, use ingress to implement cert-manager and externalSecret support. */}}
|
|
||||||
{{- $federationIngress := deepCopy .Values.federation.ingress }}
|
|
||||||
{{- if .Values.federation.tls.certManager.enabled }}
|
|
||||||
{{- $secret := printf "%s-federation-cert" $svcName }}
|
|
||||||
{{- $_ := set $federationIngress "tlsSecret" $secret }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.federation.tls.externalSecret.enabled }}
|
|
||||||
{{- $_ := set $federationIngress "tlsSecret" .Values.federation.tls.externalSecret.secretName }}
|
|
||||||
{{- end }}
|
|
||||||
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
{{- $ingressControllerType := include "spire-lib.ingress-controller-type" (dict "global" .Values.global "ingress" .Values.federation.ingress) }}
|
||||||
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
{{- $annotations := deepCopy .Values.federation.ingress.annotations }}
|
||||||
{{- if eq $ingressControllerType "ingress-nginx" }}
|
{{- if eq $ingressControllerType "ingress-nginx" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/force-ssl-redirect" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/backend-protocol" "HTTPS" }}
|
||||||
{{- if not .Values.federation.ingress.tlsSecret }}
|
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
||||||
{{- $_ := set $annotations "nginx.ingress.kubernetes.io/ssl-passthrough" "true" }}
|
|
||||||
{{- end }}
|
|
||||||
{{- else if eq $ingressControllerType "openshift" }}
|
{{- else if eq $ingressControllerType "openshift" }}
|
||||||
{{- if $federationIngress.tlsSecret }}
|
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
||||||
{{- $_ := set $annotations "route.openshift.io/termination" "reencrypt" }}
|
|
||||||
{{- else }}
|
|
||||||
{{- $_ := set $annotations "route.openshift.io/termination" "passthrough" }}
|
|
||||||
{{- $path = "" }}
|
{{- $path = "" }}
|
||||||
{{- $pathType = "ImplementationSpecific" }}
|
{{- $pathType = "ImplementationSpecific" }}
|
||||||
{{- $tlsSection = false }}
|
{{- $tlsSection = false }}
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
{{- end }}
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
@@ -44,6 +29,6 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" $federationIngress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "path" $path "pathType" $pathType "tlsSection" $tlsSection "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -315,6 +315,10 @@ spec:
|
|||||||
mountPath: /tmp-direct-hashes
|
mountPath: /tmp-direct-hashes
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if or .Values.federation.tls.certManager.enabled .Values.federation.tls.externalSecret.enabled }}
|
||||||
|
- name: bundle-endpoint-tls
|
||||||
|
mountPath: /bundle-endpoint-tls
|
||||||
|
{{- end }}
|
||||||
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
{{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
|
||||||
- name: upstream-ca
|
- name: upstream-ca
|
||||||
mountPath: /run/spire/upstream_ca
|
mountPath: /run/spire/upstream_ca
|
||||||
@@ -450,6 +454,16 @@ spec:
|
|||||||
name: {{ include "spire-server.fullname" . }}-tpm-direct-hash
|
name: {{ include "spire-server.fullname" . }}-tpm-direct-hash
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.federation.tls.certManager.enabled }}
|
||||||
|
- name: bundle-endpoint-tls
|
||||||
|
secret:
|
||||||
|
secretName: {{ printf "%s-federation-cert" (include "spire-server.fullname" .) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.federation.tls.externalSecret.enabled }}
|
||||||
|
- name: bundle-endpoint-tls
|
||||||
|
secret:
|
||||||
|
secretName: {{ .Values.federation.tls.externalSecret.secretName }}
|
||||||
|
{{- end }}
|
||||||
{{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
|
{{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
|
||||||
- name: server-cert
|
- name: server-cert
|
||||||
secret:
|
secret:
|
||||||
|
|||||||
@@ -248,8 +248,12 @@ federation:
|
|||||||
port: 8443
|
port: 8443
|
||||||
## @param federation.bundleEndpoint.address Address for trust bundle federation
|
## @param federation.bundleEndpoint.address Address for trust bundle federation
|
||||||
address: "0.0.0.0"
|
address: "0.0.0.0"
|
||||||
## @param federation.bundleEndpoint.refresh_hint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.
|
## @param federation.bundleEndpoint.refreshHint Hint used by federated servers on how often to refresh the bundle. CA TTL must be 3-5x the duration of this value to ensure public keys are loaded on federated servers prior to private key rotation on remote server.
|
||||||
refresh_hint: "5m"
|
refreshHint: "5m"
|
||||||
|
profile:
|
||||||
|
httpWeb:
|
||||||
|
## @param federation.bundleEndpoint.profile.httpWeb.fileSyncInterval Interval on which to reload the certificate/key from disk
|
||||||
|
fileSyncInterval: 1h
|
||||||
|
|
||||||
tls:
|
tls:
|
||||||
spire:
|
spire:
|
||||||
|
|||||||
@@ -129,7 +129,7 @@ install_and_test() {
|
|||||||
--values /tmp/dummydns \
|
--values /tmp/dummydns \
|
||||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||||
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
||||||
--set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
|
--set spire-server.federation.tls.externalSecret.secretName=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
|
||||||
--wait
|
--wait
|
||||||
|
|
||||||
helm test --namespace "${ns}" spire
|
helm test --namespace "${ns}" spire
|
||||||
|
|||||||
@@ -4,10 +4,9 @@ spire-server:
|
|||||||
enabled: true
|
enabled: true
|
||||||
federation:
|
federation:
|
||||||
enabled: true
|
enabled: true
|
||||||
ingress:
|
tls:
|
||||||
enabled: true
|
spire:
|
||||||
controllerType: ingress-nginx
|
enabled: false
|
||||||
|
externalSecret:
|
||||||
# className: nginx
|
enabled: true
|
||||||
|
secretName: spire-server-federation-tls
|
||||||
tlsSecret: spire-server-federation-tls
|
|
||||||
|
|||||||
Reference in New Issue
Block a user