panxiao81/helm-charts-hardened
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add direct tpm support for spire-server (#211)

Browse Source 
* Add direct tpm support

Signed-off-by: Kevin Fox <[email protected]>

* Add agent support

Signed-off-by: Kevin Fox <[email protected]>

* Add missing condition

Signed-off-by: Kevin Fox <[email protected]>

* Add missing condition

Signed-off-by: Kevin Fox <[email protected]>

* Remove agent bits from this pr

Signed-off-by: Kevin Fox <[email protected]>

* Plugin needs to write to /tmp

Signed-off-by: Kevin Fox <[email protected]>

* Fix tmp mount

Signed-off-by: Kevin Fox <[email protected]>

* Make it possible to manage cas/hashes via values

Signed-off-by: Kevin Fox <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

* Fix docs

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Update to the newest release

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

* Incorperate feedback

Signed-off-by: Kevin Fox <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
2024-02-29 11:41:25 -08:00
committed by GitHub
co-authored by Faisal Memon
parent c57017425e
commit fcd0c11e14
5 changed files with 126 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/spire/charts/spire-server/README.md
+9
View File
@@ -296,6 +296,15 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| `nodeAttestor.k8sPsat.enabled` | Enable Psat k8s nodeattestor | `true` |
| `nodeAttestor.k8sPsat.serviceAccountAllowList` | Allowed service accounts for Psat nodeattestor | `[]` |
| `nodeAttestor.joinToken.enabled` | Enable the join_token nodeattestor | `false` |
| `nodeAttestor.tpmDirect.enabled` | Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental. | `false` |
| `nodeAttestor.tpmDirect.image.registry` | The OCI registry to pull the image from | `docker.io` |
| `nodeAttestor.tpmDirect.image.repository` | The repository within the registry | `boxboat/spire-tpm-plugin-tpm-attestor-server` |
| `nodeAttestor.tpmDirect.image.pullPolicy` | The image pull policy | `IfNotPresent` |
| `nodeAttestor.tpmDirect.image.tag` | Overrides the image tag | `v1.8.7` |
| `nodeAttestor.tpmDirect.checksum` | The sha256 checksum of the plugin binary | `f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2` |
| `nodeAttestor.tpmDirect.pluginPath` | The filename in the container of the plugin | `/app/tpm_attestor_server` |
| `nodeAttestor.tpmDirect.cas` | A dictionary of TPM CA PEM or DER files that are allowed to connect. | `{}` |
| `nodeAttestor.tpmDirect.hashes` | A list of TPM hashes that are allowed to connect. | `[]` |
### Tornjak