Add direct tpm support for spire-server (#211)

* Add direct tpm support Signed-off-by: Kevin Fox <[email protected]> * Add agent support Signed-off-by: Kevin Fox <[email protected]> * Add missing condition Signed-off-by: Kevin Fox <[email protected]> * Add missing condition Signed-off-by: Kevin Fox <[email protected]> * Remove agent bits from this pr Signed-off-by: Kevin Fox <[email protected]> * Plugin needs to write to /tmp Signed-off-by: Kevin Fox <[email protected]> * Fix tmp mount Signed-off-by: Kevin Fox <[email protected]> * Make it possible to manage cas/hashes via values Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update to the newest release Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-02-29 11:41:25 -08:00
parent c57017425e
commit fcd0c11e14
5 changed files with 126 additions and 2 deletions
@@ -95,7 +95,7 @@ plugins:
      plugin_data:
        {{ include "spire-server.datastore-config" . | nindent 10 }}

-  {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.joinToken.enabled }}
+  {{- if or .Values.nodeAttestor.k8sPsat.enabled .Values.nodeAttestor.joinToken.enabled .Values.nodeAttestor.tpmDirect.enabled }}
  NodeAttestor:
  {{- with .Values.nodeAttestor.k8sPsat }}
  {{- if eq (.enabled | toString) "true" }}
@@ -112,6 +112,24 @@ plugins:
      plugin_data: {}
  {{- end }}
  {{- end }}
+  {{- with .Values.nodeAttestor.tpmDirect }}
+  {{- if eq (.enabled | toString) "true" }}
+    tpm:
+      plugin_cmd: "/tpm/tpm_attestor_server"
+      plugin_checksum: {{ .checksum }}
+      plugin_data:
+        {{- if ne (len .cas) 0 }}
+        ca_path: /tpm-direct-cas
+        {{- else }}
+        ca_path: /run/spire/data/tpm-direct/certs
+        {{- end }}
+        {{- if ne (len .hashes) 0 }}
+        hash_path: /tmp-direct-hashes
+        {{- else }}
+        hash_path: /run/spire/data/tpm-direct/hashes
+        {{- end }}
+  {{- end }}
+  {{- end }}
  {{- end }}

  {{- with .Values.keyManager.disk }}
@@ -53,8 +53,28 @@ spec:
      securityContext:
        {{- include "spire-lib.podsecuritycontext" . | nindent 8 }}
      {{- include "spire-lib.default_cluster_priority_class_name" . | nindent 6 }}
-      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) }}
+      {{- if or (gt (len .Values.initContainers) 0) (and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create) .Values.nodeAttestor.tpmDirect.enabled }}
      initContainers:
+        {{- if .Values.nodeAttestor.tpmDirect.enabled }}
+        - name: init-tpm-direct
+          securityContext:
+            {{- include "spire-lib.securitycontext" . | nindent 12 }}
+          image: {{ template "spire-lib.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.nodeAttestor.tpmDirect.image "global" .Values.global) }}
+          command:
+            - sh
+            - -ec
+            - |
+              # SPIRE must be able to fork the plugin directly within its container. Copy the plugin into a volume that can be mounted where SPIRE can execute it.
+              cp -a {{ .Values.nodeAttestor.tpmDirect.pluginPath }} /tpm/tpm_attestor_server
+              mkdir -p /run/spire/data/tpm-direct/certs
+              mkdir -p /run/spire/data/tpm-direct/hashes
+          volumeMounts:
+            - name: tpm-direct
+              mountPath: /tpm
+            - name: spire-data
+              mountPath: /run/spire/data
+          imagePullPolicy: {{ .Values.nodeAttestor.tpmDirect.image.pullPolicy }}
+      {{- end }}
      {{- if and .Values.upstreamAuthority.certManager.enabled .Values.upstreamAuthority.certManager.ca.create }}
        - name: wait
          securityContext:
@@ -158,6 +178,19 @@ spec:
            - name: spire-data
              mountPath: /run/spire/data
              readOnly: false
+            {{- if .Values.nodeAttestor.tpmDirect.enabled }}
+            - name: tpm-direct
+              mountPath: /tpm
+              readOnly: true
+            {{- if ne (len .Values.nodeAttestor.tpmDirect.cas) 0 }}
+            - name: tpm-direct-cas
+              mountPath: /tpm-direct-cas
+            {{- end }}
+            {{- if ne (len .Values.nodeAttestor.tpmDirect.hashes) 0 }}
+            - name: tpm-direct-hashes
+              mountPath: /tmp-direct-hashes
+            {{- end }}
+            {{- end }}
            {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }}
            - name: upstream-ca
              mountPath: /run/spire/upstream_ca
@@ -191,6 +224,9 @@ spec:
            {{- if gt (len .Values.extraVolumeMounts) 0 }}
            {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
            {{- end }}
+            - name: server-tmp
+              mountPath: /tmp
+              readOnly: false
        {{- if eq (.Values.controllerManager.enabled | toString) "true" }}
        - name: spire-controller-manager
          securityContext:
@@ -314,6 +350,8 @@ spec:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
+        - name: server-tmp
+          emptyDir: {}
        - name: spire-config
          configMap:
            name: {{ include "spire-server.fullname" . }}
@@ -321,6 +359,20 @@ spec:
          emptyDir: {}
        - name: spire-controller-manager-tmp
          emptyDir: {}
+        {{- if .Values.nodeAttestor.tpmDirect.enabled }}
+        - name: tpm-direct
+          emptyDir: {}
+        {{- if ne (len .Values.nodeAttestor.tpmDirect.cas) 0 }}
+        - name: tpm-direct-cas
+          configMap:
+            name: {{ include "spire-server.fullname" . }}-tpm-direct-ca
+        {{- end }}
+        {{- if ne (len .Values.nodeAttestor.tpmDirect.hashes) 0 }}
+        - name: tpm-direct-hashes
+          configMap:
+            name: {{ include "spire-server.fullname" . }}-tpm-direct-hash
+        {{- end }}
+        {{- end }}
        {{- if or (eq (include "spire-tornjak.connectionType" .) "tls") (eq (include "spire-tornjak.connectionType" .) "mtls") }}
        - name: server-cert
          secret:
@@ -0,0 +1,24 @@
+{{- if ne (len .Values.nodeAttestor.tpmDirect.cas) 0 }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-server.fullname" . }}-tpm-direct-ca
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  {{- range $key, $value := .Values.nodeAttestor.tpmDirect.cas }}
+  {{ $key }}: |
+    {{ $value | nindent 4 }}
+  {{- end }}
+{{- end }}
+---
+{{- if ne (len .Values.nodeAttestor.tpmDirect.hashes) 0 }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "spire-server.fullname" . }}-tpm-direct-hash
+  namespace: {{ include "spire-server.namespace" . }}
+data:
+  {{- range .Values.nodeAttestor.tpmDirect.hashes }}
+  {{ . }}: ""
+  {{- end }}
+{{- end }}