Add direct tpm support for spire-server (#211)

* Add direct tpm support Signed-off-by: Kevin Fox <[email protected]> * Add agent support Signed-off-by: Kevin Fox <[email protected]> * Add missing condition Signed-off-by: Kevin Fox <[email protected]> * Add missing condition Signed-off-by: Kevin Fox <[email protected]> * Remove agent bits from this pr Signed-off-by: Kevin Fox <[email protected]> * Plugin needs to write to /tmp Signed-off-by: Kevin Fox <[email protected]> * Fix tmp mount Signed-off-by: Kevin Fox <[email protected]> * Make it possible to manage cas/hashes via values Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Co-authored-by: Faisal Memon <[email protected]> Signed-off-by: kfox1111 <[email protected]> * Fix docs Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update to the newest release Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
2024-02-29 11:41:25 -08:00
parent c57017425e
commit fcd0c11e14
5 changed files with 126 additions and 2 deletions
@@ -700,6 +700,27 @@ nodeAttestor:
  joinToken:
    ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor
    enabled: false
+  tpmDirect:
+    ## @param nodeAttestor.tpmDirect.enabled Enable the direct TPM node attestor, a 3rd party plugin by Boxboat. This plugin is experimental.
+    enabled: false
+    ## @param nodeAttestor.tpmDirect.image.registry The OCI registry to pull the image from
+    ## @param nodeAttestor.tpmDirect.image.repository The repository within the registry
+    ## @param nodeAttestor.tpmDirect.image.pullPolicy The image pull policy
+    ## @param nodeAttestor.tpmDirect.image.tag Overrides the image tag
+    ##
+    image:
+      registry: docker.io
+      repository: boxboat/spire-tpm-plugin-tpm-attestor-server
+      pullPolicy: IfNotPresent
+      tag: "v1.8.7"
+    ## @param nodeAttestor.tpmDirect.checksum The sha256 checksum of the plugin binary
+    checksum: f39ef9cdd2b3dd74112bfe827b79d6721c59215d0d5f4c2e34fa09bbc60d36d2
+    ## @param nodeAttestor.tpmDirect.pluginPath The filename in the container of the plugin
+    pluginPath: /app/tpm_attestor_server
+    ## @param nodeAttestor.tpmDirect.cas A dictionary of TPM CA PEM or DER files that are allowed to connect.
+    cas: {}
+    ## @param nodeAttestor.tpmDirect.hashes A list of TPM hashes that are allowed to connect.
+    hashes: []

 ## @section Tornjak
 tornjak: