feat: 支持按 Pod UID 生成 Agent ID

Signed-off-by: panxiao81 <[email protected]>

charts/spire/Chart.yaml

@@ -4,7 +4,7 @@ description: >
   A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
 
 type: application
-version: 0.30.2
+version: 0.30.2-ddupan.1
 appVersion: "1.15.3"
 keywords: ["spiffe", "spire", "spire-server", "spire-agent", "oidc", "spire-controller-manager"]
 home: https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire

charts/spire/charts/spire-server/README.md

@@ -475,11 +475,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
 | `nodeAttestor.k8sPSAT.audience`                                                                               | Audience for token validation. If set to [] (empty array), Kubernetes API server audience is used                                                                                                                                                                                                                                                                                                    | `[]`                                                                                                        |
 | `nodeAttestor.k8sPSAT.allowedNodeLabelKeys`                                                                   | Node label keys considered for selectors                                                                                                                                                                                                                                                                                                                                                             | `[]`                                                                                                        |
 | `nodeAttestor.k8sPSAT.allowedPodLabelKeys`                                                                    | Pod label keys considered for selectors                                                                                                                                                                                                                                                                                                                                                              | `[]`                                                                                                        |
+| `nodeAttestor.k8sPSAT.usePodUIDForAgentID`                                                                    | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID                                                                                                                                                                                                                                                                                                                | `false`                                                                                                     |
 | `nodeAttestor.externalK8sPSAT.enabled`                                                                        | Enable PSAT k8s nodeattestor for external Kubernetes clusters                                                                                                                                                                                                                                                                                                                                        | `true`                                                                                                      |
 | `nodeAttestor.externalK8sPSAT.defaults.serviceAccountAllowList`                                               | Allowed service accounts for PSAT node attestor                                                                                                                                                                                                                                                                                                                                                      | `[]`                                                                                                        |
 | `nodeAttestor.externalK8sPSAT.defaults.audience`                                                              | Audience for token validation. If it is set to an empty array ([]), Kubernetes API server audience is used                                                                                                                                                                                                                                                                                           | `[]`                                                                                                        |
 | `nodeAttestor.externalK8sPSAT.defaults.allowedNodeLabelKeys`                                                  | Node label keys considered for selectors                                                                                                                                                                                                                                                                                                                                                             | `[]`                                                                                                        |
 | `nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys`                                                   | Pod label keys considered for selectors                                                                                                                                                                                                                                                                                                                                                              | `[]`                                                                                                        |
+| `nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID`                                                   | Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID                                                                                                                                                                                                                                                                                                                | `false`                                                                                                     |
 | `nodeAttestor.externalK8sPSAT.clusters`                                                                       | A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.                                                                                                                                                                                                                                                                                 | `{}`                                                                                                        |
 | `nodeAttestor.joinToken.enabled`                                                                              | Enable the join_token nodeattestor                                                                                                                                                                                                                                                                                                                                                                   | `false`                                                                                                     |
 | `nodeAttestor.httpChallenge.enabled`                                                                          | Enable the http_challenge nodeattesto                                                                                                                                                                                                                                                                                                                                                                | `false`                                                                                                     |

charts/spire/charts/spire-server/templates/configmap.yaml

@@ -215,6 +215,7 @@ plugins:
               {{ toYaml .allowedNodeLabelKeys | nindent 14 }}
             allowed_pod_label_keys:
               {{ toYaml .allowedPodLabelKeys | nindent 14 }}
+            use_pod_uid_for_agent_id: {{ .usePodUIDForAgentID }}
           {{- end }}
           {{- end }}
           {{- if eq (.Values.nodeAttestor.externalK8sPSAT.enabled | toString) "true" }}
@@ -237,6 +238,7 @@ plugins:
               {{ if hasKey $clusterSettings "allowedNodeLabelKeys" }}{{ toYaml $clusterSettings.allowedNodeLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedNodeLabelKeys | nindent 14 }}{{ end }}
             allowed_pod_label_keys:
               {{ if hasKey $clusterSettings "allowedPodLabelKeys" }}{{ toYaml $clusterSettings.allowedPodLabelKeys | nindent 14 }}{{ else }}{{ toYaml $clusterDefaults.allowedPodLabelKeys | nindent 14 }}{{ end }}
+            use_pod_uid_for_agent_id: {{ if hasKey $clusterSettings "usePodUIDForAgentID" }}{{ $clusterSettings.usePodUIDForAgentID }}{{ else }}{{ $clusterDefaults.usePodUIDForAgentID }}{{ end }}
           {{- end }}
           {{- end }}
   {{- end }}

charts/spire/charts/spire-server/values.yaml

@@ -1178,6 +1178,8 @@ nodeAttestor:
     allowedNodeLabelKeys: []
     ## @param nodeAttestor.k8sPSAT.allowedPodLabelKeys [array] Pod label keys considered for selectors
     allowedPodLabelKeys: []
+    ## @param nodeAttestor.k8sPSAT.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID
+    usePodUIDForAgentID: false
   externalK8sPSAT:
     ## @param nodeAttestor.externalK8sPSAT.enabled Enable PSAT k8s nodeattestor for external Kubernetes clusters
     enabled: true
@@ -1190,11 +1192,14 @@ nodeAttestor:
       allowedNodeLabelKeys: []
       ## @param nodeAttestor.externalK8sPSAT.defaults.allowedPodLabelKeys [array] Pod label keys considered for selectors
       allowedPodLabelKeys: []
+      ## @param nodeAttestor.externalK8sPSAT.defaults.usePodUIDForAgentID Use the attesting pod UID instead of the node UID when generating the agent SPIFFE ID
+      usePodUIDForAgentID: false
     ## @param nodeAttestor.externalK8sPSAT.clusters [object] A dictionary of clusters to add with optional overrides. If empty, all clusters defined in kubeConfigs will be used.
     clusters: {}
     # clustera:
     #   kubeConfigName: foo
     #   serviceAccountAllowList: ["other-ns:other-agent"]
+    #   usePodUIDForAgentID: true
     # clusterb: {}
   joinToken:
     ## @param nodeAttestor.joinToken.enabled Enable the join_token nodeattestor

tests/unit/spire_test.go

@@ -416,6 +416,41 @@ spire-server:
 			Expect(objs[serverTmpl]).Should(ContainSubstring("init-jwt-svid-exec"))
 		})
 	})
+	Describe("spire-server.nodeAttestor.k8sPSAT.usePodUIDForAgentID", func() {
+		It("renders the local cluster setting", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  nodeAttestor:
+    k8sPSAT:
+      usePodUIDForAgentID: true
+`)
+			Expect(err).Should(Succeed())
+			serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
+		})
+
+		It("allows an external cluster to override the default", func() {
+			objs, err := ValueStringRender(chart, `
+spire-server:
+  kubeConfigs:
+    sandbox:
+      kubeConfig: |
+        apiVersion: v1
+        kind: Config
+  nodeAttestor:
+    externalK8sPSAT:
+      defaults:
+        usePodUIDForAgentID: false
+      clusters:
+        sandbox:
+          usePodUIDForAgentID: true
+`)
+			Expect(err).Should(Succeed())
+			serverCM := objs["spire/charts/spire-server/templates/configmap.yaml"]
+			Expect(serverCM).Should(ContainSubstring(`"sandbox": {`))
+			Expect(serverCM).Should(ContainSubstring(`"use_pod_uid_for_agent_id": true`))
+		})
+	})
 	Describe("spiffe-csi-driver.syncWave", func() {
 		csiTmpl := "spire/charts/spiffe-csi-driver/templates/spiffe-csi-driver.yaml"
 		It("renders the default sync-wave annotation on OpenShift", func() {