05d0f4778d
This PR introduces a simplified version of [Tornjak](https://github.com/spiffe/tornjak) to support UI and SPIRE control plane. It extends the `/charts/spire-server` sub-chart by injecting *tornjak* container to the *spire-server* pod. Tornjak image consists of Tornjak API (Tornjak Backend), Tornjak UI (Frontend), and database for storing Tornjak specific information. Tornjak Backend communicates with SPIRE API via SPIRE Server socket. Since Tornjak UI (Frontend) is a React code that renders in a browser, it needs to communicate with Tornjak APIs, and that requires communication ports to be open, either via Ingress (in Cloud deployment) or via port forwarding in local deployments (e.g. kind, minikube etc). Typically port 10000 is used for HTTP connection to Backend, and port 3000 for the HTTP connection to Frontend. End user management, TLS, and mTLS connections will be addressed by future PRs. This PR resolves issue #31 --------- Signed-off-by: Mariusz Sabath <[email protected]> Signed-off-by: Marco Franssen <[email protected]> Co-authored-by: Kevin Fox <[email protected]> Co-authored-by: Marco Franssen <[email protected]> Co-authored-by: Pete Cable <[email protected]> Co-authored-by: Dennis Gove <[email protected]>
spire
A Helm chart for deploying the complete Spire stack including: spire-server, spire-agent, spiffe-csi-driver, spiffe-oidc-discovery-provider and spire-controller-manager.
Homepage: https://github.com/spiffe/helm-charts/tree/main/charts/spire
Warning
: Please note this chart requires Projected Service Account Tokens which has to be enabled on your k8s api server.
Note
: Minimum Spire version is
v1.5.3.
To enable Projected Service Account Tokens on Docker for Mac/Windows run the following command to SSH into the Docker Desktop K8s VM.
docker run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh
Then add the following to /etc/kubernetes/manifests/kube-apiserver.yaml
spec:
containers:
- command:
- kube-apiserver
- --api-audiences=api,spire-server
- --service-account-issuer=api,spire-agent
- --service-account-key-file=/run/config/pki/sa.pub
- --service-account-signing-key-file=/run/config/pki/sa.key
Usage
To utilize Spire in your own workloads you should add the following to your workload:
apiVersion: v1
kind: Pod
metadata:
name: my-app
spec:
containers:
- name: my-app
image: "my-app:latest"
imagePullPolicy: Always
+ volumeMounts:
+ - name: spiffe-workload-api
+ mountPath: /spiffe-workload-api
+ readOnly: true
resources:
requests:
cpu: 200m
memory: 32Mi
limits:
cpu: 500m
memory: 64Mi
+ volumes:
+ - name: spiffe-workload-api
+ csi:
+ driver: "csi.spiffe.io"
+ readOnly: true
Now you can interact with the Spire agent socket from your own application. The socket is mounted on /spiffe-workload-api/spire-agent.sock.
Maintainers
| Name | Url | |
|---|---|---|
| marcofranssen | [email protected] | https://marcofranssen.nl |
| kfox1111 | [email protected] |
Source Code
Requirements
Kubernetes: >=1.21.0-0
| Repository | Name | Version |
|---|---|---|
| file://./charts/spiffe-csi-driver | spiffe-csi-driver | 0.1.0 |
| file://./charts/spiffe-oidc-discovery-provider | spiffe-oidc-discovery-provider | 0.1.0 |
| file://./charts/spire-agent | spire-agent | 0.1.0 |
| file://./charts/spire-server | spire-server | 0.1.0 |
Values
| Key | Type | Default | Description |
|---|---|---|---|
| fullnameOverride | string | "" |
|
| nameOverride | string | "" |
|
| spiffe-csi-driver.enabled | bool | true |
|
| spiffe-oidc-discovery-provider.enabled | bool | false |
|
| spiffe-oidc-discovery-provider.trustDomain | string | "example.org" |
|
| spire-agent.bundleConfigMap | string | "spire-bundle" |
|
| spire-agent.clusterName | string | "example-cluster" |
|
| spire-agent.enabled | bool | true |
|
| spire-agent.nameOverride | string | "agent" |
|
| spire-agent.trustDomain | string | "example.org" |
|
| spire-server.bundleConfigMap | string | "spire-bundle" |
|
| spire-server.clusterName | string | "example-cluster" |
|
| spire-server.controllerManager.enabled | bool | true |
|
| spire-server.enabled | bool | true |
|
| spire-server.nameOverride | string | "server" |
|
| spire-server.trustDomain | string | "example.org" |