Files
helm-charts-hardened/tests/integration/spiffe-step-ssh/spire-agent.conf
T
kfox1111andFaisal Memon ec7259699f spiffe-step-ssh server (#198)
* Initial prototype of spire-step-ssh integration

Signed-off-by: Kevin Fox <[email protected]>

* Ingress work, image cleanup and misc cleanup

Signed-off-by: Kevin Fox <[email protected]>

* More values rework

Signed-off-by: Kevin Fox <[email protected]>

* Rename chart spiffe-step-ssh

Signed-off-by: Kevin Fox <[email protected]>

* Update to use shared lib

Signed-off-by: Kevin Fox <[email protected]>

* Update spiffe-helper

Signed-off-by: Kevin Fox <[email protected]>

* Use URLSAN rather then CN

Signed-off-by: Kevin Fox <[email protected]>

* Lookup the sans.

Signed-off-by: Kevin Fox <[email protected]>

* Make trust domain configurable

Signed-off-by: Kevin Fox <[email protected]>

* Add flag

Signed-off-by: Kevin Fox <[email protected]>

* Make driver configurable

Signed-off-by: Kevin Fox <[email protected]>

* Add more configurables. Fix up docs to pass test.

Signed-off-by: Kevin Fox <[email protected]>

* Add some metadata

Signed-off-by: Kevin Fox <[email protected]>

* Fix metadata

Signed-off-by: Kevin Fox <[email protected]>

* Add default values for lint

Signed-off-by: Kevin Fox <[email protected]>

* Forgot values updates

Signed-off-by: Kevin Fox <[email protected]>

* Fix metadata

Signed-off-by: Kevin Fox <[email protected]>

* Start working on integration test

Signed-off-by: Kevin Fox <[email protected]>

* Test

Signed-off-by: Kevin Fox <[email protected]>

* Test

Signed-off-by: Kevin Fox <[email protected]>

* Fix names

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More test bits

Signed-off-by: Kevin Fox <[email protected]>

* More fixes

Signed-off-by: Kevin Fox <[email protected]>

* More fixes

Signed-off-by: Kevin Fox <[email protected]>

* More fixes

Signed-off-by: Kevin Fox <[email protected]>

* Fix name conflict. Align naming

Signed-off-by: Kevin Fox <[email protected]>

* Fix name

Signed-off-by: Kevin Fox <[email protected]>

* Add more logging

Signed-off-by: Kevin Fox <[email protected]>

* Disable unneeded test. Add missing file.

Signed-off-by: Kevin Fox <[email protected]>

* Setup more things

Signed-off-by: Kevin Fox <[email protected]>

* Add missing conf file

Signed-off-by: Kevin Fox <[email protected]>

* Fix multiple svids

Signed-off-by: Kevin Fox <[email protected]>

* Fix ci defaults

Signed-off-by: Kevin Fox <[email protected]>

* Fix filename

Signed-off-by: Kevin Fox <[email protected]>

* Try and get the linter to stop complaining...

Signed-off-by: Kevin Fox <[email protected]>

* Fix perms

Signed-off-by: Kevin Fox <[email protected]>

* More logs

Signed-off-by: Kevin Fox <[email protected]>

* More setup

Signed-off-by: Kevin Fox <[email protected]>

* Fixes

Signed-off-by: Kevin Fox <[email protected]>

* Fixes

Signed-off-by: Kevin Fox <[email protected]>

* Add wait

Signed-off-by: Kevin Fox <[email protected]>

* More logging

Signed-off-by: Kevin Fox <[email protected]>

* Test ssh

Signed-off-by: Kevin Fox <[email protected]>

* Restart fetchca on updates too

Signed-off-by: Kevin Fox <[email protected]>

* Fix formating

Signed-off-by: Kevin Fox <[email protected]>

* Add missing file flag

Signed-off-by: Kevin Fox <[email protected]>

* Increase timeout

Signed-off-by: Kevin Fox <[email protected]>

* More flags

Signed-off-by: Kevin Fox <[email protected]>

* Fix name

Signed-off-by: Kevin Fox <[email protected]>

* Finish end to end test

Signed-off-by: Kevin Fox <[email protected]>

* Fix ingress setting

Signed-off-by: Kevin Fox <[email protected]>

* More logging/tests

Signed-off-by: Kevin Fox <[email protected]>

* More testing

Signed-off-by: Kevin Fox <[email protected]>

* Fix namespace

Signed-off-by: Kevin Fox <[email protected]>

* Fetch correct bundle

Signed-off-by: Kevin Fox <[email protected]>

* Chart testing will fail as it depends on spire to be preinstalled. Weird dependency loop.

Signed-off-by: Kevin Fox <[email protected]>

* Dont skip tls for testing

Signed-off-by: Kevin Fox <[email protected]>

* More logging

Signed-off-by: Kevin Fox <[email protected]>

* More debug

Signed-off-by: Kevin Fox <[email protected]>

* More debug

Signed-off-by: Kevin Fox <[email protected]>

* Pass intermediates

Signed-off-by: Kevin Fox <[email protected]>

* Fix trustdomain

Signed-off-by: Kevin Fox <[email protected]>

* Add ca authority prefix

Signed-off-by: Kevin Fox <[email protected]>

* fix

Signed-off-by: Kevin Fox <[email protected]>

* fix

Signed-off-by: Kevin Fox <[email protected]>

* fix

Signed-off-by: Kevin Fox <[email protected]>

* ci test is just broken. Revert trying to fix it.

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spiffe-step-ssh/files/ssh_x5c.tpl

Signed-off-by: kfox1111 <[email protected]>

* Self review feedback

Signed-off-by: Kevin Fox <[email protected]>

* Switch ingress to our more functional/easy type

Signed-off-by: Kevin Fox <[email protected]>

* Simplify the template

Signed-off-by: Kevin Fox <[email protected]>

* Add cast

Signed-off-by: Kevin Fox <[email protected]>

* Add install notes

Signed-off-by: Kevin Fox <[email protected]>

* Fix test

Signed-off-by: Kevin Fox <[email protected]>

* Update tests for updated client

Signed-off-by: Kevin Fox <[email protected]>

* Fix logging and entry

Signed-off-by: Kevin Fox <[email protected]>

* Add missing dir

Signed-off-by: Kevin Fox <[email protected]>

* Fix file location

Signed-off-by: Kevin Fox <[email protected]>

* Update timeout

Signed-off-by: Kevin Fox <[email protected]>

* More logging

Signed-off-by: Kevin Fox <[email protected]>

* Fix filename

Signed-off-by: Kevin Fox <[email protected]>

* Fix perms

Signed-off-by: Kevin Fox <[email protected]>

* Update charts/spiffe-step-ssh/README.md

Signed-off-by: kfox1111 <[email protected]>

* Apply suggestions from code review

Co-authored-by: Faisal Memon <[email protected]>
Signed-off-by: kfox1111 <[email protected]>

---------

Signed-off-by: Kevin Fox <[email protected]>
Signed-off-by: kfox1111 <[email protected]>
Co-authored-by: Faisal Memon <[email protected]>
2024-11-07 23:43:26 -08:00

26 lines
603 B
Plaintext

agent {
log_level = "DEBUG"
trust_domain = "production.other"
server_address = "spire-server.production.other"
server_port = 443
# Insecure bootstrap is NOT appropriate for production use but is ok for
# simple testing/evaluation purposes.
insecure_bootstrap = true
}
plugins {
KeyManager "disk" {
plugin_data {
directory = "./"
}
}
NodeAttestor "http_challenge" {
plugin_data {
hostname = "test.production.other"
port = 81
}
}
WorkloadAttestor "systemd" {
plugin_data {}
}
}