kfox1111
952cbedbff
* Broker updates Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Fix broker permission when running as nonroot Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Add workload attestor config Signed-off-by: Kevin Fox <[email protected]> * Bump versions Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
290 lines
12 KiB
YAML
290 lines
12 KiB
YAML
{{- define "spire-agent.check-config-values" -}}
|
|
{{- include "spire-lib.check-strict-mode" (list . "clusterName must be set" (eq (include "spire-lib.cluster-name" .) "example-cluster"))}}
|
|
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
|
{{- include "spire-lib.check-strict-mode" (list . "trustDomain must be set" (eq $trustDomain "example.org"))}}
|
|
{{- range $type, $tvals := .Values.customPlugins }}
|
|
{{- if not (has $type (list "keyManager" "nodeAttestor" "svidStore" "workloadAttestor")) }}
|
|
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
|
{{- end }}
|
|
{{- range $name, $nval := $tvals }}
|
|
{{- if not (hasKey $nval "plugin_cmd") }}
|
|
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
|
{{- end }}
|
|
{{- if not (hasKey $nval "plugin_checksum") }}
|
|
{{- fail (printf "plugin_checksum is a required field.") }}
|
|
{{- end }}
|
|
{{- range $sname, $svals := $nval }}
|
|
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data" "image")) }}
|
|
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if and .Values.keyManager.disk.enabled (ne .Values.persistence.type "hostPath") (eq .Values.keyManager.disk.mode "hostPath") }}
|
|
{{- fail "keyManager.disk.enabled is true but persistence.type is not hostPath. Ensure persistence.type is hostPath when keyManager.disk.enabled is true." }}
|
|
{{- end }}
|
|
{{- if hasPrefix (.Values.socketPath | dir | clean) (.Values.sockets.hostBasePath | clean) }}
|
|
{{- fail "The sockets.hostBasePath can not be located under the socketPath directory" }}
|
|
{{- end }}
|
|
{{- /* Validate kubeletAddress.mode */ -}}
|
|
{{- if and (hasKey .Values "kubeletAddress") (ne .Values.kubeletAddress.mode "") }}
|
|
{{- if not (has .Values.kubeletAddress.mode (list "auto" "localhost" "hostname" "hostip" "custom")) }}
|
|
{{- fail (printf "kubeletAddress.mode must be one of [auto, localhost, hostname, hostip, custom], got: %s" .Values.kubeletAddress.mode) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- /* Prevent using both old and new config */ -}}
|
|
{{- if and (ne (.Values.kubeletConnectByHostname | toString) "") (and (hasKey .Values "kubeletAddress") (ne .Values.kubeletAddress.mode "") (ne .Values.kubeletAddress.mode "auto")) }}
|
|
{{- fail "Both kubeletConnectByHostname (deprecated) and kubeletAddress.mode are set. Please use only kubeletAddress.mode." }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- define "spire-agent.yaml-config" -}}
|
|
{{- $trustDomain := include "spire-lib.trust-domain" . }}
|
|
agent:
|
|
{{- if .Values.sockets.admin.enabled }}
|
|
admin_socket_path: /tmp/spire-agent/private/admin.sock
|
|
{{- end }}
|
|
{{- with .Values.authorizedDelegates }}
|
|
authorized_delegates:
|
|
{{- range . }}
|
|
{{- if hasPrefix "/" . }}
|
|
- spiffe://{{ $trustDomain }}{{ . }}
|
|
{{- else }}
|
|
- {{ . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
data_dir: "/var/lib/spire"
|
|
log_level: {{ .Values.logLevel | quote }}
|
|
log_format: {{ .Values.logFormat | quote }}
|
|
rebootstrap_mode: {{ .Values.rebootstrapMode | quote }}
|
|
rebootstrap_delay: {{ .Values.rebootstrapDelay | quote }}
|
|
server_address: {{ include "spire-agent.server-address" . | trim | quote }}
|
|
server_port: {{ .Values.server.port | quote }}
|
|
socket_path: /tmp/spire-agent/public/{{ include "spire-agent.socket-path" . | base }}
|
|
trust_bundle_format: {{ .Values.trustBundleFormat | quote }}
|
|
{{- if ne (len .Values.trustBundleURL) 0 }}
|
|
trust_bundle_url: {{ .Values.trustBundleURL | quote }}
|
|
{{- else if ne (len .Values.trustBundleHostPath) 0 }}
|
|
trust_bundle_path: {{ .Values.trustBundleHostPath | quote }}
|
|
{{- else }}
|
|
trust_bundle_path: {{ printf "/run/spire/bundle/bundle.%s" (include "spire-lib.trust-bundle-ext" (dict "trustBundleFormat" .Values.trustBundleFormat)) | quote }}
|
|
{{- end }}
|
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
|
{{- with .Values.availabilityTarget }}
|
|
availability_target: {{ . | quote }}
|
|
{{- end }}
|
|
{{- if .Values.sds.enabled }}
|
|
sds:
|
|
default_svid_name: {{ .Values.sds.defaultSVIDName | quote }}
|
|
default_bundle_name: {{ .Values.sds.defaultBundleName | quote }}
|
|
default_all_bundles_name: {{ .Values.sds.defaultAllBundlesName | quote }}
|
|
disable_spiffe_cert_validation: {{ eq .Values.sds.disableSPIFFECertValidation true }}
|
|
{{- end }}
|
|
|
|
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled (eq (.Values.experimental.enabled | toString) "true") }}
|
|
experimental:
|
|
{{- if or (eq (.enabled | toString) "true") .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
|
broker:
|
|
{{- if .Values.sockets.broker.enabled }}
|
|
socket_path: "/tmp/spire-agent/broker/broker.sock"
|
|
{{- end }}
|
|
{{- if .Values.brokerAPI.tcp.enabled }}
|
|
bind_address: {{ .Values.brokerAPI.tcp.bindAddress | quote }}
|
|
{{- end }}
|
|
brokers:
|
|
{{- range .Values.brokerAPI.brokers }}
|
|
{{- if .enabled }}
|
|
- broker:
|
|
- id: {{ tpl .idTemplate (dict "TrustDomain" $trustDomain) }}
|
|
allowed_reference_types:
|
|
{{- range .allowedReferenceTypes }}
|
|
- allowed_reference_types:
|
|
type_url: {{ .typeURL | quote }}
|
|
allow_over_tcp: {{ .allowOverTCP }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.experimental }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
sync_interval: {{ .syncInterval | quote }}
|
|
require_pq_kem: {{ .requirePQKEM }}
|
|
{{- if gt (len .featureFlags) 0 }}
|
|
feature_flags:
|
|
{{- range .featureFlags }}
|
|
- {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- $nodeAttestorUsed := add (len .Values.customPlugins.nodeAttestor) (len .Values.unsupportedBuiltInPlugins.nodeAttestor) }}
|
|
{{- $keyManagerUsed := add (len .Values.customPlugins.keyManager) (len .Values.unsupportedBuiltInPlugins.keyManager) }}
|
|
plugins:
|
|
NodeAttestor:
|
|
{{- if .Values.nodeAttestor.k8sPSAT.enabled }}
|
|
k8s_psat:
|
|
plugin_data:
|
|
cluster: {{ include "spire-lib.cluster-name" . | quote }}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.httpChallenge }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
http_challenge:
|
|
plugin_data:
|
|
agentname: {{ .agentname | quote }}
|
|
{{- if ne (int .port) 0 }}
|
|
port: {{ .port }}
|
|
{{- end }}
|
|
{{- if ne (int .advertisedPort) 0 }}
|
|
advertisedPort: {{ .advertisedPort }}
|
|
{{- end }}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.tpmDirect }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
tpm:
|
|
plugin_cmd: "/tpm/tpm_attestor_agent"
|
|
plugin_checksum: {{ .plugin.checksum | quote }}
|
|
plugin_data: {}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.x509POP }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
x509pop:
|
|
plugin_data:
|
|
spiffe_endpoint_socket: unix://{{ .spiffeEndpointSocket }}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.awsIID }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
aws_iid:
|
|
plugin_data: {}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.nodeAttestor.gcpIIT }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
gcp_iit:
|
|
plugin_data: {}
|
|
{{- $nodeAttestorUsed = add1 $nodeAttestorUsed }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if ne $nodeAttestorUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Node Attestor. There are %d enabled." $nodeAttestorUsed) }}
|
|
{{- end }}
|
|
|
|
KeyManager:
|
|
{{- if .Values.keyManager.memory.enabled }}
|
|
memory:
|
|
plugin_data:
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
{{- end }}
|
|
{{- if .Values.keyManager.disk.enabled }}
|
|
disk:
|
|
plugin_data:
|
|
{{- if eq .Values.keyManager.disk.mode "hostPath" }}
|
|
directory: {{ .Values.persistence.hostPath }}
|
|
{{- else if eq .Values.keyManager.disk.mode "emptyDir" }}
|
|
directory: /key-manager
|
|
{{- end }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
{{- end }}
|
|
{{- if ne $keyManagerUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
|
{{- end }}
|
|
|
|
WorkloadAttestor:
|
|
{{- if .Values.workloadAttestors.k8s.enabled }}
|
|
k8s:
|
|
plugin_data:
|
|
{{- if or (eq .Values.workloadAttestors.k8s.verification.type "hostCert") (eq .Values.workloadAttestors.k8s.verification.type "auto") }}
|
|
kubelet_ca_path: /hostCert/kubelet.crt
|
|
{{- else if eq .Values.workloadAttestors.k8s.verification.type "apiServerCA" }}
|
|
kubelet_ca_path: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
{{- end }}
|
|
skip_kubelet_verification: {{ eq .Values.workloadAttestors.k8s.verification.type "skip" }}
|
|
disable_container_selectors: {{ eq .Values.workloadAttestors.k8s.disableContainerSelectors true}}
|
|
use_new_container_locator: {{ eq .Values.workloadAttestors.k8s.useNewContainerLocator true }}
|
|
verbose_container_locator_logs: {{ eq .Values.workloadAttestors.k8s.verboseContainerLocatorLogs true }}
|
|
{{- if eq (include "spire-agent.should-set-node-name-env" .) "true" }}
|
|
node_name_env: "KUBELET_ADDR"
|
|
{{- end }}
|
|
{{- if or .Values.sockets.broker.enabled .Values.brokerAPI.tcp.enabled }}
|
|
experimental:
|
|
broker:
|
|
access_policy: {{ .Values.workloadAttestors.k8s.brokerAPI.accessPolicy | quote }}
|
|
brokers:
|
|
{{- range $key, $value := .Values.workloadAttestors.k8s.brokerAPI.brokers }}
|
|
{{- if or (not (hasKey $value "enabled")) $value.enabled }}
|
|
{{- $idTemplate := (index $.Values.brokerAPI.brokers $key).idTemplate }}
|
|
{{- if hasKey $value "idTemplate" }}
|
|
{{- $idTemplate = $value.idTemplate }}
|
|
{{- end }}
|
|
- broker:
|
|
- id: {{ tpl $idTemplate (dict "TrustDomain" $trustDomain) }}
|
|
{{- with $value.podReferenceScope }}
|
|
pod_reference_scope: {{ . | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.workloadAttestors.unix.enabled }}
|
|
unix:
|
|
plugin_data:
|
|
{{- end }}
|
|
|
|
health_checks:
|
|
listener_enabled: true
|
|
bind_address: "0.0.0.0"
|
|
bind_port: {{ .Values.healthChecks.port | quote }}
|
|
live_path: "/live"
|
|
ready_path: "/ready"
|
|
|
|
{{- if or (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) (and (dig "spire" "recommendations" "enabled" false .Values.global) (dig "spire" "recommendations" "prometheus" true .Values.global)) }}
|
|
telemetry:
|
|
- Prometheus:
|
|
- host: {{ .Values.telemetry.prometheus.host }}
|
|
port: {{ .Values.telemetry.prometheus.port }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.telemetry.datadog.enabled }}
|
|
telemetry:
|
|
- DogStatsd:
|
|
- address: "{{ .Values.telemetry.datadog.address }}:{{ .Values.telemetry.datadog.port }}"
|
|
{{- end }}
|
|
|
|
{{- end }}
|
|
{{- $root := . }}
|
|
{{- range $name := (concat (list "default") (keys .Values.agents)) | uniq }}
|
|
{{- with (dict "Release" $root.Release "Chart" $root.Chart "Values" (deepCopy $root.Values)) }}
|
|
{{- $nameSuffix := "" }}
|
|
{{- if ne $name "default" }}
|
|
{{- $nameSuffix = printf "-%s" $name }}
|
|
{{- end }}
|
|
{{- if hasKey $root.Values.agents $name }}
|
|
{{- $_ := set . "Values" (mergeOverwrite .Values (index $root.Values.agents $name)) }}
|
|
{{- end }}
|
|
{{- include "spire-agent.check-config-values" . }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ printf "%s%s" (include "spire-agent.fullname" .) $nameSuffix | quote }}
|
|
namespace: {{ include "spire-agent.namespace" . | quote }}
|
|
{{- with .Values.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
agent.conf: |
|
|
{{- include "spire-lib.reformat-and-yaml2json" (dict "config" (include "spire-agent.yaml-config" .) "root" .) | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|