Kevin Fox
3b4e7a1bd3
* ab5e5d86 fix(spiffe-oidc-discovery-provider): run under restricted PSA/SCC on OpenShift (#920)
Signed-off-by: Kevin Fox <[email protected]>
247 lines
61 KiB
Markdown
247 lines
61 KiB
Markdown
# spire-identity-exchange
|
|
|
|
  
|
|
|
|
A Helm chart to install the SPIRE Identity Exchange.
|
|
|
|
**Homepage:** <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
|
|
|
## Maintainers
|
|
|
|
| Name | Email | Url |
|
|
| ---- | ------ | --- |
|
|
| marcofranssen | <marco.franssen@gmail.com> | <https://marcofranssen.nl> |
|
|
| kfox1111 | <Kevin.Fox@pnnl.gov> | |
|
|
| faisal-memon | <fymemon@yahoo.com> | |
|
|
|
|
## Source Code
|
|
|
|
* <https://github.com/spiffe/helm-charts-hardened/tree/main/charts/spire-identity-exchange>
|
|
|
|
## Listeners
|
|
|
|
Serving is a two-axis matrix: protocol (gRPC or REST) crossed with the source of the
|
|
certificate the listener presents. All four listeners are independent and can run at once.
|
|
|
|
| Values block | Serves with | Default port | Default |
|
|
| -------------- | ---------------------------------------------------------- | ------------ | ------- |
|
|
| `tls.rest` | the certificate from `tls.externalSecret` / `tls.certManager` | 8444 | off |
|
|
| `tls.grpc` | the certificate from `tls.externalSecret` / `tls.certManager` | 8443 | off |
|
|
| `spiffe.rest` | this deployment's own X509-SVID | 8544 | **on** |
|
|
| `spiffe.grpc` | this deployment's own X509-SVID | 8543 | off |
|
|
|
|
The `spiffe.*` listeners need no certificate files: the SVID is fetched from the SPIRE Agent
|
|
Workload API and rotated automatically, so a SPIFFE-only install requires neither cert-manager
|
|
nor a TLS Secret. A cert source under `tls:` is required only when `tls.rest` or `tls.grpc` is
|
|
enabled. Client authentication is identical on all four — callers present a bearer token.
|
|
|
|
With `tls.certManager`, the requested certificate's `dnsNames` are taken from whichever exposures
|
|
are enabled — the `ingress.host`, the `gatewayAPI.host`, or both — across every enabled `tls.*`
|
|
listener, deduplicated. Each enabled `tls.*` listener must therefore have an ingress or a gateway
|
|
enabled, unless you set `tls.certManager.certificate.dnsNames` explicitly.
|
|
|
|
## The stack selector
|
|
|
|
Every exchange addresses a **stack**: an entry in `auth.stacks`, or — with
|
|
`auth.passthroughPlugins` (the default) — a single plugin addressed under its own name. It is
|
|
the `{stack}` segment of the REST path (`/api/v1/svid/{stack}/x509`).
|
|
|
|
As of app version v0.4.0 the exchange asserts one selector on its own behalf, naming the stack
|
|
that was addressed:
|
|
|
|
| Selector type | Value | Example |
|
|
| ------------------------ | ---------------------- | ---------------------------------------------- |
|
|
| `spire_identity_exchange` | `stack:name:<stack>` | `spire_identity_exchange:stack:name:k8s_psat` |
|
|
|
|
Add it to a registration entry to scope that entry to a single stack:
|
|
|
|
```yaml
|
|
controllerManager:
|
|
identities:
|
|
clusterStaticEntries:
|
|
test:
|
|
selectors:
|
|
- k8s_psat:namespace:default
|
|
- k8s_psat:service_account_name:default
|
|
- spire_identity_exchange:stack:name:k8s_psat # only issuable via this stack
|
|
```
|
|
|
|
<!-- The parameters section is generated using helm-docs.sh and should not be edited by hand. -->
|
|
|
|
## Parameters
|
|
|
|
### Chart parameters
|
|
|
|
| Name | Description | Value |
|
|
| ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
|
|
| `agentSocketName` | The name of the spire-agent unix socket | `spire-agent.sock` |
|
|
| `csiDriverName` | The csi driver to use | `csi.spiffe.io` |
|
|
| `replicaCount` | Replica count | `1` |
|
|
| `namespaceOverride` | Namespace override | `""` |
|
|
| `annotations` | Annotations for the deployment | `{}` |
|
|
| `labels` | Labels for the deployment | `{}` |
|
|
| `image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `image.repository` | The repository within the registry | `spiffe/spire-identity-exchange-server` |
|
|
| `image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
|
| `spireAgent.resources` | Resource requests and limits | `{}` |
|
|
| `spireAgent.image.registry` | The OCI registry to pull the image from | `ghcr.io` |
|
|
| `spireAgent.image.repository` | The repository within the registry | `spiffe/spire-agent` |
|
|
| `spireAgent.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `spireAgent.image.tag` | Overrides the image tag whose default is the chart appVersion | `1.15.3` |
|
|
| `extraEnv` | Extra environment variables to add to the spire identity exchange | `[]` |
|
|
| `resources` | Resource requests and limits | `{}` |
|
|
| `configMap.annotations` | Annotations to add to the SPIRE Identity Exchange ConfigMap | `{}` |
|
|
| `podSecurityContext` | Pod security context for SPIRE Identity Exchange pods | `{}` |
|
|
| `securityContext` | Security context for SPIRE Identity Exchange deployment | `{}` |
|
|
| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` |
|
|
| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` |
|
|
| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` |
|
|
| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` |
|
|
| `podAnnotations` | Pod annotations for SPIRE Identity Exchange | `{}` |
|
|
| `podLabels` | Labels to add to pods | `{}` |
|
|
| `config.logLevel` | The log level, valid values are "debug", "info", "warn", and "error" | `info` |
|
|
| `config.logFormat` | The log format, valid values are "text" and "json" | `text` |
|
|
| `telemetry.prometheus.port` | Port for prometheus metrics | `4950` |
|
|
| `telemetry.prometheus.podMonitor.enabled` | Enable podMonitor for prometheus | `false` |
|
|
| `telemetry.prometheus.podMonitor.namespace` | Override where to install the podMonitor, if not set will use the same namespace as the helm release | `""` |
|
|
| `telemetry.prometheus.podMonitor.labels` | Pod labels to filter for prometheus monitoring | `{}` |
|
|
| `imagePullSecrets` | Image pull secret names | `[]` |
|
|
| `nameOverride` | Name override | `""` |
|
|
| `fullnameOverride` | Full name override | `""` |
|
|
| `serviceAccount.create` | Specifies whether a service account should be created | `true` |
|
|
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
|
|
| `serviceAccount.name` | The name of the service account to use. If not set and create is true, a name is generated. | `""` |
|
|
| `deleteHook.enabled` | Enable Helm hooks to autofix common delete issues (should be disabled when using `helm template`) | `true` |
|
|
| `autoscaling.enabled` | Flag to enable autoscaling | `false` |
|
|
| `autoscaling.minReplicas` | Minimum replicas for autoscaling | `1` |
|
|
| `autoscaling.maxReplicas` | Maximum replicas for autoscaling | `5` |
|
|
| `autoscaling.targetCPUUtilizationPercentage` | Target CPU utlization that triggers autoscaling | `80` |
|
|
| `autoscaling.targetMemoryUtilizationPercentage` | Target Memory utlization that triggers autoscaling | `80` |
|
|
| `nodeSelector` | Node selector | `{}` |
|
|
| `tolerations` | list of tolerations | `[]` |
|
|
| `affinity` | Node affinity | `{}` |
|
|
| `trustDomain` | Set the trust domain to be used for the SPIFFE identifiers | `example.org` |
|
|
| `clusterName` | The name of this Kubernetes cluster, as it appears in SPIFFE ID paths | `example-cluster` |
|
|
| `jwtIssuer` | The issuer URL for JWT-SVIDs. Defaults to https://oidc-discovery.$trustDomain | `""` |
|
|
| `clusterDomain` | The name of the Kubernetes cluster (`kubeadm init --service-dns-domain`) | `cluster.local` |
|
|
| `auth.plugins.k8s_psat.enabled` | Enable the k8s psat plugin | `true` |
|
|
| `auth.plugins.k8s_psat.config.audiences` | The audiences to allow | `[]` |
|
|
| `auth.plugins.k8s_psat.config.allowedServiceAccounts` | The service accounts that are allowed | `[]` |
|
|
| `auth.plugins.spiffe.enabled` | Enable the spiffe plugin | `true` |
|
|
| `auth.plugins.spiffe.keySource` | What source to use to fetch the keys. Can be oidc or oidcLocal. oidcLocal forces discoveryURL to be the internal discovery address. | `oidcLocal` |
|
|
| `auth.plugins.spiffe.csiDriverName` | The CSI driver providing the SPIRE Agent workload socket this plugin attests against. Defaults to the chart level csiDriverName. Requires config.connectWithTrustBundle. | |
|
|
| `auth.plugins.spiffe.config.issuerURL` | The url to connect to for JWKS discovery | `${SPIFFE_JWT_ISSUER}` |
|
|
| `auth.plugins.spiffe.config.trustDomain` | The trust domain to use | `${SPIFFE_TRUST_DOMAIN}` |
|
|
| `auth.plugins.spiffe.config.pathPatterns` | The service accounts that are allowed | `[]` |
|
|
| `auth.plugins.spiffe.config.audiences` | The audiences to allow | `[]` |
|
|
| `auth.plugins.spiffe.config.connectWithTrustBundle` | Use the trust bundle to validate the issuerURL | `true` |
|
|
| `auth.stacks.image_pull.enabled` | Enable the image_pull stack | `true` |
|
|
| `auth.stacks.image_pull.plugins` | List of plugins that are required by this stack | `[]` |
|
|
| `auth.unsupportedBuiltInPlugins` | Unsupported mechanism to use plugins not yet supported by the chart. | `{}` |
|
|
| `auth.passthroughPlugins` | Address each plugin as a stack of its own, in addition to any stacks defined | `false` |
|
|
| `tls.externalSecret.enabled` | Provide your own certificate/key via tls style Kubernetes Secret | `false` |
|
|
| `tls.externalSecret.secretName` | Specify which Secret to use | `""` |
|
|
| `tls.certManager.enabled` | Use certificateManager to create the certificate | `false` |
|
|
| `tls.certManager.issuer.create` | Create an issuer to use to issue the certificate | `true` |
|
|
| `tls.certManager.issuer.acme.email` | Must be set in order to register with LetsEncrypt. By setting, you agree to their Terms of Service | `""` |
|
|
| `tls.certManager.issuer.acme.server` | Server to use to get certificate. Defaults to LetsEncrypt | `https://acme-v02.api.letsencrypt.org/directory` |
|
|
| `tls.certManager.issuer.acme.solvers` | Configure the issuer solvers. Defaults to http01 via ingress. | `{}` |
|
|
| `tls.certManager.certificate.dnsNames` | Override the dnsNames on the certificate request. Defaults to the same settings as Ingress | `[]` |
|
|
| `tls.certManager.certificate.issuerRef.group` | If you are using an external plugin, specify the group for it here | `""` |
|
|
| `tls.certManager.certificate.issuerRef.kind` | Kind of the issuer reference. Override if you want to use a ClusterIssuer | `Issuer` |
|
|
| `tls.certManager.certificate.issuerRef.name` | Name of the issuer to use. If unset, it will use the name of the built in issuer | `""` |
|
|
| `tls.rest.enabled` | Enable the REST listener served with the certificate from disk | `false` |
|
|
| `tls.rest.port` | Container port for the REST listener served with the certificate from disk | `8444` |
|
|
| `tls.rest.service.type` | Service type | `ClusterIP` |
|
|
| `tls.rest.service.port` | port for the service | `443` |
|
|
| `tls.rest.service.annotations` | Annotations for service resource | `{}` |
|
|
| `tls.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
|
| `tls.rest.ingress.enabled` | Flag to enable ingress | `false` |
|
|
| `tls.rest.ingress.className` | Ingress class name | `""` |
|
|
| `tls.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
|
| `tls.rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
|
| `tls.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest` |
|
|
| `tls.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
|
| `tls.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
|
| `tls.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
|
| `tls.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
|
| `tls.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest` |
|
|
| `tls.rest.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
|
| `tls.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
|
| `tls.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
|
| `tls.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
|
| `tls.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
|
| `tls.rest.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
|
| `tls.grpc.enabled` | Enable the gRPC listener served with the certificate from disk | `false` |
|
|
| `tls.grpc.port` | Container port for the gRPC listener served with the certificate from disk | `8443` |
|
|
| `tls.grpc.service.type` | Service type | `ClusterIP` |
|
|
| `tls.grpc.service.port` | port for the service | `443` |
|
|
| `tls.grpc.service.annotations` | Annotations for service resource | `{}` |
|
|
| `tls.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
|
| `tls.grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
|
| `tls.grpc.ingress.className` | Ingress class name | `""` |
|
|
| `tls.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
|
| `tls.grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
|
| `tls.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc` |
|
|
| `tls.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
|
| `tls.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
|
| `tls.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
|
| `tls.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
|
| `tls.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc` |
|
|
| `tls.grpc.gatewayAPI.tlsSecret` | Secret with the TLS cert for edge termination. Blank keeps passthrough. | `""` |
|
|
| `tls.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
|
| `tls.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
|
| `tls.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
|
| `tls.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
|
| `tls.grpc.gatewayAPI.backendTLS.caCertificateRefs` | ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap. | `[]` |
|
|
| `spiffe.rest.enabled` | Enable the REST listener served with this deployment's own X509-SVID | `true` |
|
|
| `spiffe.rest.port` | Container port for the REST listener served with this deployment's own X509-SVID | `8544` |
|
|
| `spiffe.rest.service.type` | Service type | `ClusterIP` |
|
|
| `spiffe.rest.service.port` | port for the service | `443` |
|
|
| `spiffe.rest.service.annotations` | Annotations for service resource | `{}` |
|
|
| `spiffe.rest.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
|
| `spiffe.rest.ingress.enabled` | Flag to enable ingress | `false` |
|
|
| `spiffe.rest.ingress.className` | Ingress class name | `""` |
|
|
| `spiffe.rest.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
|
| `spiffe.rest.ingress.annotations` | Annotations for ingress object | `{}` |
|
|
| `spiffe.rest.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-rest-spiffe` |
|
|
| `spiffe.rest.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
|
| `spiffe.rest.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
|
| `spiffe.rest.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
|
| `spiffe.rest.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
|
| `spiffe.rest.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-rest-spiffe` |
|
|
| `spiffe.rest.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
|
| `spiffe.rest.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
|
| `spiffe.rest.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
|
| `spiffe.rest.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
|
| `spiffe.grpc.enabled` | Enable the gRPC listener served with this deployment's own X509-SVID | `false` |
|
|
| `spiffe.grpc.port` | Container port for the gRPC listener served with this deployment's own X509-SVID | `8543` |
|
|
| `spiffe.grpc.service.type` | Service type | `ClusterIP` |
|
|
| `spiffe.grpc.service.port` | port for the service | `443` |
|
|
| `spiffe.grpc.service.annotations` | Annotations for service resource | `{}` |
|
|
| `spiffe.grpc.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
|
| `spiffe.grpc.ingress.enabled` | Flag to enable ingress | `false` |
|
|
| `spiffe.grpc.ingress.className` | Ingress class name | `""` |
|
|
| `spiffe.grpc.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, autodetection is attempted. If other, no annotations will be added. Must be one of [ingress-nginx, openshift, other, ""]. | `""` |
|
|
| `spiffe.grpc.ingress.annotations` | Annotations for ingress object | `{}` |
|
|
| `spiffe.grpc.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The grpc of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-identity-exchange-grpc-spiffe` |
|
|
| `spiffe.grpc.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
|
| `spiffe.grpc.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
|
| `spiffe.grpc.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
|
| `spiffe.grpc.gatewayAPI.enabled` | Flag to expose the endpoint via Gateway API | `false` |
|
|
| `spiffe.grpc.gatewayAPI.host` | Host name for the route. If no '.' in host, trustDomain is automatically appended. | `spire-identity-exchange-grpc-spiffe` |
|
|
| `spiffe.grpc.gatewayAPI.annotations` | Annotations for the route (and its ListenerSet) | `{}` |
|
|
| `spiffe.grpc.gatewayAPI.listenerSet.enabled` | Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets. | `nil` |
|
|
| `spiffe.grpc.gatewayAPI.parentRefs` | parentRefs used when ListenerSet management is disabled (direct attach) | `[]` |
|
|
| `spiffe.grpc.gatewayAPI.sectionName` | Listener sectionName override when attaching directly to a Gateway | `""` |
|
|
| `tools.kubectl.image.registry` | The OCI registry to pull the image from | `registry.k8s.io` |
|
|
| `tools.kubectl.image.repository` | The repository within the registry | `kubectl` |
|
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
|
| `clusterRole.create` | create a k8s cluster role to allow access to token reviews and oidc discovery | `true` |
|
|
| `server.address` | Address for Spire server | `""` |
|
|
| `server.port` | Port number for Spire server | `443` |
|
|
| `server.namespaceOverride` | Override the namespace for Spire server | `""` |
|
|
| `server.nameOverride` | Override the name for Spire server. Should only be changed when building your own nested chart to ensure names align. | `""` |
|