unufr33andFaisal Memon
d3091a829c
Current configmap template renders to a wrong KeyManager and UpstreamAuthority configurarion when aws_kms and aws_pca are enabled and container is crashing. The proposed changes will fix the issue. --------- Signed-off-by: unufree <[email protected]> Signed-off-by: unufr33 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
245 lines
8.2 KiB
YAML
245 lines
8.2 KiB
YAML
{{- range $type, $tvals := .Values.customPlugins }}
|
|
{{- if not (has $type (list "keyManager" "nodeAttestor" "upstreamAuthority" "notifier")) }}
|
|
{{- fail (printf "Unknown plugin type specified: %s" $type) }}
|
|
{{- end }}
|
|
{{- range $name, $nval := $tvals }}
|
|
{{- if not (hasKey $nval "plugin_cmd") }}
|
|
{{- fail (printf "plugin_cmd is a required field. %s" $name) }}
|
|
{{- end }}
|
|
{{- if not (hasKey $nval "plugin_checksum") }}
|
|
{{- fail (printf "plugin_checksum is a required field.") }}
|
|
{{- end }}
|
|
{{- range $sname, $svals := $nval }}
|
|
{{- if not (has $sname (list "plugin_cmd" "plugin_checksum" "plugin_data")) }}
|
|
{{- fail (printf "Unknown plugin setting specified: %s" $sname) }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- define "spire-server.yaml-config" -}}
|
|
{{- $upstreamAuthorityUsed := 0 }}
|
|
{{- $keyManagerUsed := 0 }}
|
|
{{- $root := . }}
|
|
server:
|
|
bind_address: "0.0.0.0"
|
|
bind_port: "8081"
|
|
trust_domain: {{ include "spire-lib.trust-domain" . | quote }}
|
|
data_dir: "/run/spire/data"
|
|
log_level: {{ .Values.logLevel | quote }}
|
|
jwt_issuer: {{ include "spire-lib.jwt-issuer" . | quote }}
|
|
|
|
ca_key_type: {{ .Values.caKeyType | quote }}
|
|
ca_ttl: {{ .Values.caTTL | quote }}
|
|
|
|
default_x509_svid_ttl: {{ .Values.defaultX509SvidTTL | quote }}
|
|
default_jwt_svid_ttl: {{ .Values.defaultJwtSvidTTL | quote }}
|
|
|
|
ca_subject:
|
|
{{- with .Values.ca_subject }}
|
|
- country: [{{ .country | quote }}]
|
|
organization: [{{ .organization | quote }}]
|
|
common_name: {{ .common_name | quote }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.federation }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
federation:
|
|
bundle_endpoint:
|
|
- {{ .bundleEndpoint | toYaml | nindent 8 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
plugins:
|
|
DataStore:
|
|
sql:
|
|
plugin_data:
|
|
{{ include "spire-server.datastore-config" . | nindent 10 }}
|
|
|
|
{{- with .Values.nodeAttestor.k8sPsat }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
NodeAttestor:
|
|
k8s_psat:
|
|
plugin_data:
|
|
clusters:
|
|
{{ include "spire-lib.cluster-name" $root }}:
|
|
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.disk }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
disk:
|
|
plugin_data:
|
|
keys_path: "/run/spire/data/keys.json"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.memory }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
memory:
|
|
plugin_data:
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.keyManager.awsKMS }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $keyManagerUsed = add1 $keyManagerUsed }}
|
|
KeyManager:
|
|
aws_kms:
|
|
plugin_data:
|
|
region: {{ .region | quote }}
|
|
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
|
|
{{- if ne .accessKeyID "" }}
|
|
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
|
|
{{- end }}
|
|
{{- if ne .secretAccessKey "" }}
|
|
secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}"
|
|
{{- end }}
|
|
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
|
|
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- if ne $keyManagerUsed 1 }}
|
|
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
|
|
{{- end }}
|
|
|
|
Notifier:
|
|
k8sbundle:
|
|
plugin_data:
|
|
namespace: {{ .Values.notifier.k8sbundle.namespace | default (include "spire-server.namespace" .) | quote }}
|
|
config_map: {{ include "spire-lib.bundle-configmap" . | quote }}
|
|
|
|
{{- with .Values.upstreamAuthority.disk }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
disk:
|
|
plugin_data:
|
|
cert_file_path: "/run/spire/upstream_ca/tls.crt"
|
|
key_file_path: "/run/spire/upstream_ca/tls.key"
|
|
{{- if ne .secret.data.bundle "" }}
|
|
bundle_file_path: "/run/spire/upstream_ca/bundle.crt"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.certManager }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
cert-manager:
|
|
plugin_data:
|
|
issuer_name: {{ default (include "spire-server.fullname" $root) .issuer_name }}-ca
|
|
issuer_kind: {{ .issuer_kind | quote }}
|
|
issuer_group: {{ .issuer_group | quote }}
|
|
namespace: {{ default $root.Release.Namespace .namespace | quote }}
|
|
{{- if ne .kube_config_file "" }}
|
|
kube_config_file: {{ .kube_config_file | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.spire }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
spire:
|
|
plugin_data:
|
|
server_address: {{ include "spire-server.upstream-spire-address" $root | quote }}
|
|
server_port: {{ .server.port }}
|
|
workload_api_socket: "/run/spire/upstream_agent/spire-agent.sock"
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.vault }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
vault:
|
|
plugin_data:
|
|
vault_addr: {{ .vaultAddr | quote }}
|
|
pki_mount_point: {{ .pkiMountPoint | quote }}
|
|
insecure_skip_verify: {{ .insecureSkipVerify }}
|
|
{{- if ne (.insecureSkipVerify | toString) "true" }}
|
|
ca_cert_path: "/run/spire/vault-upstream/ca.crt"
|
|
{{- end }}
|
|
{{- if ne .namespace "" }}
|
|
namespace: {{ .namespace | quote }}
|
|
{{- end }}
|
|
|
|
{{- $vaultAuthMethodUsed := 0 }}
|
|
{{- with .k8sAuth }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $vaultAuthMethodUsed = add1 $vaultAuthMethodUsed }}
|
|
k8s_auth:
|
|
k8s_auth_mount_point: {{ .k8sAuthMountPoint | quote }}
|
|
k8s_auth_role_name: {{ .k8sAuthRoleName | quote }}
|
|
token_path: "/var/run/secrets/tokens/spire-server"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if gt $vaultAuthMethodUsed 1 }}
|
|
{{- fail "You can only enable a single authentication mechanism to an upstream Vault." }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
|
|
{{- with .Values.upstreamAuthority.awsPCA }}
|
|
{{- if eq (.enabled | toString) "true" }}
|
|
{{- $upstreamAuthorityUsed = add1 $upstreamAuthorityUsed }}
|
|
UpstreamAuthority:
|
|
aws_pca:
|
|
plugin_data:
|
|
region: {{ .region | quote }}
|
|
certificate_authority_arn: {{ .certificateAuthorityARN | quote }}
|
|
ca_signing_template_arn: {{ .caSigningTemplateARN | default "arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1" | quote }}
|
|
{{- if ne .signingAlgorithm "" }}
|
|
signing_algorithm: {{ .signingAlgorithm | quote }}
|
|
{{- end }}
|
|
{{- if ne .assumeRoleARN "" }}
|
|
assume_role_arn: {{ .assumeRoleARN | quote }}
|
|
{{- end }}
|
|
{{- if ne .endpoint "" }}
|
|
endpoint: {{ .endpoint | quote }}
|
|
{{- end }}
|
|
{{- if ne .supplementalBundlePath "" }}
|
|
supplemental_bundle_path: {{ .supplementalBundlePath | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if gt $upstreamAuthorityUsed 1 }}
|
|
{{- fail "You can only enable a single Upstream Authority." }}
|
|
{{- end }}
|
|
|
|
health_checks:
|
|
listener_enabled: true
|
|
bind_address: "0.0.0.0"
|
|
bind_port: "8080"
|
|
live_path: "/live"
|
|
ready_path: "/ready"
|
|
|
|
{{- if (dig "telemetry" "prometheus" "enabled" .Values.telemetry.prometheus.enabled .Values.global) }}
|
|
telemetry:
|
|
- Prometheus:
|
|
- host: "0.0.0.0"
|
|
port: 9988
|
|
{{- end }}
|
|
{{- end }}
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ include "spire-server.fullname" . }}
|
|
namespace: {{ include "spire-server.namespace" . }}
|
|
{{- with .Values.configMap.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
data:
|
|
server.conf: |
|
|
{{- include "spire-server.reformat-and-yaml2json" (dict "config" (include "spire-server.yaml-config" .) "root" .) | nindent 4 }}
|