82 lines
3.5 KiB
Go Template
82 lines
3.5 KiB
Go Template
{{ template "chart.header" . }}
|
|
|
|
<!-- This README.md is generated. Please edit README.md.gotmpl -->
|
|
|
|
{{ template "chart.deprecationWarning" . }}
|
|
|
|
{{ template "chart.badgesSection" . }}
|
|
|
|
{{ template "chart.description" . }}
|
|
|
|
{{ template "chart.homepageLine" . }}
|
|
|
|
> **Note**: Minimum Spire version is `1.5.3`.
|
|
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
|
|
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
>
|
|
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
|
|
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
|
|
|
|
{{ template "chart.maintainersSection" . }}
|
|
|
|
{{ template "chart.sourcesSection" . }}
|
|
|
|
{{ template "chart.requirementsSection" . }}
|
|
|
|
## Tornjak
|
|
|
|
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
|
|
|
|
* Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
|
|
* [Frontend](../tornjak-frontend/README.md) - Tornjak UI
|
|
|
|
When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from `http` to `https` to ensure users always use the https endpoint.
|
|
|
|
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
|
|
|
|
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
|
|
|
|
### Tornjak with TLS Connection Type
|
|
|
|
TLS connection requires Tornjak to have access to TLS key and certificate.
|
|
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
|
|
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
|
|
|
|
```console
|
|
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
|
|
```
|
|
|
|
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
|
|
|
|
```console
|
|
curl --cacert CA/rootCA.crt https://localhost:10443
|
|
```
|
|
|
|
### Tornjak with mTLS Connection Type
|
|
|
|
mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create
|
|
TLS secret with key and the certificate.
|
|
|
|
Additionally, you must provide the user CA to Tornjak server via `Secret` or `ConfigMap`.
|
|
Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md), then create a *Secret* (or *ConfigMap*) prior to deploying this Helm chart.
|
|
|
|
Here is an example using a *Secret* in `spire-server` namespace:
|
|
|
|
```console
|
|
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
|
|
```
|
|
|
|
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
|
|
|
|
```console
|
|
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
|
|
```
|
|
|
|
### Tornjak with HTTP Connection Type
|
|
|
|
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
|
|
|
|
{{ template "chart.valuesSection" . }}
|
|
|
|
----------------------------------------------
|