Files
helm-charts-hardened/charts/spire/charts/spire-server/README.md.gotmpl
T

82 lines
3.5 KiB
Go Template

{{ template "chart.header" . }}
<!-- This README.md is generated. Please edit README.md.gotmpl -->
{{ template "chart.deprecationWarning" . }}
{{ template "chart.badgesSection" . }}
{{ template "chart.description" . }}
{{ template "chart.homepageLine" . }}
> **Note**: Minimum Spire version is `1.5.3`.
> The recommended version is `1.6.0` to support arm64 nodes. If running with any
> prior version to `1.6.0` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
>
> The recommended spire-controller-manager version is `0.2.2` to support arm64 nodes. If running with any
> prior version to `0.2.2` you have to use a `nodeSelector` to limit to `kubernetes.io/arch: amd64`.
{{ template "chart.maintainersSection" . }}
{{ template "chart.sourcesSection" . }}
{{ template "chart.requirementsSection" . }}
## Tornjak
Tornjak is the UI and Control Plane for SPIRE [https://github.com/spiffe/tornjak](https://github.com/spiffe/tornjak) and it is composed of two components:
* Backend (this chart) - Tornjak APIs that extend SPIRE APIs with Control Plane functionality
* [Frontend](../tornjak-frontend/README.md) - Tornjak UI
When Tornjak is enabled, it is exposed on both http and https (if TLS server certs are configured). Tornjak handles a permanent redirect from `http` to `https` to ensure users always use the https endpoint.
In addition, you can configure a `client certificate authority`, this will make Tornjak backend verify Client certificates signed by this authority to enable mTLS authentication.
**Warning**: For production, we recommend configuring TLS certificates and client CA to protect Tornjak from unauthorized access.
### Tornjak with TLS Connection Type
TLS connection requires Tornjak to have access to TLS key and certificate.
Complete instruction on creating your own TLS certificate can be found [here](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md).
TLS Certificate and the private key must be provided to Tornjak via *TLS Secret*. Prior to deploying this Helm chart, create TLS Secret in the deployment namespace (e.g. `spire-server`)
```console
kubectl -n spire-server create secret tls tornjak-tls-secret --cert=client.crt --key=client.key
```
Once the charts are deployed, you can test the TLS connection with the following command (assuming localhost):
```console
curl --cacert CA/rootCA.crt https://localhost:10443
```
### Tornjak with mTLS Connection Type
mTLS connection allows Tornjak server validation by client and Tornjak client validation by Tornjak server. The server validation is identical to above TLS. Follow the steps to create
TLS secret with key and the certificate.
Additionally, you must provide the user CA to Tornjak server via `Secret` or `ConfigMap`.
Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/blob/main/examples/tls_mtls/README.md), then create a *Secret* (or *ConfigMap*) prior to deploying this Helm chart.
Here is an example using a *Secret* in `spire-server` namespace:
```console
kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt"
```
Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost):
```console
curl --cacert CA/rootCA.crt --key client.key --cert client.crt https://localhost:10443
```
### Tornjak with HTTP Connection Type
In order to run Tornjak with simple HTTP Connection only, make sure you don't create any `Secrets` or `ConfigMaps` listed above.
{{ template "chart.valuesSection" . }}
----------------------------------------------