kfox1111andFaisal Memon
a539065c02
* Add direct tpm support for spire-agent Signed-off-by: Kevin Fox <[email protected]> * Add fingerprinting support Signed-off-by: Kevin Fox <[email protected]> * Add example Signed-off-by: Kevin Fox <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Update charts/spire/charts/spire-agent/templates/configmap.yaml Signed-off-by: kfox1111 <[email protected]> * Fix broken tests Signed-off-by: Kevin Fox <[email protected]> * Fix hardcoded nodeAttestor and keyManager in spire-agent Fixes: https://github.com/spiffe/helm-charts-hardened/issues/220 Signed-off-by: Kevin Fox <[email protected]> * Fix merge issues Signed-off-by: Kevin Fox <[email protected]> * Fix unit tests Signed-off-by: Kevin Fox <[email protected]> * Pass the agent's securityContext on to Kubernetes Currently its ignored. Signed-off-by: Kevin Fox <[email protected]> * Update example to be usable Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Update to the newest release Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]> Co-authored-by: Faisal Memon <[email protected]>
16 lines
690 B
YAML
16 lines
690 B
YAML
spire-agent:
|
|
nodeAttestor:
|
|
k8sPsat:
|
|
enabled: false
|
|
tpmDirect:
|
|
enabled: true
|
|
|
|
spire-server:
|
|
controllerManager:
|
|
# K8s labels have a 63 character limit. TPM hashes are 64 chars. So you need to label the node with two labels with half of the tpm's hash each. The 'node-restriction.kubernetes.io/' prefix is so that the
|
|
# nodes can't update the hash themselves, an important security constraint.
|
|
parentIDTemplate: 'spiffe://{{ .TrustDomain }}/spire/agent/tpm/{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash" }}{{ index .NodeMeta.Labels "node-restriction.kubernetes.io/tpm-pubhash2" }}'
|
|
nodeAttestor:
|
|
tpmDirect:
|
|
enabled: true
|