Skip to content
This repository has been archived by the owner on Mar 22, 2024. It is now read-only.

Commit

Permalink
Adds AWS KMS KeyManager support (#435)
Browse files Browse the repository at this point in the history 
Co-authored-by: Marco Franssen <marco.franssen@gmail.com>
Co-authored-by: kfox1111 <Kevin.Fox@pnnl.gov>
  • Loading branch information
@mchurichi @marcofranssen @kfox1111
3 people authored Aug 18, 2023
1 parent 77fe43f commit 5e2e8a9
Show file tree
Hide file tree
Showing 8 changed files with 110 additions and 2 deletions.
1 change: 1 addition & 0 deletions .gitignore
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
bin/
.idea/
.vscode/
*.swp
charts/**/*.tgz
.DS_Store
7 changes: 7 additions & 0 deletions charts/spire/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -359,6 +359,13 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.ingress.tls | list | `[]` | |
| spire-server.initContainers | list | `[]` | |
| spire-server.jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
| spire-server.keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
| spire-server.keyManager.awsKMS.enabled | bool | `false` | |
| spire-server.keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
| spire-server.keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
| spire-server.keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
| spire-server.keyManager.awsKMS.region | string | `""` | |
| spire-server.keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
| spire-server.keyManager.disk.enabled | bool | `true` | |
| spire-server.keyManager.memory.enabled | bool | `false` | |
| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
Expand Down
7 changes: 7 additions & 0 deletions charts/spire/charts/spire-server/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,13 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| ingress.tls | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"https://oidc-discovery.example.org"` | The JWT issuer domain |
| keyManager.awsKMS.accessKeyID | Optional | `""` | Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role. |
| keyManager.awsKMS.enabled | bool | `false` | |
| keyManager.awsKMS.keyPolicy | object | `{"existingConfigMap":"","policy":""}` | Policy to use when creating keys. If no policy is specified, a default policy will be used. |
| keyManager.awsKMS.keyPolicy.existingConfigMap | Optional | `""` | Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format. |
| keyManager.awsKMS.keyPolicy.policy | Optional | `""` | Key policy in JSON format. |
| keyManager.awsKMS.region | string | `""` | |
| keyManager.awsKMS.secretAccessKey | Optional | `""` | Secret access key for the AWS account. |
| keyManager.disk.enabled | bool | `true` | |
| keyManager.memory.enabled | bool | `false` | |
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
Expand Down
10 changes: 10 additions & 0 deletions charts/spire/charts/spire-server/templates/aws-kms-configmap.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
{{- if ne .Values.keyManager.awsKMS.keyPolicy.policy "" }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "spire-server.fullname" . }}-aws-kms
namespace: {{ include "spire-server.namespace" . }}
data:
policy.json: |
{{ .Values.keyManager.awsKMS.keyPolicy.policy | nindent 4 }}
{{- end }}
17 changes: 17 additions & 0 deletions charts/spire/charts/spire-server/templates/aws-kms-secret.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{{- $root := . }}
{{- with .Values.keyManager.awsKMS }}
{{- if or (ne .accessKeyID "") (ne .secretAccessKey "") }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "spire-server.fullname" $root }}-aws-kms
namespace: {{ include "spire-server.namespace" $root }}
data:
{{- if ne .accessKeyID "" }}
AWS_KMS_ACCESS_KEY_ID: {{ .accessKeyID | b64enc }}
{{- end }}
{{- if ne .secretAccessKey "" }}
AWS_KMS_SECRET_ACCESS_KEY: {{ .secretAccessKey | b64enc }}
{{- end }}
{{- end }}
{{- end }}
24 changes: 22 additions & 2 deletions charts/spire/charts/spire-server/templates/configmap.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,8 +67,28 @@ plugins:
{{- end }}
{{- end }}

{{- if gt $keyManagerUsed 1 }}
{{- fail "You can only enable a single KeyManager" }}
{{- with .Values.keyManager.awsKMS }}
{{- if eq (.enabled | toString) "true" }}
{{- $keyManagerUsed = add1 $keyManagerUsed }}
KeyManager:
- aws_kms:
plugin_data:
region: {{ .region | quote }}
key_metadata_file: "/run/spire/data/aws-kms-key-metadata"
{{- if ne .accessKeyID "" }}
access_key_id: "${AWS_KMS_ACCESS_KEY_ID}"
{{- end }}
{{- if ne .secretAccessKey "" }}
secret_access_key: "${AWS_KMS_SECRET_ACCESS_KEY}"
{{- end }}
{{- if or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "") }}
key_policy_file: "/run/spire/data/aws-kms-key-policy.json"
{{- end }}
{{- end }}
{{- end }}

{{- if ne $keyManagerUsed 1 }}
{{- fail (printf "You have to enable exactly one Key Manager. There are %d enabled." $keyManagerUsed) }}
{{- end }}

Notifier:
Expand Down
33 changes: 33 additions & 0 deletions charts/spire/charts/spire-server/templates/statefulset.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,20 @@ spec:
name: {{ $fullname }}-dbpw
key: DBPW
{{- end }}
{{- if ne .Values.keyManager.awsKMS.accessKeyID "" }}
- name: AWS_KMS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: {{ $fullname }}-aws-kms
key: AWS_KMS_ACCESS_KEY_ID
{{- end }}
{{- if ne .Values.keyManager.awsKMS.secretAccessKey "" }}
- name: AWS_KMS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: {{ $fullname }}-aws-kms
key: AWS_KMS_SECRET_ACCESS_KEY
{{- end }}
ports:
- name: grpc
containerPort: 8081
Expand Down Expand Up @@ -136,6 +150,14 @@ spec:
mountPath: /run/spire/upstream_agent
readOnly: true
{{ end }}
{{- with .Values.keyManager.awsKMS }}
{{- if and (eq (.enabled | toString) "true") (or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "")) }}
- name: aws-kms-key-policy
mountPath: /run/spire/data/aws-kms-key-policy.json
subPath: policy.json
readOnly: true
{{ end }}
{{ end }}
{{- if gt (len .Values.extraVolumeMounts) 0 }}
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -286,6 +308,17 @@ spec:
driver: {{ .Values.upstreamAuthority.spire.upstreamDriver }}
readOnly: true
{{- end }}
{{- with .Values.keyManager.awsKMS }}
{{- if and (eq (.enabled | toString) "true") (or (ne .keyPolicy.policy "") (ne .keyPolicy.existingConfigMap "")) }}
- name: aws-kms-key-policy
configMap:
{{- if ne .keyPolicy.policy "" }}
name: {{ $fullname }}-aws-kms
{{- else if ne .keyPolicy.existingConfigMap "" }}
name: {{ .keyPolicy.existingConfigMap }}
{{- end }}
{{- end }}
{{- end }}
{{- if eq (.Values.controllerManager.enabled | toString) "true" }}
- name: controller-manager-config
configMap:
Expand Down
13 changes: 13 additions & 0 deletions charts/spire/charts/spire-server/values.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,19 @@ keyManager:
enabled: true
memory:
enabled: false
awsKMS:
enabled: false
region: ""
# -- Policy to use when creating keys. If no policy is specified, a default policy will be used.
keyPolicy:
# -- (Optional) Key policy in JSON format.
policy: ""
# -- (Optional) Name of a ConfigMap that has a `policy.json` file with the key policy in JSON format.
existingConfigMap: ""
# -- (Optional) Access key ID for the AWS account. It's recommended to use an IAM role instead. See [here](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) to learn how to annotate your SPIRE Server Service Account to assume an IAM role.
accessKeyID: ""
# -- (Optional) Secret access key for the AWS account.
secretAccessKey: ""

upstreamAuthority:
disk:
Expand Down

0 comments on commit 5e2e8a9

Please sign in to comment.