Skip to content
This repository has been archived by the owner on Mar 22, 2024. It is now read-only.

Adds AWS KMS KeyManager support #435

Merged
merged 12 commits into from
Aug 18, 2023
Merged

Adds AWS KMS KeyManager support #435

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
a8f163c
Adds AWS KMS KeyManager support
mchurichi Aug 8, 2023
12d7fc9
Make aws_kms.key_metadata_file non configurable
mchurichi Aug 9, 2023
726f604
Make keymanager disk.keys_path non configurable
mchurichi Aug 9, 2023
447dc5d
Use aws kms keys as env vars from a secret rather than injecting them…
mchurichi Aug 10, 2023
f539715
Update docs
mchurichi Aug 10, 2023
3e1ab37
Make aws kms key policy configurable through either ConfigMap or raw …
mchurichi Aug 11, 2023
c6e2209
Merge branch 'main' into aws-kms-keymanager
kfox1111 Aug 11, 2023
6c919f0
Merge branch 'main' into aws-kms-keymanager
mchurichi Aug 14, 2023
2c1b2e5
Refactor aws kms secret
mchurichi Aug 14, 2023
dee04ac
Merge branch 'main' into aws-kms-keymanager
mchurichi Aug 15, 2023
2218b2b
Document aws kms credentials configuration alternatives
mchurichi Aug 16, 2023
bbd01f9
Merge branch 'main' into aws-kms-keymanager
mchurichi Aug 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions charts/spire/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -362,6 +362,12 @@ Now you can interact with the Spire agent socket from your own application. The
| spire-server.ingress.tls | list | `[]` | |
| spire-server.initContainers | list | `[]` | |
| spire-server.jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| spire-server.keyManager.awsKMS.enabled | bool | `false` | |
| spire-server.keyManager.awsKMS.keyMetadataFile | string | `"/run/spire/data/aws-kms-key-metadata"` | |
mchurichi marked this conversation as resolved.
Show resolved Hide resolved
| spire-server.keyManager.awsKMS.keyPolicyFile | string | `""` | |
mchurichi marked this conversation as resolved.
Show resolved Hide resolved
| spire-server.keyManager.awsKMS.region | string | `""` | |
| spire-server.keyManager.disk.enabled | bool | `true` | |
| spire-server.keyManager.disk.keysPath | string | `"/run/spire/data/keys.json"` | |
mchurichi marked this conversation as resolved.
Show resolved Hide resolved
| spire-server.livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
| spire-server.livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| spire-server.livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
Expand Down
6 changes: 6 additions & 0 deletions charts/spire/charts/spire-server/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,12 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
| ingress.tls | list | `[]` | |
| initContainers | list | `[]` | |
| jwtIssuer | string | `"oidc-discovery.example.org"` | The JWT issuer domain |
| keyManager.awsKMS.enabled | bool | `false` | |
| keyManager.awsKMS.keyMetadataFile | string | `"/run/spire/data/aws-kms-key-metadata"` | |
| keyManager.awsKMS.keyPolicyFile | string | `""` | |
| keyManager.awsKMS.region | string | `""` | |
| keyManager.disk.enabled | bool | `true` | |
| keyManager.disk.keysPath | string | `"/run/spire/data/keys.json"` | |
| livenessProbe.failureThreshold | int | `2` | Failure threshold count for livenessProbe |
| livenessProbe.initialDelaySeconds | int | `15` | Initial delay seconds for livenessProbe |
| livenessProbe.periodSeconds | int | `60` | Period seconds for livenessProbe |
Expand Down
35 changes: 33 additions & 2 deletions charts/spire/charts/spire-server/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
{{- define "spire-server.yaml-config" -}}
{{- $upstreamAuthorityUsed := 0 }}
{{- $keyManagerUsed := 0 }}
{{- $root := . }}
server:
bind_address: "0.0.0.0"
Expand Down Expand Up @@ -46,11 +47,41 @@ plugins:
service_account_allow_list: {{ include "spire-server.serviceAccountAllowedList" $root | trim }}
{{- end }}
{{- end }}


{{- with .Values.keyManager.disk }}
{{- if eq (.enabled | toString) "true" }}
{{- $keyManagerUsed = add1 $keyManagerUsed }}
KeyManager:
- disk:
plugin_data:
keys_path: "/run/spire/data/keys.json"
keys_path: {{ .keysPath | quote }}
{{- end }}
{{- end }}

{{- with .Values.keyManager.awsKMS }}
{{- if eq (.enabled | toString) "true" }}
{{- $keyManagerUsed = add1 $keyManagerUsed }}
KeyManager:
- aws_kms:
plugin_data:
region: {{ .region | quote }}
key_metadata_file: {{ .keyMetadataFile | quote }}
{{- if ne .accessKeyID "" }}
access_key_id: {{ .accessKeyID | quote }}
mchurichi marked this conversation as resolved.
Show resolved Hide resolved
{{- end }}
{{- if ne .secretAccessKey "" }}
secret_access_key: {{ .secretAccessKey | quote }}
mchurichi marked this conversation as resolved.
Show resolved Hide resolved
{{- end }}
{{- if ne .keyPolicyFile "" }}
key_policy_file: {{ .keyPolicyFile | quote }}
{{- end }}

{{- end }}
{{- end }}

{{- if ne $keyManagerUsed 1 }}
{{- fail "You have to enable exactly one Key Manager." }}
{{- end }}

Notifier:
- k8sbundle:
Expand Down
10 changes: 10 additions & 0 deletions charts/spire/charts/spire-server/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,16 @@ ca_subject:
organization: Example
common_name: example.org

keyManager:
disk:
enabled: true
keysPath: "/run/spire/data/keys.json"
awsKMS:
enabled: false
region: ""
keyMetadataFile: "/run/spire/data/aws-kms-key-metadata"
keyPolicyFile: ""

upstreamAuthority:
disk:
enabled: false
Expand Down